# ![](media/image1.jpeg){width="4.285416666666666in" height="0.7888888888888889in"}

# 

# 

# 

# **FPKI Audit Working Group Mapping Comparison:** 

# **NIST Special Publication 800-53 Moderate Controls Comparison to** 

# **Federal Bridge Certification Authority (FBCA) CP Mapping Summary**

**Version 1.0, August, 2007**

This document provides a summary of National Institute of Standards and
Technology (NIST) Special Publication (SP) 800-53 security controls that
are satisfied by Public Key Infrastructure (PKI) Certificate Authorities
(CA) that are compliant with certificate policies (CP) equivalent to one
or more policies of the Federal Bridge Certification Authority (FBCA) or
the FPKI Common Policy. This compliance is shown by a detailed
independent audit, the particulars of which are described in the FBCA
and Common CPs. The intent of this document is to show how 800-53
control requirements are satisfied by a CA that is cross-certified with
the FBCA or SSP CAs operating under the Common Policy. This document can
be used as a tool by auditors evaluating US Government agency systems to
understand what security controls listed in 800-53 are satisfied by
compliance audits conducted on an agency's PKI.

Table 1-1 below provides a simple listing of 800-53 controls that are
and are not satisfied by demonstrated compliance with a certificate
policy deemed equivalent with the FBCA CP (or compliance with the Common
Policy for SSP CAs). The table shows the 800-53 controls, relevant
section(s) in the FBCA CP that satisfy the requirements of the control
from a variety of views 1) the FBCA Policy as a whole, 2) A CA that
meets the requirements for the Basic Assurance policy and 3) a CA that
meets the requirements for the Medium Assurance and Above policies (as
well as the Common Policy since the FBCA Medium and above policies map
to policies in the Common Policy). The table numbers listed in the last
column of the summary table refer to the table numbers of the mapping
matrix that appears in the appendix of this document. Table 1-2 lists
only 800-53 security controls that are not satisfied by demonstrated
compliance with a certificate policy deemed equivalent with the FBCA CP.
The appendix provides a more detailed evaluation of every 800-53 control
mapped to relevant FBCA CP text and provides insight into the rating
that was applied.

