Home / Dated plan
The dated plan
Seven steps, from the inventory to the post-publication re-test. The dates run from 21 October 2026 and end at the outer planning date of 16 September 2027, which is 330 days away. Each step names the clauses it closes and the artefact that proves it.
Seven steps | 330 days to the outer date | 103 evidence artefacts in the register
| When | What | Clauses | Artefact |
|---|---|---|---|
| Now to 4 November 2026 | Inventory the mechanism set List every entity authentication mechanism you run, its family, its parameter set and the evidence you hold. Name an owner per row. | Clause 1, Clauses 4 to 9 | A mechanism inventory with four columns and an owner per row. |
| Two weeks to 18 November 2026 | Place each mechanism in its family Decide which of the five families each row belongs to, and record why. The family fixes the parameter guidance and the verifier test. | Introduction, Clauses 4 to 9 | A family field on every inventory row, with a reason. |
| Four weeks to 2 December 2026 | Review the parameters Take the modulus, group, curve or key size and the challenge length, and record the constraint that fixed each one against Annex C. | Annex C | A parameter table with a constraint and a date per value. |
| Six weeks to 16 December 2026 | Test the verifier rejections Add the negative cases: wrong key, wrong challenge, replayed response, and for elliptic curves a point that is not on the curve. | 4.3, 5.3, 6.3, 7.3, 8.2, 8.3, 9.3 | A test log with the negative cases per verifier. |
| Eight weeks to 30 December 2026 | Close the identifier and evidence work Inventory every object identifier you emit or parse, and assemble the evidence file with a pointer on every row. | Annex A, Annex D | An identifier inventory and an evidence index. |
| Before the outer date to 16 September 2027 | Publication check Re-read the published fourth edition against this record and the register. Update the rows whose wording changed and re-issue the plan. | The whole record | A dated reconciliation note and an updated register. |
| After publication to 16 October 2027 | Re-test and re-brief Re-run the verifier tests against the published text, and brief the risk committee on what moved. | All clauses and annexes | A test run, a committee note and a closed action list. |
Why the first step is the inventory
Every other step depends on it. A family placement needs the mechanism. A parameter review needs the mechanism and its parameters. A verifier test needs the verifier. An identifier inventory needs the places that emit or parse an identifier. An estate that starts with a family decision and works backwards spends the first month on a pilot that cannot be scoped.
Put the publication check on the risk agenda as a quarter
The publication check is small enough to take in one meeting and large enough to need a quarter against it if the revision moves a parameter. Record the target quarter next to the identity and access work, so that a later reader can see when the choice was made and what it displaced.
What the plan does not promise
It does not promise that the published text will match the draft word for word. It does not promise a certification, because there is none for this standard. And it does not promise that a date is a legal deadline, because the new edition binds nobody unless something points at it.