**FPKI CPWG Medium Requirements Mapping Matrix**

**Federal Bridge Certification Authority (FBCA) CP**

**and the**

**\<Entity\> CP**

**For cross certification at the**

**Medium Level of Assurance**

Version 1.1 DD Month YYYY

**Table of Contents**

[1 INTRODUCTION 3](#introduction)

[2 BRIEF ASSESSMENT 4](#brief-assessment)

[3 DETAILED ASSESSMENT 6](#detailed-assessment)

[4 REFERENCES 17](#references)

[5 CONTACT DETAILS 17](#contact-details)

#  {#section .unnumbered}

#  {#section-1 .unnumbered}

#   {#section-2 .unnumbered}

# **INTRODUCTION**

The purposes, in relation to the comparison study conducted with the
\<Entity\> CP \[2\] and the FBCA CP \[3\], are:

> 1\) To identify at a high-level the areas of similarity between the
> contents of these two Certificate Policy (CP) documents; and
>
> 2\) To recommend appropriate changes to the \<Entity\> CP \[2\] that
> would make it more comparable with the FBCA CP \[3\].

The set of FBCA CP Medium Requirements found in the tables in this
document are the requirements unique to the Medium Level of Assurance
for cross certification with the FBCA. These requirements work in tandem
with the FBCA CP non-assurance level specific requirements contained in
the FPKI CPWG General Requirements Mapping Matrix \[4\], to provide all
the necessary FBCA CP requirements for evaluation of the \<Entity\> CP
at the Medium assurance level.

This document is organized to achieve these purposes in the following
sections:

1)  [***BRIEF ASSESSMENT***](#brief-assessment) \-\-- a summary table
    that provides a quick referencing listing of the results found in
    the [*DETAILED ASSESSMENT*](#detailed-assessment) tables for each
    \<Entity\> CP section compared to the FBCA CP; and

2)  [***DETAILED ASSESSMENT***](#detailed-assessment) \-\-- a detailed,
    section by section breakdown of the Medium Requirements in the FBCA
    CP, categorizing the degree of similarity of the \<Entity\> CP to
    the FBCA CP. Comments to explain the rationale for the degree of
    similarity and recommended changes for the \<Entity\> CP are also
    provided, where necessary. The topical and organizational framework
    used as a basis for this comparison is Request for Comments (RFC)
    2527, the Internet X.509 Public Key Infrastructure Certificate
    Policy and Certification Practices Framework \[1\].

#   {#section-3 .unnumbered}

# **BRIEF ASSESSMENT**

This section of the report contains the Brief Assessment table, a
summary list of how well the \<Entity\> CP \[2\] was evaluated against
the FBCA CP \[3\] for the FBCA requirements that are considered
associated with the Medium Level of Assurance. The policy comparison
results in the Brief Assessment summary table are identical to the
results in the [DETAILED ASSESSMENT](#DETAILEDASSESSMENT) tables. The
policy comparison results from this *[FPKI CPWG Medium Requirements
Mapping Matrix]{.underline}* in conjunction with the [*FPKI CPWG*
*General Requirements Mapping Matrix*]{.underline} \[4\], determine if
the \<Entity\> CP is comparable with the FBCA CP for cross certification
with the FBCA at the Medium Level of Assurance.

The Brief Assessment table contains five columns described as follows:

1)  **Table \#** - identifies the number of all the tables in this
    matrix, grouped by Section Topic.

2)  **FBCA Section** -- identifies the section numbers for FBCA CP
    requirements in the matrix.

3)  **\<Entity\> Section** -- identifies the section numbers for
    \<Entity\> CP text in the matrix.

4)  **Section Topic** -- identifies the FBCA CP section titles
    corresponding to the section numbers.

> 5\) **Evaluation Summary --** displays the corresponding evaluation
> result, which indicates the "Overall Match" from that particular table
> in the DETAILED ASSESSMENT.

The following seven evaluation terms and their definitions, listed in
order of degree of conformity, were used to assess the \<Entity\>CP
similarity to the FBCA CP elements:

1)  **EXCEEDS** - The \<Entity\> CP provides a higher level of
    assurance/security than the FBCA CP requirement

2)  **EQUIVALENT** - The \<Entity\> CP policy provides exactly the same
    policy text and assurance/security as the FBCA CP requirement.

3)  **COMPARABLE** - The \<Entity\> CP contains dissimilar policy
    contents, but provides a comparable assurance level/security as the
    FBCA CP requirement.

4)  **PARTIAL** - The \<Entity\> CP contains some policy that is
    comparable to the FBCA CP, but it does not address the entire FBCA
    CP requirement.

5)  **NOT COMPARABLE** - The \<Entity\> CP contains dissimilar policy
    contents, which provides a lower level of assurance/security than
    the FBCA CP requirement.

6)  **MISSING** - The \<Entity\> CP does not contain policy contents
    that can be compared to the FBCA CP requirement in any way.

> 7\) **N/A** -- The FBCA CP requirement is **Not Applicable** to the
> \<Entity\> CP or its associated PKI implementation.

