Security contact

The Security contact (or contacts) for an identity provider or service provider is a contact point during a security incident response, and can be a service function such as "Security Operations" or individuals' email addresses. If the security contact is a mailing list or alias, it must be possible to send emails to this address from outside the registrant organisation since, by their nature, federated security incidents cross organizational boundaries. These contact details are published in metadata and elsewhere.

A Security contact can only be appointed or replaced by a Management Contact or an Administrative Contact for that entity.

Including a security contact is RECOMMENDED for all entities. There MUST be one or more security contacts for entities which are are part of the Sirtfi trust framework.

Registering or Updating a Security Contact

To add or update a Security Contact, the entity's registered Management Contact or Administrative Contact should email the UK federation helpdesk with:

• The entityID of the IdP or SP
• The name of the Security Contact
• The email address of the Security Contact

Once the request has been verified, the UK federation team will update the entity's metadata accordingly.

Summary of inter-relations between federation contacts

This document summarises the inter-relations between the roles of the federation contacts