<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Michael,<div class=""><br class=""></div><div class="">Here are answers to the two questions Steve has pulled out of your query.</div><div class=""><br class=""></div><div class="">1) Yes, the SSAC has released revisions to several documents. These are usually within a short period of time after initial publication of the first version of the document and could be to correct minor issues with the document or to update the document to capture any changes in the SSAC’s thinking based on feedback received from the community post-publication that brings to light new facts or more appropriate ways to direct recommendations. It is fairly rare, but not unprecedented.</div><div class=""><br class=""></div><div class="">2) No, we have not considered updating SAC058. We completed a fairly comprehensive look at our prior advice within the last two years and put anything we thought may need updating on a list of potential future work. In such cases, we would issue new advice rather than reach several years back in time to update an older document. That new work would supplant earlier work. SAC058 is not on that list, but certainly, if work done by your group or elsewhere were to substantially change the landscape in that topic area, we’d look to release a fresh advisory.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class=""><br class=""></div><div class="">Rod</div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 5, 2021, at 6:13 AM, Steve Crocker <<a href="mailto:steve@shinkuro.com" class="">steve@shinkuro.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;">Michael,</div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;"><br class=""></div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;">Thanks for your note. See inline below.</div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;"><br class=""></div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;">Steve</div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;"><br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Oct 4, 2021 at 10:28 PM Michael Palage <<a href="mailto:michael@palage.com" target="_blank" class="">michael@palage.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US" class=""><div class=""><p class="MsoNormal">Steve,<u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">First thanks for completing the survey and getting a head start on some of our future work – you get the Chair’s first Gold Star for Working Group Participation<span style="font-family:"Segoe UI Emoji",sans-serif" class="">😊</span><u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">One of the questions I would like to pose to you, Jeff and the rest of your SSAC colleagues is the following. SAC 058 was written in 2013 - over 8 years ago. Since that time there has been a substantial amount of work done internationally on identity/accuracy proofing standards. Has SSAC ever revised a previously published SAC document to make sure that it is still up to date with current international and industry best practices?</p></div></div></blockquote><div class=""><br class=""></div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;">I perceive two questions. One is a general SSAC process question, viz "has SSAC ever revised [any] previously published SAC document..." The other is a specific question, "has SSAC [considered revising SAC 058]?" I've cc'd SSAC chair Rod Rasmussen and vice chair Julie Hammer for their consideration of both questions.</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US" class=""><div class=""><p class="MsoNormal"> <u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">Specifically, I would like to address your validation levels V0, V1, V2, and V3. Under older NIST Guidelines (Version 1.0.2. -2011) I believe there were 4 recognized assurance levels. However, under the current NIST SP 800-63a Digital Identity Guidelines (<a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63a.pdf" target="_blank" class="">https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63a.pdf</a>) there are now 3 Identity Assurance Levels (IAL) NOT 4. These three assurance levels also align with the levels in the current EU eIDAS Regulation (2016) (low, substantial and high), see <a href="https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/eIDAS+Levels+of+assurance" target="_blank" class="">https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/eIDAS+Levels+of+assurance</a></p></div></div></blockquote><div class=""><br class=""></div><div class="gmail_default" style="font-family: arial, sans-serif; font-size: small;">Thank you for referencing these documents. I've taken a quick look and written the short attached memo. In brief, the SSAC scale is applicable on a per data element basis. The NIST and EU scales appear to be holistic. The SSAC scale is a bit more specific regarding the operational test. The high rating in the SSAC scale appears to me not to distinguish between the two higher ratings in the NIST and EU scales. See the attached memo for slightly more detail.</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US" class=""><div class=""><p class="MsoNormal"> <u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">So please keep up the excellent work and I look forward to hearing any additional feedback from you and Jeff.