iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
ISO

ISO/IEC FDIS 24760-2

(Main)

IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements

IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements

This document: — provides guidelines for the implementation of systems for the management of identity information, and —specifies requirements for the implementation and operation of a framework for identity management. This document is applicable to any information system where information relating to identity is processed or stored.

Sécurité IT et confidentialité — Cadre pour la gestion de l'identité — Partie 2: Architecture de référence et exigences

General Information

Status
Not Published
ICS
35.030 - IT Security
Technical Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Drafting Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Current Stage
5000 - FDIS registered for formal approval
Start Date
31-Jul-2023
Completion Date
17-Jul-2024
Ref Project

Relations

Revises
ISO/IEC 24760-2:2015 - Information technology — Security techniques — A framework for identity management — Part 2: Reference architecture and requirements
Effective Date
06-Jun-2022

Buy Standard

ISO/IEC FDIS 24760-2 - IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements Released:11/27/2024ISO/IEC FDIS 24760-2 - IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements Released:11/27/2024
PreviousNext
Draft
ISO/IEC FDIS 24760-2 - IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements Released:11/27/2024
English language
46 pages
sale 15% off
Preview
sale 15% off
Preview
REDLINE ISO/IEC FDIS 24760-2 - IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements Released:11/27/2024REDLINE ISO/IEC FDIS 24760-2 - IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements Released:11/27/2024
PreviousNext
Draft
REDLINE ISO/IEC FDIS 24760-2 - IT Security and Privacy — A framework for identity management — Part 2: Reference architecture and requirements Released:11/27/2024
English language
46 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)


FINAL DRAFT
International
Standard
ISO/IEC
FDIS
24760-2
ISO/IEC JTC 1/SC 27
IT Security and Privacy —
Secretariat: DIN
A framework for identity
Voting begins on:
management —
2024-12-11
Part 2:
Voting terminates on:
2025-02-05
Reference architecture and
requirements
Sécurité IT et confidentialité — Cadre pour la gestion de
l'identité —
Partie 2: Architecture de référence et exigences
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
ISO/IEC FDIS 24760­2:2024(en) © ISO/IEC 2024

FINAL DRAFT
International
Standard
ISO/IEC
FDIS
24760-2
ISO/IEC JTC 1/SC 27
IT Security and Privacy —
Secretariat: DIN
A framework for identity
Voting begins on:
management —
Part 2:
Voting terminates on:
Reference architecture and
requirements
Sécurité IT et confidentialité — Cadre pour la gestion de
l'identité —
Partie 2: Architecture de référence et exigences
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2024
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
ISO/IEC FDIS 24760­2:2024(en) © ISO/IEC 2024

© ISO/IEC 2024 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms. 3
5 Reference architecture . 3
5.1 General .3
5.2 Deployment scenarios .3
5.3 Stakeholders .4
5.3.1 General .4
5.3.2 Principal .5
5.3.3 Identity management authority .5
5.3.4 Identity information authority .6
5.3.5 Relying party .6
5.3.6 Regulatory body .6
5.3.7 Consumer/citizen representative or advocate .6
5.4 Actors .7
5.4.1 General .7
5.4.2 Principal .8
5.4.3 Identity management authority .8
5.4.4 Identity registration authority .9
5.4.5 Relying party .10
5.4.6 Identity information authority .10
5.4.7 Identity information provider .11
5.4.8 Verifier . 12
5.4.9 Auditor . 13
5.5 Processes and services . 13
5.5.1 Documentation. 13
5.5.2 Identity information management processes .14
5.5.3 Specific identity information management processes . 15
5.5.4 Additional functions . .17
5.6 Viewpoints . 20
5.6.1 General . 20
5.6.2 Context viewpoint . 20
5.6.3 Functional viewpoint . 20
5.7 Use cases .21
5.7.1 General .21
5.7.2 Principal use cases . 22
5.8 Components . 23
5.8.1 General . 23
5.8.2 Principal . 23
5.8.3 Identity register . 23
5.9 C ompliance and governance .24
5.10 Physical model .24
6 Architecture for managing internal identities, the enterprise model .24
6.1 Context .24
6.2 Stakeholders and concerns . 25
6.3 The enterprise deployment scenario . 26
6.4 Use cases . 26
6.4.1 Employee use cases . 26
6.4.2 Employer use cases .27

© ISO/IEC 2024 – All rights reserved
iii
7 Architecture for managing external identities .27
7.1 Context .27
7.2 Stakeholders and concerns .27
7.3 Deployment scenarios with external identities . 29
7.3.1 The federated deployment scenario . 29
7.3.2 The service deployment scenario . 29
7.3.3 The federated deployment scenario as applied as a service . 29
7.4 Use cases . 29
7.4.1 Device use cases .
...


