...

"Outgoing" SPs that SURFnet publishes (in eduGAIN) should be handled individually. A commercial SP like Edugroepen should probably list its own direct contact information and check compliance with the framework. SPs that are run by SURFnet itself may similarly decide on what the most appropriate contact point is. We can republish such information from the SPs metadata feed.

Implementation

•  Discuss within SURFconext team
•  Discuss with SURFcert
•  Discuss with key users
•  Make some basic documentation on SURFcert wikiwespje
•  Update SURFconext wiki to list Sirtfi contact info
•  Inform CSIRTS about expectations re incident handling of federated infra e.g. via SCIRT. Maybe item at SCIRT meeting?
•  Publish contact info and assertions for IdPs; inform IdPs about Sirtfi
•  Inform SPs and ask them to provide Sirtfi information in their metadata fields; republish if present
•  Change serviceregistry to accept incoming Sirtfi information.

...