Assurance

[Ann West <>]

Well Nick is correct. Silver is not a carbon copy of 800-63. It contains additional information about InCommon's trust model, certification requirements, HE comparable solutions (See 4.2.2.4.1 Existing Relationship for instance), etc. 

However, you're correct too, Mark, in the case of the identity proofing requirements. Silver is comparable and in some cases, uses the same language. 800-63-1 does provide more background about the process, however, that might be useful to folks, which is why we strongly recommend it as prerequisite reading and as a reference. 

Ann

---

Where did "Silver is not 800-63 level 2, Silver is Silver" come from?  I’m confused why people seem to want to distance Silver from 800-63.

 

From what I read, 800-63 level 2 is exactly what Silver is with respect to identity proofing and credential issuance.

 

“InCommon Bronze and Silver are intended to be compatible with US federal government Identity, Credential, and Access Management (ICAM) Trust Framework Provider Adoption Process (TFPAP) Levels of Assurance 1 and 2.”

http://www.incommon.org/docs/assurance/IAP_V1.1.pdf

 

and

 

800-63 is a core ICAM document.  http://www.idmanagement.gov/pages.cfm/page/ICAM

 

If that is not enough…

 

Sections §4.2.2.4.2 and §4.2.2.4.3 of the IAP describing ‘in-person’ and ‘remote’ proofing are taken verbatim from the 800-63 table that describes “Identity Proofing Requirements” for NIST level 2.  http://csrc.nist.gov/publications/nistpubs/800-63-1/SP-800-63-1.pdf

 

When we are discussing identity proofing and credential issuance for Silver we are talking 800-63.

 

 

From: [mailto:]
Sent: Monday, August 06, 2012 5:01 PM
To: Jones, Mark B
Subject: [confluence] InC-Assurance > Remote-Proofing Approaches

 

Remote-Proofing Approaches

Page comment added by

 

I got some feedback from the Big Ten auditor community.  Their feedback was (generalized):

1) The notary approach might work

2) They don't like the video approach, but did not give specific reasons why

3) They think the eVerify process used for I9 stuff in HR processes is good enough to use for proofing (not remote, really, but OK I think this is good news for existing relationship stuff)

4) Quote:

"I don't know how InCommon relates to NIST 800-63, but 800-63 seems clearer.  It says that remote proofing for Level 2 or 3 requires validation of the gov't ID and/or financial acct, plus address validation.  The latter is not a substitute for the former."

To me that says if you take this to be 800-63 rules, then you also need to validate the ID at LoA2/Silver.  But then again, "Silver is not 800-63 level 2, Silver is Silver."

Stop watching page | Change email notification preferences

View Online | Reply To This