**Table 1-1: List of All Requirements: Met and Not Met**

+-------------------+-----------------+--------+--------+--------+-----+
| **[800-53         | **[FBCA CP      | **[    | **[    | **[    | *   |
| Contr             | Sections That   | 800-53 | 800-53 | 800-53 | *[M |
| ol]{.underline}** | Meet 800-53     | Requir | Requir | Requir | app |
|                   | Control         | ements | ements | ements | ing |
|                   | Requirements    | Vs.    | Vs.    | Vs.    | Ta  |
|                   | ]{.underline}** | FBCA   | Basic  | Medium | ble |
|                   |                 | CP]{.  | Mat    | and    | ]{. |
|                   |                 | underl | rix]{. | Above  | und |
|                   |                 | ine}** | underl | Ma     | erl |
|                   |                 |        | ine}** | trices | ine |
|                   |                 |        |        | (and   | }** |
|                   |                 |        |        | Common |     |
|                   |                 |        |        | Poli   |     |
|                   |                 |        |        | cy)]{. |     |
|                   |                 |        |        | underl |     |
|                   |                 |        |        | ine}** |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-1, ACCESS      |                 |       |       |       | 1   |
| CONTROL POLICY    |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-2 (1)(2)(3),   |                 |       |       |       | 2   |
| ACCOUNT           |                 |        |        |        |     |
| MANAGEMENT        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-3 (1), ACCESS  | 5.2.1, Trusted  |       |       |       | 3   |
| ENFORCEMENT       | Roles           |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.5., Specific  |        |        |        |     |
|                   | Computer        |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Technical       |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-4, INFORMATION | 2.4 -- Access   |       |       |       | 4   |
| FLOW ENFORCEMENT  | Controls for    |        |        |        |     |
|                   | Repositories    |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.7 -- Network  |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-5, SEPARATION  | 5.2.4 --        |       |       |       | 5   |
| OF DUTIES         | Separation of   |        |        |        |     |
|                   | Roles           |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.5.1 --        |        |        |        |     |
|                   | Specific        |        |        |        |     |
|                   | Computer        |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Technical       |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-6, LEAST       | 6.5.1 --        |       |       |       | 6   |
| PRIVILEGE         | Specific        |        |        |        |     |
|                   | Computer        |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Technical       |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-7,             |                 |       |       |       | 7   |
| UNSUCCESSFUL      |                 |        |        |        |     |
| LOGIN ATTEMPTS    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-8, SYSTEM USE  |                 |       |       |       | 8   |
| NOTIFICATION      |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-9, PREVIOUS    |                 | This   | This   | This   | 9   |
| LOGON             |                 | c      | c      | c      |     |
| NOTIFICATION      |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-10, CONCURRENT |                 | This   | This   | This   | 10  |
| SESSION CONTROL   |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-11, SESSION    |                 |       |       |       | 11  |
| LOCK              |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-12, SESSION    |                 |       |       |       | 12  |
| TERMINATION       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-13,            | 5.2.1.3 Auditor |       |       |       | 13  |
| SUPERVISION AND   |                 |        |        |        |     |
| REVIEW --- ACCESS | 5.2.4 --        |        |        |        |     |
| CONTROL           | Separation of   |        |        |        |     |
|                   | Roles           |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-14, PERMITTED  | 5.2.3           |       |       |       | 14  |
| ACTIONS WITHOUT   | Identification  |        |        |        |     |
| IDENTIFICATION OR | and             |        |        |        |     |
| AUTHENTICATION    | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-15, AUTOMATED  |                 | This   | This   | This   | 15  |
| MARKING           |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-16, AUTOMATED  |                 | This   | This   | This   | 16  |
| LABELING          |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-17, REMOTE     |                 |       |       |       | 17  |
| ACCESS            |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-18, WIRELESS   |                 |       |       |       | 18  |
| ACCESS            |                 |        |        |        |     |
| RESTRICTIONS      |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-19, ACCESS     |                 |       |       |       | 19  |
| CONTROL FOR       |                 |        |        |        |     |
| PORTABLE AND      |                 |        |        |        |     |
| MOBILE DEVICES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-20, PERSONALLY |                 |       |       |       | 20  |
| OWNED INFORMATION |                 |        |        |        |     |
| SYSTEMS           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AT-1, SECURITY    | 5.3.3 Training  |       |       |       | 21  |
| AWARENESS AND     | Requirements    |        |        |        |     |
| TRAINING POLICY   |                 |        |        |        |     |
| AND PROCEDURES    | 5.3.4           |        |        |        |     |
|                   | Retraining      |        |        |        |     |
|                   | Frequency &     |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AT-2, SECURITY    | 5.3.3 Training  |       |       |       | 22  |
| AWARENESS         | Requirements    |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.3.4           |        |        |        |     |
|                   | Retraining      |        |        |        |     |
|                   | Frequency &     |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AT-3, SECURITY    | 5.3.3 Training  |       |       |       | 23  |
| TRAINING          | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AT-4, SECURITY    | 5.3.4           |       |       |       | 24  |
| TRAINING RECORDS  | Retraining      |        |        |        |     |
|                   | Frequency &     |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AT-5, CONTACTS    |                 | This   | This   | This   | 25  |
| WITH SECURITY     |                 | c      | c      | c      |     |
| GROUPS AND        |                 | ontrol | ontrol | ontrol |     |
| ASSOCIATIONS      |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-1, AUDIT AND   | 5.4 AUDIT       |       |       |       | 26  |
| ACCOUNTABILITY    | LOGGING         |        |        |        |     |
| POLICY AND        | PROCEDURES      |        |        |        |     |
| PROCEDURES        |                 |        |        |        |     |
|                   | 5.4.1 Types of  |        |        |        |     |
|                   | Events Recorded |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.2 Frequency |        |        |        |     |
|                   | of Processing   |        |        |        |     |
|                   | Log             |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.3 Retention |        |        |        |     |
|                   | Period for      |        |        |        |     |
|                   | Audit Logs      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.4           |        |        |        |     |
|                   | Protection of   |        |        |        |     |
|                   | Audit Logs      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.5 Audit Log |        |        |        |     |
|                   | Backup          |        |        |        |     |
|                   | Procedures      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.6 Audit     |        |        |        |     |
|                   | Collection      |        |        |        |     |
|                   | System          |        |        |        |     |
|                   | (internal vs.   |        |        |        |     |
|                   | external)       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.7           |        |        |        |     |
|                   | Notification to |        |        |        |     |
|                   | Event-Causing   |        |        |        |     |
|                   | Subject         |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.8           |        |        |        |     |
|                   | Vulnerability   |        |        |        |     |
|                   | Assessments     |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-2, AUDITABLE   | 5.4.1 Types of  |       |       |       | 27  |
| EVENTS            | Events Recorded |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-3, CONTENT OF  | 5.4.1 Types of  |       |       |       | 28  |
| AUDIT RECORDS     | Events Recorded |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-4, AUDIT       | 5.4.4           |       |       |       | 29  |
| STORAGE CAPACITY  | Protection of   |        |        |        |     |
|                   | Audit Logs      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-5, AUDIT       | 5.4.4           |       |       |       | 30  |
| PROCESSING        | Protection of   |        |        |        |     |
|                   | Audit Logs      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-6, AUDIT       | 5.4.2 Frequency |       |       |       | 31  |
| MONITORING,       | of Processing   |        |        |        |     |
| ANALYSIS, AND     | Log             |        |        |        |     |
| REPORTING         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-7, AUDIT       | 5.4.2 Frequency |       |       |       | 32  |
| REDUCTION AND     | of Processing   |        |        |        |     |
| REPORT GENERATION | Log             |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-8, TIME STAMPS | 5.4.1 Types of  |       |       |       | 33  |
|                   | Events Recorded |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-9, PROTECTION  | 5.4.4           |       |       |       | 34  |
| OF AUDIT          | Protection of   |        |        |        |     |
| INFORMATION       | Audit Logs      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-10,            | 5.4.1 Types of  |       |       |       | 35  |
| NON-REPUDIATION   | Events Recorded |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-11, AUDIT      | 5.5.2 Retention |       |       |       | 36  |
| RETENTION         | Period for      |        |        |        |     |
|                   | Archive         |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-1,             |                 |       |       |       | 37  |
| CERTIFICATION,    |                 |        |        |        |     |
| ACCREDITATION,    |                 |        |        |        |     |
| AND SECURITY      |                 |        |        |        |     |
| ASSESSMENT        |                 |        |        |        |     |
| POLICIES AND      |                 |        |        |        |     |
| PROCEDURES        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-2, SECURITY    | 8.1 Frequency   |       |       |       | 38  |
| ASSESSMENTS       | of Auditor      |        |        |        |     |
|                   | Assessments     |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-3, INFORMATION | 1.1.5           |       |       |       | 39  |
| SYSTEM            | Interaction     |        |        |        |     |
| CONNECTIONS       | with PKIs       |        |        |        |     |
|                   | External to the |        |        |        |     |
|                   | Federal         |        |        |        |     |
|                   | Government      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-4 (1),         | 8.3 Assessor's  |       |       |       | 40  |
| SECURITY          | Relationship to |        |        |        |     |
| CERTIFICATION     | Assessed Entity |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-5. PLAN OF     | 8.5 Actions     |       |       |       | 41  |
| ACTION AND        | Taken As A      |        |        |        |     |
| MILESTONES        | Result of       |        |        |        |     |
|                   | Deficiency      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-6, SECURITY    |                 |       |       |       | 42  |
| ACCREDITATION     |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-7, CONTINUOUS  | 5.4 Audit       |       |       |       | 43  |
| MONITORING        | Logging         |        |        |        |     |
|                   | Procedures      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.1 Types of  |        |        |        |     |
|                   | Events Recorded |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.2 Frequency |        |        |        |     |
|                   | of Processing   |        |        |        |     |
|                   | Logs            |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-1,             | 2.2.2           |       |       |       | 44  |
| CONFIGURATION     | Publication of  |        |        |        |     |
| MANAGEMENT POLICY | CA Information  |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
|                   | 5.4.1 Types of  |        |        |        |     |
|                   | Events Recorded |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.4           |        |        |        |     |
|                   | Protection of   |        |        |        |     |
|                   | Audit Logs      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.5.1 Types of  |        |        |        |     |
|                   | Events Archived |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-2 (1),         | 5.4.1 Types of  |       |       |       | 45  |
| BASELINE          | Events Recorded |        |        |        |     |
| CONFIGURATION AND |                 |        |        |        |     |
| SYSTEM COMPONENT  | 5.5.1 Types of  |        |        |        |     |
| INVENTORY         | events archived |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-3,             |                 |       |       |       | 46  |
| CONFIGURATION     |                 |        |        |        |     |
| CHANGE CONTROL    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-4, MONITORING  |                 |       |       |       | 47  |
| CONFIGURATION     |                 |        |        |        |     |
| CHANGES           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-5, ACCESS      | 5.1.2.1         |       |       |       | 48  |
| RESTRICTIONS FOR  | Physical Access |        |        |        |     |
| CHANGE            | for CA          |        |        |        |     |
|                   | equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.2.2         |        |        |        |     |
|                   | Physical Access |        |        |        |     |
|                   | for RA          |        |        |        |     |
|                   | equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.1 Types of  |        |        |        |     |
|                   | Events Recorded |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.5.1 Types of  |        |        |        |     |
|                   | events archived |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.5.1 Specific  |        |        |        |     |
|                   | Computer        |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Technical       |        |        |        |     |
|                   | Requirements    |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-6,             |                 |       |       |       | 49  |
| CONFIGURATION     |                 |        |        |        |     |
| SETTINGS          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-7, LEAST       | 6.6.1 System    |       |       |       | 50  |
| FUNCTIONALITY     | Development     |        |        |        |     |
|                   | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.7 Network     |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-1, CONTINGENCY |                 |       |       |       | 51  |
| PLANNING POLICY   |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-2 (1),         |                 |       |       |       | 52  |
| CONTINGENCY PLAN  |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-3, CONTINGENCY | 5.3.3 Training  |       |       |       | 53  |
| TRAINING          | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-4 (1),         |                 |       |       |       | 54  |
| CONTINGENCY PLAN  |                 |        |        |        |     |
| TESTING           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-5, CONTINGENCY |                 |       |       |       | 55  |
| PLAN UPDATE       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-6 (1),         | 5.1.8 Off-Site  |       |       |       | 56  |
| ALTERNATE STORAGE | backup          |        |        |        |     |
| SITES             |                 |        |        |        |     |
|                   | 5.7.4 Business  |        |        |        |     |
|                   | Continuity      |        |        |        |     |
|                   | Capabilities    |        |        |        |     |
|                   | after a         |        |        |        |     |
|                   | Disaster        |        |        |        |     |
|                   | (Section 5.7.4  |        |        |        |     |
|                   | Does Not Appear |        |        |        |     |
|                   | In Matrices)    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-7 (1) (2) (3), |                 |       |       |       | 57  |
| ALTERNATE         |                 |        |        |        |     |
| PROCESSING SITES  |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-8 (1)(2),      |                 |       |       |       | 58  |
| T                 |                 |        |        |        |     |
| ELECOMMUNICATIONS |                 |        |        |        |     |
| SERVICES          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-9 (1),         |                 |       |       |       | 59  |
| INFORMATION       |                 |        |        |        |     |
| SYSTEM BACKUP     |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-10,            | 5.1.8 Off-Site  |       |       |       | 60  |
| INFORMATION       | backup          |        |        |        |     |
| SYSTEM RECOVERY   |                 |        |        |        |     |
| AND               | 5.7.4 Business  |        |        |        |     |
| RECONSTITUTION    | Continuity      |        |        |        |     |
|                   | Capabilities    |        |        |        |     |
|                   | after a         |        |        |        |     |
|                   | Disaster        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-1,             | 2.2.2           |       |       |       | 61  |
| IDENTIFICATION    | Publication of  |        |        |        |     |
| AND               | CA Information  |        |        |        |     |
| AUTHENTICATION    |                 |        |        |        |     |
| POLICY AND        | 3.2.3.1         |        |        |        |     |
| PROCEDURES        | Authentication  |        |        |        |     |
|                   | of Human        |        |        |        |     |
|                   | Subscribers     |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-2, USER        | 5.1.2.1         |       |       |       | 62  |
| IDENTIFICATION    | Physical Access |        |        |        |     |
| AND               | for CA          |        |        |        |     |
| AUTHENTICATION    | Equipment (     |        |        |        |     |
|                   | Section 5.1.2.1 |        |        |        |     |
|                   | only appears in |        |        |        |     |
|                   | Med and Above)  |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.3           |        |        |        |     |
|                   | Identification  |        |        |        |     |
|                   | and             |        |        |        |     |
|                   | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-3, DEVICE      |                 |       |       |       | 63  |
| IDENTIFICATION    |                 |        |        |        |     |
| AND               |                 |        |        |        |     |
| AUTHENTICATION    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-4, IDENTIFIER  | 5.2.1 Trusted   |       |       |       | 64  |
| MANAGEMENT        | Roles (Section  |        |        |        |     |
|                   | 5.2.1. does not |        |        |        |     |
|                   | appear in       |        |        |        |     |
|                   | matrices)       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.3           |        |        |        |     |
|                   | Identification  |        |        |        |     |
|                   | and             |        |        |        |     |
|                   | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.4           |        |        |        |     |
|                   | Separation of   |        |        |        |     |
|                   | Roles           |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-5,             | 5.2.1 Trusted   |       |       |       | 65  |
| AUTHENTICATOR     | Roles (Section  |        |        |        |     |
| MANAGEMENT        | 5.2.1. does not |        |        |        |     |
|                   | appear in       |        |        |        |     |
|                   | matrices)       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.3           |        |        |        |     |
|                   | Identification  |        |        |        |     |
|                   | and             |        |        |        |     |
|                   | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.4           |        |        |        |     |
|                   | Separation of   |        |        |        |     |
|                   | Roles           |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-6,             |                 |       |       |       | 66  |
| AUTHENTICATOR     |                 |        |        |        |     |
| FEEDBACK          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-7,             | 6.1.1.1 CA Key  |       |       |       | 67  |
| CRYPTOGRAPHIC     | Pair Generation |        |        |        |     |
| MODULE            |                 |        |        |        |     |
| AUTHENTICATION    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-1, INCIDENT    | 2.2.2           |       |       |       | 68  |
| RESPONSE POLICY   | Publication of  |        |        |        |     |
| AND PROCEDURES    | CA Information  |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.7.1 Incident  |        |        |        |     |
|                   | Compromise and  |        |        |        |     |
|                   | Handling        |        |        |        |     |
|                   | Procedures      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.7.2 Computing |        |        |        |     |
|                   | Resources,      |        |        |        |     |
|                   | Software,       |        |        |        |     |
|                   | and/Or Data Are |        |        |        |     |
|                   | Corrupted       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.7.3 Entity    |        |        |        |     |
|                   | (CA) Private    |        |        |        |     |
|                   | Key Compromise  |        |        |        |     |
|                   | Procedures      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.7.4 Business  |        |        |        |     |
|                   | Continuity      |        |        |        |     |
|                   | Capabilities    |        |        |        |     |
|                   | after a         |        |        |        |     |
|                   | Disaster        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-2, INCIDENT    |                 |       |       |       | 69  |
| RESPONSE TRAINING |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-3, INCIDENT    |                 |       |       |       | 70  |
| RESPONSE TESTING  |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-4 (1),         |                 |       |       |       | 71  |
| INCIDENT HANDLING |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-5, INCIDENT    | 5.4 Audit       |       |       |       | 72  |
| MONITORING        | Logging         |        |        |        |     |
|                   | Procedures      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.1 Types of  |        |        |        |     |
|                   | Events Recorded |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-6 (1),         |                 |       |       |       | 73  |
| INCIDENT          |                 |        |        |        |     |
| REPORTING         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-7 (1),         |                 |       |       |       | 74  |
| INCIDENT RESPONSE |                 |        |        |        |     |
| ASSISTANCE        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-1, SYSTEM      | 2.2.2           |       |       |       | 75  |
| MAINTENANCE       | Publication of  |        |        |        |     |
| POLICY AND        | CA Information  |        |        |        |     |
| PROCEDURES        |                 |        |        |        |     |
|                   | 1.3.1.3 FPKI    |        |        |        |     |
|                   | Operational     |        |        |        |     |
