<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
        {font-family:Wingdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Wingdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p
        {mso-style-priority:99;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
        {mso-style-priority:99;
        mso-style-link:"Balloon Text Char";
        margin:0in;
        margin-bottom:.0001pt;
        font-size:8.0pt;
        font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
        {mso-style-name:"Balloon Text Char";
        mso-style-priority:99;
        mso-style-link:"Balloon Text";
        font-family:"Tahoma","sans-serif";}
span.EmailStyle20
        {mso-style-type:personal;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
span.EmailStyle21
        {mso-style-type:personal;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
span.EmailStyle22
        {mso-style-type:personal-reply;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-size:10.0pt;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
/* List Definitions */
@list l0
        {mso-list-id:1077508849;
        mso-list-type:hybrid;
        mso-list-template-ids:1911203496 269025281 -14751092 269025285 269025281 269025283 269025285 269025281 269025283 269025285;}
@list l0:level1
        {mso-level-number-format:bullet;
        mso-level-text:\F0B7;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:.25in;
        text-indent:-.25in;
        font-family:Symbol;}
@list l0:level2
        {mso-level-start-at:0;
        mso-level-number-format:bullet;
        mso-level-text:·;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:.75in;
        text-indent:-.25in;
        font-family:"Calibri","sans-serif";
        mso-fareast-font-family:Calibri;
        mso-bidi-font-family:"Times New Roman";}
@list l0:level3
        {mso-level-number-format:bullet;
        mso-level-text:\F0A7;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:1.25in;
        text-indent:-.25in;
        font-family:Wingdings;}
@list l0:level4
        {mso-level-number-format:bullet;
        mso-level-text:\F0B7;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:1.75in;
        text-indent:-.25in;
        font-family:Symbol;}
@list l0:level5
        {mso-level-number-format:bullet;
        mso-level-text:o;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:2.25in;
        text-indent:-.25in;
        font-family:"Courier New";}
@list l0:level6
        {mso-level-number-format:bullet;
        mso-level-text:\F0A7;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:2.75in;
        text-indent:-.25in;
        font-family:Wingdings;}
@list l0:level7
        {mso-level-number-format:bullet;
        mso-level-text:\F0B7;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:3.25in;
        text-indent:-.25in;
        font-family:Symbol;}
@list l0:level8
        {mso-level-number-format:bullet;
        mso-level-text:o;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:3.75in;
        text-indent:-.25in;
        font-family:"Courier New";}
@list l0:level9
        {mso-level-number-format:bullet;
        mso-level-text:\F0A7;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        margin-left:4.25in;
        text-indent:-.25in;
        font-family:Wingdings;}
ol
        {margin-bottom:0in;}
ul
        {margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-CA link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Copy of the Government of Canada&#8217;s <b>Guideline on Identity Assurance </b>just distributed to IAWG and AIMWG.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Ken<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><div><p class=MsoNormal><span lang=FR-CA style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>Kenneth Dagg<br>Senior Project Co-ordinator | Coordonnateur de projet supérieur<br>Security and Identity Management | Sécurité et gestion des identités<br>Chief Information Officer Branch | Direction du dirigeant principal de l'information<br>Treasury Board of Canada Secretariat | Secrétariat du Conseil du Trésor du Canada<br>Ottawa, Canada K1A 0R5<br><a href="mailto:Kenneth.Dagg@tbs-sct.gc.ca">Kenneth.Dagg@tbs-sct.gc.ca</a><o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=FR-CA style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>Telephone | Téléphone 613-957-7041 / Facsimile | Télécopieur 613-954-6642 / Teletypewriter | Téléimprimeur 613-957-9090<br>Government of Canada | Gouvernement du Canada<br><br></span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'><img border=0 width=576 height=61 id="_x0000_i1026" src="cid:image001.gif@01CE4FEC.4A22E4C0" alt="cid:image001.gif@01CDF886.3DB7BC50"></span><span lang=FR-CA style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'><o:p></o:p></span></p></div><p class=MsoNormal><span lang=FR-CA style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Dagg, Kenneth <br><b>Sent:</b> May-13-13 3:19 PM<br><b>To:</b> 'wg-idassurance@kantarainitiative.org'; 'wg-attributes-in-motion@kantarainitiative.org'<br><b>Cc:</b> 'Joni Brennan (joni@ieee-isto.org)'; 'Andrew Hughes (andrew@kantarainitiative.org)'; 'Heather Flanagan (heather@kantarainitiative.org)'; Bouma, Tim<br><b>Subject:</b> GC Guideline on Identity Assurance - Draft for Consultation<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-family:"Calibri","sans-serif"'>Please find attached the&nbsp; consultation draft of the<span style='color:#1F497D'> </span>Government of Canada&#8217;s <b>Guideline on Identity Assurance</b>. We have distributed this document to our provincial and territorial government<span style='color:#1F497D'> </span>counterparts in Canada for consultation<span style='color:#1F497D'>.</span> We plan to finalize this document in early summer. I have received the go-ahead to provide to Kantara initiative Working Groups. Please do not hesitate to forward it to other Kantara Initiative members to whom it might be of interest. We have also forwarded the document to representatives of other foreign governments for their comments.