https://wiki.idesg.org/index.php?action=history&feed=atom&title=Baseline_Functional_Requirements_v1.0Baseline Functional Requirements v1.0 - Revision history2026-05-01T07:17:44ZRevision history for this page on the wikiMediaWiki 1.38.4https://wiki.idesg.org/index.php?title=Baseline_Functional_Requirements_v1.0&diff=593&oldid=prevOmaerz: 27 revisions imported: Initial Upload of old pages from IDESG Wiki2018-06-28T03:00:53Z<p>27 revisions imported: Initial Upload of old pages from IDESG Wiki</p>
<p><b>New page</b></p><div><br />
Below is the list of the titles of each of the Requirements and Best Practices comprising the IDEF Baseline Functional Requirements v1.0. Each title on this page provides a link to a separate page on this website (wiki) containing the text of the item. <br><br />
<br />
Additional commentary and supplemental material is in development and will be linked to each requirement page. In the requirement text: (a) Short titles for each item are included for indexing and ease of reading, but are not considered normative. (b) Certain words are CAPITALIZED for ease of review and identifying specific roles, but that capitalization is not considered normative.<br />
<br />
A formal printed version of these same Requirements as approved, with IDESG logos, can be downloaded from: <br><br />
https://workspace.idesg.org/kws/public/download/442/IDEF-Baseline-Requirement-v1.0-with-Supplemental-Guidance.pdf<br />
<br />
== Scope ==<br />
The [http://www.nist.gov/nstic National Strategy for Trusted Identities in Cyberspace (NSTIC)] envisions widespread, trusted identity exchanges using federated methods that are secure, interoperable, privacy-enhancing and easy to use. Realization of that vision will require companies, agencies and individuals to perform at a new level. The Requirements are our first step towards that goal, by describing a set of functions that parties must be able to fulfill, and a set of criteria for assessing those capabilities. <br />
<br />
The Requirements are an informed step forward in privacy, security, interoperability and usability based on the work of the IDESG's diverse membership of practitioners expert in their respective fields. <br />
<br />
Identity Ecosystem stakeholders can use the Requirements to identify and measure capabilities and services today and identify others to implement. [http://www.idesg.org IDESG]'s Identity Ecosystem Framework (IDEF) includes guidance, listing and self-reporting facilities, in its [http://www.IDEFRegistry.org IDEF Registry]. The IDEF Registry supports reporting by identity service providers of their self-assessments. IDESG plans include an option to expand this program to also accommodate third-party certification, based on execution of the initial listing and IDESG’s outreach, activities and stakeholder input.<br />
<br />
== Interpretation ==<br />
<br />
IDESG has approved and provided a [[IDEF_Glossary|Glossary of Terms]] for the IDEF program, and a list of [[APPENDIX A-Defined Terms|certain definitions]], linked below. Defined terms that are used in these Requirements are hyperlinked, in the Requirement text displayed in this wiki, to the relevant definitions. <br />
<br />
== Requirements ==<br />
=== Interoperability ===<br />
[[Interop Req 1|INTEROP-1. THIRD PARTY AUTHENTICATION]] <br><br />
[[Interop Req 2|INTEROP-2. THIRD PARTY CREDENTIALS]] <br><br />
[[Interop Req 3|INTEROP-3. STANDARDIZED CREDENTIALS]] <br><br />
[[Interop Req 4|INTEROP-4. STANDARDIZED DATA EXCHANGES]] <br><br />
[[Interop Req 5|INTEROP-5. DOCUMENTED PROCESSES]] <br><br />
