FAL2 Requirements #71
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added to the list
continuing to add references.
Replaced last version with a complete set of requirements tagged by document section.
Updated section 2.1
Continuing to work through the doc to identify requirements that are met/not met, and requirements that are unlikely to be useful to IPSIE.
This was referenced May 8, 2025
Closed
Updated the doc with references to filed issues through section 3.11.2.
This was referenced Jun 12, 2025
Completed through line 619.
Reviewed up to line 696
Finalized review of requirements. Issues have been created where needed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I pulled all of the requirements for FAL2 from NIST SP800-63Crev4 using the draft version available as of May 1, 2025.
I'll be updating this doc as I review the requirements against the current OIDC SL1 profile draft. Publishing this PR to allow the WG to more readily see the requirements.
(Edited to add the following on May 2, 2025)
The IPSIE WG needs to determine which parts of the FAL2 guidelines we want to adopt. While our initial levels stated FAL2 compliance, it is my expectation that the WG will narrow this to focus on meaningful controls for enterprise use cases and not wholesale adoption of all FAL2 required controls.