|                   | Authority (FPKI |        |        |        |     |
|                   | OA)             |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.1.1         |        |        |        |     |
|                   | Administrator   |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-2 (1),         | 1.3.1.3 FPKI    |       |       |       | 76  |
| PERIODIC          | Operational     |        |        |        |     |
| MAINTENANCE       | Authority (FPKI |        |        |        |     |
|                   | OA)             |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.1.1         |        |        |        |     |
|                   | Administrator   |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-3, MAINTENANCE |                 |       |       |       | 77  |
| TOOLS             |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-4 (1)(2),      |                 |       |       |       | 78  |
| REMOTE            |                 |        |        |        |     |
| MAINTENANCE       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-5, MAINTENANCE | 5.2.1.1         |       |       |       | 79  |
| PERSONNEL         | Administrator   |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-6, TIMELY      | 5.2.1.1         |       |       |       | 80  |
| MAINTENANCE       | Administrator   |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-1, MEDIA       | 5.1.2.1         |       |       |       | 81  |
| PROTECTION POLICY | Physical Access |        |        |        |     |
| AND PROCEDURES    | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.6 Media     |        |        |        |     |
|                   | Storage         |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.5.3           |        |        |        |     |
|                   | Protection of   |        |        |        |     |
|                   | Archive         |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-2, MEDIA       | 5.1.2.1         |       |       |       | 82  |
| ACCESS            | Physical Access |        |        |        |     |
|                   | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-3, MEDIA       |                 |       |       |       | 83  |
| LABELING          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-4, MEDIA       | 5.1.2.1         |       |       |       | 84  |
| STORAGE           | Physical Access |        |        |        |     |
|                   | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-5, MEDIA       | 5.1.2.1         |       |       |       | 85  |
| TRANSPORT         | Physical Access |        |        |        |     |
|                   | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.5.3           |        |        |        |     |
|                   | Protection of   |        |        |        |     |
|                   | Archive         |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-6, MEDIA       |                 |       |       |       | 86  |
| SANITIZATION AND  |                 |        |        |        |     |
| DISPOSAL          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-1 PHYSICAL AND |                 |       |       |       | 87  |
| ENVIRONMENTAL     |                 |        |        |        |     |
| PROTECTION POLICY |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-2, PHYSICAL    | 5.1.1 Site      |       |       |       | 88  |
| ACCESS            | Location and    |        |        |        |     |
| AUTHORIZATIONS    | Construction    |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | #### 5.1.2.1 Ph |        |        |        |     |
|                   | ysical Access f |        |        |        |     |
|                   | or CA Equipment |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.2.2         |        |        |        |     |
|                   | Physical Access |        |        |        |     |
|                   | for RA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.3           |        |        |        |     |
|                   | Identification  |        |        |        |     |
|                   | and             |        |        |        |     |
|                   | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-3, PHYSICAL    | 5.1.1 Site      |       |       |       | 89  |
| ACCESS CONTROL    | Location and    |        |        |        |     |
|                   | Construction    |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | #### 5.1.2.1 Ph |        |        |        |     |
|                   | ysical Access f |        |        |        |     |
|                   | or CA Equipment |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.2.2         |        |        |        |     |
|                   | Physical Access |        |        |        |     |
|                   | for RA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.3           |        |        |        |     |
|                   | Identification  |        |        |        |     |
|                   | and             |        |        |        |     |
|                   | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-4, ACCESS      | 6.7 Network     |       |       |       | 90  |
| CONTROL FOR       | Security        |        |        |        |     |
| TRANSMISSION      | Controls        |        |        |        |     |
| MEDIUM            |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-5, ACCESS      | 5.1.1 Site      |       |       |       | 91  |
| CONTROL FOR       | Location and    |        |        |        |     |
| DISPLAY MEDIUM    | Construction    |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.2.1         |        |        |        |     |
|                   | Physical Access |        |        |        |     |
|                   | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-6 (1),         |                 |       |       |       | 92  |
| MONITORING        |                 |        |        |        |     |
| PHYSICAL ACCESS   |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-7 (1), VISITOR |                 |       |       |       | 93  |
| CONTROL           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-8, ACCESS      |                 |       |       |       | 94  |
| RECORDS           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-9, POWER       |                 |       |       |       | 95  |
| EQUIPMENT AND     |                 |        |        |        |     |
| POWER CABLING     |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-10, EMERGENCY  |                 | This   | This   | This   | 96  |
| SHUTOFF           |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-11, EMERGENCY  | 5.1.3 Power and |       |       |       | 97  |
| POWER             | Air             |        |        |        |     |
|                   | Conditioning    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-12, EMERGENCY  |                 | This   | This   | This   | 98  |
| LIGHTING          |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-13 (1), FIRE   |                 |       |       |       | 99  |
| PROTECTION        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-14,            | 5.1.3 Power and |       |       |       | 100 |
| TEMPERATURE AND   | Air             |        |        |        |     |
| HUMIDITY CONTROLS | Conditioning    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-15, WATER      |                 |       |       |       | 101 |
| DAMAGE PROTECTION |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-16, DELIVERY   |                 |       |       |       | 102 |
| AND REMOVAL       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-17, ALTERNATE  | 5.1.8 Off-Site  |       |       |       | 103 |
| WORK SITE         | Backup          |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.4           |        |        |        |     |
|                   | Protection of   |        |        |        |     |
|                   | Audit Logs      |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.2.4.1 Backup  |        |        |        |     |
|                   | of FBCA &       |        |        |        |     |
|                   | Entity CA       |        |        |        |     |
|                   | Private Key     |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-18, LOCATION   | 5.1.2.1         |       |       |       | 104 |
| OF INFORMATION    | Physical Access |        |        |        |     |
| SYSTEM COMPONENTS | to CA Equipment |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-19,            |                 | This   | This   | This   | 105 |
| INFORMATION       |                 | c      | c      | c      |     |
| LEAKAGE           |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-1, SECURITY    | 6.6.2 Security  |       |       |       | 106 |
| PLANNING POLICY   | Management      |        |        |        |     |
| AND PROCEDURES    | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 9.4.1 Privacy   |        |        |        |     |
|                   | Plan            |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-2, SYSTEM      | 6.6.2 Security  |       |       |       | 107 |
| SECURITY PLAN     | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-3, SYSTEM      | 6.6.2 Security  |       |       |       | 108 |
| SECURITY PLAN     | Management      |        |        |        |     |
| UPDATE            | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-4, RULES OF    | 9.6.3           |       |       |       | 109 |
| BEHAVIOR          | Subscriber      |        |        |        |     |
|                   | Representations |        |        |        |     |
|                   | and Warranties  |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-5, PRIVACY     |                 |       |       |       | 110 |
| IMPACT ASSESSMENT |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-6,             |                 |       |       |       | 111 |
| SECURITY-RELATED  |                 |        |        |        |     |
| ACTIVITY PLANNING |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-1, PERSONNEL   | 5.3.1 Personnel |       |       |       | 112 |
| SECURITY POLICY   | Controls        |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
|                   | 5.2 Procedural  |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-2, POSITION    | 5.3.1 Personnel |       |       |       | 113 |
| CATEGORIZATION    | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.3.2           |        |        |        |     |
|                   | Background      |        |        |        |     |
|                   | Check           |        |        |        |     |
|                   | Procedures      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-3, PERSONNEL   | 5.3.2           |       |       |       | 114 |
| SCREENING         | Background      |        |        |        |     |
|                   | Check           |        |        |        |     |
|                   | Procedures      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-4, PERSONNEL   |                 |       |       |       | 115 |
| TERMINATION       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-5, PERSONNEL   |                 |       |       |       | 116 |
| TRANSFER          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-6, ACCESS      | 9.6.3           |       |       |       | 117 |
| AGREEMENTS        | Subscriber      |        |        |        |     |
|                   | Representations |        |        |        |     |
|                   | and Warranties  |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-7, THIRD-PARTY | 5.3.7           |       |       |       | 118 |
| PERSONNEL         | Independent     |        |        |        |     |
| SECURITY          | Contractor      |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-8, PERSONNEL   |                 |       |       |       | 119 |
| SANCTIONS         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-1, RISK        |                 |       |       |       | 120 |
| ASSESSMENT POLICY |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-2, SECURITY    | 1.4.1           |       |       |       | 121 |
| CATEGORIZATION    | Appropriate     |        |        |        |     |
|                   | Certificate     |        |        |        |     |
|                   | Uses            |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-3, RISK        |                 |       |       |       | 122 |
| ASSESSMENT        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-4, RISK        |                 |       |       |       | 123 |
| ASSESSMENT UPDATE |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-5,             | ### 5           |       |       |       | 124 |
| VULNERABILITY     | .4.8 Vulnerabil |        |        |        |     |
| SCANNING          | ity Assessments |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.4.2 Frequency |        |        |        |     |
|                   | of Processing   |        |        |        |     |
|                   | Log             |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.1 System    |        |        |        |     |
|                   | Development     |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-1, SYSTEM AND  | 6.6.1 System    |       | This   | This   | 125 |
| SERVICES          | Development     |        | c      | c      |     |
| ACQUISITION       | Controls        |        | ontrol | ontrol |     |
| POLICY AND        |                 |        | is not | is not |     |
| PROCEDURES        | 6.6.2 Security  |        | met,   | met,   |     |
|                   | Management      |        | but is | but is |     |
|                   | Controls        |        | likely | likely |     |
|                   |                 |        | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-2, ALLOCATION  |                 | This   | This   | This   | 126 |
| OF RESOURCES      |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-3, LIFE CYCLE  | 6.6.1 System    |       |       |       | 127 |
| SUPPORT           | Development     |        |        |        |     |
|                   | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-4,             |                 | This   | This   | This   | 128 |
| ACQUISITIONS      |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-5 (1),         | 5.3.3 Training  |       |       |       | 129 |
| INFORMATION       | Requirements    |        |        |        |     |
| SYSTEM            |                 |        |        |        |     |
| DOCUMENTATION     | 5.3.8           |        |        |        |     |
|                   | Documentation   |        |        |        |     |
|                   | Supplied to     |        |        |        |     |
|                   | Personnel       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-6, SOFTWARE    |                 | This   | This   | This   | 130 |
| USAGE             |                 | c      | c      | c      |     |
| RESTRICTIONS      |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-7, USER        | 6.6.2 Security  |       |       |       | 131 |
| INSTALLED         | Management      |        |        |        |     |
| SOFTWARE          | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-8, SECURITY    | 6.6.1 System    |       |       |       | 132 |
| DESIGN PRINCIPLES | Development     |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-9, OUTSOURCED  | 6.6.1 System    |       |       |       | 133 |
| INFORMATION       | Development     |        |        |        |     |
| SYSTEM SERVICES   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-10, DEVELOPER  |                 | This   | This   | This   | 134 |
| CONFIGURATION     |                 | c      | c      | c      |     |
| MANAGEMENT        |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-11, DEVELOPER  | 8.0 Compliance  |       |       |       | 135 |
| SECURITY TESTING  | Audit and Other |        |        |        |     |
|                   | Assessments     |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 8.5 Actions     |        |        |        |     |
|                   | Taken as a      |        |        |        |     |
|                   | Result of       |        |        |        |     |
|                   | Deficiency      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-1, SYSTEM AND  | 6.7 Network     |       |       |       | 136 |
| COMMUNICATIONS    | Security        |        |        |        |     |
| PROTECTION POLICY | Controls        |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-2, APPLICATION | 6.5.1 Specific  |       |       |       | 137 |
| PARTITIONING      | Computer        |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Technical       |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-3, SECURITY    |                 | This   | This   | This   | 138 |
| FUNCTION          |                 | c      | c      | c      |     |
| ISOLATION         |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-4, INFORMATION | 6.5.1 Specific  |       |       |       | 139 |
| REMNANTS          | Computer        |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Technical       |        |        |        |     |
|                   | Requirements    |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-5, DENIAL OF   |                 | This   | This   | This   | 140 |
| SERVICE           |                 | c      | c      | c      |     |
| PROTECTION        |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-6, RESOURCE    |                 | This   | This   | This   | 141 |
| PRIORITY          |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-7 (1),         | 6.7 Network     |       |       |       | 142 |
| BOUNDARY          | Security        |        |        |        |     |
| PROTECTION        | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.2.1         |        |        |        |     |
|                   | Physical Access |        |        |        |     |
|                   | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-8,             | 6.1.5 Key Sizes |       |       |       | 143 |
| TRANSMISSION      |                 |        |        |        |     |
| INTEGRITY         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-9,             | 6.1.5 Key Sizes |       |       |       | 144 |
| TRANSMISSION      |                 |        |        |        |     |
| CONFIDENTIALITY   |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-10, NETWORK    |                 |       |       |       | 145 |
| DISCONNECT        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-11, TRUSTED    |                 | This   | This   | This   | 146 |
| PATH              |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-12,            | 6.1.1.1 CA Key  |       |       |       | 147 |
| CRYPTOGRAPHIC KEY | Pair Generation |        |        |        |     |
| ESTABLISHMENT AND |                 |        |        |        |     |
| MANAGEMENT        | 6.1.1.2         |        |        |        |     |
|                   | Subscriber Key  |        |        |        |     |
|                   | Pair Generation |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-13, USE OF     | 6.1.1.1 CA Key  |       |       |       | 148 |
| VALIDATED         | Pair Generation |        |        |        |     |
| CRYPTOGRAPHY      |                 |        |        |        |     |
|                   | 6.1.1.2         |        |        |        |     |
|                   | Subscriber Key  |        |        |        |     |
|                   | Pair Generation |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-14, PUBLIC     | 6.7 Network     |       |       |       | 149 |
| ACCESS            | Security        |        |        |        |     |
| PROTECTIONS       | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-15,            |                 | This   | This   | This   | 150 |
| COLLABORATIVE     |                 | c      | c      | c      |     |
| COMPUTING         |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-16,            |                 | This   | This   | This   | 151 |
| TRANSMISSION OF   |                 | c      | c      | c      |     |
| SECURITY          |                 | ontrol | ontrol | ontrol |     |
| PARAMETERS        |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-17, PUBLIC KEY | Whole Document  |       |       |       | 152 |
| INFRASTRUCTURE    |                 |        |        |        |     |
| CERTIFICATES      |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-18, MOBILE     |                 | This   | This   | This   | 153 |
| CODE              |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-19, VOICE OVER |                 | This   | This   | This   | 154 |
| INTERNET PROTOCOL |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-20, SECURE     |                 | This   | This   | This   | 155 |
| NAME LOOKUP       |                 | c      | c      | c      |     |
| SERVICE           |                 | ontrol | ontrol | ontrol |     |
| (AUTHORITATIVE    |                 | is not | is not | is not |     |
| SOURCE)           |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-21, SECURE     |                 | This   | This   | This   | 156 |
| NAME LOOKUP       |                 | c      | c      | c      |     |
| SERVICE           |                 | ontrol | ontrol | ontrol |     |
| (RESOLUTION)      |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-22,            |                 | This   | This   | This   | 157 |
| ARCHITECTURE AND  |                 | c      | c      | c      |     |
| PROVISIONING FOR  |                 | ontrol | ontrol | ontrol |     |
| NAMES AND         |                 | is not | is not | is not |     |
| ADDRESSES         |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-23,            | 6.1.5 Key Sizes |       |       |       | 158 |
| AUTHENTICITY OF   |                 |        |        |        |     |
| SESSION           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-1, SYSTEM AND  | 5.3 Personnel   |       |       |       | 159 |
| INFORMATION       | Controls        |        |        |        |     |
| INTEGRITY POLICY  |                 |        |        |        |     |
| AND PROCEDURES    | 6.5 Computer    |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6 Life-cycle  |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.7 Network     |        |        |        |     |
|                   | Security        |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-2, FLAW        | 6.6.2           |       |       |       | 160 |
| REMEDIATION       | Configuration   |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Methodology     |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-3 (1),         | 6.6.1 System    |       |       |       | 161 |
| MALICIOUS CODE    | Development     |        |        |        |     |
| PROTECTION        | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.1.2.1         |        |        |        |     |
|                   | Physical Access |        |        |        |     |
|                   | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-4 (4),         | 5.1.2.1         |       |       |       | 162 |
| INFORMATION       | Physical Access |        |        |        |     |
| SYSTEM MONITORING | for CA          |        |        |        |     |
| TOOLS AND         | Equipment       |        |        |        |     |
| TECHNIQUES        |                 |        |        |        |     |
|                   | 5.4.8           |        |        |        |     |
|                   | Vulnerability   |        |        |        |     |
|                   | Assessments     |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-5, SECURITY    |                 | This   | This   | This   | 163 |
| ALERTS AND        |                 | c      | c      | c      |     |
| ADVISORIES        |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-6, SECURITY    |                 | This   | This   | This   | 164 |
| FUNCTIONALITY     |                 | c      | c      | c      |     |
| VERIFICATION      |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-7, SOFTWARE    |                 | This   | This   | This   | 165 |
| AND INFORMATION   |                 | c      | c      | c      |     |
| INTEGRITY         |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-8, SPAM        |                 | This   | This   | This   | 166 |
| PROTECTION        |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-9, INFORMATION | 5.1.2.1         |       |       |       | 167 |
| INPUT             | Physical Access |        |        |        |     |
| RESTRICTIONS      | for CA          |        |        |        |     |
|                   | Equipment       |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 5.2.3           |        |        |        |     |
|                   | Identification  |        |        |        |     |
|                   | and             |        |        |        |     |
|                   | Authentication  |        |        |        |     |
|                   | for Each Role   |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 6.6.2 Security  |        |        |        |     |
|                   | Management      |        |        |        |     |
|                   | Controls        |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-10,            | 4.2 Certificate |       |       |       | 168 |
| INFORMATION       | Application     |        |        |        |     |
| ACCURACY,         | Processing      |        |        |        |     |
| COMPLETENESS,     |                 |        |        |        |     |
| VALIDITY, AND     | 5.5.7           |        |        |        |     |
| AUTHENTICITY      | Procedures to   |        |        |        |     |
|                   | Obtain & Verify |        |        |        |     |
|                   | Archive         |        |        |        |     |
|                   | Information     |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-11, ERROR      | 5.4 Audit       |       |       |       | 169 |
| HANDLING          | Logging         |        |        |        |     |
|                   | Procedures      |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-12,            | 5.4 Audit       |       |       |       | 170 |
| INFORMATION       | Logging         |        |        |        |     |
| OUTPUT HANDLING   | Procedures      |        |        |        |     |
| AND RETENTION     |                 |        |        |        |     |
|                   | 5.5 Records     |        |        |        |     |
|                   | Archive         |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+

