...
| Phase | Requirement | Deadline | Comments |
|---|---|---|---|
| 1 | Require security contacts and commitment to incident response for federations | 31st December 2025 | Complete, target achieved |
| 2 | Require security contacts and commitment to incident response for all entities Require privacy notice and completion of mdui:PrivacyStatementURL for all entities Require expression of RAF information / ability to assert https://refeds.org/assurance for all Identity Providers. | 31st December 2026 | Proposed - is it too much to include RAF in this year? Could be rolled to 2027 I think we can discuss this. I would not dilute it too much though. Maybe we could move RAF base requirement to 2027-Q1? (Davide) |
| 3 | Require Sirtfi for all entities Require expression of identifier uniqueness / ability to assert: https://refeds.org/assurance/ID/unique | 31st December 2027 | +1 (Davide) |
| 4 | Require minimum RAF level - TBD. | This still needs significant scoping work A base level would of course be IAP/low. A way to scope this is 1. usefulness (what's really needed?) - 2. what's current industry standard? for example Google, Amazon, MS, etc have now better vetting processes (Davide) |
Process
- Requirements will be announced by the Secretariat and appropriate amendments made the SAML Technical Profile.
- Federations will be asked to remove all entities that do not meet these standards by the deadline or (or they will be filtered by eduGAIN OT?).
...