<?xml version="1.0" encoding="UTF-8"?><!--Serialized by the GTRI Trustmark Framework API, version: 1.4.70--><tf:TrustmarkDefinition xmlns:tf="https://trustmarkinitiative.org/specifications/trustmark-framework/1.4/schema/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><tf:Metadata><tf:Identifier>https://trustmark.nief.org/tpat/tds/nief-28-cfr-certification-indicator-attribute/1.0/</tf:Identifier><tf:Name>NIEF 28 CFR Certification Indicator Attribute</tf:Name><tf:Version>1.0</tf:Version><tf:Description>Specifies requirements for Identity Provider Organizations (IDPOs) that wish to assert the National Identity Exchange Federation (NIEF) 28 CFR Certification Indicator attribute on behalf of their users.</tf:Description><tf:PublicationDateTime>2017-11-21T00:00:00.000Z</tf:PublicationDateTime><tf:TrustmarkDefiningOrganization><tf:Identifier>https://nief.org/</tf:Identifier><tf:Name>NIEF</tf:Name><tf:Contact><tf:Kind>PRIMARY</tf:Kind><tf:Responder>NIEF Support</tf:Responder><tf:Email>help@nief.org</tf:Email><tf:WebsiteURL>https://nief.org/</tf:WebsiteURL></tf:Contact></tf:TrustmarkDefiningOrganization><tf:TargetStakeholderDescription>Identity Provider Organizations (IDPOs) and Attribute Provider Organizations (APOs) within the NIEF community, as well as Federated ICAM Relying Parties that require assurances about the quality of attributes asserted by NIEF IDPOs and APOs.</tf:TargetStakeholderDescription><tf:TargetRecipientDescription>Identity Provider Organizations (IDPOs) and Attribute Provider Organizations (APOs) that intend to assert Federated ICAM attributes in a manner that conforms to the attribute assertion requirements stipulated by NIEF.</tf:TargetRecipientDescription><tf:TargetRelyingPartyDescription>Federated ICAM Relying Parties that require assurances about the quality of attributes asserted by NIEF IDPOs and APOs.</tf:TargetRelyingPartyDescription><tf:TargetProviderDescription>Trustmark Providers that are capable of issuing Federated ICAM interoperability trustmarks. Note that the Trustmark Provider must have a access to a fully functional Federated ICAM test federation to perform the necessary assessment steps for this trustmark.</tf:TargetProviderDescription><tf:ProviderEligibilityCriteria>Any organization or business entity may act as a Trustmark Provider for trustmarks under this Trustmark Definition.</tf:ProviderEligibilityCriteria><tf:AssessorQualificationsDescription>Any individual employed or contracted by the Trustmark Provider may act as the assessor for trustmarks under this Trustmark Definition.</tf:AssessorQualificationsDescription><tf:TrustmarkRevocationCriteria>For any trustmark issued under this Trustmark Definition, the Trustmark Provider must revoke the trustmark upon any condition whereby one or more Conformance Criteria cease to be satisfied, unless the trustmark contains appropriate documentation of that condition in accordance with the exception reporting requirements specified by the Trustmark Framework Technical Specification.</tf:TrustmarkRevocationCriteria><tf:ExtensionDescription>This Trustmark Definition requires no extension data.</tf:ExtensionDescription><tf:LegalNotice>This document and the information contained herein is provided on an "AS IS" basis, and the Georgia Tech Research Institute disclaims all warranties, express or implied, including but not limited to any warranty that the use of the information herein will not infringe any rights or any implied warranties or merchantability or fitness for a particular purpose. In addition, the Georgia Tech Research Institute disclaims legal liability for any loss incurred as a result of the use or reliance on the document or the information contained herein.</tf:LegalNotice><tf:Keywords><tf:Keyword>NIEF</tf:Keyword><tf:Keyword>National Identity Exchange Federation</tf:Keyword><tf:Keyword>Attributes</tf:Keyword><tf:Keyword>NIEF Attributes</tf:Keyword><tf:Keyword>Identity Provider Organization</tf:Keyword><tf:Keyword>IDPO</tf:Keyword><tf:Keyword>Attribute Provenance</tf:Keyword><tf:Keyword>Attribute Provider Organization</tf:Keyword><tf:Keyword>APO</tf:Keyword><tf:Keyword>Interoperability</tf:Keyword></tf:Keywords></tf:Metadata><tf:Terms><tf:Term><tf:Name>Global Federated Identity and Privilege Management</tf:Name><tf:Abbreviation>GFIPM</tf:Abbreviation><tf:Definition><![CDATA[An applied research program in federated identity and credential management that was initiated in 2005 as part of the Global Justice Information Sharing Initiative. The GFIPM program sought to develop secure, scalable, and cost-effective technologies for information sharing within the law enforcement and criminal justice communities.]]