**Table 1-2: List of Requirements: Not Met**

+-------------------+-----------------+--------+--------+--------+-----+
| **[800-53         | **[FBCA CP      | **[    | **[    | **[    | *   |
| Contr             | Sections That   | 800-53 | 800-53 | 800-53 | *[M |
| ol]{.underline}** | Meet 800-53     | Requir | Requir | Requir | app |
|                   | Control         | ements | ements | ements | ing |
|                   | Requirements    | Vs.    | Vs.    | Vs.    | Ta  |
|                   | ]{.underline}** | FBCA   | Basic  | Medium | ble |
|                   |                 | CP]{.  | Mat    | and    | ]{. |
|                   |                 | underl | rix]{. | Above  | und |
|                   |                 | ine}** | underl | Ma     | erl |
|                   |                 |        | ine}** | trices | ine |
|                   |                 |        |        | (and   | }** |
|                   |                 |        |        | Common |     |
|                   |                 |        |        | Poli   |     |
|                   |                 |        |        | cy)]{. |     |
|                   |                 |        |        | underl |     |
|                   |                 |        |        | ine}** |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-1, ACCESS      |                 |       |       |       | 1   |
| CONTROL POLICY    |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-2 (1)(2)(3),   |                 |       |       |       | 2   |
| ACCOUNT           |                 |        |        |        |     |
| MANAGEMENT        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-7,             |                 |       |       |       | 7   |
| UNSUCCESSFUL      |                 |        |        |        |     |
| LOGIN ATTEMPTS    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-8, SYSTEM USE  |                 |       |       |       | 8   |
| NOTIFICATION      |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-9, PREVIOUS    |                 | This   | This   | This   | 9   |
| LOGON             |                 | c      | c      | c      |     |
| NOTIFICATION      |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-10, CONCURRENT |                 | This   | This   | This   | 10  |
| SESSION CONTROL   |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-11, SESSION    |                 |       |       |       | 11  |
| LOCK              |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-12, SESSION    |                 |       |       |       | 12  |
| TERMINATION       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-15, AUTOMATED  |                 | This   | This   | This   | 15  |
| MARKING           |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-16, AUTOMATED  |                 | This   | This   | This   | 16  |
| LABELING          |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-17, REMOTE     |                 |       |       |       | 17  |
| ACCESS            |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-18, WIRELESS   |                 |       |       |       | 18  |
| ACCESS            |                 |        |        |        |     |
| RESTRICTIONS      |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-19, ACCESS     |                 |       |       |       | 19  |
| CONTROL FOR       |                 |        |        |        |     |
| PORTABLE AND      |                 |        |        |        |     |
| MOBILE DEVICES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AC-20, PERSONALLY |                 |       |       |       | 20  |
| OWNED INFORMATION |                 |        |        |        |     |
| SYSTEMS           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AT-5, CONTACTS    |                 | This   | This   | This   | 25  |
| WITH SECURITY     |                 | c      | c      | c      |     |
| GROUPS AND        |                 | ontrol | ontrol | ontrol |     |
| ASSOCIATIONS      |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| AU-6, AUDIT       | 5.4.2 Frequency |       |       |       | 31  |
| MONITORING,       | of Processing   |        |        |        |     |
| ANALYSIS, AND     | Log             |        |        |        |     |
| REPORTING         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CA-1,             |                 |       |       |       | 37  |
| CERTIFICATION,    |                 |        |        |        |     |
| ACCREDITATION,    |                 |        |        |        |     |
| AND SECURITY      |                 |        |        |        |     |
| ASSESSMENT        |                 |        |        |        |     |
| POLICIES AND      |                 |        |        |        |     |
| PROCEDURES        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-3,             |                 |       |       |       | 46  |
| CONFIGURATION     |                 |        |        |        |     |
| CHANGE CONTROL    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-4, MONITORING  |                 |       |       |       | 47  |
| CONFIGURATION     |                 |        |        |        |     |
| CHANGES           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CM-6,             |                 |       |       |       | 49  |
| CONFIGURATION     |                 |        |        |        |     |
| SETTINGS          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-1, CONTINGENCY |                 |       |       |       | 51  |
| PLANNING POLICY   |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-2 (1),         |                 |       |       |       | 52  |
| CONTINGENCY PLAN  |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-4 (1),         |                 |       |       |       | 54  |
| CONTINGENCY PLAN  |                 |        |        |        |     |
| TESTING           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-5, CONTINGENCY |                 |       |       |       | 55  |
| PLAN UPDATE       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-7 (1) (2) (3), |                 |       |       |       | 57  |
| ALTERNATE         |                 |        |        |        |     |
| PROCESSING SITES  |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-8 (1)(2),      |                 |       |       |       | 58  |
| T                 |                 |        |        |        |     |
| ELECOMMUNICATIONS |                 |        |        |        |     |
| SERVICES          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| CP-9 (1),         |                 |       |       |       | 59  |
| INFORMATION       |                 |        |        |        |     |
| SYSTEM BACKUP     |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-3, DEVICE      |                 |       |       |       | 63  |
| IDENTIFICATION    |                 |        |        |        |     |
| AND               |                 |        |        |        |     |
| AUTHENTICATION    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IA-6,             |                 |       |       |       | 66  |
| AUTHENTICATOR     |                 |        |        |        |     |
| FEEDBACK          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-2, INCIDENT    |                 |       |       |       | 69  |
| RESPONSE TRAINING |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-3, INCIDENT    |                 |       |       |       | 70  |
| RESPONSE TESTING  |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-4 (1),         |                 |       |       |       | 71  |
| INCIDENT HANDLING |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-6 (1),         |                 |       |       |       | 73  |
| INCIDENT          |                 |        |        |        |     |
| REPORTING         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| IR-7 (1),         |                 |       |       |       | 74  |
| INCIDENT RESPONSE |                 |        |        |        |     |
| ASSISTANCE        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-3, MAINTENANCE |                 |       |       |       | 77  |
| TOOLS             |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MA-4 (1)(2),      |                 |       |       |       | 78  |
| REMOTE            |                 |        |        |        |     |
| MAINTENANCE       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-3, MEDIA       |                 |       |       |       | 83  |
| LABELING          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| MP-6, MEDIA       |                 |       |       |       | 86  |
| SANITIZATION AND  |                 |        |        |        |     |
| DISPOSAL          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-1 PHYSICAL AND |                 |       |       |       | 87  |
| ENVIRONMENTAL     |                 |        |        |        |     |
| PROTECTION POLICY |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-6 (1),         |                 |       |       |       | 92  |
| MONITORING        |                 |        |        |        |     |
| PHYSICAL ACCESS   |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-7 (1), VISITOR |                 |       |       |       | 93  |
| CONTROL           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-8, ACCESS      |                 |       |       |       | 94  |
| RECORDS           |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-9, POWER       |                 |       |       |       | 95  |
| EQUIPMENT AND     |                 |        |        |        |     |
| POWER CABLING     |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-10, EMERGENCY  |                 | This   | This   | This   | 96  |
| SHUTOFF           |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-12, EMERGENCY  |                 | This   | This   | This   | 98  |
| LIGHTING          |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-13 (1), FIRE   |                 |       |       |       | 99  |
| PROTECTION        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-16, DELIVERY   |                 |       |       |       | 102 |
| AND REMOVAL       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PE-19,            |                 | This   | This   | This   | 105 |
| INFORMATION       |                 | c      | c      | c      |     |
| LEAKAGE           |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-1, SECURITY    | 6.6.2 Security  |       |       |       | 106 |
| PLANNING POLICY   | Management      |        |        |        |     |
| AND PROCEDURES    | Controls        |        |        |        |     |
|                   |                 |        |        |        |     |
|                   | 9.4.1 Privacy   |        |        |        |     |
|                   | Plan            |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-5, PRIVACY     |                 |       |       |       | 110 |
| IMPACT ASSESSMENT |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PL-6,             |                 |       |       |       | 111 |
| SECURITY-RELATED  |                 |        |        |        |     |
| ACTIVITY PLANNING |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-4, PERSONNEL   |                 |       |       |       | 115 |
| TERMINATION       |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-5, PERSONNEL   |                 |       |       |       | 116 |
| TRANSFER          |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| PS-8, PERSONNEL   |                 |       |       |       | 119 |
| SANCTIONS         |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-1, RISK        |                 |       |       |       | 120 |
| ASSESSMENT POLICY |                 |        |        |        |     |
| AND PROCEDURES    |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-3, RISK        |                 |       |       |       | 122 |
| ASSESSMENT        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| RA-4, RISK        |                 |       |       |       | 123 |
| ASSESSMENT UPDATE |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-1, SYSTEM AND  | 6.6.1 System    |       | This   | This   | 125 |
| SERVICES          | Development     |        | c      | c      |     |
| ACQUISITION       | Controls        |        | ontrol | ontrol |     |
| POLICY AND        |                 |        | is not | is not |     |
| PROCEDURES        | 6.6.2 Security  |        | met,   | met,   |     |
|                   | Management      |        | but is | but is |     |
|                   | Controls        |        | likely | likely |     |
|                   |                 |        | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-2, ALLOCATION  |                 | This   | This   | This   | 126 |
| OF RESOURCES      |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-4,             |                 | This   | This   | This   | 128 |
| ACQUISITIONS      |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-6, SOFTWARE    |                 | This   | This   | This   | 130 |
| USAGE             |                 | c      | c      | c      |     |
| RESTRICTIONS      |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SA-10, DEVELOPER  |                 | This   | This   | This   | 134 |
| CONFIGURATION     |                 | c      | c      | c      |     |
| MANAGEMENT        |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-3, SECURITY    |                 | This   | This   | This   | 138 |
| FUNCTION          |                 | c      | c      | c      |     |
| ISOLATION         |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-5, DENIAL OF   |                 | This   | This   | This   | 140 |
| SERVICE           |                 | c      | c      | c      |     |
| PROTECTION        |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-6, RESOURCE    |                 | This   | This   | This   | 141 |
| PRIORITY          |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-10, NETWORK    |                 |       |       |       | 145 |
| DISCONNECT        |                 |        |        |        |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-11, TRUSTED    |                 | This   | This   | This   | 146 |
| PATH              |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-15,            |                 | This   | This   | This   | 150 |
| COLLABORATIVE     |                 | c      | c      | c      |     |
| COMPUTING         |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-16,            |                 | This   | This   | This   | 151 |
| TRANSMISSION OF   |                 | c      | c      | c      |     |
| SECURITY          |                 | ontrol | ontrol | ontrol |     |
| PARAMETERS        |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-18, MOBILE     |                 | This   | This   | This   | 153 |
| CODE              |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-19, VOICE OVER |                 | This   | This   | This   | 154 |
| INTERNET PROTOCOL |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-20, SECURE     |                 | This   | This   | This   | 155 |
| NAME LOOKUP       |                 | c      | c      | c      |     |
| SERVICE           |                 | ontrol | ontrol | ontrol |     |
| (AUTHORITATIVE    |                 | is not | is not | is not |     |
| SOURCE)           |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-21, SECURE     |                 | This   | This   | This   | 156 |
| NAME LOOKUP       |                 | c      | c      | c      |     |
| SERVICE           |                 | ontrol | ontrol | ontrol |     |
| (RESOLUTION)      |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SC-22,            |                 | This   | This   | This   | 157 |
| ARCHITECTURE AND  |                 | c      | c      | c      |     |
| PROVISIONING FOR  |                 | ontrol | ontrol | ontrol |     |
| NAMES AND         |                 | is not | is not | is not |     |
| ADDRESSES         |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-5, SECURITY    |                 | This   | This   | This   | 163 |
| ALERTS AND        |                 | c      | c      | c      |     |
| ADVISORIES        |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-6, SECURITY    |                 | This   | This   | This   | 164 |
| FUNCTIONALITY     |                 | c      | c      | c      |     |
| VERIFICATION      |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-7, SOFTWARE    |                 | This   | This   | This   | 165 |
| AND INFORMATION   |                 | c      | c      | c      |     |
| INTEGRITY         |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+
| SI-8, SPAM        |                 | This   | This   | This   | 166 |
| PROTECTION        |                 | c      | c      | c      |     |
|                   |                 | ontrol | ontrol | ontrol |     |
|                   |                 | is not | is not | is not |     |
|                   |                 | met,   | met,   | met,   |     |
|                   |                 | but is | but is | but is |     |
|                   |                 | likely | likely | likely |     |
|                   |                 | N/A    | N/A    | N/A    |     |
+-------------------+-----------------+--------+--------+--------+-----+

# **Appendix A-2 -- Detailed Mapping Comparison: NIST SP 800-53 to FBCA CP Evaluation Mapping Matrix**

The tables listed below provide detail about how FBCA text maps to each
800-53 control and insight into how the rating for the table was
derived.