MEDIUM LEVEL OF ASSURANCE MAPPING RESULTS

+----+------+-------+----------------------------------+-------------+
| *  | **   | \<Ent | **Section Topic**                | *           |
| *T | FBCA | ity\> |                                  | *Evaluation |
| ab | S    |       |                                  | Summary**   |
| le | ecti | *     |                                  |             |
| \# | on** | *Sect |                                  |             |
| ** |      | ion** |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 1  |      |       | **[INTRODUCTION]{.mark}**        |             |
| \. |      |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 1  | 1.2  |       | Identification                   |             |
+----+------+-------+----------------------------------+-------------+
| 2  |      |       | **[GENERAL PROVISIONS]{.mark}**  |             |
| \. |      |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 2  | 2    |       | Frequency of Entity Compliance   |             |
|    | .7.1 |       | Audit                            |             |
+----+------+-------+----------------------------------+-------------+
| 3  |      |       | **[IDENTIFICATION AND            |             |
| \. |      |       | AUTHENTICATION]{.mark}**         |             |
+----+------+-------+----------------------------------+-------------+
| 3  | 3    |       | Types of names                   |             |
|    | .1.1 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 4  | 3    |       | Need for names to be meaningful  |             |
|    | .1.2 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 5  | 3    |       | Method to prove possession of    |             |
|    | .1.7 |       | private key                      |             |
+----+------+-------+----------------------------------+-------------+
| 6  | 3    |       | Authentication of individual     |             |
|    | .1.9 |       | identity                         |             |
+----+------+-------+----------------------------------+-------------+
| 7  | 3    |       | Certificate Re-key               |             |
|    | .2.1 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 4  |      |       | **[OPERATIONAL                   |             |
| \. |      |       | REQUIREMENTS]{.mark}**           |             |
+----+------+-------+----------------------------------+-------------+
| 8  | 4    |       | Delivery of public key for       |             |
|    | .1.1 |       | certificate issuance             |             |
+----+------+-------+----------------------------------+-------------+
| 9  | 4.3  |       | Certificate Acceptance           |             |
+----+------+-------+----------------------------------+-------------+
| 10 | 4.4  |       | CARL/CRL Issuance Frequency      |             |
|    | .3.1 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 11 | 4.5  |       | Security Audit Procedure         |             |
+----+------+-------+----------------------------------+-------------+
| 12 | 4    |       | Frequency of processing data     |             |
|    | .5.2 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 13 | 4    |       | Types of events archived         |             |
|    | .6.1 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 14 | 4    |       | Retention period for archive     |             |
|    | .6.2 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 5  |      |       | **[PHYSICAL, PROCEDURAL AND      |             |
| \. |      |       | PERSONNEL SECURITY               |             |
|    |      |       | CONTROLS]{.mark}**               |             |
+----+------+-------+----------------------------------+-------------+
| 15 | 5    |       | Physical access                  |             |
|    | .1.2 |       |                                  |             |
| 16 |      |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 17 | 5    |       | Electrical Power                 |             |
|    | .1.3 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 18 | 5    |       | Off-site backup                  |             |
|    | .1.8 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 19 | 5    |       | Separation of Roles              |             |
|    | .2.2 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 20 | 5    |       | Identification and               |             |
|    | .2.4 |       | authentication for each role     |             |
+----+------+-------+----------------------------------+-------------+
| 21 | 5    |       | Background, qualifications,      |             |
|    | .3.1 |       | experience, and security         |             |
|    |      |       | clearance requirements           |             |
+----+------+-------+----------------------------------+-------------+
| 6  |      |       | **[TECHNICAL SECURITY            |             |
| \. |      |       | CONTROLS]{.mark}**               |             |
+----+------+-------+----------------------------------+-------------+
| 2  | 6    |       | FBCA and CA key pair generation  |             |
| 2- | .1.1 |       |                                  |             |
| 23 |      |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 24 | 6    |       | Hardware/Software Subscriber key |             |
|    | .1.8 |       | generation                       |             |
+----+------+-------+----------------------------------+-------------+
| 25 | 6    |       | Key usage purposes (as per X.509 |             |
|    | .1.9 |       | v3 key usage field)              |             |
+----+------+-------+----------------------------------+-------------+
| 26 | 6    |       | Standards for cryptographic      |             |
|    | .2.1 |       | module                           |             |
+----+------+-------+----------------------------------+-------------+
| 27 | 6.2  |       | Backup of subscriber private     |             |
|    | .4.2 |       | signature key                    |             |
+----+------+-------+----------------------------------+-------------+
| 28 | 6.3  |       | Good Practices Regarding         |             |
|    |      |       | Key-Pair Management              |             |
+----+------+-------+----------------------------------+-------------+
| 29 | 6    |       | Activation data generation and   |             |
|    | .4.1 |       | installation                     |             |
+----+------+-------+----------------------------------+-------------+
| 30 | 6    |       | System development controls      |             |
|    | .6.1 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+
| 7  |      |       | **CERTIFICATE AND CARL/CRL       |             |
| \. |      |       | PROFILES**                       |             |
+----+------+-------+----------------------------------+-------------+
| 31 | 7    |       | Certificate Extensions           |             |
|    | .1.2 |       |                                  |             |
+----+------+-------+----------------------------------+-------------+

# **DETAILED ASSESSMENT**

This section of the report presents the detailed mapping results of the
\<Entity\> CP compared to the FBCA CP. The mapping comparison is
characterized using the same evaluation terms defined in the [BRIEF
ASSESSMENT](#BRIEFASSESSMENT).