[[Interop Req 6|INTEROP-6. THIRD-PARTY COMPLIANCE]] <br><br />
[[Interop Req 7|INTEROP-7. USER REDRESS]] <br><br />
[[Interop Req 8|INTEROP-8. ACCOUNTABILITY]] <br><br />
<br />
=== Privacy ===<br />
[[Privacy Req 1|PRIVACY-1. DATA MINIMIZATION]] <br><br />
[[Privacy Req 2|PRIVACY-2. PURPOSE LIMITATION]] <br><br />
[[Privacy Req 3|PRIVACY-3. ATTRIBUTE MINIMIZATION]] <br><br />
[[Privacy Req 4|PRIVACY-4. CREDENTIAL LIMITATION]] <br><br />
[[Privacy Req 5|PRIVACY-5. DATA AGGREGATION RISK]] <br><br />
[[Privacy Req 6|PRIVACY-6. USAGE NOTICE]] <br><br />
[[Privacy Req 7|PRIVACY-7. USER DATA CONTROL]] <br><br />
[[Privacy Req 8|PRIVACY-8. THIRD-PARTY LIMITATIONS]] <br><br />
[[Privacy Req 9|PRIVACY-9. USER NOTICE OF CHANGES]] <br><br />
[[Privacy Req 10|PRIVACY-10. USER OPTION TO DECLINE]] <br><br />
[[Privacy Req 11|PRIVACY-11. OPTIONAL INFORMATION]] <br><br />
[[Privacy Req 12|PRIVACY-12. ANONYMITY]] <br><br />
[[Privacy Req 13|PRIVACY-13. CONTROLS PROPORTIONATE TO RISK]] <br><br />
[[Privacy Req 14|PRIVACY-14. DATA RETENTION AND DISPOSAL]] <br><br />
[[Privacy Req 15|PRIVACY-15. ATTRIBUTE SEGREGATION]] <br><br />
<br />
=== Security ===<br />
[[Secure Req 1|SECURE-1. SECURITY PRACTICES]] <br><br />
[[Secure Req 2|SECURE-2. DATA INTEGRITY]] <br><br />
[[Secure Req 3|SECURE-3. CREDENTIAL REPRODUCTION]] <br><br />
[[Secure Req 4|SECURE-4. CREDENTIAL PROTECTION]] <br><br />
[[Secure Req 5|SECURE-5. CREDENTIAL ISSUANCE]] <br><br />
[[Secure Req 6|SECURE-6. CREDENTIAL UNIQUENESS]] <br><br />
[[Secure Req 7|SECURE-7. TOKEN CONTROL]] <br><br />
[[Secure Req 8|SECURE-8. MULTIFACTOR AUTHENTICATION]] <br><br />
[[Secure Req 9|SECURE-9. AUTHENTICATION RISK ASSESSMENT]] <br><br />
[[Secure Req 10|SECURE-10. UPTIME]] <br><br />
[[Secure Req 11|SECURE-11. KEY MANAGEMENT]] <br><br />
[[Secure Req 12|SECURE-12. RECOVERY AND REISSUANCE]] <br><br />
[[Secure Req 13|SECURE-13. REVOCATION]] <br><br />
[[Secure Req 14|SECURE-14. SECURITY LOGS]] <br><br />
[[Secure Req 15|SECURE-15. SECURITY AUDITS]] <br><br />
<br />
=== Usability ===<br />
[[Usable Req 1|USABLE-1. USABILITY PRACTICES]] <br><br />
[[Usable Req 2|USABLE-2. USABILITY ASSESSMENT]] <br><br />
[[Usable Req 3|USABLE-3. PLAIN LANGUAGE]] <br><br />
[[Usable Req 4|USABLE-4. NAVIGATION]] <br><br />
[[Usable Req 5|USABLE-5. ACCESSIBILITY]] <br><br />
[[Usable Req 6|USABLE-6. USABILITY FEEDBACK]] <br><br />
[[Usable Req 7|USABLE-7. USER REQUIREMENTS]] <br><br />
<br />
== Best Practices and Potential Future Requirements ==<br />
<br />
[[Interop Best Practice A|INTEROP-BP-A. RECOMMENDED PORTABILITY]] <br><br />
[[Interop Best Practice B|INTEROP-BP-B. RECOMMENDED EXCHANGE STANDARDS]] <br><br />
[[Interop Best Practice C|INTEROP-BP-C. RECOMMENDED TAXONOMY STANDARDS]] <br><br />
[[Interop Best Practice D|INTEROP-BP-D. RECOMMENDED PROCESS MODELS]] <br><br />
[[Interop Best Practice E|INTEROP-BP-E. RECOMMENDED MODULARITY]] <br><br />
[[Interop Best Practice F|INTEROP-BP-F. RECOMMENDED FEDERATION COMPLIANCE]] <br><br />
[[Interop Best Practice G|INTEROP-BP-G. RECOMMENDED LEGAL COMPLIANCE]] <br><br />
[[Privacy Best Practice A|PRIVACY-BP-A. RECOMMENDED QUALITY CONTROLS]] <br><br />
[[Privacy Best Practice B|PRIVACY-BP-B. RECOMMENDED TECHNOLOGY ENFORCEMENT]] <br><br />
[[Privacy Best Practice C|PRIVACY-BP-C. RECOMMENDED CONSEQUENCES OF DECLINING]] <br><br />
[[Usable Best Practice A|USABLE-BP-A. RECOMMENDED ATTRIBUTE REQUIREMENTS QUERY]] <br><br />
<br />
== Defined Terms ==<br />
<br />
{| class="wikitable"<br />
|>> ||''Forward to:''|| [[IDEF_Glossary]] <br />
|-<br />
|>> || || <br />
[[APPENDIX A-Defined Terms]]<br />
|}</div>Omaerz