+---+-----+--------------------------------+-------------------------+
| * | **  | **800-53 Requirement**         | **FBCA Mapping Phrase** |
| * | 800 |                                |                         |
| T | -53 |                                |                         |
| a | Con |                                |                         |
| b | tro |                                |                         |
| l | l** |                                |                         |
| e |     |                                |                         |
| * |     |                                |                         |
| * |     |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | A   | Control:                       | FBCA Section:           |
| . | C-1 |                                |                         |
|   |     | The organization develops,     | 5.1.2.1, Physical       |
|   | ACC | disseminates, and periodically | Access for CA equipment |
|   | ESS | reviews/updates: (i) a formal, | -- "                    |
|   | C   | documented, access control     |                         |
|   | ONT | policy that addresses purpose, | -   Ensure no           |
|   | ROL | scope, roles,                  |     unauthorized access |
|   | POL | responsibilities, management   |     to the hardware is  |
|   | ICY | commitment, coordination among |     permitted           |
|   | AND | organizational entities, and   |                         |
|   | P   | compliance; and (ii) formal,   | -   Ensure all          |
|   | ROC | documented procedures to       |     removable media and |
|   | EDU | facilitate the implementation  |     paper containing    |
|   | RES | of the access control policy   |     sensitive           |
|   |     | and associated access          |     plain-text          |
|   |     | controls.                      |     information is      |
|   |     |                                |     stored in secure    |
|   |     | Enhancements:                  |     containers          |
|   |     |                                |                         |
|   |     | None                           | -   Ensure manual or    |
|   |     |                                |     electronic          |
|   |     | Supplemental Guidance:         |     monitoring for      |
|   |     |                                |     unauthorized        |
|   |     | The access control policy and  |     intrusion at all    |
|   |     | procedures are consistent with |     times               |
|   |     | applicable federal laws,       |                         |
|   |     | directives, policies,          | -   Ensure an access    |
|   |     | regulations, standards, and    |     log is maintained   |
|   |     | guidance. The access control   |     and inspected       |
|   |     | policy can be included as part |     periodically        |
|   |     | of the general information     |                         |
|   |     | security policy for the        | -   Require two person  |
|   |     | organization. Access control   |     physical access     |
|   |     | procedures can be developed    |     control to both the |
|   |     | for the security program in    |     cryptographic       |
|   |     | general, and for a particular  |     module and computer |
|   |     | information system, when       |     system"             |
|   |     | required. NIST Special         |                         |
|   |     | Publication 800-12 provides    | 5.1.2.2, Physical       |
|   |     | guidance on security policies  | Access for RA equipment |
|   |     | and procedures.                | -- "RA equipment shall  |
|   |     |                                | be protected from       |
|   |     |                                | unauthorized access     |
|   |     |                                | while the cryptographic |
|   |     |                                | module is installed and |
|   |     |                                | activated. The RA shall |
|   |     |                                | implement physical      |
|   |     |                                | access controls to      |
|   |     |                                | reduce the risk of      |
|   |     |                                | equipment tampering     |
|   |     |                                | even when the           |
|   |     |                                | cryptographic module is |
|   |     |                                | not installed and       |
|   |     |                                | activated."             |
|   |     |                                |                         |
|   |     |                                | 6.4.1, Activation Data  |
|   |     |                                | Generation &            |
|   |     |                                | Installation -- "The    |
|   |     |                                | activation data used to |
|   |     |                                | unlock FBCA, Entity CA  |
|   |     |                                | or subscriber private   |
|   |     |                                | keys, in conjunction    |
|   |     |                                | with any other access   |
|   |     |                                | control, shall have an  |
|   |     |                                | appropriate level of    |
|   |     |                                | strength for the keys   |
|   |     |                                | or data to be           |
|   |     |                                | protected."             |
|   |     |                                |                         |
|   |     |                                | 6.4.2, Activation Data  |
|   |     |                                | Protection -- "Data     |
|   |     |                                | used to unlock private  |
|   |     |                                | keys shall be protected |
|   |     |                                | from disclosure by a    |
|   |     |                                | combination of          |
|   |     |                                | cryptographic and       |
|   |     |                                | physical access control |
|   |     |                                | mechanisms"             |
|   |     |                                |                         |
|   |     |                                | 6.5., Specific Computer |
|   |     |                                | Security Technical      |
|   |     |                                | Requirements - \"       |
|   |     |                                |                         |
|   |     |                                | For the FBCA, the       |
|   |     |                                | computer security       |
|   |     |                                | functions listed below  |
|   |     |                                | are required. These     |
|   |     |                                | functions may be        |
|   |     |                                | provided by the         |
|   |     |                                | operating system, or    |
|   |     |                                | through a combination   |
|   |     |                                | of operating system,    |
|   |     |                                | software, and physical  |
|   |     |                                | safeguards. The FBCA    |
|   |     |                                | and its ancillary parts |
|   |     |                                | shall include the       |
|   |     |                                | following               |
|   |     |                                | functionality:          |
|   |     |                                |                         |
|   |     |                                | • Require authenticated |
|   |     |                                | logins                  |
|   |     |                                |                         |
|   |     |                                | • Provide Discretionary |
|   |     |                                | Access Control          |
|   |     |                                |                         |
|   |     |                                | • Provide a security    |
|   |     |                                | audit capability        |
|   |     |                                |                         |
|   |     |                                | • Restrict access       |
|   |     |                                | control to FBCA         |
|   |     |                                | services and PKI roles  |
|   |     |                                |                         |
|   |     |                                | • Enforce separation of |
|   |     |                                | duties for PKI roles\"  |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| . | C-2 |                                |                         |
|   | (1) | The organization manages       | 5.2.1, Trusted Roles -  |
|   | (2) | information system accounts,   | The requirements of     |
|   | (3) | including establishing,        | this policy are defined |
|   |     | activating, modifying,         | in terms of four roles. |
|   | A   | reviewing, disabling, and      | (Note: the information  |
|   | CCO | removing accounts. The         | derives from the        |
|   | UNT | organization reviews           | Certificate Issuing and |
|   | M   | information system accounts    | Management Components   |
|   | ANA | \[*Assignment:                 | (CIMC) Protection       |
|   | GEM | organization-defined           | Profile.)               |
|   | ENT | frequency*\].                  |                         |
|   |     |                                | 1\. Administrator --    |
|   |     | Enhancements:                  | authorized to install,  |
|   |     |                                | configure, and maintain |
|   |     | \(1\) The organization employs | the CA; establish and   |
|   |     | automated mechanisms to        | maintain user accounts; |
|   |     | support the management of      | configure profiles and  |
|   |     | information system accounts.\  | audit parameters; and   |
|   |     | (2) The information system     | generate component      |
|   |     | automatically terminates       | keys.                   |
|   |     | temporary and emergency        |                         |
|   |     | accounts after \[Assignment:   | 6.5., Specific Computer |
|   |     | organization-defined time      | Security Technical      |
|   |     | period for each type of        | Requirements - \"       |
|   |     | account\].\                    |                         |
|   |     | (3) The information system     | For the FBCA, the       |
|   |     | automatically disables         | computer security       |
|   |     | inactive accounts after        | functions listed below  |
|   |     | \[Assignment:                  | are required. These     |
|   |     | organization-defined time      | functions may be        |
|   |     | period\].\                     | provided by the         |
|   |     | (4) The organization employs   | operating system, or    |
|   |     | automated mechanisms to ensure | through a combination   |
|   |     | that account creation,         | of operating system,    |
|   |     | modification,\                 | software, and physical  |
|   |     | disabling, and termination     | safeguards. The FBCA    |
|   |     | actions are audited and, as    | and its ancillary parts |
|   |     | required, appropriate          | shall include the       |
|   |     | individuals are\               | following               |
|   |     | notified.                      | functionality:          |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | a.  Require             |
|   |     |                                |     authenticated       |
|   |     | Account management includes    |     logins              |
|   |     | the identification of account  |                         |
|   |     | types (i.e., individual,       | b.  Provide             |
|   |     | group, and system),            |     Discretionary       |
|   |     | establishment of conditions    |     Access Control      |
|   |     | for group membership, and      |                         |
|   |     | assignment of associated       | c.  Provide a security  |
|   |     | authorizations. The            |     audit capability    |
|   |     | organization identifies        |                         |
|   |     | authorized users of the        | d.  Restrict access     |
|   |     | information system and         |     control to FBCA     |
|   |     | specifies access               |     services and PKI    |
|   |     | rights/privileges. The         |     roles               |
|   |     | organization grants access to  |                         |
|   |     | the information system based   | e.  Enforce separation  |
|   |     | on: (i) a valid need-to-know   |     of duties for PKI   |
|   |     | that is determined by assigned |     roles\"             |
|   |     | official duties and satisfying |                         |
|   |     | all personnel security         |                         |
|   |     | criteria; and (ii) intended    |                         |
|   |     | system usage. The organization |                         |
|   |     | requires proper identification |                         |
|   |     | for requests to establish      |                         |
|   |     | information system accounts    |                         |
|   |     | and approves all such          |                         |
|   |     | requests. The organization     |                         |
|   |     | specifically authorizes and    |                         |
|   |     | monitors the use of            |                         |
|   |     | guest/anonymous accounts and   |                         |
|   |     | removes, disables, or          |                         |
|   |     | otherwise secures unnecessary  |                         |
|   |     | accounts. The organization     |                         |
|   |     | ensures that account managers  |                         |
|   |     | are notified when information  |                         |
|   |     | system users are terminated or |                         |
|   |     | transferred and associated     |                         |
|   |     | accounts are removed,          |                         |
|   |     | disabled, or otherwise         |                         |
|   |     | secured. Account managers are  |                         |
|   |     | also notified when users'      |                         |
|   |     | information system usage or    |                         |
|   |     | need-to-know changes.          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | A   | Control:                       | FBCA Section:           |
| . | C-3 |                                |                         |
|   | (1) | The information system         | 5.2.1, Trusted Roles -  |
|   |     | enforces assigned              | The requirements of     |
|   | ACC | authorizations for controlling | this policy are defined |
|   | ESS | access to the system in        | in terms of four roles. |
|   | EN  | accordance with applicable     | (Note: the information  |
|   | FOR | policy. The information system | derives from the        |
|   | CEM | ensures that access to         | Certificate Issuing and |
|   | ENT | security functions (deployed   | Management Components   |
|   |     | in hardware, software, and     | (CIMC) Protection       |
|   |     | firmware) and information is   | Profile.)               |
|   |     | restricted to authorized       |                         |
|   |     | personnel (e.g., security      | 1\. Administrator --    |
|   |     | administrators).               | authorized to install,  |
|   |     |                                | configure, and maintain |
|   |     | Enhancements:                  | the CA; establish and   |
|   |     |                                | maintain user accounts; |
|   |     | \(1\) The information system   | configure profiles and  |
|   |     | ensures that access to         | audit parameters; and   |
|   |     | security functions (deployed   | generate component      |
|   |     | in hardware, software, and     | keys.                   |
|   |     | firmware) and information is   |                         |
|   |     | restricted to authorized       | 2\. Officer --          |
|   |     | personnel (e.g., security      | authorized to request   |
|   |     | administrators).               | or approve certificates |
|   |     |                                | or certificate          |
|   |     | Supplemental Guidance:         | revocations.            |
|   |     |                                |                         |
|   |     | Access control policies (e.g., | 3\. Auditor --          |
|   |     | identity-based policies,       | authorized to maintain  |
|   |     | role-based policies,           | audit logs.             |
|   |     | ruled-based policies) and      |                         |
|   |     | associated access enforcement  | 4\. Operator --         |
|   |     | mechanisms (e.g., access       | authorized to perform   |
|   |     | control lists, access control  | system backup and       |
|   |     | matrices, cryptography) are    | recovery.               |
|   |     | employed by organizations to   |                         |
|   |     | control access between users   | 6.5., Specific Computer |
|   |     | (or processes acting on behalf | Security Technical      |
|   |     | of users) and objects (e.g.,   | Requirements - \"       |
|   |     | devices, files, records,       |                         |
|   |     | processes, programs, domains)  | For the FBCA, the       |
|   |     | in the information system. In  | computer security       |
|   |     | addition to controlling access | functions listed below  |
|   |     | at the information system      | are required. These     |
|   |     | level, access enforcement      | functions may be        |
|   |     | mechanisms are employed at the | provided by the         |
|   |     | application level, when        | operating system, or    |
|   |     | necessary, to provide          | through a combination   |
|   |     | increased information security | of operating system,    |
|   |     | for the organization. If       | software, and physical  |
|   |     | encryption of stored           | safeguards. The FBCA    |
|   |     | information is employed as an  | and its ancillary parts |
|   |     | access enforcement mechanism,  | shall include the       |
|   |     | the cryptography used is FIPS  | following               |
|   |     | 140-2 compliant. If the        | functionality:          |
|   |     | federal Personal Identity      |                         |
|   |     | Verification (PIV) credential  | • Require authenticated |
|   |     | is used as an identification   | logins                  |
|   |     | token where token-based access |                         |
|   |     | control is employed, the       | • Provide Discretionary |
|   |     | access control system conforms | Access Control          |
|   |     | to the requirements of FIPS    |                         |
|   |     | 201 and NIST Special           | • Provide a security    |
|   |     | Publication 800-73 and employs | audit capability        |
|   |     | either cryptographic           |                         |
|   |     | verification or biometric      | • Restrict access       |
|   |     | verification. If the           | control to FBCA         |
|   |     | token-based access control\    | services and PKI roles  |
|   |     | employs cryptographic          |                         |
|   |     | verification, the access       | • Enforce separation of |
|   |     | control\                       | duties for PKI roles\"  |
|   |     | system conforms to the         |                         |
|   |     | requirements of NIST Special   |                         |
|   |     | Publication 800-78. If the     |                         |
|   |     | token-based access control     |                         |
|   |     | employs biometric              |                         |
|   |     | verification, the access       |                         |
|   |     | control system conforms to the |                         |
|   |     | requirements of NIST Special   |                         |
|   |     | Publication 800-76.            |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | A   | Control:                       | FBCA Section:           |
| . | C-4 |                                |                         |
|   |     | The information system         | 2.4 -- Access Controls  |
|   | IN  | enforces assigned              | for Repositories        |
|   | FOR | authorizations for controlling |                         |
|   | MAT | the flow of information within | The FPKI Operational    |
|   | ION | the system and between         | Authority shall protect |
|   | F   | interconnected systems in      | any repository          |
|   | LOW | accordance with applicable     | information not         |
|   | EN  | policy.                        | intended for public     |
|   | FOR |                                | dissemination or        |
|   | CEM | Enhancements:                  | modification.           |
|   | ENT |                                | Certificates and        |
|   |     | None.                          | certificate status      |
|   |     |                                | information in the FBCA |
|   |     | Supplemental Guidance:         | repository shall be     |
|   |     |                                | publicly available      |
|   |     | Information flow control       | through the Internet.   |
|   |     | policies and enforcement       |                         |
|   |     | mechanisms are employed by     | Access to information   |
|   |     | organizations to control the   | in Entity CA            |
|   |     | flow of information between    | repositories shall be   |
|   |     | designated sources and         | determined by the       |
|   |     | destinations (e.g.,            | Entity pursuant to the  |
|   |     | individuals, devices) within   | rules and statutes that |
|   |     | information systems and        | apply to that entity.   |
|   |     | between interconnected systems |                         |
|   |     | based on the characteristics   | 6.7 -- Network Security |
|   |     | of the information. Simple     | Controls                |
|   |     | examples of flow control       |                         |
|   |     | enforcement can be found in    | Network security        |
|   |     | firewall and router devices    | controls shall be       |
|   |     | that employ rule sets or       | employed to protect the |
|   |     | establish configuration        | FBCA and the FBCA       |
|   |     | settings that restrict         | Internal Directory.     |
|   |     | information system services or | Networking equipment    |
|   |     | provide a packet filtering     | shall turn off unused   |
|   |     | capability. Flow control       | network ports and       |
|   |     | enforcement can also be found  | services. Any network   |
|   |     | in information systems that    | software installed on   |
|   |     | use explicit labels on         | the FBCA equipment      |
|   |     | information, source, and       | shall be necessary to   |
|   |     | destination objects as the     | the functioning of the  |
|   |     | basis for flow control         | FBCA.                   |
|   |     | decisions (e.g., to control    |                         |
|   |     | the release of certain types   | The FBCA Border         |
|   |     | of information).               | Directory shall be      |
|   |     |                                | connected to the        |
|   |     |                                | Internet and provide    |
|   |     |                                | continuous service      |
|   |     |                                | (except, when           |
|   |     |                                | necessary, for brief    |
|   |     |                                | periods of maintenance  |
|   |     |                                | or backup).             |
|   |     |                                |                         |
|   |     |                                | Any boundary control    |
|   |     |                                | devices used to protect |
|   |     |                                | the Border directory or |
|   |     |                                | FBCA local area network |
|   |     |                                | shall deny all but the  |
|   |     |                                | necessary services to   |
|   |     |                                | the PKI equipment even  |
|   |     |                                | if those services are   |
|   |     |                                | enabled for other       |
|   |     |                                | devices on the network. |
|   |     |                                |                         |
|   |     |                                | Entity CAs and          |
|   |     |                                | directories shall       |
|   |     |                                | employ appropriate      |
|   |     |                                | network security        |
|   |     |                                | controls. Networking    |
|   |     |                                | equipment shall turn    |
|   |     |                                | off unused network      |
|   |     |                                | ports and services. Any |
|   |     |                                | network software        |
|   |     |                                | present shall be        |
|   |     |                                | necessary to the        |
|   |     |                                | functioning of the      |
|   |     |                                | equipment.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | A   | Control:                       | FBCA Section:           |
| . | C-5 |                                |                         |
|   |     | The information system         | 5.2.4 -- Separation of  |
|   | S   | enforces separation of duties  | Roles                   |
|   | EPA | through assigned access        |                         |
|   | RAT | authorizations.                | (Basic Assurance) -     |
|   | ION |                                | Individual CA personnel |
|   | OF  | Enhancements:                  | shall be specifically   |
|   | DUT |                                | designated to the four  |
|   | IES | None.                          | roles defined in        |
|   |     |                                | Section 5.2.1 above.    |
|   |     | Supplemental Guidance:         | Individuals may assume  |
|   |     |                                | more than one role,     |
|   |     | The organization establishes   | however, no one         |
|   |     | appropriate divisions of       | individual shall assume |
|   |     | responsibility and separates   | both the Officer and    |
|   |     | duties as needed to eliminate  | Administrator roles.    |
|   |     | conflicts of interest in the   | This may be enforced    |
|   |     | responsibilities and duties of | procedurally. No        |
|   |     | individuals. There is access   | individual shall be     |
|   |     | control software on the        | assigned more than one  |
|   |     | information system that        | identity.               |
|   |     | prevents users from having all |                         |
|   |     | of the necessary authority or  | Section 6.5.1 --        |
|   |     | information access to perform  | Specific Computer       |
|   |     | fraudulent activity without    | Security Technical      |
|   |     | collusion. Examples of         | Requirements            |
|   |     | separation of duties include:  |                         |
|   |     | (i) mission functions and      | • Enforce separation of |
|   |     | distinct information system    | duties for PKI roles    |
|   |     | support functions are divided  |                         |
|   |     | among different                |                         |
|   |     | individuals/roles; (ii)        |                         |
|   |     | different individuals perform  |                         |
|   |     | information system support     |                         |
|   |     | functions (e.g., system        |                         |
|   |     | management, systems            |                         |
|   |     | programming, quality           |                         |
|   |     | assurance/testing,             |                         |
|   |     | configuration management, and  |                         |
|   |     | network security); and (iii)   |                         |
|   |     | security personnel who         |                         |
|   |     | administer access control      |                         |
|   |     | functions do not administer    |                         |
|   |     | audit functions.               |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | A   | Control:                       | FBCA Section:           |
| . | C-6 |                                |                         |
|   |     | The information system         | Section 6.5.1 --        |
|   | LE  | enforces the most restrictive  | Specific Computer       |
|   | AST | set of rights/privileges or    | Security Technical      |
|   | PRI | accesses needed by users (or   | Requirements            |
|   | VIL | processes acting on behalf of  |                         |
|   | EGE | users) for the performance of  | For Entity CAs, the     |
|   |     | specified tasks.               | computer security       |
|   |     |                                | functions listed below  |
|   |     | Enhancements:                  | are required. These     |
|   |     |                                | functions may be        |
|   |     | None.                          | provided by the         |
|   |     |                                | operating system, or    |
|   |     | Supplemental Guidance:         | through a combination   |
|   |     |                                | of operating system,    |
|   |     | The organization employs the   | software, and physical  |
|   |     | concept of least privilege for | safeguards. The Entity  |
|   |     | specific duties and            | CA and its ancillary    |
|   |     | information systems (including | parts shall include the |
|   |     | specific ports, protocols, and | following               |
|   |     | services) in accordance with   | functionality:          |
|   |     | risk assessments as necessary  |                         |
|   |     | to adequately mitigate risk to | • authenticate the      |
|   |     | organizational operations,     | identity of users       |
|   |     | organizational assets, and     | before permitting       |
|   |     | individuals.                   | access to the system or |
|   |     |                                | applications;           |