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-family:"Calibri","sans-serif"'>A few notes on the draft guideline:<o:p></o:p></span></p><p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:.25in;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span style='font-family:"Calibri","sans-serif"'>This guideline supports the implementation of the <b>Standard on Identity and Credential Assurance</b>, specifically, <b>Appendix C: &nbsp;Minimum Requirements to Establish an Identity Assurance Level . </b>It is mandatory that federal departments comply with this standard, including the appendix. This policy can be found at: <a href="http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=26776" target="_blank"><span style='color:windowtext'>http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=26776</span></a><span style='color:#1F497D'>. </span><o:p></o:p></span></p><p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:.25in;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span style='font-family:"Calibri","sans-serif"'>This version of the guideline has undergone extensive consultation with federal government departments<span style='color:#1F497D'> </span>and we<span style='color:#1F497D'> a</span>re now comfortable with sharing this with the broader community. &nbsp;We believe we&#8217;ve created something that gives departments reasonably precise parameters but without being unnecessarily prescriptive (always a challenge). Departments will be able to implement this guideline within their respective legislative frameworks and comply with the standard. The standard and the guideline are also intended to facilitate the adoption of trust frameworks where appropriate.<span style='color:#1F497D'> </span>It should be noted that both the standard and guideline were developed by users, rather than providers, of identity.<o:p></o:p></span></p><p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:.25in;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span style='font-family:"Calibri","sans-serif"'>The guideline pays significant attention to articulating requirements and guidelines that are &#8216;<i>independent of channel&#8217;</i> (e.g. in-person, remote, etc.) and that <i>are &#8216;beyond the document&#8217;</i> (to allow for digital alternatives). As such, it does not unnecessarily constrain departments to providing in-person processes and/or require that physical documentary evidence be provided. <span style='color:#1F497D'>While</span> this may be difficult, if not impossible today, these possibilities cannot be discounted in the future.<o:p></o:p></span></p><p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:.25in;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span style='font-family:"Calibri","sans-serif"'>You will notice there are many similarities to US government<span style='color:#1F497D'> </span>documents such as <b>OMB M04-04</b>, and<span style='color:#1F497D'> </span><b>NIST SP 800-63-2. </b>We have also taken a very close look at the <b>United<span style='color:#1F497D'> </span>Kingdom GPG-45</b>&nbsp; and the <b>New<span style='color:#1F497D'> </span>Zealand Evidence<span style='color:#1F497D'> </span>of<span style='color:#1F497D'> </span>Identity<span style='color:#1F497D'> </span>(EOI)<span style='color:#1F497D'> </span>Standard. </b>We have also kept up to date on the work being done by the <b>ANSI/NASPO/IDPV-2013</b>. We have taken the very best of these documents/efforts, and adapted/evolved it for Canadian context.<o:p></o:p></span></p><p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:.25in;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span style='font-family:"Calibri","sans-serif"'>The &#8216;normative&#8217; section of the guideline is <b>Section 3.0</b> (Sections 3.1 to 3.10). Within these sections you will see various tables with specific criteria and guidelines. We envision these sections as forming the basis of an implementation assessment framework. The primary focus of this guideline has been on programs providing services to external clients, however, it also applies to programs providing services to internal clients (e.g. employees and contractors), including PKI.<o:p></o:p></span></p><p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:.25in;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span style='font-family:"Calibri","sans-serif"'>This guideline is &nbsp;a companion to the TBS &nbsp;<b>Guideline of Defining Authentication Requirements</b>, found at: <a href="http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=26262" target="_blank"><span style='color:windowtext'>http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=26262</span></a> . This guideline provides departments with a definitive assessment framework to determine an assurance level requirement (similar to OMB M04-04 but with some key differences). There are some other technical companion documents (described in Section 2.5)<span style='color:#1F497D'>.</span><o:p></o:p></span></p><p style='margin-bottom:12.0pt'><span style='font-family:"Calibri","sans-serif"'>We look forward to any comments, questions, and/or feedback.&nbsp; I will keep you up to date as the document is finalized.<o:p></o:p></span></p><p style='margin-bottom:12.0pt'><span lang=FR-CA style='font-family:"Calibri","sans-serif"'>Regards,<o:p></o:p></span></p><p style='margin-bottom:12.0pt'><span lang=FR-CA style='font-family:"Calibri","sans-serif"'>Ken<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=MsoNormal><span lang=FR-CA style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>Kenneth Dagg<br>Senior Project Co-ordinator | Coordonnateur de projet supérieur<br>Security and Identity Management | Sécurité et gestion des identités<br>Chief Information Officer Branch | Direction du dirigeant principal de l'information<br>Treasury Board of Canada Secretariat | Secrétariat du Conseil du Trésor du Canada<br>Ottawa, Canada K1A 0R5<br><a href="mailto:Kenneth.Dagg@tbs-sct.gc.ca">Kenneth.Dagg@tbs-sct.gc.ca</a><o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=FR-CA style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>Telephone | Téléphone 613-957-7041 / Facsimile | Télécopieur 613-954-6642 / Teletypewriter | Téléimprimeur 613-957-9090<br>Government of Canada | Gouvernement du Canada<br><br></span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'><img border=0 width=576 height=61 id="Picture_x0020_1" src="cid:image001.gif@01CE4FEC.4A22E4C0" alt="cid:image001.gif@01CDF886.3DB7BC50"></span><span lang=FR-CA style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'><o:p></o:p></span></p><p style='margin-bottom:12.0pt'><span lang=FR-CA style='font-family:"Calibri","sans-serif"'><o:p>&nbsp;</o:p></span></p></div></body></html>