Process and timeline for V1.1

After researching the 1.0 process and the current OASIS requirements and bouncing it off Prateek, Eve, and Jeff, I've put together the attached timeline for everyone to review and comment.

In order to use this as the schedule, it means that on the 22-April call, we MUST make final decisions on what we will include in V1.1. We then have to have the spec's ready for SSTC Last Call on 29-April.

Note that we probably have a bit of slack in item #8 below, so we might squeeze out an extra week for our internal reviews, etc. But I think we should shoot for the dates below.

Note that we need to get at least 3 attestations of implementation for the V1.1 spec. So PLEASE start thinking about whether your company can provide that. I am currently assuming we need to follow the process we used for V1.1, where I think we obtained attestations for each major area of functionality (e.g. Browser/POST, Browser/Artifact). Do folks feel it's necessary to follow this same model for the 1.1 release?

Here's the SSTC's "Committee Last Call Process":

http://lists.oasis-open.org/archives/security-services/200202/msg00176.html

and the OASIS standardization process:

http://www.oasis-open.org/committees/guidelines.php#spec_standard

To me, it seems the earliest we could get the specs to OASIS is 15-July for an OASIS vote in August.

It's now 18-April. Given the discussions on Tuesday's call, I honestly don't believe we can vote to start the SSTC Last Call period until probably the end of this month (29-April). I personally think this is very aggressive, but possibly doable. However, with our SSTC-mandated 2-week Last Call period, I don't see how we can realistically make a request to OASIS to start their 30-day Public Review period until toward the end of May. This means we can't close the public review, work on any public comments, and prepare the submission documents until the end of June. We have to have stuff in by the 15^th of a month. Since it doesn't look, to me at least, that it's possible to do this in June, it pushes us to July 15 for OASIS submission.

I think the timeline looks something like this:

[Now] The SSTC produces working drafts of the specs.
[Target: 29-April] When the TC agrees that the draft specs are ready for TC last call, the Chairs announce the start of the TC "Last Call period" with at least a 2 week cutoff date. The announcement is sent to the TC and the next version of OASIS News.
[Target: 13-May] Cutoff date for all Last Call input.
[Target: 20-May] All outstanding issues have been dealt with according to the last call process. The specs now become "Candidate Committee Spec's" and the TC addresses any outstanding non-normative editorial issues.
[Target: 27-May] Once editorial issues are resolved, the TC votes to turn the "candidate" spec into the official "Committee Spec".
[Target: 28-May] The TC chairs must announce to OASIS that the Committee Spec is available for a 30-day Public Review period.
[Target: 1-July (1^st Tuesday following 30-day period)] The TC must do a final (re-)approval of the spec as a Committee Spec and vote to submit the Committee Spec to OASIS
[Target: 1-July] Chairs begin to prepare OASIS spec submission document which includes

Reference links to specs
Certification by at least 3 vendors successfully using the spec
Disposition of public review comments
IPR policy compliance statements

[Target: 15-July] The submission document must be submitted to OASIS by the 15^th of the month
[Target: 1-August] OASIS will make the announcement of the TC's request for standardization of the committee spec by the 1^st of the month.
[Target: 15-August] Voting will commence by the 15^th of the month.
[Target: 31-August] Voting will complete at the end of the month.

Rob Philpott
RSA Security Inc.
The Most Trusted Name in e-Security
Tel: 781-515-7115
Mobile: 617-510-0893
Fax: 781-515-7020
mailto:rphilpott@rsasecurity.com

security-services message