|   |     |                                |                         |
|   |     |                                | • manage privileges of  |
|   |     |                                | users to limit users to |
|   |     |                                | their assigned roles    |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | A   | Control:                       | FBCA Section:           |
| . | C-7 |                                |                         |
|   |     | The information system         | Section 5.4.1 -- Types  |
|   | UNS | enforces a limit of            | of Events Recorded      |
|   | UCC | \[*Assignment:                 |                         |
|   | ESS | organization-defined number*\] | The number of           |
|   | FUL | consecutive invalid access     | unsuccessful            |
|   | LO  | attempts by a user during a    | authentication attempts |
|   | GIN | \[*Assignment:                 | exceeds the maximum     |
|   | AT  | organization-defined time      | authentication attempts |
|   | TEM | period*\] time period. The     | during user login.      |
|   | PTS | information system             |                         |
|   |     | automatically \[*Selection:    | 6.4.2 Activation Data   |
|   |     | locks the account/node for an* | Protection              |
|   |     | \[*Assignment:                 |                         |
|   |     | organization-defined time      | Data used to unlock     |
|   |     | period*\], *delays next login  | private keys shall be   |
|   |     | prompt according to*           | protected from          |
|   |     | \[*Assignment:                 | disclosure by a         |
|   |     | organization-defined delay     | combination of          |
|   |     | algorithm.*\]\] when the       | cryptographic and       |
|   |     | maximum number of unsuccessful | physical access control |
|   |     | attempts is exceeded.          | mechanisms. Activation  |
|   |     |                                | data shall be:          |
|   |     | Enhancements:                  |                         |
|   |     |                                | • memorized             |
|   |     | \(1\) The information system   |                         |
|   |     | automatically locks the        | • biometric in nature,  |
|   |     | account/node until released by | or                      |
|   |     | an administrator\              |                         |
|   |     | when the maximum number of     | • recorded and secured  |
|   |     | unsuccessful attempts is       | at the level of         |
|   |     | exceeded.                      | assurance associated    |
|   |     |                                | with the activation of  |
|   |     | Supplemental Guidance:         | the cryptographic       |
|   |     |                                | module, and shall not   |
|   |     | Due to the potential for       | be stored with the      |
|   |     | denial of service, automatic   | cryptographic module.   |
|   |     | lockouts initiated by the      |                         |
|   |     | information system are usually | The protection          |
|   |     | temporary and automatically    | mechanism shall include |
|   |     | release after a predetermined  | a facility to           |
|   |     | time period established by the | temporarily lock the    |
|   |     | organization.                  | account, or terminate   |
|   |     |                                | the application, after  |
|   |     |                                | a predetermined number  |
|   |     |                                | of failed login         |
|   |     |                                | attempts as set forth   |
|   |     |                                | in the respective CP or |
|   |     |                                | CPS.                    |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | NOT |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | A   | Control:                       | FBCA Section:           |
| . | C-8 |                                |                         |
|   |     | The information system         | None                    |
|   | SYS | displays an approved, system   |                         |
|   | TEM | use notification message       |                         |
|   | USE | before granting system access  |                         |
|   | NOT | informing potential users: (i) |                         |
|   | IFI | that the user is accessing a   |                         |
|   | CAT | U.S. Government information    |                         |
|   | ION | system; (ii) that system usage |                         |
|   |     | may be monitored, recorded,    |                         |
|   |     | and subject to audit; (iii)    |                         |
|   |     | that unauthorized use of the   |                         |
|   |     | system is prohibited and       |                         |
|   |     | subject to criminal and civil  |                         |
|   |     | penalties; and (iv) that use   |                         |
|   |     | of the system indicates        |                         |
|   |     | consent to monitoring and      |                         |
|   |     | recording. The system use      |                         |
|   |     | notification message provides  |                         |
|   |     | appropriate privacy and        |                         |
|   |     | security notices (based on     |                         |
|   |     | associated privacy and         |                         |
|   |     | security policies or           |                         |
|   |     | summaries) and remains on the  |                         |
|   |     | screen until the user takes    |                         |
|   |     | explicit actions to log on to  |                         |
|   |     | the information system.        |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Privacy and security policies  |                         |
|   |     | are consistent with applicable |                         |
|   |     | federal laws, directives,      |                         |
|   |     | policies, regulations,         |                         |
|   |     | standards, and guidance.       |                         |
|   |     | System use notification        |                         |
|   |     | messages can be implemented in |                         |
|   |     | the form of warning banners    |                         |
|   |     | displayed when individuals log |                         |
|   |     | in to the information system.  |                         |
|   |     | For publicly accessible        |                         |
|   |     | systems: (i) the system use    |                         |
|   |     | information is available as    |                         |
|   |     | opposed to displaying the      |                         |
|   |     | information before granting    |                         |
|   |     | access; (ii) there are no      |                         |
|   |     | references to monitoring,      |                         |
|   |     | recording, or auditing since   |                         |
|   |     | privacy accommodations for     |                         |
|   |     | such systems generally         |                         |
|   |     | prohibit those activities; and |                         |
|   |     | (iii) the notice given to      |                         |
|   |     | public users of the            |                         |
|   |     | information system includes a  |                         |
|   |     | description of the authorized  |                         |
|   |     | uses of the system.            |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | A   | Control:                       | FBCA Section:           |
| . | C-9 |                                |                         |
|   |     | The information system         | None                    |
|   | PR  | notifies the user, upon        |                         |
|   | EVI | successful logon, of the date  |                         |
|   | OUS | and time of the last logon,    |                         |
|   | LO  | and the number of unsuccessful |                         |
|   | GON | logon attempts since the last  |                         |
|   | NOT | successful logon.              |                         |
|   | IFI |                                |                         |
|   | CAT | Enhancements:                  |                         |
|   | ION |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 0 | -10 |                                |                         |
| . |     | The information system limits  | None                    |
|   | C   | the number of concurrent       |                         |
|   | ONC | sessions for any user to       |                         |
|   | URR | \[*Assignment:                 |                         |
|   | ENT | organization-defined number of |                         |
|   | S   | sessions*\].                   |                         |
|   | ESS |                                |                         |
|   | ION | Enhancements:                  |                         |
|   | C   |                                |                         |
|   | ONT | None.                          |                         |
|   | ROL |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 1 | -11 |                                |                         |
| . |     | The information system         | None                    |
|   | S   | prevents further access to the |                         |
|   | ESS | system by initiating a session |                         |
|   | ION | lock that remains in effect    |                         |
|   | L   | until the user reestablishes   |                         |
|   | OCK | access using appropriate       |                         |
|   |     | identification and             |                         |
|   |     | authentication procedures.     |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Users can directly initiate    |                         |
|   |     | session lock mechanisms. The   |                         |
|   |     | information system also        |                         |
|   |     | activates session lock         |                         |
|   |     | mechanisms automatically after |                         |
|   |     | a specified period of          |                         |
|   |     | inactivity defined by the      |                         |
|   |     | organization. A session lock   |                         |
|   |     | is not a substitute for        |                         |
|   |     | logging out of the information |                         |
|   |     | system.                        |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 2 | -12 |                                |                         |
| . |     | The information system         | None                    |
|   | S   | automatically terminates a     |                         |
|   | ESS | session after \[*Assignment:   |                         |
|   | ION | organization-defined time      |                         |
|   | TE  | period*\] of inactivity.       |                         |
|   | RMI |                                |                         |
|   | NAT | Enhancements:                  |                         |
|   | ION |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 3 | -13 |                                |                         |
| . |     | The organization supervises    | Section 5.2.1.3 Auditor |
|   | SU  | and reviews the activities of  |                         |
|   | PER | users with respect to the      | The auditor role is     |
|   | VIS | enforcement and usage of       | responsible for:        |
|   | ION | information system access      |                         |
|   | AND | controls.                      | • Reviewing,            |
|   | REV |                                | maintaining, and        |
|   | IEW | Enhancements:                  | archiving audit logs;   |
|   | --- |                                |                         |
|   | ACC | \(1\) The organization employs | • Performing or         |
|   | ESS | automated mechanisms to        | overseeing internal     |
|   | C   | facilitate the review of user  | compliance audits to    |
|   | ONT | activities.                    | ensure that the FBCA or |
|   | ROL |                                | Entity CA is operating  |
|   |     | Supplemental Guidance:         | in accordance with its  |
|   |     |                                | CPS;                    |
|   |     | The organization reviews audit |                         |
|   |     | records (e.g., user activity   | 5.2.4 -- Separation of  |
|   |     | logs) for inappropriate        | Roles                   |
|   |     | activities in accordance with  |                         |
|   |     | organizational procedures. The | (Basic Assurance) -     |
|   |     | organization investigates any  | Individual CA personnel |
|   |     | unusual information            | shall be specifically   |
|   |     | system-related activities and  | designated to the four  |
|   |     | periodically reviews changes   | roles defined in        |
|   |     | to access authorizations. The  | Section 5.2.1 above.    |
|   |     | organization reviews more      | Individuals may assume  |
|   |     | frequently, the activities of  | more than one role,     |
|   |     | users with significant         | however, no one         |
|   |     | information system roles and   | individual shall assume |
|   |     | responsibilities.              | both the Officer and    |
|   |     |                                | Administrator roles.    |
|   |     |                                | This may be enforced    |
|   |     |                                | procedurally. No        |
|   |     |                                | individual shall be     |
|   |     |                                | assigned more than one  |
|   |     |                                | identity.               |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | Ab  |                                |                         |
|   | ove |                                |                         |
|   | X-C |                                |                         |
|   | ERT |                                |                         |
|   | D** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 4 | -14 |                                |                         |
| . |     | The organization identifies    | Section 5.2.3           |
|   | PER | specific user actions that can | Identification and      |
|   | MIT | be performed on the            | Authentication for Each |
|   | TED | information system without     | Role                    |
|   | A   | identification or              |                         |
|   | CTI | authentication.                | At all assurance levels |
|   | ONS |                                | other than Rudimentary, |
|   | W   | Enhancements:                  | an individual shall     |
|   | ITH |                                | identify and            |
|   | OUT | \(1\) The organization permits | authenticate            |
|   | ID  | actions to be performed        | him/herself before      |
|   | ENT | without identification and     | being permitted to      |
|   | IFI | authentication only to the     | perform any actions set |
|   | CAT | extent necessary to accomplish | forth above for that    |
|   | ION | mission objectives.            | role or identity.       |
|   | OR  |                                |                         |
|   | AU  | Supplemental Guidance:         |                         |
|   | THE |                                |                         |
|   | NTI | The organization allows        |                         |
|   | CAT | limited user activity without  |                         |
|   | ION | identification and             |                         |
|   |     | authentication for public      |                         |
|   |     | websites or other publicly     |                         |
|   |     | available information systems. |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 5 | -15 |                                |                         |
| . |     | The information system marks   | Section 3.1, Naming and |
|   | AUT | output using standard naming   | Identification          |
|   | OMA | conventions to identify any    |                         |
|   | TED | special dissemination,         | For Entity CAs, the     |
|   | M   | handling, or distribution      | following rules apply.  |
|   | ARK | instructions*.*                | All CA and RA           |
|   | ING |                                | certificates shall      |
|   |     | Enhancements:                  | include a non-NULL      |
|   |     |                                | subject DN. All         |
|   |     | None.                          | certificates issued to  |
|   |     |                                | end entities, except    |
|   |     | Supplemental Guidance:         | those issued at the     |
|   |     |                                | Rudimentary level of    |
|   |     | Automated marking refers to    | assurance, shall        |
|   |     | labels employed on external    | include a non-NULL      |
|   |     | media (e.g., hardcopy          | subject DN.             |
|   |     | documents output from the      | Certificates issued at  |
|   |     | information system). The       | the Rudimentary level   |
|   |     | labels used in external        | of assurance may        |
|   |     | marking is distinguished from  | include a null subject  |
|   |     | the labels used on internal    | DN if they include at   |
|   |     | data structures described in   | least one alternative   |
|   |     | AC-16.                         | name form. Certificates |
|   |     |                                | at all levels of        |
|   |     |                                | assurance may include   |
|   |     |                                | alternative name forms. |
|   |     |                                | This CP does not        |
|   |     |                                | restrict the types of   |
|   |     |                                | names that can be used. |
|   |     |                                |                         |
|   |     |                                | 5.1.2.1 Physical Access |
|   |     |                                | for CA Equipment        |
|   |     |                                |                         |
|   |     |                                | • Ensure all removable  |
|   |     |                                | media and paper         |
|   |     |                                | containing sensitive    |
|   |     |                                | plain-text information  |
|   |     |                                | is stored in secure     |
|   |     |                                | containers              |
|   |     |                                |                         |
|   |     |                                | 5.1.6 Media Storage     |
|   |     |                                |                         |
|   |     |                                | FBCA and Entity CA      |
|   |     |                                | media shall be stored   |
|   |     |                                | so as to protect it     |
|   |     |                                | from accidental damage  |
|   |     |                                | (water, fire,           |
|   |     |                                | electromagnetic).       |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 6 | -16 |                                |                         |
| . |     | The information system         | 5.1.2.1 Physical Access |
|   | AUT | appropriately labels           | for CA Equipment        |
|   | OMA | information in storage, in     |                         |
|   | TED | process, and in transmission.  | • Ensure all removable  |
|   | LA  |                                | media and paper         |
|   | BEL | Enhancements:                  | containing sensitive    |
|   | ING |                                | plain-text information  |
|   |     | Supplemental Guidance:         | is stored in secure     |
|   |     |                                | containers              |
|   |     | Automated marking refers to    |                         |
|   |     | labels employed on external    | 5.1.6 Media Storage     |
|   |     | media (e.g., hardcopy          |                         |
|   |     | documents output from the      | FBCA and Entity CA      |
|   |     | information system). The       | media shall be stored   |
|   |     | labels used in external        | so as to protect it     |
|   |     | marking is distinguished from  | from accidental damage  |
|   |     | the labels used on internal    | (water, fire,           |
|   |     | data structures described in   | electromagnetic).       |
|   |     | AC-16.                         |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 7 | -17 |                                |                         |
| . |     | The organization documents,    | 6.7 -- Network Security |
|   | REM | monitors, and controls all     | Controls                |
|   | OTE | methods of remote access       |                         |
|   | ACC | (e.g., dial-up, Internet) to   | Network security        |
|   | ESS | the information system         | controls shall be       |
|   |     | including remote access for    | employed to protect the |
|   |     | privileged functions.          | FBCA and the FBCA       |
|   |     | Appropriate organization       | Internal Directory.     |
|   |     | officials authorize each       | Networking equipment    |
|   |     | remote access method for the   | shall turn off unused   |
|   |     | information system and         | network ports and       |
|   |     | authorize only the necessary   | services. Any network   |
|   |     | users for each access method.  | software installed on   |
|   |     |                                | the FBCA equipment      |
|   |     | Enhancements:                  | shall be necessary to   |
|   |     |                                | the functioning of the  |
|   |     | \(1\) The organization employs | FBCA.                   |
|   |     | automated mechanisms to        |                         |
|   |     | facilitate the monitoring and  | The FBCA Border         |
|   |     | control of remote access       | Directory shall be      |
|   |     | methods.\                      | connected to the        |
|   |     | (2) The organization uses      | Internet and provide    |
|   |     | encryption to protect the      | continuous service      |
|   |     | confidentiality of remote      | (except, when           |
|   |     | access sessions.\              | necessary, for brief    |
|   |     | (3) The organization controls  | periods of maintenance  |
|   |     | all remote accesses through a  | or backup).             |
|   |     | managed access control point.  |                         |
|   |     |                                | Any boundary control    |
|   |     | Supplemental Guidance:         | devices used to protect |
|   |     |                                | the Border directory or |
|   |     | Remote access controls are     | FBCA local area network |
|   |     | applicable to information      | shall deny all but the  |
|   |     | systems other than public web  | necessary services to   |
|   |     | servers or systems             | the PKI equipment even  |
|   |     | specifically designed for      | if those services are   |
|   |     | public access. The             | enabled for other       |
|   |     | organization restricts access  | devices on the network. |
|   |     | achieved through dial-up       |                         |
|   |     | connections (e.g., limiting    | Entity CAs and          |
|   |     | dial-up access based upon      | directories shall       |
|   |     | source of request) or protects | employ appropriate      |
|   |     | against unauthorized           | network security        |
|   |     | connections or subversion of   | controls. Networking    |
|   |     | authorized connections (e.g.,  | equipment shall turn    |
|   |     | using virtual private network  | off unused network      |
|   |     | technology). The organization  | ports and services. Any |
|   |     | permits remote access for      | network software        |
|   |     | privileged functions only for  | present shall be        |
|   |     | compelling operational needs.  | necessary to the        |
|   |     | NIST Special Publication       | functioning of the      |
|   |     | 800-63 provides guidance on    | equipment.              |
|   |     | remote electronic              |                         |
|   |     | authentication. If the federal |                         |
|   |     | Personal Identity Verification |                         |
|   |     | (PIV) credential is used as an |                         |
|   |     | identification token where     |                         |
|   |     | cryptographic token-based      |                         |
|   |     | access control is employed,    |                         |
|   |     | the access control system      |                         |
|   |     | conforms to the requirements   |                         |
|   |     | of FIPS 201 and NIST Special   |                         |
|   |     | Publications 800-73 and        |                         |
|   |     | 800-78. NIST Special           |                         |
|   |     | Publication 800-77 provides    |                         |
|   |     | guidance on IPsec-based        |                         |
|   |     | virtual private networks.      |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | NOT |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 8 | -18 |                                |                         |
| . |     | The organization: (i)          | 6.7 -- Network Security |
|   | WI  | establishes usage restrictions | Controls                |
|   | REL | and implementation guidance    |                         |
|   | ESS | for wireless technologies; and | Network security        |
|   | ACC | (ii) documents, monitors, and  | controls shall be       |
|   | ESS | controls wireless access to    | employed to protect the |
|   | RES | the information system.        | FBCA and the FBCA       |
|   | TRI | Appropriate organizational     | Internal Directory.     |
|   | CTI | officials authorize the use of | Networking equipment    |
|   | ONS | wireless technologies.         | shall turn off unused   |
|   |     |                                | network ports and       |
|   |     | Enhancements:                  | services. Any network   |
|   |     |                                | software installed on   |
|   |     | \(1\) The organization uses    | the FBCA equipment      |
|   |     | authentication and encryption  | shall be necessary to   |
|   |     | to protect wireless access to  | the functioning of the  |
|   |     | the information system.        | FBCA.                   |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | The FBCA Border         |
|   |     |                                | Directory shall be      |
|   |     | NIST Special Publication       | connected to the        |
|   |     | 800-48 provides guidance on    | Internet and provide    |
|   |     | wireless network security.     | continuous service      |
|   |     |                                | (except, when           |
|   |     |                                | necessary, for brief    |
|   |     |                                | periods of maintenance  |
|   |     |                                | or backup).             |
|   |     |                                |                         |
|   |     |                                | Any boundary control    |
|   |     |                                | devices used to protect |
|   |     |                                | the Border directory or |
|   |     |                                | FBCA local area network |
|   |     |                                | shall deny all but the  |
|   |     |                                | necessary services to   |
|   |     |                                | the PKI equipment even  |
|   |     |                                | if those services are   |
|   |     |                                | enabled for other       |
|   |     |                                | devices on the network. |
|   |     |                                |                         |
|   |     |                                | Entity CAs and          |
|   |     |                                | directories shall       |
|   |     |                                | employ appropriate      |
|   |     |                                | network security        |
|   |     |                                | controls. Networking    |
|   |     |                                | equipment shall turn    |
|   |     |                                | off unused network      |
|   |     |                                | ports and services. Any |
|   |     |                                | network software        |
|   |     |                                | present shall be        |
|   |     |                                | necessary to the        |
|   |     |                                | functioning of the      |
|   |     |                                | equipment.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | AC  | Control:                       | FBCA Section:           |
| 9 | -19 |                                |                         |
| . |     | The organization: (i)          | None                    |
|   | ACC | establishes usage restrictions |                         |
|   | ESS | and implementation guidance    |                         |
|   | C   | for portable and mobile        |                         |
|   | ONT | devices; and (ii) documents,   |                         |
|   | ROL | monitors, and controls device  |                         |
|   | FOR | access to organizational       |                         |
|   | PO  | networks. Appropriate          |                         |
|   | RTA | organizational officials       |                         |
|   | BLE | authorize the use of portable  |                         |
|   | AND | and mobile devices.            |                         |
|   | MOB |                                |                         |
|   | ILE | Enhancements:                  |                         |
|   | D   |                                |                         |
|   | EVI | \(1\) The organization employs |                         |
|   | CES | removable hard drives or       |                         |
|   |     | cryptography to protect        |                         |
|   |     | information residing\          |                         |
|   |     | on portable and mobile         |                         |
