diff --git a/lib/list_all_entities_with_legacy_security_contact_csv.xsl b/lib/list_all_entities_with_legacy_security_contact_csv.xsl
index 46b4574..85aa617 100644
--- a/lib/list_all_entities_with_legacy_security_contact_csv.xsl
+++ b/lib/list_all_entities_with_legacy_security_contact_csv.xsl
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-	Copyright 2016 Internet2
+	Copyright 2016-2017 Internet2
 
 	Licensed under the Apache License, Version 2.0 (the "License");
 	you may not use this file except in compliance with the License.
@@ -21,13 +21,14 @@
 	entity descriptor containing a legacy security contact, and produces 
 	a CSV file with the following fields:
 	
-	  1. Organization Name: md:OrganizationName
-	  2. Display Name: mdui:DisplayName
+	  1. Organization Name: md:OrganizationName[@xml:lang='en']
+	  2. Display Name: mdui:DisplayName[@xml:lang='en']
 	  3. Entity ID: @entityID
 	  4. Role: "IdP" or "SP"
 	
 	Since all entities are registered by InCommon, all fields are nonempty
-	and well defined.
+	and well defined. In particular, every entity has an IdP role or an
+	SP role but not both.
 -->
 <xsl:stylesheet version="1.0"
 	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
@@ -49,60 +50,49 @@
 	  <xsl:apply-templates/>
 	</xsl:template>
 
-	<!-- match all IdP entity descriptors with a legacy security contact -->
+	<!-- match all entity descriptors with a legacy security contact -->
 	<xsl:template match="
-		//md:EntityDescriptor[md:IDPSSODescriptor][
+		/md:EntitiesDescriptor/md:EntityDescriptor[
 			md:ContactPerson[
-				@contactType = 'other' 
+				@contactType='other' 
 				and 
-				@icmd:contactType = 'http://id.incommon.org/metadata/contactType/security'
+				@icmd:contactType='http://id.incommon.org/metadata/contactType/security'
 			]
 		]">
 		
-		<!-- compute the normalized values of mdui:DisplayName and md:OrganizationName -->
-		<xsl:variable name="displayName" select="normalize-space(md:IDPSSODescriptor/md:Extensions/mdui:UIInfo/mdui:DisplayName[@xml:lang='en'])"/>
+		<!-- compute the normalized value of md:OrganizationName -->
 		<xsl:variable name="orgName" select="normalize-space(md:Organization/md:OrganizationName[@xml:lang='en'])"/>
 		
-		<!-- output md:OrganizationName or "NONE" -->
-		<xsl:choose>
-			<xsl:when test="$orgName != ''">
-				<!-- escape literal double quotes in md:OrganizationName -->
-				<xsl:variable name="escapedOrgName">
-					<xsl:call-template name="string-replace-all">
-						<xsl:with-param name="string" select="$orgName"/>
-						<xsl:with-param name="search" select="$double_quote"/>
-						<xsl:with-param name="replace" select="$double_double_quote"/>
-					</xsl:call-template>
-				</xsl:variable>
-				<xsl:text>"</xsl:text>
-				<xsl:value-of select="$escapedOrgName"/>
-				<xsl:text>"</xsl:text>
-			</xsl:when>
-			<xsl:otherwise>
-				<xsl:text>NONE</xsl:text>
-			</xsl:otherwise>
-		</xsl:choose>
+		<!-- escape literal double quotes in md:OrganizationName -->
+		<xsl:variable name="escapedOrgName">
+			<xsl:call-template name="string-replace-all">
+				<xsl:with-param name="string" select="$orgName"/>
+				<xsl:with-param name="search" select="$double_quote"/>
+				<xsl:with-param name="replace" select="$double_double_quote"/>
+			</xsl:call-template>
+		</xsl:variable>
+		
+		<!-- output md:OrganizationName -->
+		<xsl:text>"</xsl:text>
+		<xsl:value-of select="$escapedOrgName"/>
+		<xsl:text>"</xsl:text>
+		
+		<!-- compute the normalized value of mdui:DisplayName -->
+		<xsl:variable name="displayName" select="normalize-space(descendant::mdui:UIInfo/mdui:DisplayName[@xml:lang='en'])"/>
 