The detailed mapping results show the FBCA CP sections and requirements
that are to be mapped, the \<Entity\> CP section(s) and appropriate
applicable policy text, the evaluation result for each requirement
element addressed by the \<Entity\> CP, as well as the evaluation
comments. By default, the evaluation results listed in the "Overall
Match" field indicates the *lowest* evaluation rating when multiple
policy elements from the \<Entity\> CP are mapped to a particular FBCA
CP requirement.

+-------+-------------+------------------------------------------------+
| Table | **CP        | Mapping Phrase                                 |
| No.   | Section**   |                                                |
+=======+=============+================================================+
| 1.    | FBCA:       | The OIDs are registered under the id-infosec   |
|       |             | arc as follows:                                |
|       | **1.2**     |                                                |
|       |             | id-fpki-certpcy-mediumAssurance                |
|       |             |                                                |
|       |             | ::= fbca-policies 3                            |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 2.    | FBCA:       | The FBCA, Entity Principal CAs and RAs and     |
|       |             | their subordinate CAs and RAs shall be subject |
|       | **2.7.1**   | to a periodic compliance audit which is no     |
|       |             | less frequent than once per year for High and  |
|       |             | Medium Assurance, and no less than once every  |
|       |             | two years for Basic Assurance.                 |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 3.    | FBCA:       | The table below describes the naming           |
|       |             | requirements that apply to each level of       |
|       | **3.1.1**   | assurance.                                     |
|       |             |                                                |
|       |             | Medium -- X.500 Distinguished Name, and        |
|       |             | optional Alternative Subject Name if marked    |
|       |             | non-critical                                   |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 4.    | FBCA:       | All certificates issued by the FBCA at the     |
|       |             | Medium or High Assurance levels shall have     |
|       | **3.1.2**   | name constraints asserted that limit the name  |
|       |             | space of the Principal CAs to that appropriate |
|       |             | for their domains.                             |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 5.    | FBCA:       | For all assurance levels, when keyed hardware  |
|       |             | tokens are delivered to certificate subjects,  |
|       | **3.1.7**   | the delivery shall be accomplished in a way    |
|       |             | that ensures that the correct tokens and       |
|       |             | activation data are provided to the correct    |
|       |             | subjects.                                      |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 6.    | FBCA:       | The table below summarizes the identification  |
|       |             | requirements for each level of assurance.      |
|       | **3.1.9**   |                                                |
|       |             | Medium - Identity shall be established by      |
|       |             | in-person proofing before the Registration     |
|       |             | Authority, Trusted Agent or an entity          |
|       |             | certified by a State or Federal Entity as      |
|       |             | being authorized to confirm identities;        |
|       |             | information provided shall be verified to      |
|       |             | ensure legitimacy. A trust relationship        |
|       |             | between the Trusted Agent and the applicant    |
|       |             | which is based on an in-person antecedent may  |
|       |             | suffice as meeting the in-person identity      |
|       |             | proofing requirement. Credentials required are |
|       |             | either one Federal Government-issued Picture   |
|       |             | I.D., or two Non-Federal Government I.D.s, one |
|       |             | of which shall be a photo I.D. (e.g., Drivers  |
|       |             | License)                                       |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 7.    | FBCA:       | Subscribers of Entity CAs shall identify       |
|       |             | themselves for the purpose of re-keying as     |
|       | **3.2.1**   | required in table below.                       |
|       |             |                                                |
|       |             | Medium - Identity may be established through   |
|       |             | use of current signature key, except that      |
|       |             | identity shall be established through initial  |
|       |             | registration process at least once every nine  |
|       |             | years from the time of initial registration    |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 8.    | FBCA:       | For all levels of assurance, this binding may  |
|       |             | be accomplished using cryptography. If         |
|       | **4.1.1**   | cryptography is used, it must be at least as   |
|       |             | strong as that employed in certificate         |
|       |             | issuance.                                      |
|       |             |                                                |
|       |             | Additionally, for Medium and Basic Assurance,  |
|       |             | this binding may also be accomplished using    |
|       |             | non-cryptographic physical and procedural      |
|       |             | mechanisms. These mechanisms may include, but  |
|       |             | are not limited to, floppy disk (or other      |
|       |             | storage medium) sent via registered mail or    |
|       |             | courier, or by delivery of a hardware or       |
|       |             | software token to a certificate issuer for     |
|       |             | local key generation at the point of           |
|       |             | certificate issuance or request.               |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+
| 9.    | FBCA:       | For Medium and High Assurance levels, a        |
|       |             | Subscriber shall be required to sign a         |
|       | **4.3**     | document containing the requirements the       |
|       |             | Subscriber shall meet respecting protection of |
|       |             | the private key and use of the certificate     |
|       |             | before being issued the certificate.           |
+-------+-------------+------------------------------------------------+
|       | \<Entity\>: |                                                |
+-------+-------------+------------------------------------------------+
|       | [Overall    | Comments:                                      |
|       | Mat         |                                                |
|       | ch:]{.mark} |                                                |
+-------+-------------+------------------------------------------------+