Formatted: Centered
ISO/IEC JTC 1 /SC 7 N2XXXX
Style Definition: Heading 1
Style Definition: Heading 2
Date:2024-07-15
Style Definition: Heading 3
DIS ISO/IEC FDIS 24760--2:2024 (E(en)
Style Definition: Heading 4
ISO/IEC JTC 1/SC 27/WG 5 Style Definition: Heading 5
Style Definition: Heading 6
Secretariat: DIN
Style Definition: Default Paragraph Font
Date: 2024-11-26
Style Definition: ANNEX
Style Definition: List Paragraph
IT Security and Privacy—
— A framework for identity management—
Style Definition: Note: Adjust space between Latin and
— Part 2: Reference architecture and requirements
Asian text, Adjust space between Asian text and
numbers, Tab stops: 1.7 cm, Left + Not at 2 cm
Sécurité informatique et Protection de la vie privée—Cadre pour la gestion d'identité ——Partie 2: Architecture
Style Definition: Body Text Indent 2
de référence et exigences
Style Definition: Body Text Indent 3
Partie 2: Architecture de référence et exigences
Style Definition: AMEND Terms Heading
Style Definition: AMEND Heading 1 Unnumbered
Style Definition: IneraTableMultiPar: Font: Font color:
Black, Adjust space between Latin and Asian text, Adjust
space between Asian text and numbers
Formatted: Top: 1.4 cm, Bottom: 0.5 cm, Section start:
New page
Formatted: Don't adjust space between Latin and Asian
text, Don't adjust space between Asian text and
numbers
Formatted: French (Switzerland)
Formatted: Font: Bold, Not Italic, French (Switzerland)
Formatted: Centered
ISO/IEC FDIS2 24760-2:2024 (E)
© ISO/IEC 2024 Formatted
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part
of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or
mechanical, including photocopying, or posting on the internet or an intranet, without prior written
permission. Permission can be requested from either ISO at the address below or ISO's member body in
the country of the requester.
ISO Copyright Office
CP 401 • CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
Email: copyright@iso.orgcopyright@iso.org
Website: www.iso.orgwww.iso.org
Published in Switzerland.
ii © ISO/IEC 2024 – All rights reserved

