assurance - [Assurance] 800-63-2: Identity Proofing

Subject: Assurance

List archive

[Assurance] 800-63-2: Identity Proofing

From: Ann West <>
To: "" <>
Subject: [Assurance] 800-63-2: Identity Proofing
Date: Fri, 15 Mar 2013 16:00:09 +0000
Accept-language: en-US
Authentication-results: sfpop-ironport04.merit.edu; dkim=neutral (message not signed) header.i=none

NIST published 800-63-2 Draft earlier this year. The comment period has closed, but I thought I'd send along a high level summary of the suggestions, since they may be helpful (assuming they are accepted).

If you are reviewing identity proofing and haven't taken a look at the draft, you should:

http://csrc.nist.gov/publications/drafts/800-63-2/sp800_63_2_draft.pdf

Suggested changes are highlighted in yellow starting on page 27. Highlights include:

Leveraging cellular phone number/account as financial or utility account number option under remote proofing.
Citing examples of primary and secondary Ids that can be used for proofing (e.g. the lists in the I-9).
Using specific in-person and remote faculty/staff HR on-boarding processes to satisfy LoA2 identity proofing.

For those of you looking ahead, FICAM is exploring the notion of decoupling assurance components:

http://blog.aniljohn.com/2013/01/nist-800-63-1-token-attribute-seperation.html

Ann

[Assurance] 800-63-2: Identity Proofing, Ann West, 03/15/2013

List archive

[Assurance] 800-63-2: Identity Proofing