+------+---+-------------+------------------------------------------------+
| **T  |   | **CP        | **Mapping Phrase**                             |
| able |   | Section**   |                                                |
| N    |   |             |                                                |
| o.** |   |             |                                                |
+------+---+-------------+------------------------------------------------+
| 10.  |   | FBCA:       | The following table provides CARL/CRL issuance |
|      |   |             | requirements.                                  |
|      |   | **4.4.3.1** |                                                |
|      |   |             | [Medium]{.underline}                           |
|      |   |             |                                                |
|      |   |             | (Routine) = At Least Once Each Day             |
|      |   |             |                                                |
|      |   |             | (Loss or Compromise of Private Key) = Within   |
|      |   |             | 18 Hours of Notification                       |
+------+---+-------------+------------------------------------------------+
|      |   | \<Entity\>: |                                                |
+------+---+-------------+------------------------------------------------+
|      |   | [Overall    | Comments:                                      |
|      |   | Mat         |                                                |
|      |   | ch:]{.mark} |                                                |
+------+---+-------------+------------------------------------------------+
| 11.  |   | FBCA:       | Auditing capabilities are as set forth in the  |
|      |   |             | table below. \[SEE END OF DOCUMENT\]           |
|      |   | **4.5**     |                                                |
+------+---+-------------+------------------------------------------------+
|      |   | \<Entity\>: |                                                |
+------+---+-------------+------------------------------------------------+
|      |   | Overall     | Comments:                                      |
|      |   | Match:      |                                                |
+------+---+-------------+------------------------------------------------+
| 12.  |   | FBCA:       | Medium - At least once every two months        |
|      |   |             |                                                |
|      |   | **4.5.2**   | Statistically significant set of security      |
|      |   |             | audit data generated by Entity CAs since the   |
|      |   |             | last review shall be examined (where the       |
|      |   |             | confidence intervals for each category of      |
|      |   |             | security audit data are determined by the      |
|      |   |             | security ramifications of the category and the |
|      |   |             | availability of tools to perform such a        |
|      |   |             | review), as well as a reasonable search for    |
|      |   |             | any evidence of malicious activity             |
+------+---+-------------+------------------------------------------------+
|      |   | \<Entity\>: |                                                |
+------+---+-------------+------------------------------------------------+
|      |   | [Overall    | Comments:                                      |
|      |   | Mat         |                                                |
|      |   | ch:]{.mark} |                                                |
+------+---+-------------+------------------------------------------------+
| 13.  | F |             | At a minimum, the following data shall be      |
|      | B |             | recorded for archive in accordance with each   |
|      | C |             | assurance level (requirements for Test         |
|      | A |             | Assurance shall be set forth in the MOA):      |
|      | : |             |                                                |
|      |   |             | \- FBCA or Entity CA accreditation (if         |
|      | * |             | applicable)                                    |
|      | * |             |                                                |
|      | 4 |             | -   Certification Practice Statement           |
|      | . |             |                                                |
|      | 6 |             | -   Contractual obligations                    |
|      | . |             |                                                |
|      | 1 |             | -   System and equipment configuration         |
|      | * |             |                                                |
|      | * |             | -   Modifications and updates to system or     |
|      |   |             |     configuration                              |
|      |   |             |                                                |
|      |   |             | -   Certificate requests                       |
|      |   |             |                                                |
|      |   |             | -   Revocation requests                        |
|      |   |             |                                                |
|      |   |             | -   Subscriber Identity Authentication data as |
|      |   |             |     per Section 3.1.9                          |
|      |   |             |                                                |
|      |   |             | -   Documentation of receipt and acceptance of |
|      |   |             |     certificates                               |
|      |   |             |                                                |
|      |   |             | -   Documentation of receipt of tokens         |
|      |   |             |                                                |
|      |   |             | -   All certificates issued or published       |
|      |   |             |                                                |
|      |   |             | -   Record of FBCA or Entity CA Re-key         |
|      |   |             |                                                |
|      |   |             | -   All CARLs and CRLs issued and/or published |
|      |   |             |                                                |
|      |   |             | -   All Audit Logs                             |
|      |   |             |                                                |
|      |   |             | -   Other data or applications to verify       |
|      |   |             |     archive contents                           |
|      |   |             |                                                |
|      |   |             | -   Documentation required by compliance       |
|      |   |             |     auditors                                   |
+------+---+-------------+------------------------------------------------+
|      | \ |             |                                                |
|      | < |             |                                                |
|      | E |             |                                                |
|      | n |             |                                                |
|      | t |             |                                                |
|      | i |             |                                                |
|      | t |             |                                                |
|      | y |             |                                                |
|      | \ |             |                                                |
|      | > |             |                                                |
|      | : |             |                                                |
+------+---+-------------+------------------------------------------------+
|      | [ |             | Comments:                                      |
|      | O |             |                                                |
|      | v |             |                                                |
|      | e |             |                                                |
|      | r |             |                                                |
|      | a |             |                                                |
|      | l |             |                                                |
|      | l |             |                                                |
|      | M |             |                                                |
|      | a |             |                                                |
|      | t |             |                                                |
|      | c |             |                                                |
|      | h |             |                                                |
|      | : |             |                                                |
|      | ] |             |                                                |
|      | { |             |                                                |
|      | . |             |                                                |
|      | m |             |                                                |
|      | a |             |                                                |
|      | r |             |                                                |
|      | k |             |                                                |
|      | } |             |                                                |
+------+---+-------------+------------------------------------------------+
| 14.  | F |             | The minimum retention periods for archive data |
|      | B |             | are identified below.                          |
|      | C |             |                                                |
|      | A |             | Medium - 10 Years & 6 Months                   |
|      | : |             |                                                |
|      |   |             |                                                |
|      | * |             |                                                |
|      | * |             |                                                |
|      | 4 |             |                                                |
|      | . |             |                                                |
|      | 6 |             |                                                |
|      | . |             |                                                |
|      | 2 |             |                                                |
|      | * |             |                                                |
|      | * |             |                                                |
+------+---+-------------+------------------------------------------------+
|      | \ |             |                                                |
|      | < |             |                                                |
|      | E |             |                                                |
|      | n |             |                                                |
|      | t |             |                                                |
|      | i |             |                                                |
|      | t |             |                                                |
|      | y |             |                                                |
|      | \ |             |                                                |
|      | > |             |                                                |
|      | : |             |                                                |
+------+---+-------------+------------------------------------------------+
|      | [ |             | Comments:                                      |
|      | O |             |                                                |
|      | v |             |                                                |
|      | e |             |                                                |
|      | r |             |                                                |
|      | a |             |                                                |
|      | l |             |                                                |
|      | l |             |                                                |
|      | M |             |                                                |
|      | a |             |                                                |
|      | t |             |                                                |
|      | c |             |                                                |
|      | h |             |                                                |
|      | : |             |                                                |
|      | ] |             |                                                |
|      | { |             |                                                |
|      | . |             |                                                |
|      | m |             |                                                |
|      | a |             |                                                |
|      | r |             |                                                |
|      | k |             |                                                |
|      | } |             |                                                |
+------+---+-------------+------------------------------------------------+

