UC Trust Meeting - March, 2013

1. 1.     Incommon silver certification

• All UC’s are supposed to go through UCTrust compliance auditing every two years to be compliant – only UC Hastings is compliant (because they haven’t been in UCTrust for two years yet)
• Kris Hafner (co-interim CIO) is concerned that campuses are not compliant with our basic UCTrust audit requirements and wants an update on status. Dedra took a summary of status from comments on the call and posted here:
  • https://spaces.ais.ucla.edu/display/uctrustwg/InCommon+Silver+Update+for+ITLC+-+April+2013
  • Sept 2011 – last update to incommon silver page
  • InCommon Silver is an opportunity for aligning UCTrust Basic assurance with the rest of InCommon. This alignment will have the following benefits:
    • Interoperability with other InCommon participants when identity assurance at LoA 2 is required.
    • Efficiency and cost saving by having a single assessment process for both UCTrust Basic and InCommon Silver.
    • What resources are needed for all campuses to be compliant?
      • Only a few campuses have completed the resource survey.
      • Wide range of estimates of resources

1. UCSB: Has a synergistic plan; from a capital perspective, they have the resource they need. From an institutional perspective, there might be difficulties. UCSB is applying for the Bronze IAQ next month, and is currently compiling all the documentation and audit materials. Next step will be to apply for silver certification. Arlene sees this as an opportunity for internal growth.
2. UCOP: We don’t serve students, so we don’t have the same problems as the campuses; additionally our systems are in the same central location. Silver certification would require a couple months’ work. This is based on the assumption that UC Path requires incommon silver – which it does not. Eric sees this as an opportunity to make headway into good id management practices.
3. UC Davis: Certification progress is stalled for lack of resources, and is not a priority. Additionally, UC Davis was never federated with AYSO.
4. LBNL: Certification is not a priority for management. In order to complete silver certification, there would be a lot of documentation and infrastructure work.
5. UC Irvine: There are currently no special resources allocated towards certification. It’s not required for UC Path or for their service provider.
6. UC Riverside: Completed the evaluation in 2011, but nothing has happened since that time.
7. UC Merced: NO work on incommon silver. UCM is a wave 1 UC Path site, so the resources most focused on that project.
8. UCSC: NA
9. UC Berkeley: Reported steady progress but internal resources keep getting shuffled around; they project to be certified by the end of the year.
10. UCSF: Not a priority, like some of the other campuses.
11. UCLA: Still pursuing certification; they are working on some other business projects, will resume certification when those are completed. 2014 is the target date for certification.
12. UC San Diego: Currently no project to do bronze or silver; nothing funded, nothing scheduled.

• Next steps: create a business plan to submit to ITLC
  • Control initiative offers some incommon silver audits assistance.
  • Either use campus resources or contract it out— Dedra will bring the plan to ITLC.

1. 2.     UC Trust as a service

• Arlene’s document
  • This is a strategic topic at the CAS level – who is responsible, who is funding etc
  • How do we streamline these services?
  • Service providers come on board, coordinate services, service point of contact, etc – what is the campus feeling about that scenario?
  • Arlene will add this to the May, 2013 ITLC meeting agenda.
    • Next steps: Who is available to turn this into a document for review?

Next call:

UC Online issues