At a security standards summit this week, I had a discussion with a member of a USG agency (who is on this list) and a member of a very large software producer (who isn't on this list but someone else from that company is). It was suggested that we put a placeholder into ISO now for our work as a preemptive gesture to prevent duplication moving forward. OASIS does have a relatively easy path to ISO but it does take a long time and part of that is because we don't normally put such a placeholder in until after we are done creating the standard. Besides introducing delay, it allows for 'duplicative' work to flourish.
So one topic to discuss is to validate that we would eventually want to 'promote' out work "up' to ISO (as opposed to the ITU, or as opposed to just leaving it just in OASIS).
My personal opinion is this work is more within ISO scope than ITU scope - albeit there is work going on in Q4 of ITU-T SG17 already. IMHO we should alert ISO to our intent, get a placeholder, and then we (ie OASIS) should inform the ITU that the supply chain topic is broader than just telcom and the work rightly belongs in ISO (as fed by OASIS).
I propose this be a topic for discussion at our next meeting.
------------------------------
Duncan Sparrell
Chief Cyber Curmudgeion
sFractal Consulting LLC
Oakton VA
703-828-8646
------------------------------