+------+--------------+------------------------------------------------+
| **T  | **CP         | **Mapping Phrase**                             |
| able | Section**    |                                                |
| N    |              |                                                |
| o.** |              |                                                |
+------+--------------+------------------------------------------------+
| 15.  | FBCA:        | In addition to those requirements, the         |
|      |              | following requirements shall apply to CAs that |
|      | **5.1.2**    | issue Medium or High assurance certificates:   |
|      |              |                                                |
|      |              | -   Be manually or electronically monitored    |
|      |              |     for unauthorized intrusion at all times    |
|      |              |                                                |
|      |              | -   Ensure an access log is maintained and     |
|      |              |     inspected periodically                     |
|      |              |                                                |
|      |              | -   Require two-person physical access control |
|      |              |     to both the cryptographic module and       |
|      |              |     computer system                            |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 16.  | FBCA:        | A security check of the facility housing the   |
|      |              | FBCA or Entity CA equipment (operating at the  |
|      | **5.1.2**    | Basic Assurance level or higher) shall occur   |
|      |              | if the facility is to be left unattended. At a |
|      |              | minimum, the check shall verify the following: |
|      |              |                                                |
|      |              | -   The equipment is in a state appropriate to |
|      |              |     the current mode of operation (e.g., that  |
|      |              |     cryptographic modules are in place when    |
|      |              |     "open", and secured when "closed"; and for |
|      |              |     the FBCA, that all equipment other than    |
|      |              |     the repository is shut down);              |
|      |              |                                                |
|      |              | -   Any security containers are properly       |
|      |              |     secured;                                   |
|      |              |                                                |
|      |              | -   Physical security systems (e.g., door      |
|      |              |     locks, vent covers) are functioning        |
|      |              |     properly; and                              |
|      |              |                                                |
|      |              | -   The area is secured against unauthorized   |
|      |              |     access.                                    |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 17.  | FBCA:        | The FBCA and Entity CAs (operating at the      |
|      |              | Basic Assurance level or higher) shall have    |
|      | **5.1.3**    | backup capability sufficient to automatically  |
|      |              | lockout input, finish any pending actions, and |
|      |              | record the state of the equipment before lack  |
|      |              | of power or air conditioning causes a          |
|      |              | shutdown.                                      |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 18.  | FBCA:        | For the FBCA and Entity CAs (operating at the  |
|      |              | Basic Assurance level or higher), full system  |
|      | **5.1.8**    | backups, sufficient to recover from system     |
|      |              | failure, shall be made on a periodic schedule, |
|      |              | described in the respective CPS.               |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 19.  | FBCA:        | The separation of roles for the FBCA and       |
|      |              | Entity CAs shall be as follows:                |
|      | **5.2.2**    |                                                |
|      |              | Medium - Individual CA personnel shall be      |
|      |              | specifically designated to the four roles      |
|      |              | defined in Section 5.2.1 above. Individuals    |
|      |              | may assume more than one role, however,        |
|      |              | individuals who assume an Officer role may not |
|      |              | assume an Administrator or Auditor role. The   |
|      |              | CA system shall identify and authenticate its  |
|      |              | users and shall ensure that no user identity   |
|      |              | can assume both an Administrator and an        |
|      |              | Officer role, or an Auditor and an Officer     |
|      |              | role. No individual shall be assigned more     |
|      |              | than one identity.                             |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+

