The InCommon Assurance process is designed to support the needs of service providers that must require identity providers to meet a more detailed set of requirements than is defined with our basic federation services. The National Institutes of Health and National Science Foundation are examples of such service proviers.

These new assurance levels are named bronze and silver and originally corresponded with the National Institute of Standards (NIST) security guide 800-63 for level 1 and level 2 of assurance. Silver provides a higher level of assurance, including criteria for more robust identity management and identity-proofing procedures. InCommon has undertaken a detailed review and as a result is refining the Identity Assurance Profile with the goal of simplifying the profile and ensuring it meets the current requirements of the federal government. 

This project has two main drivers:

1. The federal government requirements have changed. The standards are now being developed by the Identity, Credential and Access Management (ICAM) effort at the GSA. The Identity Assurance Profiles were originally written to comply with an older government initiative - eAuth - which is no longer active and had a number of criteria that no longer apply.

2. A group of schools has been working through the Silver adoption process and uncovering a number of questions and recommendations. These have also been incorporated into the updated profile.

The updated Identity Assurance Profile and the related Identity Assurance Assessment Framework are now available for community comment. In the box to the right, you will find links to the new documents (both version 1.1), along with the current 1.0 versions. I invite you to send your comments to ia-review@incommon.org.

We will accept comments through March 28, 2011, with the goal of completing this process by April 18, 2011.

The community wishes to thank the schools that have been working on the Silver adoption process – the Committee for Institutional Cooperation (CIC), which includes the Big Ten plus the University of Chicago, along with the University of Washington and Virginia Tech. In addition, a group of member-institutions of SURA (Southeastern University Research Association) has recently started a Silver adoption process. Both of these collaborations will document their efforts, which will help all of us as we move to adopt Silver.

InCommon Assurance Community Wiki

Baseline Expectations for Trust in Federation

Baseline Expectations links and information

Baseline Expectations Foundational Document

InCommon Community Trust and Assurance Board (CTAB) Minutes Publicly Available

InCommon Community Trust and Assurance Board (CTAB) Minutes are publicly available here

The charter for the InCommon Community Trust and Assurance Board (CTAB) is here

InCommon MFA Interoperability Profile Working Group

The mission of the working group was to develop and document requirements for creating and implementing an interoperability profile to allow the community to leverage MFA provided by an InCommon Identity Provider by allowing SPs to rely on a standard syntax and semantics regarding MFA. See the working group wiki and the Final Work Products.

InCommon Silver with Active Directory Domain Services Cookbook for 1.2 Released

The final version of the InCommon Silver with Active Directory Domain Services Cookbook is available now! For an overview of the important bits, see the May 2014 webinar recording. 

Reading Bronze: Understanding the InCommon Profile (recordings available)

InCommon sponsored a community reading of the Bronze InCommon Assurance Profile to aid in the understanding and intent of the requirements. There were four calls during Dec. 2013 and Jan. 2014.  The calls have now concluded. Thanks to all who participated for the excellent comments and questions.

Recordings are available at this link.

Assurance Program

Specification Documents

• Identity Assurance Assessment Framework; Version 1.2 Feb 2013 [PDF]
• Identity Assurance Profiles; Version 1.2 Feb 2013 [PDF]
• Alternative Means; Multi-factor Authentication for Silver certification
• DIFFS with 1.1: Framework and Profiles
• Deprecated Versions

Alternative Means

• Alternative Means History

Community Resources

Toolkits

• Auditor

Technical InterOp

• Assurance Technical Implementation Considerations - Draft Guidance for IdPs and SPs.
• See Implementation Examples
• Bronze and Silver AuthnContext Schema

Community Contributions

• AD and Silver Cookbook, Multi-factor Considerations, and  case studies.
• Assurance Implementation Example from Virginia Tech 
• Harvard University Executive Summary of achieving Bronze Certification, Bronze Self-Certification Document, and Enhancing the Harvard Authentication System to Support InCommon Bronze
         
• Add your Approach to Supporting the Federal Privacy Requirements
• more community contributions

Webinars and Presentations

• Introducing CTAB (recording and slides) - Dec. 6, 2017

• Refocusing Community Guidance of InCommon's Trust Programs: Baseline and Bronze (recording and slides) - Oct 4, 2017

• IAM Online Webinar on Baseline Expectations Implementation and Maintenance (recording and slides) - July 19, 2017

• Baseline Expectations Implementation - June 7, 2017

• NIST 800-63 / Digital Identity Guidelines - March 1, 2017

• REFEDs Assurance Working Groups, Jan 4, 2017 - slides and Adobe Connect here

• Baseline Expectations and their Implementation, Oct 5, 2016 (Slides) and (AdobeConnect)

• Baseline Expectations – Last Call for Comments, Aug. 3, 2016 (link to slides and recording)
• Baseline Expectations for Trust in Federation, July 6, 2016 (link to slides and recording)
• Sirtfi for Security Incidents in a Federated Context, May 4, 2016 (link to slides and recording)

• Multifactor Authentication Interop Profile Working Group Update, April, 6, 2016 (link to slides and recording)

• Developments in Assurance: Insights from Across the Pond, Feb. 3, 2016 (link to slides and recording)

• Assurance Survey Results and Baseline Standards to replace the POP, at Nov. 2015 Assurance call (link to slides and recording)
   
• Duo with Shibboleth v3, from U. Chicago and Unicon, at Sept 2015 Assurance call (link to slides and recording)
• Flexible Vetting: using a point system to verify identity, at May 2015 Assurance call. (link to slides and recording)
• Password Reset practices, at April 2015 Assurance call.  (link to slides and recording)
• InCommon Bronze Approaches from GW and Harvard, recorded March 4, 2015. See recorded Webinar. See slides (PDF).
• InCommon Bronze and Security, IAM Online with two Bronze case studies (Todd Haddaway, UMBC and Sharon Welna, University of Nebraska Medical Center), (webinar recorded October 15, 2014  and slide deck)
• Successful Security Practices: Counting Failed Login Attempts, PDF slide Deck, Webinar recorded Sept. 3, 2014
• Better Practices Build Better Systems: Identity Assurance, recorded presentation by Ann West, Internet2, and Ron Thielen, U. Chicago, at EDUCAUSE Security Professionals Conference, May 2014 
• Open for Business: InCommon Identity Assurance Program (PDF Silde Deck. Webinar recorded February 29, 2012)
• Grab the Bronze and Silver Ring: Identity Assurance Progress (PDF Slide Deck. Webinar recorded June 15, 2011)

Additional Resources

InCommon Assurance Program website