Policy Guidelines

AUDIENCE: RESEARCH COMMUNITY MANAGEMENT

Many of your questions will not be solved by defining your technical stack - arguably some of the most difficult issues relate to policy. Regardless of what software you choose, those responsible for your research community will need to be able to show that the following considerations, among others, have been addressed:

• How are members identified, verified and removed from the collaboration? 
• Are all services within the AAI implementing security patches? 
• What will happen when there is a security incident?
• Who has access to user data?

AARC’s Policy guidelines are a compilation of best practices and recommendations that help research and e-Infrastructures to implement scalable and cost-effective policy and operational frameworks for their AARC BPA compliant AAIs. These documents aim to ensure three core capabilities for Research Infrastructures: Operational Security, Trustworthy Membership Management and Data Protection. 

The set of necessary policies has been reviewed in AARC-I082 following several years of experience of running the AARC BPA in practice. This document addresses trust across the entire chain of AAI components and aims to remove difficulties in tracing back any information to its original source. Establishing trust becomes more challenging when it is not possible to see which link in the ‘chain’ asserts which information and how trustworthy that link is.

Practical steps for adopting AARC’s policy recommendations

1. Define a unique name for your collaboration (we recommend a DNS name to avoid collisions) 
2. Identify a governance body to make policy decisions
3. Define the purpose of your collaboration (this will be used for your AUP) 
4. We strongly suggest
1. Identifying your primary assets
2. Completing a risk assessment
3. Defining your rules of participation and the escalation procedure in case of non-compliance
4. Identifying any additional legal and regulatory compliance necessary
5. Define the following documents and seek endorsement from your governance body
   

   Document	AARC Template	Example (where no template is recommended)
   Attribute Authority Operational Security Policy	Attribute Authority Operational Security
   Acceptable Use Policy	WISE AUP
   Incident response procedure		EOSC, UK-IRIS, AARC federated incident response procedure
   Membership management	Membership Management
   Privacy Policy		REFEDS privacy notice, UK-IRIS
   Security Operational Baseline	Security Operational Baseline

6. Review the AEGIS endorsed policy guidelines required for AARC compliance and ensure their technical implementation such as
1. Identify your assurance requirements following AARC-G031 
2. Identify suitable token lifetimes following AARC-G081
7. Ensure that the policies are presented to and accepted by the relevant audiences (e.g. service operators, end users)
8. Publish your documents and responsible parties at a suitable location