Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Do you have a LoA (schema) in place and which one? - Yes, as per <https://www.igtf.net/ap/loa/>
  • Do you have contracts with IdPs? - No, but there are sanctions for not complying with the requirement  (e.g. on attending policy meetings and meeting the self-assessment  requirements) that will result in expulsion of an IdP from the federation.
  • Do you require an Identity Management Practice Statement? Do you enforce it?-  Yes, required and enforced.
  • Do you require any audits/documentations for IdPs? - Yes, required for documentation. Audits in the sense of peer-reviewed self-assessment are required periodically, and additional scrutiny is performed on accession.

...

  • Have you made any cost analysis for introducing (a higher) LoA? Is a higher LoA want from IdPs? - No assessment has been done - and for now no relying parties have requested a higher LoA than the one provided (i.e. higher than F2F+2FA)
  • Any experiences, which costs IdPs have to make in order to achieve  specific LoA? - This is unknown at a federation level, and is much country- and  model-dependent. In most cases, the cost of LoA is distributed to the user who has to perform the F2F vetting
  • Impacts on adopting LoA -  Differentiated LoA has been introduced recently (adding a 'lower' "Identifier-Only" assurance level below the conventional F2F+real name), which has resulted in some relying parties and end-users being confused about the 'trustworthiness' of the credential. It is rather complex to explain to non-experts that within a single federation multiple LoA levels exist, and that these should not be automatically all treated as equal.