Clear responsibilities.
Confidence in collective work.

A framework for independent technical cooperation and trusted information sharing.

ISAC for Identity and QTSP is an initiative to establish an independent, neutral international non-profit association under Belgian law (AISBL). The association is currently being formed.

The General Assembly decides membership matters. The Steering Committee directs technical work, while the Board manages the association and its finances.

The Committee sets technical priorities and coordinates the work programme.

The Committee adopts the annual Work Programme, prioritises activities, oversees Technical Groups and validates critical technical deliverables before adoption or external use.

Voting representation
Identity Document Issuers and National Cybersecurity Certification Authorities (NCCAs), based on the principle of one nation, one vote.

Technical participation
Technical Group Chairs, the Secretariat and invited experts contribute in nonvoting roles.

Membership authority

Approve the annual accounts, budget and membership fees. Review activities and decide matters reserved to members under the Statutes.

Corporate & financial oversight

Two to four Directors are elected by the Steering Committee for three years. The Board prepares accounts and budgets, represents the association and supervises the Secretariat. The President represents an Identity Document Issuer.

Technical development

Develop agreed work items, produce evidence and prepare technical deliverables. Groups can validate noncritical documents directly, with critical outputs submitted to the Steering Committee.

Attack Methods, the Attack Catalogue, the Attack Potential methodology and key interpretation or methodology decisions follow a common validation route.

Technical Groups prepare the evidence and technical outputs.

The Steering Committee reviews critical outputs and determines their publication and confidentiality level.

The ISAC adopts the validated technical baseline for common use.

Agreed Traffic Light Protocol markings and distribution rules define who may receive and use shared information. Confidentiality agreements apply where required.

A Code of Conduct and Terms of Reference for each Technical Group clarify responsibilities, contributions and how participants work together.

An Intellectual Property Rights Policy and Antitrust Guidelines provide a common framework for contributions, reuse and appropriate technical cooperation.