-		<!-- output mdui:DisplayName or "NONE" -->
-		<xsl:text>,</xsl:text>
-		<xsl:choose>
-			<xsl:when test="$displayName != ''">
-				<!-- escape literal double quotes in mdui:DisplayName -->
-				<xsl:variable name="escapedDisplayName">
-					<xsl:call-template name="string-replace-all">
-						<xsl:with-param name="string" select="$displayName"/>
-						<xsl:with-param name="search" select="$double_quote"/>
-						<xsl:with-param name="replace" select="$double_double_quote"/>
-					</xsl:call-template>
-				</xsl:variable>
-				<xsl:text>"</xsl:text>
-				<xsl:value-of select="$escapedDisplayName"/>
-				<xsl:text>"</xsl:text>
-			</xsl:when>
-			<xsl:otherwise>
-				<xsl:text>NONE</xsl:text>
-			</xsl:otherwise>
-		</xsl:choose>
+		<!-- escape literal double quotes in mdui:DisplayName -->
+		<xsl:variable name="escapedDisplayName">
+			<xsl:call-template name="string-replace-all">
+				<xsl:with-param name="string" select="$displayName"/>
+				<xsl:with-param name="search" select="$double_quote"/>
+				<xsl:with-param name="replace" select="$double_double_quote"/>
+			</xsl:call-template>
+		</xsl:variable>
+		
+		<!-- output mdui:DisplayName -->
+		<xsl:text>,"</xsl:text>
+		<xsl:value-of select="$escapedDisplayName"/>
+		<xsl:text>"</xsl:text>
 
 		<!-- output the entityID -->
 		<xsl:text>,</xsl:text>
@@ -110,73 +100,14 @@
 
 		<!-- output the role -->
 		<xsl:text>,</xsl:text>
-		<xsl:text>IdP</xsl:text>
-		
-		<xsl:text>&#x0a;</xsl:text>
-	</xsl:template>
-	
-	<!-- match all SP entity descriptors with a legacy security contact -->
-	<xsl:template match="
-		//md:EntityDescriptor[md:SPSSODescriptor][
-			md:ContactPerson[
-				@contactType = 'other' 
-				and 
-				@icmd:contactType = 'http://id.incommon.org/metadata/contactType/security'
-			]
-		]">
-		
-		<!-- compute the normalized values of mdui:DisplayName and md:OrganizationName -->
-		<xsl:variable name="displayName" select="normalize-space(md:SPSSODescriptor/md:Extensions/mdui:UIInfo/mdui:DisplayName[@xml:lang='en'])"/>
-		<xsl:variable name="orgName" select="normalize-space(md:Organization/md:OrganizationName[@xml:lang='en'])"/>
-		
-		<!-- output md:OrganizationName or "NONE" -->
 		<xsl:choose>
-			<xsl:when test="$orgName != ''">
-				<!-- escape literal double quotes in md:OrganizationName -->
-				<xsl:variable name="escapedOrgName">
-					<xsl:call-template name="string-replace-all">
-						<xsl:with-param name="string" select="$orgName"/>
-						<xsl:with-param name="search" select="$double_quote"/>
-						<xsl:with-param name="replace" select="$double_double_quote"/>
-					</xsl:call-template>
-				</xsl:variable>
-				<xsl:text>"</xsl:text>
-				<xsl:value-of select="$escapedOrgName"/>
-				<xsl:text>"</xsl:text>
+			<xsl:when test="md:IDPSSODescriptor">
+				<xsl:text>IdP</xsl:text>
 			</xsl:when>
-			<xsl:otherwise>
-				<xsl:text>NONE</xsl:text>
-			</xsl:otherwise>
-		</xsl:choose>
-
-		<!-- output mdui:DisplayName or "NONE" -->
-		<xsl:text>,</xsl:text>
-		<xsl:choose>
-			<xsl:when test="$displayName != ''">
-				<!-- escape literal double quotes in mdui:DisplayName -->
-				<xsl:variable name="escapedDisplayName">
-					<xsl:call-template name="string-replace-all">
-						<xsl:with-param name="string" select="$displayName"/>
-						<xsl:with-param name="search" select="$double_quote"/>
-						<xsl:with-param name="replace" select="$double_double_quote"/>
-					</xsl:call-template>
-				</xsl:variable>
-				<xsl:text>"</xsl:text>
-				<xsl:value-of select="$escapedDisplayName"/>
-				<xsl:text>"</xsl:text>
+			<xsl:when test="md:SPSSODescriptor">
+				<xsl:text>SP</xsl:text>
 			</xsl:when>
-			<xsl:otherwise>
-				<xsl:text>NONE</xsl:text>
-			</xsl:otherwise>
 		</xsl:choose>
-
-		<!-- output the entityID -->
-		<xsl:text>,</xsl:text>
-		<xsl:value-of select="@entityID"/>
-
-		<!-- output the role -->
-		<xsl:text>,</xsl:text>
-		<xsl:text>SP</xsl:text>
 		
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>