Formatted
...
Formatted
...
ISO/IEC FDIS2FDIS 24760-2:2024 (E(en)
Formatted
...
Field Code Changed
...
Formatted
...
Contents
Formatted
...
Foreword . vi
Field Code Changed
...
Introduction . viii Formatted
...
1 Scope . 11 Formatted
...
2 Normative references . 11
Formatted
...
3 Terms and definitions . 11 Formatted
...
4 Symbols and abbreviated terms . 33 Formatted
...
Formatted
5 Reference architecture . 33
...
Formatted
5.1 General. 33 .
Formatted
5.2 Deployment scenarios . 33 .
Formatted
...
5.3 Stakeholders . 44
Formatted
...
5.3.1 General . 44
Formatted
...
5.3.2 Principal . 55
Formatted
...
5.3.3 Identity management authority . 55
Formatted
...
5.3.4 Identity information authority. 6
Formatted
...
5.3.5 Relying party . 6
Formatted
...
5.3.6 Regulatory body . 66
Formatted
...
5.3.7 Consumer/citizen representative or advocate . 77
Formatted
...
5.4 Actors . 7
Formatted
...
5.4.1 General . 77
Formatted
...
5.4.2 Principal . 88
Formatted
...
5.4.3 Identity management authority . 99
Formatted
...
5.4.4 Identity registration authority . 1010
Formatted
...
5.4.5 Relying party . 1111
Formatted
...
5.4.6 Identity information authority. 1111
Field Code Changed
...
5.4.7 Identity information provider . 1212
Formatted
...
5.4.8 Verifier . 1313
Formatted
...
5.4.9 Auditor . 1414
Field Code Changed
...
5.5 Processes and services . 1414
Formatted
...
5.5.1 Documentation . 1414
Formatted
...
5.5.2 Identity information management processes . 1515
Formatted
...
5.5.3 Specific identity information management processes . 1616
Formatted
...
5.5.4 Additional functions . 1919
Formatted
...
5.6 Viewpoints . 2222
Formatted
...
5.6.1 General . 2222
Field Code Changed
...
5.6.2 Context viewpoint . 2222
Formatted
...
Formatted
...
Formatted
...
© ISO/IEC 2024 – All rights reserved iii
Formatted
...
Formatted
...
© ISO/IEC 2024 – All rights reserved
iii Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
ISO/IEC FDIS2 24760-2:2024 (E)
Formatted
...
Formatted
...
Formatted
5.6.3 Functional viewpoint . 2323 .
Formatted
5.7 Use cases . 2323 .
Formatted
5.7.1 General . 2323 .
Formatted
...
5.7.2 Principal use cases . 2626
Formatted
...
5.8 Components . 2626
Formatted
...
5.8.1 General . 2626
Formatted
...
5.8.2 Principal . 2626
Formatted
...
5.8.3 Identity register . 2626
Formatted
...
5.9 Compliance and governance . 2727
Formatted
...
5.10 Physical model . 2727
Formatted
...
6 Architecture for managing internal identities, the enterprise model . 2727
Formatted
...
6.1 Context . 2727
Formatted
...
6.2 Stakeholders and concerns . 2828
Formatted
...
6.3 The enterprise deployment scenario . 3030
Formatted
...
6.4 Use cases . 3030
Formatted
...
6.4.1 Employee use cases . 3030
Formatted
...
6.4.2 Employer use cases . 3030
Formatted
...
7 Architecture for managing external identities . 3030
Formatted
...
7.1 Context . 3030
Formatted
...
7.2 Stakeholders and concerns . 3232
Formatted
...
7.3 Deployment scenarios with external identities . 3333
Formatted
...
7.3.1 The federated deployment scenario . 3333
Formatted
...
7.3.2 The service deployment scenario . 3333
Formatted
...
7.3.3 The federated deployment scenario as applied as a service . 3333
Formatted
...
7.4 Use cases . 3434
Formatt
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

ISO
ISO/IEC 27019:2024(Main)
Information security, cybersecurity and privacy protection — Information security controls for the energy utility industry

This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes. This includes in particular the following: — central and distributed process control, monitoring and automation technology as well as information systems used for their operation, such as programming and parameterization devices; — digital controllers and automation components such as control and field devices or programmable logic controllers (PLCs), including digital sensor and actuator elements; — all further supporting information systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving, historian logging, reporting and documentation purposes; — communication technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote-control technology; — Advanced metering infrastructure (AMI) components, e.g. smart meters; — measurement devices, e.g. for emission values; — digital protection and safety systems, e.g. protection relays, safety PLCs, emergency governor mechanisms; — energy management systems, e.g. for distributed energy resources (DER), electric charging infrastructures, and for private households, residential buildings or industrial customer installations; — distributed components of smart grid environments, e.g. in energy grids, in private households, residential buildings or industrial customer installations; — all software, firmware and applications installed on above-mentioned systems, e.g. distribution management system (DMS) applications or outage management systems (OMS); — any premises housing the abovementioned equipment and systems; — remote maintenance systems for abovementioned systems. This document does not apply to the process control domain of nuclear facilities. This domain is covered by IEC 63096.

  • Standard
    39 pages
    English language
    sale 15% off
  • Standard
    48 pages
    French language
    sale 15% off
ISO
ISO/IEC 23264-2:2024(Main)
Information security — Redaction of authentic data — Part 2: Redactable signature schemes based on asymmetric mechanisms

This document specifies cryptographic mechanisms to redact authentic data. The mechanisms described in this document offer different combinations of the security properties defined and described in ISO/IEC 23264-1. For all mechanisms, this document describes the processes for key generation, generating the redactable attestation, carrying out redactions and verifying redactable attestations. This document contains mechanisms that are based on asymmetric cryptography using three related transformations: ¾ a public transformation defined by a verification key (verification process for verifying a redactable attestation), ¾ a private transformation defined by a private attestation key (redactable attestation process for generating a redactable attestation), and ¾ a third transformation defined by the redaction key (redaction process) allowing to redact authentic information within the constraints set forth during generation of the attestation such that redacted information cannot be reconstructed. This document contains mechanisms which, after a successful redaction, allow the attestation to remain verifiable using the verification transformation and attest that non-redacted fields of the attested message are unmodified. This document further details that the three transformations have the property whereby it is computationally infeasible to derive the private attestation transformation, given the redaction and or the verification transformation and key(s).