|   |     | devices.                       |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Portable and mobile devices    |                         |
|   |     | (e.g., notebook computers,     |                         |
|   |     | workstations, personal digital |                         |
|   |     | assistants) are not allowed    |                         |
|   |     | access to organizational       |                         |
|   |     | networks without first meeting |                         |
|   |     | organizational security        |                         |
|   |     | policies and procedures.       |                         |
|   |     | Security policies and          |                         |
|   |     | procedures might include such  |                         |
|   |     | activities as scanning the     |                         |
|   |     | devices for malicious code,    |                         |
|   |     | updating virus protection      |                         |
|   |     | software, scanning for         |                         |
|   |     | critical software updates and  |                         |
|   |     | patches, conducting primary    |                         |
|   |     | operating system (and possibly |                         |
|   |     | other resident software)       |                         |
|   |     | integrity checks, and          |                         |
|   |     | disabling unnecessary hardware |                         |
|   |     | (e.g., wireless).              |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | AC  | Control:                       | FBCA Section:           |
| 0 | -20 |                                |                         |
| . |     | The organization restricts the | None                    |
|   | P   | use of personally owned        |                         |
|   | ERS | information systems for        |                         |
|   | ONA | official U.S. Government       |                         |
|   | LLY | business involving the         |                         |
|   | OW  | processing, storage, or        |                         |
|   | NED | transmission of federal        |                         |
|   | IN  | information.                   |                         |
|   | FOR |                                |                         |
|   | MAT | Enhancements:                  |                         |
|   | ION |                                |                         |
|   | S   | None.                          |                         |
|   | YST |                                |                         |
|   | EMS | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The organization establishes   |                         |
|   |     | strict terms and conditions    |                         |
|   |     | for the use of personally      |                         |
|   |     | owned information systems when |                         |
|   |     | accessing federal information  |                         |
|   |     | and information systems. The   |                         |
|   |     | terms and conditions should    |                         |
|   |     | address, at a minimum: (i) the |                         |
|   |     | types of applications that can |                         |
|   |     | be accessed from personally    |                         |
|   |     | owned information systems;     |                         |
|   |     | (ii) the maximum FIPS 199      |                         |
|   |     | security category of           |                         |
|   |     | information that can           |                         |
|   |     | processed, stored, and         |                         |
|   |     | transmitted; (iii) how other   |                         |
|   |     | users of the personally owned  |                         |
|   |     | information system or          |                         |
|   |     | individuals with potential     |                         |
|   |     | access to the information      |                         |
|   |     | system, are prevented from     |                         |
|   |     | accessing federal information; |                         |
|   |     | (iv) the use of virtual        |                         |
|   |     | private networking (VPN) and   |                         |
|   |     | firewall technologies; (v) the |                         |
|   |     | use of and protection against  |                         |
|   |     | the vulnerabilities of         |                         |
|   |     | wireless technologies; (vi)    |                         |
|   |     | the use of adequate physical   |                         |
|   |     | security controls; (vii) the   |                         |
|   |     | use of malicious code          |                         |
|   |     | protection software; (viii)    |                         |
|   |     | how often the security         |                         |
|   |     | capabilities of installed      |                         |
|   |     | software are to be updated     |                         |
|   |     | (e.g., operating system and    |                         |
|   |     | other software security        |                         |
|   |     | patches, virus definitions,    |                         |
|   |     | firewall version updates,      |                         |
|   |     | spyware definitions); and (ix) |                         |
|   |     | any other technologies, the    |                         |
|   |     | application of which, may      |                         |
|   |     | result in vulnerabilities      |                         |
|   |     | causing potential comprise of  |                         |
|   |     | federal information.           |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 1 | T-1 |                                |                         |
| . |     | The organization develops,     | 5.3.3 Training          |
|   | SE  | disseminates, and periodically | Requirements            |
|   | CUR | reviews/updates: (i) a formal, |                         |
|   | ITY | documented, security awareness | All personnel           |
|   | AWA | and training policy that       | performing duties with  |
|   | REN | addresses purpose, scope,      | respect to the          |
|   | ESS | roles, responsibilities,       | operation of the FBCA   |
|   | AND | management commitment,         | or Entity CA shall      |
|   | TR  | coordination among             | receive comprehensive   |
|   | AIN | organizational entities, and   | training in all         |
|   | ING | compliance; and (ii) formal,   | operational duties they |
|   | POL | documented procedures to       | are expected to         |
|   | ICY | facilitate the implementation  | perform, including      |
|   | AND | of the security awareness and  | disaster recovery and   |
|   | P   | training policy and associated | business continuity     |
|   | ROC | security awareness and         | procedures.             |
|   | EDU | training controls.             |                         |
|   | RES |                                | In addition, personnel  |
|   |     | Enhancements:                  | performing duties with  |
|   |     |                                | respect to the          |
|   |     | None.                          | operation of the FBCA   |
|   |     |                                | or Entity CA shall      |
|   |     | Supplemental Guidance:         | receive comprehensive   |
|   |     |                                | training, or            |
|   |     | The security awareness and     | demonstrate competence, |
|   |     | training policy and procedures | in the following areas: |
|   |     | are consistent with applicable |                         |
|   |     | federal laws, directives,      | • CA/RA security        |
|   |     | policies, regulations,         | principles and          |
|   |     | standards, and guidance. The   | mechanisms;             |
|   |     | security awareness and         |                         |
|   |     | training policy can be         | • All PKI software      |
|   |     | included as part of the        | versions in use on the  |
|   |     | general information security   | CA system.              |
|   |     | policy for the organization.   |                         |
|   |     | Security awareness and         | Documentation shall be  |
|   |     | training procedures can be     | maintained identifying  |
|   |     | developed for the security     | all personnel who       |
|   |     | program in general, and for a  | received training and   |
|   |     | particular information system, | the level of training   |
|   |     | when required. NIST Special    | completed. Where        |
|   |     | Publications 800-16 and 800-50 | competence was          |
|   |     | provide guidance on security   | demonstrated in lieu of |
|   |     | awareness and training. NIST   | training, supporting    |
|   |     | Special Publication 800-12     | documentation shall be  |
|   |     | provides guidance on security  | maintained.             |
|   |     | policies and procedures.       |                         |
|   |     |                                | 5.3.4 Retraining        |
|   |     |                                | Frequency &             |
|   |     |                                | Requirements            |
|   |     |                                |                         |
|   |     |                                | Individuals responsible |
|   |     |                                | for PKI roles shall be  |
|   |     |                                | aware of changes in the |
|   |     |                                | FBCA and Entity CA      |
|   |     |                                | operation. Any          |
|   |     |                                | significant change to   |
|   |     |                                | the operations shall    |
|   |     |                                | have a training         |
|   |     |                                | (awareness) plan, and   |
|   |     |                                | the execution of such   |
|   |     |                                | plan shall be           |
|   |     |                                | documented. Examples of |
|   |     |                                | such changes are FBCA   |
|   |     |                                | and Entity CA software  |
|   |     |                                | or hardware upgrade,    |
|   |     |                                | changes in automated    |
|   |     |                                | security systems, and   |
|   |     |                                | relocation of           |
|   |     |                                | equipment.              |
|   |     |                                |                         |
|   |     |                                | Documentation shall be  |
|   |     |                                | maintained identifying  |
|   |     |                                | all personnel who       |
|   |     |                                | received training and   |
|   |     |                                | the level of training   |
|   |     |                                | completed.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 2 | T-2 |                                |                         |
| . |     | The organization ensures all   | 5.3.3 Training          |
|   | SE  | users (including managers and  | Requirements            |
|   | CUR | senior executives) are exposed |                         |
|   | ITY | to basic information system    | All personnel           |
|   | AWA | security awareness materials   | performing duties with  |
|   | REN | before authorizing access to   | respect to the          |
|   | ESS | the system and *\[Assignment:  | operation of the FBCA   |
|   |     | organization-defined           | or Entity CA shall      |
|   |     | frequency, at least            | receive comprehensive   |
|   |     | annually\]* thereafter.        | training in all         |
|   |     |                                | operational duties they |
|   |     | Enhancements:                  | are expected to         |
|   |     |                                | perform, including      |
|   |     | None.                          | disaster recovery and   |
|   |     |                                | business continuity     |
|   |     | Supplemental Guidance:         | procedures.             |
|   |     |                                |                         |
|   |     | The organization determines    | In addition, personnel  |
|   |     | the appropriate content of     | performing duties with  |
|   |     | security awareness training    | respect to the          |
|   |     | based on the specific          | operation of the FBCA   |
|   |     | requirements of the            | or Entity CA shall      |
|   |     | organization and the           | receive comprehensive   |
|   |     | information systems to which   | training, or            |
|   |     | personnel have authorized      | demonstrate competence, |
|   |     | access. The organization's     | in the following areas: |
|   |     | security awareness program is  |                         |
|   |     | consistent with the            | • CA/RA security        |
|   |     | requirements contained in 5    | principles and          |
|   |     | C.F.R. Part 930.301 and with   | mechanisms;             |
|   |     | the guidance in NIST Special   |                         |
|   |     | Publication 800-50.            | • All PKI software      |
|   |     |                                | versions in use on the  |
|   |     |                                | CA system.              |
|   |     |                                |                         |
|   |     |                                | Documentation shall be  |
|   |     |                                | maintained identifying  |
|   |     |                                | all personnel who       |
|   |     |                                | received training and   |
|   |     |                                | the level of training   |
|   |     |                                | completed. Where        |
|   |     |                                | competence was          |
|   |     |                                | demonstrated in lieu of |
|   |     |                                | training, supporting    |
|   |     |                                | documentation shall be  |
|   |     |                                | maintained.             |
|   |     |                                |                         |
|   |     |                                | 5.3.4 Retraining        |
|   |     |                                | Frequency &             |
|   |     |                                | Requirements            |
|   |     |                                |                         |
|   |     |                                | Individuals responsible |
|   |     |                                | for PKI roles shall be  |
|   |     |                                | aware of changes in the |
|   |     |                                | FBCA and Entity CA      |
|   |     |                                | operation. Any          |
|   |     |                                | significant change to   |
|   |     |                                | the operations shall    |
|   |     |                                | have a training         |
|   |     |                                | (awareness) plan, and   |
|   |     |                                | the execution of such   |
|   |     |                                | plan shall be           |
|   |     |                                | documented. Examples of |
|   |     |                                | such changes are FBCA   |
|   |     |                                | and Entity CA software  |
|   |     |                                | or hardware upgrade,    |
|   |     |                                | changes in automated    |
|   |     |                                | security systems, and   |
|   |     |                                | relocation of           |
|   |     |                                | equipment.              |
|   |     |                                |                         |
|   |     |                                | Documentation shall be  |
|   |     |                                | maintained identifying  |
|   |     |                                | all personnel who       |
|   |     |                                | received training and   |
|   |     |                                | the level of training   |
|   |     |                                | completed.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 3 | T-3 |                                |                         |
| . |     | The organization identifies    | 5.3.3 Training          |
|   | SE  | personnel with significant     | Requirements            |
|   | CUR | information system security    |                         |
|   | ITY | roles and responsibilities,    | All personnel           |
|   | TR  | documents those roles and      | performing duties with  |
|   | AIN | responsibilities, and provides | respect to the          |
|   | ING | appropriate information system | operation of the FBCA   |
|   |     | security training before       | or Entity CA shall      |
|   |     | authorizing access to the      | receive comprehensive   |
|   |     | system and *\[Assignment:      | training in all         |
|   |     | organization-defined           | operational duties they |
|   |     | frequency\]* thereafter.       | are expected to         |
|   |     |                                | perform, including      |
|   |     | Enhancements:                  | disaster recovery and   |
|   |     |                                | business continuity     |
|   |     | None.                          | procedures.             |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | In addition, personnel  |
|   |     |                                | performing duties with  |
|   |     | The organization determines    | respect to the          |
|   |     | the appropriate content of     | operation of the FBCA   |
|   |     | security training based on the | or Entity CA shall      |
|   |     | specific requirements of the   | receive comprehensive   |
|   |     | organization and the           | training, or            |
|   |     | information systems to which   | demonstrate competence, |
|   |     | personnel have authorized      | in the following areas: |
|   |     | access. In addition, the       |                         |
|   |     | organization ensures system    | • CA/RA security        |
|   |     | managers, system               | principles and          |
|   |     | administrators, and other      | mechanisms;             |
|   |     | personnel having access to     |                         |
|   |     | system-level software have     | • All PKI software      |
|   |     | adequate technical training to | versions in use on the  |
|   |     | perform their assigned duties. | CA system.              |
|   |     | The organization's security    |                         |
|   |     | training program is consistent | Documentation shall be  |
|   |     | with the requirements          | maintained identifying  |
|   |     | contained in 5 C.F.R. Part     | all personnel who       |
|   |     | 930.301 and with the guidance  | received training and   |
|   |     | in NIST Special Publication    | the level of training   |
|   |     | 800-50.                        | completed. Where        |
|   |     |                                | competence was          |
|   |     |                                | demonstrated in lieu of |
|   |     |                                | training, supporting    |
|   |     |                                | documentation shall be  |
|   |     |                                | maintained.             |
|   |     |                                |                         |
|   |     |                                | 5.3.4 Retraining        |
|   |     |                                | Frequency &             |
|   |     |                                | Requirements            |
|   |     |                                |                         |
|   |     |                                | Individuals responsible |
|   |     |                                | for PKI roles shall be  |
|   |     |                                | aware of changes in the |
|   |     |                                | FBCA and Entity CA      |
|   |     |                                | operation. Any          |
|   |     |                                | significant change to   |
|   |     |                                | the operations shall    |
|   |     |                                | have a training         |
|   |     |                                | (awareness) plan, and   |
|   |     |                                | the execution of such   |
|   |     |                                | plan shall be           |
|   |     |                                | documented. Examples of |
|   |     |                                | such changes are FBCA   |
|   |     |                                | and Entity CA software  |
|   |     |                                | or hardware upgrade,    |
|   |     |                                | changes in automated    |
|   |     |                                | security systems, and   |
|   |     |                                | relocation of           |
|   |     |                                | equipment.              |
|   |     |                                |                         |
|   |     |                                | Documentation shall be  |
|   |     |                                | maintained identifying  |
|   |     |                                | all personnel who       |
|   |     |                                | received training and   |
|   |     |                                | the level of training   |
|   |     |                                | completed.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 4 | T-4 |                                |                         |
| . |     | The organization documents and | 5.3.4 Retraining        |
|   | SE  | monitors individual            | Frequency &             |
|   | CUR | information system security    | Requirements            |
|   | ITY | training activities including  |                         |
|   | TR  | basic security awareness       | Individuals responsible |
|   | AIN | training and specific          | for PKI roles shall be  |
|   | ING | information system security    | aware of changes in the |
|   | R   | training.                      | FBCA and Entity CA      |
|   | ECO |                                | operation. Any          |
|   | RDS | Enhancements:                  | significant change to   |
|   |     |                                | the operations shall    |
|   |     | None.                          | have a training         |
|   |     |                                | (awareness) plan, and   |
|   |     | Supplemental Guidance:         | the execution of such   |
|   |     |                                | plan shall be           |
|   |     | None.                          | documented. Examples of |
|   |     |                                | such changes are FBCA   |
|   |     |                                | and Entity CA software  |
|   |     |                                | or hardware upgrade,    |
|   |     |                                | changes in automated    |
|   |     |                                | security systems, and   |
|   |     |                                | relocation of           |
|   |     |                                | equipment.              |
|   |     |                                |                         |
|   |     |                                | Documentation shall be  |
|   |     |                                | maintained identifying  |
|   |     |                                | all personnel who       |
|   |     |                                | received training and   |
|   |     |                                | the level of training   |
|   |     |                                | completed.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 5 | T-5 |                                |                         |
| . |     | The organization establishes   | None                    |
|   | CO  | and maintains contacts with    |                         |
|   | NTA | special interest groups,       |                         |
|   | CTS | specialized forums, or         |                         |
|   | W   | professional associations to   |                         |
|   | ITH | stay up to date with the       |                         |
|   | SE  | latest recommended security    |                         |
|   | CUR | practices, techniques, and     |                         |
|   | ITY | technologies.                  |                         |
|   | GRO |                                |                         |
|   | UPS | Enhancements:                  |                         |
|   | AND |                                |                         |
|   | ASS | None.                          |                         |
|   | OCI |                                |                         |
|   | ATI | Supplemental Guidance:         |                         |
|   | ONS |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 6 | U-1 |                                |                         |
| . |     | The organization develops,     | For brevity, the        |
|   | AU  | disseminates, and periodically | contents of the Audit   |
|   | DIT | reviews/updates: (i) a formal, | Logging Procedures      |
|   | AND | documented, audit and          | section of the FBCA CP  |
|   | AC  | accountability policy that     | are listed below:       |
|   | COU | addresses purpose, scope,      |                         |
|   | NTA | roles, responsibilities,       | 5.4 AUDIT LOGGING       |
|   | BIL | management commitment,         | PROCEDURES              |
|   | ITY | coordination among             |                         |
|   | POL | organizational entities, and   | 5.4.1 Types of Events   |
|   | ICY | compliance; and (ii) formal,   | Recorded                |
|   | AND | documented procedures to       |                         |
|   | P   | facilitate the implementation  | 5.4.2 Frequency of      |
|   | ROC | of the audit and               | Processing Log          |
|   | EDU | accountability policy and      |                         |
|   | RES | associated audit and           | 5.4.3 Retention Period  |
|   |     | accountability controls.       | for Audit Logs          |
|   |     |                                |                         |
|   |     | Enhancements:                  | 5.4.4 Protection of     |
|   |     |                                | Audit Logs              |
|   |     | None.                          |                         |
|   |     |                                | 5.4.5 Audit Log Backup  |
|   |     | Supplemental Guidance:         | Procedures              |
|   |     |                                |                         |
|   |     | The audit and accountability   | 5.4.6 Audit Collection  |
|   |     | policy and procedures are      | System (internal vs.    |
|   |     | consistent with applicable     | external)               |
|   |     | federal laws, directives,      |                         |
|   |     | policies, regulations,         | 5.4.7 Notification to   |
|   |     | standards, and guidance. The   | Event-Causing Subject   |
|   |     | audit and accountability       |                         |
|   |     | policy can be included as part | 5.4.8 Vulnerability     |
|   |     | of the general information     | Assessments             |
|   |     | security policy for the        |                         |
|   |     | organization. Audit and        |                         |
|   |     | accountability procedures can  |                         |
|   |     | be developed for the security  |                         |
|   |     | program in general, and for a  |                         |
|   |     | particular information system, |                         |
|   |     | when required. NIST Special    |                         |
|   |     | Publication 800-12 provides    |                         |
|   |     | guidance on security policies  |                         |
|   |     | and procedures.                |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 7 | U-2 |                                |                         |
| . |     | The information system         | Section 5.4.1 Types of  |
|   | AUD | generates audit records for    | Events Recorded         |
|   | ITA | the following events:          |                         |
|   | BLE | \[*Assignment:                 | A message from any      |
|   | EVE | organization-defined auditable | source received by the  |
|   | NTS | events*\].                     | FBCA or Entity CA       |
|   |     |                                | requesting an action    |
|   |     | Enhancements:                  | related to the          |
|   |     |                                | operational state of    |
|   |     | \(1\) The information system   | the CA is an auditable  |
|   |     | provides the capability to     | event. At a minimum,    |
|   |     | include additional, more       | each audit record shall |
|   |     | detailed information in the    | include the following   |
|   |     | audit records for audit events | (either recorded        |
|   |     | identified by type, location,  | automatically or        |
|   |     | or subject.\                   | manually for each       |
|   |     | (2) The information system     | auditable event):       |
|   |     | provides the capability to     |                         |
|   |     | manage the selection of events | • The type of event,    |
|   |     | to be audited by\              |                         |
|   |     | individual components of the   | • The date and time the |
|   |     | system.                        | event occurred,         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | • A success or failure  |
|   |     |                                | indicator, where        |
|   |     | The organization specifies     | appropriate             |
|   |     | which information system       |                         |
|   |     | components carry out auditing  | • The identity of the   |
|   |     | activities. Auditing activity  | entity and/or operator  |
|   |     | can affect information system  | (of the FBCA or Entity  |
|   |     | performance. Therefore, the    | CA) that caused the     |
|   |     | organization decides, based    | event,                  |
|   |     | upon a risk assessment, which  |                         |
|   |     | events require auditing on a   | Detailed audit          |
