IP address logging can be problematic, my company considers it to be PII to have the full IP (but not if you remove the last 3 digits). I wouldn't include that as a minimum. I also think it's weird to include SSO without including some form of opt-in 2FA. TOTP isn't all that difficult to implement if you are already storing passwords. Note also that I said opt-in so if 2FA is inconvenient, that is fine.
I also don't feel like all of the requirements should be the minimum. Good examples of minimum requirements are the redirect to TLS requirement. External pen testing is one of the requirements that feels like a nice to have rather than a minimum bar. Minimum standards should be stuff that if you don't do it, technically savvy people would be very concerned if someone uses your product. Stuff like lack of TLS, plain text passwords, lack of input sanitization, using an ancient web server, etc.
IP addresses can be uniquely identifying. I've had the same IP for years, it's static, and if you did a Google search for it a few years ago, you got straight to my full name and location (because that used to be on whois database for my domain names, which point at my IP; thankfully they no longer include that info in whois).
They don't meet the legal standard for identifying in the US so I think it's suspect to assume they are identifying in other contexts. I know some people will try.
Comments
IP address logging can be problematic, my company considers it to be PII to have the full IP (but not if you remove the last 3 digits). I wouldn't include that as a minimum. I also think it's weird to include SSO without including some form of opt-in 2FA. TOTP isn't all that difficult to implement if you are already storing passwords. Note also that I said opt-in so if 2FA is inconvenient, that is fine.
I also don't feel like all of the requirements should be the minimum. Good examples of minimum requirements are the redirect to TLS requirement. External pen testing is one of the requirements that feels like a nice to have rather than a minimum bar. Minimum standards should be stuff that if you don't do it, technically savvy people would be very concerned if someone uses your product. Stuff like lack of TLS, plain text passwords, lack of input sanitization, using an ancient web server, etc.
Why should anyone care what your company thinks?
IP addresses aren't uniquely identifying. I think GDPR only considers them PII with additional information, no?
IP addresses can be uniquely identifying. I've had the same IP for years, it's static, and if you did a Google search for it a few years ago, you got straight to my full name and location (because that used to be on whois database for my domain names, which point at my IP; thankfully they no longer include that info in whois).
They don't meet the legal standard for identifying in the US so I think it's suspect to assume they are identifying in other contexts. I know some people will try.
IPs are personal data.
see https://gdpr.eu/eu-gdpr-personal-data/ section "Identifiable individuals and identifiers"
IPv6 without privacy extensions is pretty close to uniquely identifying.