Assurance

["Jim Green " <>]

Hi, Scott,

I believe this language is probably based on NIST 800-63, for example,
here's some language from page 31 of the version I have handy, which I'm
pretty sure is current:

"At Level 2 and higher, the Applicant supplies his or her full legal name,
an address of record, and date of birth, and may, subject to the policy of
the RA or CSP, also supply other PII."

Since it seems InCommon is trying to be compatible with federal standards
(e.g. FICAM), in some cases the rationale behind the federal standards is
not explicitly explained anywhere that I've been able to find.  In this case
it appears to have to do with the ability to disambiguate multiple similar
records and prevent errors of that nature.


> -----Original Message-----
> From: 
> 
>  [
> ]
>  On Behalf Of Scott Koranda
> Sent: Thursday, October 04, 2012 2:09 PM
> To: 
> 
> Subject: Re: [Assurance] Silver registration records and DOB
> 
> Hi,
> 
> > I can tell you from a record duplication prevention point of view
> that
> > date of birth is the most statistically significant of the data
> > elements listed below to correctly match a record to the right
> person.
> 
> Ah. I see.
> 
> We have such a small community (about 1000) that matching records to
> the right person via a DOB is not something we would think of straight
> off.
> 
> Since we do not collect DOB and have no reason to collect DOB recording
> it at the time of identity proofing does not make sense for us.
> 
> > don't often respond the
> > this list, but this is one thing I do know! :)
> 
> Thanks for sharing! Since I do not have a background in campus IT
> sharing these types of insights are most helpful.
> 
> Cheers,
> 
> Scott
> 
> >
> > -----Original Message----- From:
> > 
> > [mailto:]
> >  On Behalf Of Scott Koranda
> > Sent: Thursday, October 04, 2012 12:53 PM To:
> > 
> >  Subject: [Assurance] Silver registration
> > records and DOB
> >
> > Hello,
> >
> > 4.2.2.3 of the IAP version 1.1 "REGISTRATION RECORDS"
> > includes
> >
> > "The record of the facts of registration shall include: - Identity
> > proofing document types and issuers; - Full name as shown on the
> > documents; - Date of birth; - Current Address of Record"
> >
> > What is the rationale for including date of birth?
> >
> > I ask because, as a science virtual organization (LIGO) and not a
> > campus, we have no pre-existing relationship with our users that
> > includes the need for a date of birth.
> >
> > Thanks,
> >
> > Scott