Attendees:
Scott Shorter, IAWG Vice-Chair
Tom Barton, Incommon
Matt King, SAFE BioPharma
Ann West, Incommon
Scott Perry
JJ Harkema, Experian
Richard Wilsher, Zygma
Colin Wallis, KI
Ruth Puente, KI
Follow up of action items
- TFPs to ask the CSPs if 800-63-3 is required on Request For Proposals (RFPs).
- Gathering interest on User Forum for the clients of the CSPs.
- Building together a value proposition for the justification of 63-3 certification.
- Adding CSPs updates to the agenda.
- Ann suggested creating a survey for the value proposition on adopting 63-3 (Why are they using it? What would make them use it? etc).
- Regarding the User forum, Colin commented that Kantara CSPs are concerned about the competitive side of it. Initially, the Kantara´s CSPs will not be keen to reach out their own customers to invite them to join the forum along with other competitor’s customers.
- Colin added that Kantara made a full round of assessors and CSPs and it got a mixed response. In most cases there was not a specific requirement on the RFPs. However, the sense is that customers of CSPs who are interested, are doing it as a pre-step in the expectation that there will be a mandate or the procurement people will add it to the RFPs as a requirement.
- Matt commented that the main driver would be a requirement versus a feature of their solution that they feel it would enhance their service offering.
- Matt said that it might be valuable to develop common language that we all can use, something like “reasons why it makes sense to use certified credentials”.
- Tom stressed that the main reason for the adoption would be that the CSPs customers (Federal Agencies) require 800-63-3.
Kantara IAWG Report provided by Scott Shorter
- Revision of Introductory document IAF 1000 – Overview to the Program, there was an internal round of review and it was distributed to CSPs to get their input and the IAWG will discuss it further in the next meetings.
- IDVP Uses Cases DG is preparing the final report. More information: https://kantarainitiative.org/groups/idpvusecases/
Incommon Report provided by Tom Barton
- Baseline Expectation Program: 95% of all of the entities that operate within the Federation meet the Baseline standard, which represents 90% of the member organizations.
Various
- It was asked about the status of the memos about resolving cases with respect to remote and unsupervised identity proofing. Richard responded that the first outcome from those recommendations is that Kantara has updated its 800-63 rev. 3 criteria but it is still outstanding to send the recommendations to NIST.
- Matt confirmed that David Temoshok is the NIST PoC for 800-63-3.
Any Other Business
- Colin commented that OMB apparently provided a second draft of OMB policy to the CIO Council. This would be the second OMB attempt to make its policy much clearer; in particular, it provides more clarity on the roles of GSA and NIST. Possibly, there would be other kind of contractual framework from the GSA.
Action items
- To discuss the mechanisms of the survey to CSPs in relation to 800-63-3, in order to build together the value proposition.