<u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">Best regards,<u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">Michael<u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in" class=""><p class="MsoNormal"><b class="">From:</b> GNSO-Accuracy-ST <<a href="mailto:gnso-accuracy-st-bounces@icann.org" target="_blank" class="">gnso-accuracy-st-bounces@icann.org</a>> <b class="">On Behalf Of </b>Steve Crocker<br class=""><b class="">Sent:</b> Monday, October 4, 2021 9:23 PM<br class=""><b class="">To:</b> <a href="mailto:gnso-accuracy-st@icann.org" target="_blank" class="">gnso-accuracy-st@icann.org</a><br class=""><b class="">Subject:</b> Re: [GNSO-Accuracy-ST] Proposed Agenda - Registration Data Accuracy Scoping Team Meeting #1 - Tuesday 5 October at 14.00 UTC<u class=""></u><u class=""></u></p></div><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">Folks,<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">Attached is a rough attempt at capturing the validation requirements listed in the first few pages of assignment 1. The validation settings are in the column labeled VAL. The settings V0, V1, V2 and V3 align with the definitions in SAC 058, which are repeated on the first page of assignment 2. V0 indicates no validation, i.e. accept whatever the registrant supplies. V1 indicates syntactic validation, V2 indicates operational validation, and V3 indicates identity validation.<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">The COLL column indicates whether the data element is required (Collect), optional (Optional), or left up to the registrar (Any). The SENS column indicates the sensitivity of the data element. S0 indicates "public." In other cases, the degree of sensitivity or a range of possible sensitivity settings is indicated. (There is more to explain about this part of the system, but the focus of this message is only to capture the accuracy requirement.)<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">The STORE column indicates whether ICANN stores the data element. Since ICANN does require escrow of data, it can be argued these data elements should be set to STORE. As with the sensitivity settings, this is subject to further discussion but is outside the scope of this message.)<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">Are the validation settings shown here an accurate expression of the policy and contractual requirements?<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">Regarding the meeting tomorrow, I have a conflict after 30 minutes. Going forward, this time slot will generally be ok for me, although the conflict I have tomorrow may occur every three months. I'm also open to other time slots.<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">Thanks,<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">Steve<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="font-size: 12pt; font-family: Arial, sans-serif;" class=""><u class=""></u> <u class=""></u></span></p></div></div><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><div class=""><p class="MsoNormal">On Mon, Oct 4, 2021 at 9:57 AM Marika Konings <<a href="mailto:marika.konings@icann.org" target="_blank" class="">marika.konings@icann.org</a>> wrote:<u class=""></u><u class=""></u></p></div><blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in" class=""><div class=""><div class=""><p class="MsoNormal">Dear All,<u class=""></u><u class=""></u></p><p class="MsoNormal"> <u class=""></u><u class=""></u></p><p class="MsoNormal">Please find below the proposed agenda for the first meeting of the Registration Data Accuracy Scoping Team. <u class=""></u><u class=""></u></p><p class="MsoNormal"> <u class=""></u><u class=""></u></p><p class="MsoNormal">Best regards,<u class=""></u><u class=""></u></p><p class="MsoNormal"> <u class=""></u><u class=""></u></p><p class="MsoNormal">Caitlin, Berry and Marika<u class=""></u><u class=""></u></p><div style="border-top:none;border-right:none;border-left:none;border-bottom:2.25pt double windowtext;padding:0in 0in 1pt" class=""><p class="MsoNormal"> <u class=""></u><u class=""></u></p></div><p class="MsoNormal"> <u class=""></u><u class=""></u></p><p class="MsoNormal"><b class="">Registration Data Accuracy Scoping Team – Meeting #1</b><u class=""></u><u class=""></u></p><p class="MsoNormal">Tuesday 5 October at 14.00 UTC<u class=""></u><u class=""></u></p><p class="MsoNormal"> <u class=""></u><u class=""></u></p><ol start="1" type="1" class=""><li class="">Welcome and introductions (30 minutes) <u class=""></u><u class=""></u></li></ol><ol start="1" type="1" class=""><ol start="1" type="a" class=""><li class="">Each team member to introduce themselves and share objectives for this effort (results of survey to be shared in advance of the meeting)<u class=""></u><u class=""></u></li><li class="">Consider how objectives align and how obstacles can be avoided.