+------+--------------+------------------------------------------------+
| **T  | **CP         | **Mapping Phrase**                             |
| able | Section**    |                                                |
| N    |              |                                                |
| o.** |              |                                                |
+------+--------------+------------------------------------------------+
| 20.  | FBCA:        | At all assurance levels other than             |
|      |              | Rudimentary, an individual shall identify and  |
|      | **5.2.4**    | authenticate him/herself before being          |
|      |              | permitted to perform any actions set forth     |
|      |              | above for that role or identity.               |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 21.  | FBCA:        | For PKIs operated at Medium Assurance or       |
|      |              | MediumHW Assurance, all trusted roles must be  |
|      | **5.3.1**    | held by citizens of the country where the CA   |
|      |              | is located.                                    |
|      |              |                                                |
|      |              | Where an entity PKI operated at High Assurance |
|      |              | or Medium Assurance is affiliated with RAs     |
|      |              | operated overseas, RA personnel holding        |
|      |              | trusted roles may be local citizens of the     |
|      |              | country where the RA is located or of the      |
|      |              | country where the CA is located.               |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 22.  | FBCA:        | Cryptographic keying material for certificates |
|      |              | issued by the FBCA or Entity CAs shall be      |
|      | **6.1.1**    | generated in FIPS 140 validated cryptographic  |
|      |              | modules. For Entity CAs, the modules shall     |
|      |              | meet or exceed Security Level 1 (for           |
|      |              | Rudimentary), Security Level 2 (for Basic or   |
|      |              | Medium), or Security Level 3 (for High).       |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 23.  | FBCA:        | The FBCA and Entity CAs must document their    |
|      |              | key generation procedure in their CPSs, and    |
|      | **6.1.1**    | generate auditable evidence that the           |
|      |              | documented procedures were followed. For all   |
|      |              | levels of assurance, the documentation of the  |
|      |              | procedure must be detailed enough to show that |
|      |              | appropriate role separation was used. For High |
|      |              | and Medium Assurance the process shall be      |
|      |              | validated by an independent third party.       |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 24.  | FBCA:        | Any pseudo-random numbers used for key         |
|      |              | generation material shall be generated by a    |
|      | **6.1.8**    | FIPS approved method.                          |
|      |              |                                                |
|      |              | Medium -- Software or Hardware                 |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 25.  | FBCA:        | Test, Rudimentary, Basic and Medium Assurance  |
|      |              | Level certificates may include a single key    |
|      | **6.1.9**    | for use with encryption and signature in       |
|      |              | support of legacy Secure Multipurpose Internet |
|      |              | Mail Extensions (S/MIME) applications.         |
|      |              |                                                |
|      |              | Such "dual-use" certificates shall be          |
|      |              | generated and managed in accordance with their |
|      |              | respective signature certificate requirements, |
|      |              | except where otherwise noted in this CP. Such  |
|      |              | "dual-use" certificates shall never assert the |
|      |              | non-repudiation key usage bit, and shall not   |
|      |              | be used for authenticating data that will be   |
|      |              | verified on the basis of the dual-use          |
|      |              | certificate at a future time.                  |
|      |              |                                                |
|      |              | Entities are encouraged at all levels of       |
|      |              | assurance to issue Subscribers two key pairs,  |
|      |              | one for data encryption and one for digital    |
|      |              | signature and authentication.                  |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 26.  | FBCA:        | The table below summarizes the minimum         |
|      |              | requirements for cryptographic modules; higher |
|      | **6.2.1**    | levels may be used.                            |
|      |              |                                                |
|      |              | [Medium]{.underline}                           |
|      |              |                                                |
|      |              | Latest version of FIPS 140 series - Required   |
|      |              |                                                |
|      |              | Federal Bridge Certification Authority - Level |
|      |              | 3 (Hardware)                                   |
|      |              |                                                |
|      |              | Certification Authority - Level 2 (Hardware)   |
|      |              |                                                |
|      |              | Subscriber -- Level 1 (Hardware or Software)   |
|      |              |                                                |
|      |              | Registration Authority - Level 2 (Hardware)    |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 27.  | FBCA:        | Subscriber private signature keys whose        |
|      |              | corresponding public key is contained in a     |
|      | **6.2.4.2**  | certificate asserting the FBCA                 |
|      |              | mediumAssurance, basicAssurance, or            |
|      |              |                                                |
|      |              | rudimentaryAssurance policies (or an entity    |
|      |              | policy which maps to these policies) may be    |
|      |              | backed up or copied, but must be held in the   |
|      |              | Subscriber's control.                          |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+

