Assurance

[Tom Scavo <>]

Hi Eric,

> I still would love to see some general guidelines out of InCommon
> (either the formal project group or us as a general user community)
> on specific practices

I'm not exactly sure what you're looking for but I would recommend not 
veering too far from the Identity Assurance Profile (IAP) since it is the 
definitive document throughout the entire process. It is what your auditor 
will audit against, and at the end of the day, the Assurance Program awards 
certifications for compliance with the IAP.

Others have suggested that sites engage their auditors early in the process. 
I think that's excellent advice.

Tom