Assurance

[Scott Koranda <>]

Hi,

There are also costs to waiting too long to take any
meaningful action.

When working with research organizations and their funding
agencies due diligence requires that I explain that InCommon
has no baseline level of assurance other than institutional
reputation and no mechanism for security incident response.
The people I explain that to find it surprising. There are
lost opportunities.

I would like to see that change as soon as possible. I will
help in whatever way I can, and I do expect SPs as well as
IdPs to participate.

Sincerely,

Scott K


> I think I share that loads of buy-in thing with Tom.
> 
> Several questions come to my mind:
> - Is this a good-enough starting point?
> - Is it supportable by most organizations?
> - If yes to both, then:
>       - What should be the timeframe for participation adoption?
>       - What are the carrots/sticks for post adherence deadline?
>       - What is the community willing to do to help encourage/enforce 
> adoption
> by your peers/partners?
> 
> Ann
>  
> 
> On 5/10/16, 9:36 AM, 
> "
>  on behalf of Tom
> Barton" 
> <
>  on behalf of 
> >
> wrote:
> 
> >Scott,
> >
> >Yes, they proposed practices have changed substantially in response to
> >feedback already received. Re timelines, everyone wants this to happen.
> >At this point I'm probably the biggest hold up by insisting that we get
> >loads of feedback and buy in.
> >
> >Tom
> >
> >On 5/10/2016 10:06 AM, Scott Koranda wrote:
> >> Hi Tom,
> >>
> >>> Beyond agreeing with Jim and appreciating his conciseness(!), I
> >>>address his
> >>> question by noting that the InCommon Assurance Advisory Committee will
> >>>hold
> >>> a BoF at 7:30am next Wednesday morning at the Global Summit on Baseline
> >>> Practices. Purpose is to get feedback on elements proposed to be
> >>> incorporated into something that would effectively replace the
> >>>Participant
> >>> Operating Practices doc.
> >>>
> >>> There will be more opportunities to give feedback! This is just the
> >>>next
> >>> one, for those who may be available to participate.
> >> Thanks for the update.
> >>
> >> There was also opportunity for feedback at the last TechX in
> >> Cleveland.
> >>
> >> Is there any change to the proposed baseline practices from
> >> what was presented in Cleveland?
> >>
> >> Is there still any possibility that in 2016 InCommmon will
> >> have a POP replacement?
> >>
> >> I plan to be at the BOF and would like to hear about
> >> timelines, but any information you can provide to the list
> >> would also be helpful.
> >>
> >> Thanks,
> >>
> >> Scott K for LIGO
> >
>