Assurance

["Jones, Mark B" <>]

Imagining the future...  If an institution qualified at Gold assurance (LoA 
3), would that automatically qualify the institution at Silver?

If a service required Silver assurance I'm assuming a Gold assurance should 
be acceptable in lieu of a Silver assurance.

I wonder how close these two institutions would be to a Gold spec considering 
their existing policy/procedure that uses two-factor?

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Christopher Bongaarts
Sent: Tuesday, March 13, 2012 1:43 PM
To: 

Subject: Re: [Assurance] silver and two-factor ...

On 3/13/2012 1:18 PM, Dunker, Mary wrote:
> One of Virginia Tech's drivers for submitting 2-factor for Silver
> certification is that our hardware token-issuing process  already
> includes rigorous face-to-face identity proofing and verification
> procedures. In contrast, our IDs and passwords are issued via
> self-service, with identity-proofing that would be more difficult to
> audit.

Our motivation, like VT, is that we have an existing two factor 
implementation that could be leveraged without having to overhaul our 
current password regime to meet Silver specs.

-- 
%%  Christopher A. Bongaarts   %%  

          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%