  • Standard
    58 pages
    English language
    sale 15% off
ISO
ISO/IEC 27554:2024(Main)
Information security, cybersecurity and privacy protection — Application of ISO 31000 for assessment of identity-related risk

This document provides guidelines for identity-related risk, as an extension of ISO 31000:2018. More specifically, it uses the process outlined in ISO 31000 to guide users in establishing context and assessing risk, including providing risk scenarios for processes and implementations that are exposed to identity-related risk. This document is applicable to the risk assessment of processes and services that rely on or are related to identity. This document does not include aspects of risk related to general issues of delivery, technology or security.

  • Standard
    18 pages
    English language
    sale 15% off
ISO
ISO/IEC 27403:2024(Main)
Cybersecurity – IoT security and privacy – Guidelines for IoT-domotics

This document provides guidelines to analyse security and privacy risks and identifies controls that can be implemented in Internet of Things (IoT)-domotics systems.

  • Standard
    39 pages
    English language
    sale 15% off
ISO
ISO/IEC 14888-4:2024(Main)
Information security — Digital signatures with appendix — Part 4: Stateful hash-based mechanisms

This document specifies stateful digital signature mechanisms with appendix, where the level of security is determined by the security properties of the underlying hash function. This document also provides requirements for implementing basic state management, which is needed for the secure deployment of the stateful schemes described in this document.

  • Standard
    56 pages
    English language
    sale 15% off
ISO
ISO/IEC TR 5891:2024(Main)
Information security, cybersecurity and privacy protection — Hardware monitoring technology for hardware security assessment

This document surveys and summarizes the existing hardware monitoring methods, including research efforts and industrial applications. The explored monitoring technologies are classified by applied area, carrier type, target entity, objective pattern, and method of deployment. Moreover, this document summarizes the possible ways of utilizing monitoring technologies for hardware security assessment with some existing state-of-the-art security assessment approaches. The hardware mentioned in this document refers only to the core processing hardware, such as the central processing unit (CPU), microcontroller unit (MCU), and system on a chip (SoC), in the von Neumann system and does not include single-input or single-output devices such as memory or displays. The hardware monitoring technology discussed in this document has the following considerations and restrictions: — the monitored target is for the post-silicon phase, not for the design-house phase (e.g. an RTL or netlist design); — monitoring is only applied to the runtime system.

  • Technical report
    32 pages
    English language
    sale 15% off
ISO
ISO/IEC 27011:2024(Main)
Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for telecommunications organizations

This document provides guidelines supporting the implementation of information security controls in telecommunications organizations. The adoption of this document will allow telecommunications organizations to meet baseline information security management requirements of confidentiality, integrity, availability and any other relevant information security property.

  • Standard
    28 pages
    English language
    sale 15% off
ISO
ISO/IEC DIS 27561(Main)
Information security, cybersecurity and privacy protection — Privacy operationalisation model and method for engineering (POMME)

This document describes a model and method to operationalize ISO/IEC 29100 privacy principles into sets of controls and functional capabilities. The method is described as a process following ISO/IEC/IEEE It is designed for use with other standards and privacy It supports networked, interdependent applications and This document is intended for engineers and other practitioners developing systems controlling or processing PII.

  • Standard
    29 pages
    English language
    sale 15% off
ISO
ISO/IEC 4922-2:2024(Main)
Information security — Secure multiparty computation — Part 2: Mechanisms based on secret sharing

This document specifies the processes for secure multiparty computation mechanisms based on the secret sharing techniques which are specified in ISO/IEC 19592-2. Secure multiparty computation based on secret sharing can be used for confidential data processing. Examples of possible applications include collaborative data analytics or machine learning where data are kept secret, secure auctions where each bidding price is hidden, and performing cryptographic operations where the secrecy of the private keys is maintained. This document specifies the mechanisms including but not limited to addition, subtraction, multiplication by a constant, shared random number generation, and multiplication with their parameters and properties. This document describes how to perform a secure function evaluation using these mechanisms and secret sharing techniques.

  • Standard
    33 pages
    English language
    sale 15% off
ISO
ISO/IEC 27006-1:2024(Main)
Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General

This document specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing ISMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

  • Standard
    47 pages
    English language
    sale 15% off
  • Standard
    53 pages
    French language
    sale 15% off