Proposed Workflow IDESG Self-Assessment and Attestation Program For TFP’s Discussion Deck TFTM Committee 09/23/

The purpose of this presentation is to: Provide a model for using existing Trust Framework Providers TFPs to streamline and support the mission of the IDESG Encourage discussion about the benefits and pitfalls of using TFP’s as intermediates. Leverage the proposed workflow for the IDESG Self- Assessment and Attestation process. Identify IDESG entities responsible for processes are proposed. 2 Purpose

Many TFP’s provide the following services: Develop or adopt accreditation framework(s) Review application materials and organizational bonafides of members Review and approve the accreditation materials submitted by members. Manage a registry of members and what accreditation programs they are reviewed under. – Some may issue trustmarks. Periodically reassess members to ensure they are still in conformance. 3 Trust Framework Providers

Many TFP’s provide the following services: Develop or adopt accreditation framework(s) Review application materials and organizational bonafides of members Review and approve the accreditation materials submitted by members. Manage a registry of members and what accreditation programs they are reviewed under. – Some may issue trustmarks. Periodically reassess members to ensure they are still in conformance. 4 Potential Benefits of Trust Framework Providers

Pitfalls for allowing TFP’s to function as intermediaries: What are the implications if TFPs don’t effective perform their duties? How can the IDESG deal with a wide variety of accreditation frameworks used by TFPs? How can we leverage TFPs without finalizing IDESG baseline requirements? 5 Potential Pitfalls of Trust Framework Providers

1.TFTM can propose accreditation programs for plenary approval we believe are in accordance with NSTIC strategy. – TFPs that join the IDESG can also submit their accreditation programs to TFTM for review. 2.Those TFPs that are using an approved accreditation program and apply to participate in the IDESG would be allowed to function as delegated administrators for their respective members. 3.TFPs that are approved will be granted the authority to use IDESG trustmark catalog for all trustmarks in which they are eligible and to provide them to their members 6 One Approach for Enrolling TFPs into IDESG

Allowing TFP’s to Join Before Baseline Requirements Are Defined Pro’sCon’s This will jumpstart IDESG and allow the IDESG to validate the trustmark model and build membership This will take considerable effort off IDESG and provides value for TFPs to support their members Risk is relatively low If TFTM reviews accreditation programs for fit with NSTIC goals. TFPs may not be fully aligned with final baseline requirements. Some added risk to reputation that IDESG does not control when it delegates to a TFP. This process is unnecessary if we finalize baseline requirements in a few months as proposed.

Proposed Workflow TFTM adopts initial accreditation frameworks that are consistent with NSTIC goals. – These are submitted to chairs for review – Upon chair review, these go to MC for review – Upon MC review, these go to plenary Once frameworks are adopted, TFPs would follow proposed workflow for organizations. – May need to adjust form

9 Proposed - Application, Self-Assessment and Attestation Workflow and Approval Process Overview Applicant IDESG Secretariat Approved Applicant IDESG Secretariat IDESG CRT Approve? No Yes Assessment & Attestation Pkg. Application & Bona Fides Pkg. Complete? Application Denial Application Approval Pkg. No Yes Approve? IDESG Conformance Recognition Process (TBD) Yes No 15 Days 30 Days Return Pkg. to Applicant