...
Ken added that pending a new IAPM's getting up to speed the WG will be on its own for administrative support and is in need of a volunteer Secretary to prepare Minutes. He emphasized that responsibility does not require a great deal of time and invited IAWG participants to contact him if they might be able to step up.
Minutes approval: Mark Hapner moved approval of the the draft Minutes of the IAWG meeting of June 3; Eric Eric Thompson seconded. The Minutes were approved unanimously, as written.
Staff reports and updates: Ruth Puentes reported that the assessment program is quite active and she anticipates approval of 4 or five new SPs over the next two months.
...
Consideration of 'comparable alternatives' - See: https://groups.google.com/g/idassurance/c/GIGLjValdg4
...
Ken asked Richard Wilshire to introduce the topic and provide background. Richard reported that a US Federal agency has asked how Kantara would handle its using a CSP implementing a "compatible alternative" to
...
the IA controls included in 800-63
...
-3. He said Sec 5.4. does allow
...
US Federal agencies to use "comparable alternatives" and
...
provides some guidance on how that would be done. Richard suggested that KI might perform an assessment of a service that used an alternative control, but he feels that Kantara can't take on determination of what
...
is "comparable." He shared draft language for an approach to this issue Kantara might take. Richard further reported discussion of this issue with David Temoshok of NIST. He said David strongly discouraged KI involvement in assessing these alternative controls; he further believes use of such alternatives would only be appropriate to address a use-case unique to one agency. and that sign-off for use of an alternative control would have to be made at the agency executive level, i.e., by the CIO.
Blake ??
IbLAKE – D.Me – thinks this is DOL, trying to use expired DLs. Hopes to service this requirement. THinks maybe ReaLid COULD BE ACCEPTABLE.
...