TFTM Deliverable Self Assessment and Attestation Program Discussion Deck TFTM Committee June 25, IDESG TFTM Committee1

2014 Compliance and Conformance Program Goal Meeting Objectives Why Self-attestation? Process and Components Deliverables Next Steps IDESG TFTM Committee2 Meeting Agenda

Discuss the 2014 IDESG self assessment and attestation compliance program Identify program components Identify potential deliverables IDESG TFTM Committee3 Today’s Meeting Objectives

Cost effective – For both IDESG and participants Resource light – For both IDESG and participants Can be implemented quickly – We are already half way through 2014 Provides moderate assurance that participants are operating according to established requirements, guidance, rules, etc. Most realistic option for 2014 Logical first step in the phased implementation of a compliance program – CSA and other organizations have implemented similar phased approaches IDESG TFTM Committee4 Why Self-assessment and Attestation?

Establish a self assessment and attestation compliance program for the Identity Ecosystem. – TFTM consensus decision made on 28 May 2014 – In the future, additional types of conformance will be built upon the self- attestation program IDESG TFTM Committee TFTM Compliance and Conformance Goal Self Assessment and Attestation 2014 Peer to Peer Certification TBD Independent 3 rd Party Certification TBD Future Compliance Approaches

IDESG TFTM Committee6 IDESG Conformance Assessment Program NSTIC and IDESG Guiding Principles 3 rd -Party Conformance Assessment (2015+) Privacy Conformance Self- Attestation Security Usability Other IE Framework Requirements and Assessment Procedures Interop. Self-Assessment (2014) Self-Assessment Criteria/Questionnaire

What do we need for a functional self-assessment and attestation program? Each step in the process will require a set of defined procedures (internal and external) and owners to ensure an efficient program A clear, overall process flow should be developed once the processes and components have been identified and agreed to by the TFTM IDESG TFTM Committee7 Process & Components Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance

Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance The process through which identity ecosystem participants request to be recognized through the self-assessment and attestation conformance program May be automated or manual procedure – Web form – ed/downloaded PDF Application should contain sufficient info to confirm “Bona Fides” of applying organizations – Legitimate service provider in IE – e.g., IE role/service description – Other certifications (e.g., CSA STAR, PCI DSS, FICAM), DUNs number, etc. Ownership for collecting applications and supporting documents will need to be assigned to an appropriate entity in IDESG – E.g., Secretariat, TFTM sub-committee, etc. Potential deliverables/documentation: – IDESG Application Template and Guide – Bona Fides information requirements IDESG TFTM Committee8 Process and Components

IDESG TFTM Committee9 Process and Components Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance Process by which applicants determine conformance with appropriate IDESG requirements Needs a clear, standardized format for expressing applicable requirements – E.g., clear criteria, self-assessment questionnaire Needs an identified owner in IDESG for collecting and managing assessment template submissions – May be Secretariat or TFTM sub-committee – Need to review for completeness and appropriateness of submissions Dependent upon committee requirements development – TFTM development of requirements template may assist committees in their own requirements development Potential deliverables/documentation: – Conformance Criteria/Questionnaire

IDESG TFTM Committee10 Process and Components Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance Means to formally bind applicants to the information provided in the self-assessment form Needs a standardized format with appropriate legal language/review Ownership – May be Secretariat or TFTM sub-committee Potential deliverables/documentation: – Attestation Forms/Guide

IDESG TFTM Committee11 Process and Components Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance IDESG due diligence and confirmation that all necessary and appropriate information has been received from an applicant. – Results in recommendation for acceptance of self-attestation At a minimum, should ensure that the proper documents have been fully and appropriately completed – Application (Bona fides check) – Self-assessment forms – Conformance Attestation Ownership – Responsibility for recommendations for approval should be an IDESG entity, e.g., TFTM, TFTM subcommittee, Management Council/sub-committee – Similarly, Responsibility for formal approval should be an IDESG entity Potential deliverables/documentation: – Approval process description and policy

Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance Process through which IDESG approval of an ecosystem participant’s self- assessment and attestation is publically represented – Expresses conformance with IDESG requirements to other ecosystem participants and the general public Multiple means to express conformance – Certificate – a formal certification issued by IDESG – Trustmark- a visual/electronic symbol that is licensed for use/display by approved service providers and ecosystem participants – Registry or “Trust” List - an IDESG hosted site that lists approved service providers and approved ecosystem participants These options will be explored more fully in future discussions… Deliverables/Documents – Recognition Approach IDESG TFTM Committee12 Process and Components

Application Self- Assessment AttestationApprovalRecognition Ongoing Compliance Process by which the IDESG confirms continued compliance with IDESG requirements and rules. Could be: – Re-assessment and attestation after a set period – Updated attestation of continued compliance Initial process should be stated up front as part of 2014 attestation process and documents – Could be expressed as an “expiration” or renewal date (e.g., annual, bi-annual) Deliverables/Documents – Ongoing compliance approach (may be included in attestation guidance) IDESG TFTM Committee13 Process and Components

IDESG TFTM Committee14 Potential TFTM Deliverables Application Template Bona Fides Requirements Self Assessment Form/Template – Conformance Criteria, Compliance Questionnaire or something similar Attestation Forms/Documentation Approval Process Description and Policy Recognition Approach Ongoing Compliance Approach

1.Analyze/discuss existing self-certification and self-assessment programs Cloud Security Alliance STAR Program 2.Gain consensus on deliverable list and program components 3.Develop timelines and milestones for deliverables 4.Begin development of self-assessment and attestation deliverables IDESG TFTM Committee15 Next Steps Summary