Single factor; Change of Moderate prove control Moderate address of criteria of token – AL 2 organizational record by a Attestation through criteria beneficiary of Govt ID authentication protocol Stringent Multi-factor criteria auth: – Access to an Stringent stronger cryptographic online AL 3 organizational protocol; brokerage criteria and “soft”, “hard”, account verification or “OTP” of records tokens More Multi-factor Dispensation stringent auth w/ hard of a Stringent criteria tokens only; – AL 4 controlled organizational stronger crypto drug or $1M criteria attestation protocol w/ bank wire and keys bound to verification auth process Source: Attachment 3 HMG Information Assurance Maturity Model CRITERIA L1 L2 L3 L4 L5 Initial Established Business Quantitatively Optimised Enabling Managed Leadership and R/A/G R/A/G R/A/G R/A/G R/A/G Governance. Training, Education and R/A/G R/A/G R/A/G R/A/G R/A/G Awareness Information Risk R/A/G R/A/G R/A/G R/A/G R/A/G Management Through-Life IA R/A/G R/A/G R/A/G R/A/G R/A/G Measures Assured Information R/A/G R/A/G R/A/G R/A/G R/A/G Sharing Compliance R/A/G R/A/G R/A/G R/A/G R/A/G
AL 2 Change of address of record by a beneficiary Moderate organizational criteria Moderate criteria – Attestation of Govt ID Single factor; prove control of token through authentication protocol AL 3 Access to an online brokerage account Stringent organizational criteria Stringent criteria – stronger and verification of records Multi-factor auth: cryptographic protocol; “soft”, “hard”, or “OTP” tokens AL 4 Dispensation of a controlled drug or $1M bank wire Stringent organizational criteria More stringent criteria – stronger attestation and verification Multi-factor auth w/ hard tokens only; crypto protocol w/ keys bound to auth process Source: Attachment 3 HMG Information Assurance Maturity Model CRITERIA L1 Initial L2 Established L3 Business Enabling L4 Quantitatively Managed L5 Optimised Leadership and Governance. R/A/G R/A/G R/A/G R/A/G R/A/G Training, Education and Awareness R/A/G R/A/G R/A/G R/A/G R/A/G Information Risk Management R/A/G R/A/G R/A/G R/A/G R/A/G Through-Life IA Measures R/A/G R/A/G R/A/G R/A/G R/A/G Assured Information Sharing R/A/G R/A/G R/A/G R/A/G R/A/G Compliance R/A/G R/A/G R/A/G R/A/G R/A/G
draft-commercial-service-provider.docx