re: Point of order re: Internet Security Guidelines I-D

[Craig Partridge <[e-mail]>]

Steve:
    
    OK - here's my two cents for spwg.  (Note that I don't have time to
actively get involved in spwg, and thus have not joined the mailing list.
I'm asking that folks keep me on the cc: list for any follow up on this
particular topic).

    Following up on my note to Steve and his reply.  I believe that any
guidelines that expect individuals to conform to a set of policies should
also contain explicit requirements that the policies be conveyed to the
the individuals.  And I don't think putting the requirement that organizations
circulate their policies in a Appendix, while placing the requirement on
users in the main text is appropriate.  It suggests that notification is
less important than conformance -- I don't believe conformance can be
achieved without proper notification.  I also believe that requiring
conformance without giving notification is fundamentally unfair.

Thanks!

Craig