Assurance

[Ann West <>]

Colleagues,

The AAC recently approved procedures clarifying under what circumstances Bronze and Silver certified campuses are required to inform InCommon of changes to their Identity Provider operations. These are found on InCommon Website FAQ and also included below.  and also included below.  

Appreciation to Mary Dunker of Virginia Tech, past  AAC Chair, for her leadership in helping to develop these procedures.

Best regards,

Ann

Notification to InCommon of Changes to IdP Operations

Under what conditions should changes to the IdP Operation be reported to InCommon?

For audited Silver or Bronze: When changes to the IdP Operation produce a condition that would change the auditor’s previously submitted summary report or information that was discussed between InCommon and the IdPO regarding the IdPO’s qualification for InCommon Silver, then those changes should be reported to InCommon. For InCommon procedures, see IAAF 4.5, 4.5.1, and 4.5.3.

For ROC Bronze: When changes to an IdP Operation produce a condition that would change a previously submitted Representation of Conformance submission or subsequent information that was requested by InCommon, then those changes should be reported to InCommon.

For Alternative Means: When changes to an IdP Operation produce a condition that would change a previously approved Alternative Means, then those changes should be reported to InCommon for re-approval. Changes to an approved Alternative Means should be noted by updating the published Alternative Means documentation. For InCommon procedures, see IAAF 4.5, 4.5.1, and 4.5.3.