Page Comparison

Agenda

1. Administration:
   
   1. Roll Call
   2. Agenda Confirmation
   3. Action Item Review: action item list
   4. Organization Updates - Director's Corner
   5. Staff reports and updates
   6. LC reports and updates
   7. Call for Tweet-worthy items to feed (@KantaraNews or #kantara)
2. Discussion
   Review and approve 63A/B SACs 
   Discuss approach on new GSA requirements and approve Project Plan 
   Initial comments on GSA Concept of Operations and Certification Process drafts.
3. AOB

Attendees

As of 2017-03-16, quorum is 4 of 8 (see list box below for voting members)

Meeting (did) achieve quorum

Voting

• Mark Hapner, Resilient
• Denny Prvu, Secretary
• Scott Shorter, IAWG Vice Chair
• Ken Dagg. IAWG Chair
• Andrew Hughes, LC Chair
• Richard Wilsher, Zygma 

Non-Voting

• Aakash Yadav, OKTA

• José Lopez, Zentry
• Christine Abruzzi US Arlington
  
  

Staff

•  Colin Wallis, KI ED
• Ruth Puente, KI Executive 

Apologies

• None

Notes & Minutes

Staff Updates

Director's Corner October Report 

Some highlights:

• GDPR Summit beginning of October. http://www.gdprsummit.london/ 
• Working on Privacy Summit and StandarsStandards. Mark Lizar is leading the effort and evaluating the feasibility to held an event in January 2019., which would be the first KI event.
•  Pre-conference workshop to curtain-raise Kuppinger Cole's Consumer Identity World Tour 2017  in Paris, 27th November, where Consumer identity and Access management, UMA and Consent Receipt were presented. 

Discussion

Review and Approve 63A and 63B SACs

AY asked when 63C SAC would be developed. SSH responded that the work was focused on 63A and 63B (Level 2) as immediate deliverable, in long term we plan to develop criteria for C as well.

AH added that further developments would be demand driven. The current product was developed with the intention that CSPs can be re-certified in alignment with 800-63-3, basically IAL2 and AL2. In the furturefuture, KI will be developing criteria for 63-3 AL 1 and 2, IAWL 1 and 3, 63-C.

...

AH requested to list the active contributors of this work in the front page or second page.

63A

SS commented about the philosophy that was applied. 

• A shall SHALL was an easy guidance to follow. NIST requirement about SHOULD highly desired various alternatives, it is not mandatory, discussing is this sth what was intendedbut there was a lot of discussion on this. What is intended with SHOULD?, you should but there sis are not consequences?. Should it be interpreted as a shall SHALL or weak so (no enforceable at all)?.

• Original requirement on the left, . In KI criteria we added a subject Subject as most of the text texts were passive.
• The group tunned the requirements to ensure CSP is doing its part.

...

AH asked if SACs reflect the errata of 800-63-3 documents? . He does not see version and date of document, so he suggested to make sure the documents are correctly labeled and identify the date we pulled the source document.

SS commented that an as additional value add it would be good some exposition about theories of why different types of identity evidence meet different strings, provide specific examples, explanations and analysis. He is not sure if KI would put a stamp on it or GSA would like to provide a implementation Guidance that guidance similar to what NIST did with FIPs 114. Now He said that now that we have new requirements let´s make sure real work examples are following into the same slots when everybody evaluates. 

AH as KI closer to an actual certification process, added that having guidance documents and Real real implementation examples would be part of the document kit. AH He also commented that we can collate the material over the time.

Take SS said that as part of potential changes to the policy, we can take a proposal to ARB, take : Take out of each assessment what level of evidence was used, etc. more transparency when possible. CW confirmed Policy that this is a policy decision to ARB

Potential Changes to the policy

SSH Panels 2 and 3 Identity evidence validation string table for the different levels. Verification of identity evidence at the different levels.

AH commented that presenting the spreadsheets forms into as a traceability matrix, we can demonstrate coverage to 800-63-3 requirements. Other Others are mapping making mappings to the requirements of 800-63-3. KI criteria has some traceable properties.

 63B 

63B done for AL2. SS said that 63A and 63B SACs are ONLY at xAL2.

63B Only one panel, no sub-tables. Types of authenticators are reflected in groups below, there come blocks of applicable criteria that are mandatory.

SS asked to take note to solve Row 91 Number 63B#0280- "Scott to add references". 

AH suggested that we should remove the highlights in yellow.

Motion on 63A SAC moving Motions to approve 63A and 63B and move to next step in the process proposed by AH. 

AH after Motion: After the cosmetic changes be circulated 63A SAC be circulated to public comment and PR Review.

Motion 63B: same motion above.

Mark H MH seconded both motions.

Motions carried. 

Discuss approach on new GSA requirements and approve Project Plan 

KD commented that GSA has circulated process and procedures documents for TFS Program,  ConOps and Certification Process drafts. They request hthat 22 December request  to have comments back to them on these 2 documents by December 22, 2017.

Second He added that second part of KI work will be to identify changes to its internal process (See Project Plan)

KD presented the Project Plan DRAFT KI approach to GSA process and procedures documents 20171129.docx to tackle comments to GSA and changes to KI Trust Framework Operations Program.

KD proposed to create a sub-group and made a call for participants Confirmed

Volunteers:

Colin W.

Andrew H.

Scott S.

Mark H.

Richard W.

First meeting of new Sub-group: Tuesday 14:00EST00 ET

AH stressed that the importance of this process, as these docs. which are under review at GSA, are the requirements for KI to be able to offer approvals and assessments.

There He said that there are some significant requirement increases, these are the docs. by which KI operates.

KD ARB emphasizes KD informed that he would emphasize this to ARB on Monday and get their input to this process. Encouraging , and will also encourage them to offer their comments.

KD asked RP to re-send the comments of RW RW as basis for the sub-group. 

RW reviewed the COSA 4.5 tcriteria RW commented that he reviewed the CO SAC and made a cross check with 63A and 63B SACs. 4 or 5 criteria could be withdrawn as they are covereded 63A oB SAVby 63A or B SAC. 

Scott suggested Cross cjeck discussion Next Tuesday

SS suggested to raise the cross check discussion with COSAC next Tuesday in the new SG meeting. 

CW encouraged the participants to take this survey as it is related to current IAWG discussion: https://www.surveymonkey.com/r/5YZ3Y9X

Motion to approve SACs:
Seconded: 
Motion Carried 

AOB

...

Next Meeting

• Date: Thursday, 2017-12-7 
• Time: 12:00 PT | 15:00 ET
  
  
  

...