+------+--------------+------------------------------------------------+
| **T  | **CP         | **Mapping Phrase**                             |
| able | Section**    |                                                |
| N    |              |                                                |
| o.** |              |                                                |
+------+--------------+------------------------------------------------+
| 28.  | FBCA:        | It is technically possible to use the same     |
|      |              | key-pair for both digital signature and        |
|      | **6.3**      | confidentiality. However, this CP discourages  |
|      |              | that condition for Rudimentary, Basic and      |
|      |              | Medium, except to support legacy applications  |
|      |              | as defined in Section 6.1.9.                   |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 29.  | FBCA:        | The activation data used to unlock FBCA,       |
|      |              | Entity CA or subscriber private keys, in       |
|      | **6.4.1**    | conjunction with any other access control,     |
|      |              | shall have an appropriate level of strength    |
|      |              | for the keys or data to be protected.          |
|      |              |                                                |
|      |              | For Rudimentary, Basic, and Medium assurance   |
|      |              | levels, activation data may be user selected.  |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 30.  | FBCA:        | The System Development Controls for the FBCA   |
|      |              | and Entity CAs at the Basic Assurance level    |
|      | **6.6.1**    | and above are as follows:                      |
|      |              |                                                |
|      |              | -   Use software that has been designed and    |
|      |              |     developed under a formal, documented       |
|      |              |     development methodology.                   |
|      |              |                                                |
|      |              | -   Hardware and software procured to operate  |
|      |              |     the CA shall be purchased in a fashion to  |
|      |              |     reduce the likelihood that any particular  |
|      |              |     component was tampered with (e.g., by      |
|      |              |     ensuring the equipment was randomly        |
|      |              |     selected at time of purchase).             |
|      |              |                                                |
|      |              | -   Hardware and software developed            |
|      |              |     specifically for the CA shall be developed |
|      |              |     in a controlled environment, and the       |
|      |              |     development process shall be defined and   |
|      |              |     documented. This requirement does not      |
|      |              |     apply to commercial off-the-shelf hardware |
|      |              |     or software.                               |
|      |              |                                                |
|      |              | -   All hardware must be shipped or delivered  |
|      |              |     via controlled methods that provide a      |
|      |              |     continuous chain of accountability, from   |
|      |              |     the purchase location to the CA physical   |
|      |              |     location.                                  |
|      |              |                                                |
|      |              | -   The CA hardware and software shall be      |
|      |              |     dedicated to performing one task: the CA.  |
|      |              |     There shall be no other applications;      |
|      |              |     hardware devices, network connections, or  |
|      |              |     component software installed which are not |
|      |              |     part of the CA operation.                  |
|      |              |                                                |
|      |              | -   Proper care shall be taken to prevent      |
|      |              |     malicious software from being loaded onto  |
|      |              |     the CA and RA equipment. Only applications |
|      |              |     required to perform the operation of the   |
|      |              |     CA shall be obtained from sources          |
|      |              |     authorized by local policy. RA hardware    |
|      |              |     and software shall be scanned for          |
|      |              |     malicious code on first use and            |
|      |              |     periodically thereafter.                   |
|      |              |                                                |
|      |              | -   Hardware and software updates shall be     |
|      |              |     purchased or developed in the same manner  |
|      |              |     as original equipment, and be installed by |
|      |              |     trusted and trained personnel in a defined |
|      |              |     manner.                                    |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+

+------+--------------+------------------------------------------------+
| 31.  | FBCA:        | Certificates issued by Entity PKI's operating  |
|      |              | at High and Medium shall comply with *Federal  |
|      | **7.1.2**    | Public Key Infrastructure X.509 Certificate    |
|      |              | and CRL Extensions Profile* \[FPKI-Prof\].     |
+------+--------------+------------------------------------------------+
|      | \<Entity\>:  |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+

+---+--------------------------------------------------+--------+------+
| \ | **Auditable Event**                              | \<En   | **FB |
| # |                                                  | tity\> | CA** |
|   |                                                  |        |      |
|   |                                                  | Medium | **   |
|   |                                                  |        | Medi |
|   |                                                  |        | um** |
+===+==================================================+========+======+
|   | **SECURITY AUDIT**                               |        |      |
+---+--------------------------------------------------+--------+------+
| 1 | Any changes to the Audit parameters, e.g., audit |        | *    |
|   | frequency, type of event audited                 |        | *X** |
+---+--------------------------------------------------+--------+------+
| * | Any attempt to delete or modify the Audit logs   |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **IDENTIFICATION AND AUTHENTICATION**            |        |      |
+---+--------------------------------------------------+--------+------+
| * | Successful and unsuccessful attempts to assume a |        | *    |
| * | role                                             |        | *X** |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | Change in the value of maximum authentication    |        | *    |
| * | attempts                                         |        | *X** |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | Maximum number of unsuccessful authentication    |        | *    |
| * | attempts during user login                       |        | *X** |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | An Administrator unlocks an account that has     |        | *    |
| * | been locked as a result of unsuccessful          |        | *X** |
| 6 | authentication attempts                          |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | An Administrator changes the type of             |        | *    |
| * | authenticator, e.g., from password to biometrics |        | *X** |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **KEY GENERATION**                               |        |      |
+---+--------------------------------------------------+--------+------+
| * | Whenever the FBCA or Entity CA generates a key.  |        | *    |
| * | (Not mandatory for single session or one-time    |        | *X** |
| 8 | use symmetric keys)                              |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **PRIVATE KEY LOAD AND STORAGE**                 |        |      |
+---+--------------------------------------------------+--------+------+
| * | The loading of Component private keys            |        | *    |
| * |                                                  |        | *X** |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | All access to certificate subject private keys   |        | *    |
| * | retained within the FBCA or Entity CA for key    |        | *X** |
| 1 | recovery purposes                                |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **TRUSTED PUBLIC KEY ENTRY, DELETION AND         |        |      |
|   | STORAGE**                                        |        |      |
+---+--------------------------------------------------+--------+------+
| 1 | All changes to the trusted public keys,          |        | *    |
| 1 | including additions and deletions                |        | *X** |
+---+--------------------------------------------------+--------+------+
|   | **PRIVATE KEY EXPORT**                           |        |      |
+---+--------------------------------------------------+--------+------+
| * | The export of private keys (keys used for a      |        | *    |
| * | single session or message are excluded)          |        | *X** |
| 1 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE REGISTRATION**                     |        |      |
+---+--------------------------------------------------+--------+------+
| * | All certificate requests                         |        | *    |
| * |                                                  |        | *X** |
| 1 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE REVOCATION**                       |        |      |
+---+--------------------------------------------------+--------+------+
| * | All certificate revocation requests              |        | *    |
| * |                                                  |        | *X** |
| 1 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE STATUS CHANGE APPROVAL**           |        |      |
+---+--------------------------------------------------+--------+------+
| * | The approval or rejection of a certificate       |        | *    |
| * | status change request                            |        | *X** |
| 1 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **FBCA OR ENTITY CA CONFIGURATION**              |        |      |
+---+--------------------------------------------------+--------+------+
| * | Any security-relevant changes to the             |        | *    |
| * | configuration of the FBCA or Entity CA           |        | *X** |
| 1 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **ACCOUNT ADMINISTRATION**                       |        |      |
+---+--------------------------------------------------+--------+------+
| * | Roles and users are added or deleted             |        | *    |
| * |                                                  |        | *X** |
| 1 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | The access control privileges of a user account  |        | *    |
| * | or a role are modified                           |        | *X** |
| 1 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE PROFILE MANAGEMENT**               |        |      |
+---+--------------------------------------------------+--------+------+
| 1 | All changes to the certificate profile           |        | *    |
| 9 |                                                  |        | *X** |
+---+--------------------------------------------------+--------+------+

