Best Practice Detail

13-12-8732

Service Providers, Public Safety should classify identity management services against the service architecture and deployment model being utilized to determine the general “security” posture of the identity services, how it relates to asset’s assurance and security protection requirements, and define the needed security architecture to mitigate security risks. Specifically, if identity related functions are distributed among multiple parties, all parties involved should be clearly identified (e.g., relying parties such as users and service providers, credential providers, verification or authentication providers, or federation members) with clearly defined roles, responsibilities, and accountability for the security of the identity service and all associated assets. This applies to Public Safety only in an NG9-1-1 environment.

Status: Rollover New

References/Comments: ITU-T X.1250, Baseline capabilities for enhanced global identity management and interoperability NIST SP 800-63, Electronic Authentication Guideline

Historical events:

• Service Providers
• Public Safety
• Cable
• Internet/Data
• Satellite
• Wireless
• Wireline
• Cyber Security
• Information Protection
• Public Safety Service
• Intrusion Detection
• CSRIC VII: Rollover New In CSRIC VII