></tf:Definition></tf:Term><tf:Term><tf:Name>Identity Provider</tf:Name><tf:Abbreviation>IDP</tf:Abbreviation><tf:Definition><![CDATA[A software entity that performs user authentication each time an individual presents themselves to a federated identity trust framework or issues user assertions about the individual for a given information technology session. These user assertions are presented to systems deployed by Service Provider Organizations (SPOs) in a federated identity trust framework for the purposes of access control and audit.]]></tf:Definition></tf:Term><tf:Term><tf:Name>Identity Provider Organization</tf:Name><tf:Abbreviation>IDPO</tf:Abbreviation><tf:Definition><![CDATA[An organization that vets individuals, collects attributes about these individuals, and maintains those attributes in an accurate manner. The IDPO may operate one or more Identity Provider (IDP) systems in a federated identity trust framework.]]></tf:Definition></tf:Term><tf:Term><tf:Name>National Identity Exchange Federation</tf:Name><tf:Abbreviation>NIEF</tf:Abbreviation><tf:Definition><![CDATA[A collection of agencies in the U.S. that have come together to share sensitive law enforcement information.]]></tf:Definition></tf:Term><tf:Term><tf:Name>NIEF Attribute Registry</tf:Name><tf:Definition><![CDATA[A collection of attribute definitions that are intended for use by organizations and communities that wish to implement Federated Identity, Credential, and Access Management (ICAM) technologies within the context of the National Identity Exchange Federation (NIEF).]]></tf:Definition></tf:Term></tf:Terms><tf:ConformanceCriteria><tf:ConformanceCriterion tf:id="criterion1"><tf:Number>1</tf:Number><tf:Name>Attribute Validity</tf:Name><tf:Description>When asserting the 28 CFR Certification Indicator attribute on behalf of a user, an IDPO or APO shall assert the attribute name correctly, in accordance with the attribute definition as stipulated at &lt;a href="https://nief.org/attribute-registry/attributes/user/gfipm/28CFRCertificationIndicator/2.0/"&gt;https://nief.org/attribute-registry/attributes/user/gfipm/28CFRCertificationIndicator/2.0/&lt;/a&gt;. In addition, an IDPO or APO shall assert a 28 CFR Certification Indicator attribute value of 'true' for a user only if the user has been trained and certified in the handling of criminal intelligence data in accordance with Code of Federal Regulations, Title 28 (28 CFR), Part 23. One way for a user to meet this requirement is by having taken and passed the online 28 CFR Part 23 training course and certification exam offered by the U.S. Department of Justice Bureau of Justice Assistance (BJA) via its Secured National Criminal Intelligence Resource Center (NCIRC) Web Site (&lt;a href="http://www.ncirc.gov/securedwebsite.cfm"&gt;http://www.ncirc.gov/securedwebsite.cfm&lt;/a&gt;). Alternatively, a user may meet this requirement by having taken and passed an equivalent offline 28 CFR Part 23 training course, offered by the Institute for Intergovernmental Research (IIR). (See &lt;a href="https://28cfr.iir.com/"&gt;https://28cfr.iir.com/&lt;/a&gt; for details.)</tf:Description></tf:ConformanceCriterion></tf:ConformanceCriteria><tf:AssessmentSteps><tf:AssessmentStep tf:id="Usage"><tf:Number>1</tf:Number><tf:Name>Usage</tf:Name><tf:Description>Does the organization correctly assert the 28 CFR Certification Indicator attribute in accordance with the established attribute format rules for the Federated ICAM protocol(s) and conformance or interoperability profile(s) that it uses?  Also, does the asserted attribute name align with the attribute definition provided in the NIEF Attribute Registry? See &lt;a href="https://nief.org/attribute-registry/attributes/user/gfipm/28CFRCertificationIndicator/2.0/"&gt;https://nief.org/attribute-registry/attributes/user/gfipm/28CFRCertificationIndicator/2.0/&lt;/a&gt;.</tf:Description><tf:ConformanceCriterion tf:ref="criterion1" xsi:nil="true"></tf:ConformanceCriterion><tf:Artifact><tf:Name>Sample</tf:Name><tf:Description><![CDATA[Provide a sample of a technical protocol assertion (e.g., JSON, XML, SAML, OIDC, etc.) correctly using this attribute.]]></tf:Description></tf:Artifact></tf:AssessmentStep><tf:AssessmentStep tf:id="Provenance"><tf:Number>2</tf:Number><tf:Name>Provenance</tf:Name><tf:Description>Does the organization assert the 28 CFR certification attribute appropriately? Provide details on how the organization asserts this attribute in a manner that aligns with the requirements as per the attribute's definition.</tf:Description><tf:ConformanceCriterion tf:ref="criterion1" xsi:nil="true"></tf:ConformanceCriterion><tf:Artifact><tf:Name>28 CFR Certification</tf:Name><tf:Description><![CDATA[Provide details on how users undergo 28 CFR training. If they take an online course, please provide details on how the results of this testing are tabulated and recorded. Or if the attribute is sourced directly from a training agency, clearly specify that fact.]]></tf:Description></tf:Artifact></tf:AssessmentStep></tf:AssessmentSteps><tf:IssuanceCriteria><![CDATA[yes(ALL)]]></tf:IssuanceCriteria></tf:TrustmarkDefinition>