+---+--------------------------------------------------+--------+------+
| * | **Auditable Event**                              | **     | **FB |
| * |                                                  | \<Enti | CA** |
| \ |                                                  | ty\>** |      |
| # |                                                  |        | **   |
| * |                                                  | **Me   | Medi |
| * |                                                  | dium** | um** |
+---+--------------------------------------------------+--------+------+
|   | **REVOCATION PROFILE MANAGEMENT**                |        |      |
+---+--------------------------------------------------+--------+------+
| * | All changes to the revocation profile            |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE REVOCATION LIST PROFILE            |        |      |
|   | MANAGEMENT**                                     |        |      |
+---+--------------------------------------------------+--------+------+
| * | All changes to the certificate revocation list   |        | *    |
| * | profile                                          |        | *X** |
| 2 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **MISCELLANEOUS**                                |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Installation of the Operating System*           |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Installation of the FBCA or Entity CA*          |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Installing hardware cryptographic modules*      |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Removing hardware cryptographic modules*        |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Destruction of cryptographic modules*           |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *System Startup*                                 |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Logon Attempts to FBCA or Entity CA Apps*       |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Receipt of Hardware / Software*                 |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Attempts to set passwords*                      |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Attempts to modify passwords*                   |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Backing up FBCA or Entity CA internal database* |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Restoring FBCA or Entity CA internal database*  |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *File manipulation (e.g., creation, renaming,    |        | *    |
| * | moving)*                                         |        | *X** |
| 3 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Posting of any material to a repository*        |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Access to FBCA or Entity CA internal database*  |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *All certificate compromise notification         |        | *    |
| * | requests*                                        |        | *X** |
| 3 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Loading tokens with certificates*               |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Shipment of Tokens*                             |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Zeroizing tokens*                               |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Rekey of the FBCA or Entity CA*                 |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | *Configuration changes to the CA server          |        |      |
|   | involving:*                                      |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Hardware*                                       |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Software*                                       |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| 4 | *Operating System*                               |        | *    |
| 4 |                                                  |        | *X** |
+---+--------------------------------------------------+--------+------+
| * | *Patches*                                        |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Security Profiles*                              |        |      |
| * |                                                  |        |      |
| 4 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | ***PHYSICAL ACCESS / SITE SECURITY***            |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Personnel Access to room housing FBCA or Entity |        | *    |
| * | CA*                                              |        | *X** |
| 4 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Access to the FBCA or Entity CA server*         |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Known or suspected violations of physical       |        | *    |
| * | security*                                        |        | *X** |
| 4 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | ***ANOMALIES***                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Software Error conditions*                      |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Software check integrity failures*              |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Receipt of improper messages*                   |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Misrouted messages*                             |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Network attacks (suspected or confirmed)*       |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Equipment failure*                              |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Electrical power outages*                       |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Uninterruptible Power Supply (UPS) failure*     |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Obvious and significant network service or      |        | *    |
| * | access failures*                                 |        | *X** |
| 5 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Violations of Certificate Policy*               |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Violations of Certification Practice Statement* |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Resetting Operating System clock*               |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+

# **REFERENCES**

\[1\] Request for Comments (RFC): 2527; Internet X.509 Public Key
Infrastructure Certificate Policy and Certification Practices Framework,
March 1999, <http://www.ietf.org/rfc/rfc2527.txt>

\[2\] \<Entity\> CP, Version X.X, DD Month YYYY.

\[3\] X.509 Certificate Policy For The Federal Bridge Certification
Authority (FBCA), <http://www.cio.gov/fpkipa/documents/FBCA-CP.pdf>

\[4\] FPKI CPWG General Requirements Mapping Matrix for the \<Entity\>
CP, DD Month YYYY.

# **CONTACT DETAILS**

Comments about this document may be sent to the following people:

Tim Polk, NIST 301.975.3348 <tim.polk@nist.gov>