<u class=""></u><u class=""></u></li></ol></ol><ol start="2" type="1" class=""><li class="">Required documents for review by Scoping Team (10 minutes) <u class=""></u><u class=""></u></li></ol><ol start="2" type="1" class=""><ol start="1" type="a" class=""><li class="">Council instructions and assignments (see <a href="https://community.icann.org/x/QoFaCg" target="_blank" class="">https://community.icann.org/x/QoFaCg</a>)<u class=""></u><u class=""></u></li><li class="">Index of relevant resources (see <a href="https://community.icann.org/x/SoFaCg" target="_blank" class="">https://community.icann.org/x/SoFaCg</a>) <u class=""></u><u class=""></u></li><li class="">Assignment Background briefings:<u class=""></u><u class=""></u></li></ol></ol><p style="margin-left:117pt" class=""><u class=""></u><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span style="font:7pt "Times New Roman"" class=""> </span></span></span><u class=""></u><span style="" class="">Assignment #1 -<span class=""> </span><a href="https://docs.google.com/document/d/16mFQkzM4tTj84736J-tlZ8T7tFeiFwfx/edit" title="https://docs.google.com/document/d/16mFQkzM4tTj84736J-tlZ8T7tFeiFwfx/edit" target="_blank" class=""><span style="color:rgb(3,56,109)" class="">https://docs.google.com/document/d/16mFQkzM4tTj84736J-tlZ8T7tFeiFwfx/edit</span></a></span><span style="" class=""><u class=""></u><u class=""></u></span></p><p style="margin-left:117pt" class=""><u class=""></u><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span style="font:7pt "Times New Roman"" class=""> </span></span></span><u class=""></u><span style="" class="">Assignment #2 -<span class=""> </span><a href="https://docs.google.com/document/d/1OyzzAjZgvNkfZ5EekUvJ7PQg80vNZvJ3/edit" title="https://docs.google.com/document/d/1OyzzAjZgvNkfZ5EekUvJ7PQg80vNZvJ3/edit" target="_blank" class=""><span style="color:rgb(3,56,109)" class="">https://docs.google.com/document/d/1OyzzAjZgvNkfZ5EekUvJ7PQg80vNZvJ3/edit</span></a></span><span style="" class=""><u class=""></u><u class=""></u></span></p><p style="margin-left:117pt" class=""><u class=""></u><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span style="font:7pt "Times New Roman"" class=""> </span></span></span><u class=""></u><span style="" class="">Assignment #3 -<span class=""> </span><a href="https://docs.google.com/document/d/1NiwMk6qHOQRn7VdcW0Paj5OoC3tWAQpm/edit" title="https://docs.google.com/document/d/1NiwMk6qHOQRn7VdcW0Paj5OoC3tWAQpm/edit" target="_blank" class=""><span style="color:rgb(3,56,109)" class="">https://docs.google.com/document/d/1NiwMk6qHOQRn7VdcW0Paj5OoC3tWAQpm/edit</span></a></span><span style="" class=""><u class=""></u><u class=""></u></span></p><p style="margin-left:117pt" class=""><u class=""></u><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span style="font:7pt "Times New Roman"" class=""> </span></span></span><u class=""></u><span style="" class="">Assignment #4 -<span class=""> </span><a href="https://docs.google.com/document/d/1Z8t-uH4gRqXytHOGnIkZ2qMSJctgR_kD/edit" title="https://docs.google.com/document/d/1Z8t-uH4gRqXytHOGnIkZ2qMSJctgR_kD/edit" target="_blank" class=""><span style="color:rgb(3,56,109)" class="">https://docs.google.com/document/d/1Z8t-uH4gRqXytHOGnIkZ2qMSJctgR_kD/edit</span></a></span><span style="" class=""><u class=""></u><u class=""></u></span></p><ol start="3" type="1" class=""><li style="" class="">Discuss proposed next steps (15 minutes) <u class=""></u><u class=""></u></li></ol><ol start="3" type="1" class=""><ol start="1" type="a" class=""><li style="" class="">Diversity and inclusiveness <u class=""></u><u class=""></u></li><li style="" class="">Meeting frequency / timing: proposal is to start with weekly plenary sessions to go through background briefings and develop work plan. Following that, try agile approach and have small teams make progress on work items. <u class=""></u><u class=""></u></li><li style="" class="">All team members are expected to have reviewed the items under #2 by the next meeting.<u class=""></u><u class=""></u></li><li style="" class="">All team members to provide input on the questions identified in assignment background briefing #1 - 4 by the next meeting – walk through of assignment background briefings and related questions will commence during next week’s meeting. <u class=""></u><u class=""></u></li></ol></ol><ol start="4" type="1" class=""><li style="" class="">Confirm action items & next meeting (Tuesday 12 October at 14.00 UTC)<u class=""></u><u class=""></u></li></ol><p class="MsoNormal"> <u class=""></u><u class=""></u></p></div></div><p class="MsoNormal">_______________________________________________<br class="">GNSO-Accuracy-ST mailing list<br class=""><a href="mailto:GNSO-Accuracy-ST@icann.org" target="_blank" class="">GNSO-Accuracy-ST@icann.org</a><br class=""><a href="https://mm.icann.org/mailman/listinfo/gnso-accuracy-st" target="_blank" class="">https://mm.icann.org/mailman/listinfo/gnso-accuracy-st</a><br class=""><br class="">_______________________________________________<br class="">By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" target="_blank" class="">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" target="_blank" class="">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<u class=""></u><u class=""></u></p></blockquote></div></div></div></blockquote></div></div>
<span id="cid:f_kue3la0q0"><Comparison of SAC 058.docx></span></div></blockquote></div><br class=""></div></body></html>