|   |     | continuous basis and which     | requirements are listed |
|   |     | events require auditing in     | in the table below      |
|   |     | response to specific           | according to the level  |
|   |     | situations. The checklists and | of assurance. The FBCA  |
|   |     | configuration guides at        | shall record the events |
|   |     | http                           | identified in the table |
|   |     | ://csrc.nist.gov/pcig/cig.html | for High Assurance.     |
|   |     | provide recommended lists of   |                         |
|   |     | auditable events. The          | All security auditing   |
|   |     | organization defines auditable | capabilities of the     |
|   |     | events that are adequate to    | FBCA or Entity CA       |
|   |     | support after-the-fact         | operating system and CA |
|   |     | investigations of security     | applications required   |
|   |     | incidents.                     | by this CP shall be     |
|   |     |                                | enabled. As a result,   |
|   |     |                                | most of the events      |
|   |     |                                | identified in the table |
|   |     |                                | shall be automatically  |
|   |     |                                | recorded. Where events  |
|   |     |                                | cannot be automatically |
|   |     |                                | recorded, the CA shall  |
|   |     |                                | implement manual        |
|   |     |                                | procedures to satisfy   |
|   |     |                                | this requirement.       |
|   |     |                                |                         |
|   |     |                                | \[TABLE NOT SHOWN\]     |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | EXC |                                |                         |
|   | EED |                                |                         |
|   | S** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 8 | U-3 |                                |                         |
| . |     | The information system         | Section 5.4.1 Types of  |
|   | C   | captures sufficient            | Events Recorded         |
|   | ONT | information in audit records   |                         |
|   | ENT | to establish what events       | A message from any      |
|   | OF  | occurred, the sources of the   | source received by the  |
|   | AU  | events, and the outcomes of    | FBCA or Entity CA       |
|   | DIT | the events.                    | requesting an action    |
|   | R   |                                | related to the          |
|   | ECO | Enhancements:                  | operational state of    |
|   | RDS |                                | the CA is an auditable  |
|   |     | \(1\) The information system   | event. At a minimum,    |
|   |     | provides the capability to     | each audit record shall |
|   |     | include additional, more       | include the following   |
|   |     | detailed information in\       | (either recorded        |
|   |     | the audit records for audit    | automatically or        |
|   |     | events identified by type,     | manually for each       |
|   |     | location, or subject.\         | auditable event):       |
|   |     | (2) The information system     |                         |
|   |     | provides the capability to     | • The type of event,    |
|   |     | centrally manage the content   |                         |
|   |     | of audit records\              | • The date and time the |
|   |     | generated by individual        | event occurred,         |
|   |     | components throughout the      |                         |
|   |     | system.                        | • A success or failure  |
|   |     |                                | indicator, where        |
|   |     | Supplemental Guidance:         | appropriate             |
|   |     |                                |                         |
|   |     | Audit record content includes, | • The identity of the   |
|   |     | for most audit records: (i)    | entity and/or operator  |
|   |     | date and time of the event;    | (of the FBCA or Entity  |
|   |     | (ii) the component of the      | CA) that caused the     |
|   |     | information system (e.g.,      | event,                  |
|   |     | software component, hardware   |                         |
|   |     | component) where the event     | Detailed audit          |
|   |     | occurred; (iii) type of event; | requirements are listed |
|   |     | (iv) subject identity; and (v) | in the table below      |
|   |     | the outcome (success or        | according to the level  |
|   |     | failure) of the event.         | of assurance. The FBCA  |
|   |     |                                | shall record the events |
|   |     |                                | identified in the table |
|   |     |                                | for High Assurance.     |
|   |     |                                |                         |
|   |     |                                | All security auditing   |
|   |     |                                | capabilities of the     |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | operating system and CA |
|   |     |                                | applications required   |
|   |     |                                | by this CP shall be     |
|   |     |                                | enabled. As a result,   |
|   |     |                                | most of the events      |
|   |     |                                | identified in the table |
|   |     |                                | shall be automatically  |
|   |     |                                | recorded. Where events  |
|   |     |                                | cannot be automatically |
|   |     |                                | recorded, the CA shall  |
|   |     |                                | implement manual        |
|   |     |                                | procedures to satisfy   |
|   |     |                                | this requirement.       |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 2 | A   | Control:                       | FBCA Section:           |
| 9 | U-4 |                                |                         |
| . |     | The organization allocates     | 5.4.4 Protection of     |
|   | AU  | sufficient audit record        | Audit Logs              |
|   | DIT | storage capacity and           |                         |
|   | S   | configures auditing to prevent | FBCA (or Entity CA)     |
|   | TOR | such capacity being exceeded.  | system configuration    |
|   | AGE |                                | and procedures must be  |
|   | CA  | Enhancements:                  | implemented together to |
|   | PAC |                                | ensure that:            |
|   | ITY | None.                          |                         |
|   |     |                                | • Only personnel        |
|   |     | Supplemental Guidance:         | assigned to trusted     |
|   |     |                                | roles have read access  |
|   |     | None.                          | to the logs;            |
|   |     |                                |                         |
|   |     |                                | • Only authorized       |
|   |     |                                | people may archive      |
|   |     |                                | audit logs; and,        |
|   |     |                                |                         |
|   |     |                                | • Audit logs are not    |
|   |     |                                | modified.               |
|   |     |                                |                         |
|   |     |                                | The entity performing   |
|   |     |                                | audit log archive need  |
|   |     |                                | not have modify access, |
|   |     |                                | but procedures must be  |
|   |     |                                | implemented to protect  |
|   |     |                                | archived data from      |
|   |     |                                | destruction prior to    |
|   |     |                                | the end of the audit    |
|   |     |                                | log retention period    |
|   |     |                                | (note that deletion     |
|   |     |                                | requires modification   |
|   |     |                                | access).                |
|   |     |                                |                         |
|   |     |                                | The off-site storage    |
|   |     |                                | location for audit logs |
|   |     |                                | shall be a safe, secure |
|   |     |                                | location separate from  |
|   |     |                                | the CA equipment.       |
|   |     |                                |                         |
|   |     |                                | Practice Note: If a     |
|   |     |                                | system over-writes      |
|   |     |                                | audit logs after a      |
|   |     |                                | given time, the audit   |
|   |     |                                | log is not considered   |
|   |     |                                | deleted or destroyed if |
|   |     |                                | the audit log has been  |
|   |     |                                | backed up and archived. |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | A   | Control:                       | FBCA Section:           |
| 0 | U-5 |                                |                         |
| . |     | In the event of an audit       | 5.4.4 Protection of     |
|   | AU  | failure or audit storage       | Audit Logs              |
|   | DIT | capacity being reached, the    |                         |
|   | P   | information system alerts      | FBCA (or Entity CA)     |
|   | ROC | appropriate organizational     | system configuration    |
|   | ESS | officials and takes the        | and procedures must be  |
|   | ING | following additional actions:  | implemented together to |
|   |     | \[*Assignment:                 | ensure that:            |
|   |     | organization-defined actions   |                         |
|   |     | to be taken (e.g., shutdown    | • Only personnel        |
|   |     | information system, overwrite  | assigned to trusted     |
|   |     | oldest audit records, stop     | roles have read access  |
|   |     | generating audit records)*\].  | to the logs;            |
|   |     |                                |                         |
|   |     | Enhancements:                  | • Only authorized       |
|   |     |                                | people may archive      |
|   |     | \(1\) The information system   | audit logs; and,        |
|   |     | provides a warning when        |                         |
|   |     | allocated audit record storage | • Audit logs are not    |
|   |     | volume reaches\                | modified.               |
|   |     | \[Assignment:                  |                         |
|   |     | organization-defined           | The entity performing   |
|   |     | percentage of maximum audit    | audit log archive need  |
|   |     | record storage capacity\].     | not have modify access, |
|   |     |                                | but procedures must be  |
|   |     | Supplemental Guidance:         | implemented to protect  |
|   |     |                                | archived data from      |
|   |     | None.                          | destruction prior to    |
|   |     |                                | the end of the audit    |
|   |     |                                | log retention period    |
|   |     |                                | (note that deletion     |
|   |     |                                | requires modification   |
|   |     |                                | access).                |
|   |     |                                |                         |
|   |     |                                | The off-site storage    |
|   |     |                                | location for audit logs |
|   |     |                                | shall be a safe, secure |
|   |     |                                | location separate from  |
|   |     |                                | the CA equipment.       |
|   |     |                                |                         |
|   |     |                                | Practice Note: If a     |
|   |     |                                | system over-writes      |
|   |     |                                | audit logs after a      |
|   |     |                                | given time, the audit   |
|   |     |                                | log is not considered   |
|   |     |                                | deleted or destroyed if |
|   |     |                                | the audit log has been  |
|   |     |                                | backed up and archived. |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | A   | Control:                       | FBCA Section:           |
| 1 | U-6 |                                |                         |
| . |     | The organization regularly     | 5.4.2 Frequency of      |
|   | AU  | reviews/analyzes audit records | Processing Log          |
|   | DIT | for indications of             |                         |
|   | MO  | inappropriate or unusual       | Audit logs shall be     |
|   | NIT | activity, investigates         | reviewed in accordance  |
|   | ORI | suspicious activity or         | to the table below.     |
|   | NG, | suspected violations, reports  | Such reviews involve    |
|   | ANA | findings to appropriate        | verifying that the log  |
|   | LYS | officials, and takes necessary | has not been tampered   |
|   | IS, | actions.                       | with, and then briefly  |
|   | AND |                                | inspecting all log      |
|   | REP | Enhancements:                  | entries, with a more    |
|   | ORT |                                | thorough investigation  |
|   | ING | \(1\) The organization employs | of any alerts or        |
|   |     | automated mechanisms to        | irregularities in the   |
|   |     | integrate audit monitoring,    | logs. Actions taken as  |
|   |     | analysis, and\                 | a result of these       |
|   |     | reporting into an overall      | reviews shall be        |
|   |     | process for investigation and  | documented.             |
|   |     | response to suspicious         |                         |
|   |     | activities.\                   | For the FBCA, the FPKI  |
|   |     | (2) The organization employs   | Operational Authority   |
|   |     | automated mechanisms to        | shall explain all       |
|   |     | immediately alert security     | significant events in   |
|   |     | personnel of\                  | an audit log summary.   |
|   |     | inappropriate or unusual       |                         |
|   |     | activities with security       | Assurance Level Review  |
|   |     | implications.                  | Audit Log               |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | Rudimentary Only        |
|   |     |                                | required for cause      |
|   |     | None.                          |                         |
|   |     |                                | Basic Only required for |
|   |     |                                | cause                   |
|   |     |                                |                         |
|   |     |                                | Medium                  |
|   |     |                                |                         |
|   |     |                                | (all policies) At least |
|   |     |                                | once every two months   |
|   |     |                                |                         |
|   |     |                                | Statistically           |
|   |     |                                | significant set of      |
|   |     |                                | security audit data     |
|   |     |                                | generated by Entity CAs |
|   |     |                                | since the last review   |
|   |     |                                | shall be examined       |
|   |     |                                | (where the confidence   |
|   |     |                                | intervals for each      |
|   |     |                                | category of security    |
|   |     |                                | audit data are          |
|   |     |                                | determined by the       |
|   |     |                                | security ramifications  |
|   |     |                                | of the category and the |
|   |     |                                | availability of tools   |
|   |     |                                | to perform such a       |
|   |     |                                | review), as well as a   |
|   |     |                                | reasonable search for   |
|   |     |                                | any evidence of         |
|   |     |                                | malicious activity      |
|   |     |                                |                         |
|   |     |                                | High At least once per  |
|   |     |                                | month                   |
|   |     |                                |                         |
|   |     |                                | Statistically           |
|   |     |                                | significant set of      |
|   |     |                                | security audit data     |
|   |     |                                | generated by Entity CAs |
|   |     |                                | since the last review   |
|   |     |                                | shall be examined       |
|   |     |                                | (where the confidence   |
|   |     |                                | intervals for each      |
|   |     |                                | category of security    |
|   |     |                                | audit data are          |
|   |     |                                | determined by the       |
|   |     |                                | security ramifications  |
|   |     |                                | of the category and the |
|   |     |                                | availability of tools   |
|   |     |                                | to perform such a       |
|   |     |                                | review), as well as a   |
|   |     |                                | reasonable search for   |
|   |     |                                | any evidence of         |
|   |     |                                | malicious activity      |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | NOT |                                |                         |
|   | C   |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | En  |                                |                         |
|   | tit |                                |                         |
|   | ies |                                |                         |
|   | at  |                                |                         |
|   | B   |                                |                         |
|   | asi |                                |                         |
|   | c** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | En  |                                |                         |
|   | tit |                                |                         |
|   | ies |                                |                         |
|   | at  |                                |                         |
|   | Med |                                |                         |
|   | ium |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | A   | Control:                       | FBCA Section:           |
| 2 | U-7 |                                |                         |
| . |     | The information system         | 5.4.2 Frequency of      |
|   | AU  | provides an audit reduction    | Processing Log          |
|   | DIT | and report generation          |                         |
|   | RED | capability.                    | Audit logs shall be     |
|   | UCT |                                | reviewed in accordance  |
|   | ION | Enhancements:                  | to the table below.     |
|   | AND |                                | Such reviews involve    |
|   | REP | \(1\) The information system   | verifying that the log  |
|   | ORT | provides the capability to     | has not been tampered   |
|   | G   | automatically process audit    | with, and then briefly  |
|   | ENE | records for events\            | inspecting all log      |
|   | RAT | of interest based upon         | entries, with a more    |
|   | ION | selectable, event criteria.    | thorough investigation  |
|   |     |                                | of any alerts or        |
|   |     | Supplemental Guidance:         | irregularities in the   |
|   |     |                                | logs. Actions taken as  |
|   |     | Audit reduction, review, and   | a result of these       |
|   |     | reporting tools support        | reviews shall be        |
|   |     | after-the-fact investigations  | documented.             |
|   |     | of security incidents without  |                         |
|   |     | altering original audit        |                         |
|   |     | records.                       |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | A   | Control:                       | FBCA Section:           |
| 3 | U-8 |                                |                         |
| . |     | The information system         | Section 5.4.1 Types of  |
|   | T   | provides time stamps for use   | Events Recorded         |
|   | IME | in audit record generation.    |                         |
|   | STA |                                | A message from any      |
|   | MPS | Enhancements:                  | source received by the  |
|   |     |                                | FBCA or Entity CA       |
|   |     | None.                          | requesting an action    |
|   |     |                                | related to the          |
|   |     | Supplemental Guidance:         | operational state of    |
|   |     |                                | the CA is an auditable  |
|   |     | Time stamps of audit records   | event. At a minimum,    |
|   |     | are generated using internal   | each audit record shall |
|   |     | system clocks that are         | include the following   |
|   |     | synchronized system wide.      | (either recorded        |
|   |     |                                | automatically or        |
|   |     |                                | manually for each       |
|   |     |                                | auditable event):       |
|   |     |                                |                         |
|   |     |                                | • The type of event,    |
|   |     |                                |                         |
|   |     |                                | • The date and time the |
|   |     |                                | event occurred,         |
|   |     |                                |                         |
|   |     |                                | • A success or failure  |
|   |     |                                | indicator, where        |
|   |     |                                | appropriate             |
|   |     |                                |                         |
|   |     |                                | • The identity of the   |
|   |     |                                | entity and/or operator  |
|   |     |                                | (of the FBCA or Entity  |
|   |     |                                | CA) that caused the     |
|   |     |                                | event,                  |
|   |     |                                |                         |
|   |     |                                | Detailed audit          |
|   |     |                                | requirements are listed |
|   |     |                                | in the table below      |
|   |     |                                | according to the level  |
|   |     |                                | of assurance. The FBCA  |
|   |     |                                | shall record the events |
|   |     |                                | identified in the table |
|   |     |                                | for High Assurance.     |
|   |     |                                |                         |
|   |     |                                | All security auditing   |
|   |     |                                | capabilities of the     |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | operating system and CA |
|   |     |                                | applications required   |
|   |     |                                | by this CP shall be     |
|   |     |                                | enabled. As a result,   |
|   |     |                                | most of the events      |
|   |     |                                | identified in the table |
|   |     |                                | shall be automatically  |
|   |     |                                | recorded. Where events  |
|   |     |                                | cannot be automatically |
|   |     |                                | recorded, the CA shall  |
|   |     |                                | implement manual        |
|   |     |                                | procedures to satisfy   |
|   |     |                                | this requirement.       |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | A   | Control:                       | FBCA Section:           |
| 4 | U-9 |                                |                         |
| . |     | The information system         | 5.4.4 Protection of     |
|   | P   | protects audit information and | Audit Logs              |
|   | ROT | audit tools from unauthorized  |                         |
|   | ECT | access, modification, and      | FBCA (or Entity CA)     |
|   | ION | deletion.                      | system configuration    |
|   | OF  |                                | and procedures must be  |
|   | AU  | Enhancements:                  | implemented together to |
|   | DIT |                                | ensure that:            |
|   | IN  | None.                          |                         |
|   | FOR |                                | • Only personnel        |
|   | MAT | Supplemental Guidance:         | assigned to trusted     |
|   | ION |                                | roles have read access  |
|   |     | \(1\) The information system   | to the logs;            |
|   |     | produces audit information on  |                         |
|   |     | hardware-enforced, write-once  | • Only authorized       |
|   |     | media.                         | people may archive      |
|   |     |                                | audit logs; and,        |
|   |     |                                |                         |
|   |     |                                | • Audit logs are not    |
|   |     |                                | modified.               |
|   |     |                                |                         |
|   |     |                                | The entity performing   |
|   |     |                                | audit log archive need  |
|   |     |                                | not have modify access, |
|   |     |                                | but procedures must be  |
|   |     |                                | implemented to protect  |
|   |     |                                | archived data from      |
|   |     |                                | destruction prior to    |
|   |     |                                | the end of the audit    |
|   |     |                                | log retention period    |
|   |     |                                | (note that deletion     |
|   |     |                                | requires modification   |
|   |     |                                | access).                |
|   |     |                                |                         |
|   |     |                                | The off-site storage    |
|   |     |                                | location for audit logs |
|   |     |                                | shall be a safe, secure |
|   |     |                                | location separate from  |
|   |     |                                | the CA equipment.       |
|   |     |                                |                         |
|   |     |                                | Practice Note: If a     |
|   |     |                                | system over-writes      |
|   |     |                                | audit logs after a      |
|   |     |                                | given time, the audit   |
|   |     |                                | log is not considered   |
|   |     |                                | deleted or destroyed if |
|   |     |                                | the audit log has been  |
|   |     |                                | backed up and archived. |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | AU  | Control:                       | FBCA Section:           |
| 5 | -10 |                                |                         |
| . |     | The information system         | Section 5.4.1 Types of  |
|   | NON | provides the capability to     | Events Recorded         |
|   | -RE | determine whether a given      |                         |
|   | PUD | individual took a particular   | A message from any      |
|   | IAT | action (e.g., created          | source received by the  |
|   | ION | information, sent a message,   | FBCA or Entity CA       |
|   |     | approved information \[e.g.,   | requesting an action    |
|   |     | to indicate concurrence or     | related to the          |
|   |     | sign a contract\] or received  | operational state of    |
|   |     | a message).                    | the CA is an auditable  |
|   |     |                                | event. At a minimum,    |
|   |     | Enhancements:                  | each audit record shall |
|   |     |                                | include the following   |
|   |     | None.                          | (either recorded        |
|   |     |                                | automatically or        |
|   |     | Supplemental Guidance:         | manually for each       |
|   |     |                                | auditable event):       |
|   |     | Non-repudiation protects       |                         |
|   |     | against later false claims by  | • The type of event,    |
|   |     | an individual of not having    |                         |
|   |     | taken a specific action.       | • The date and time the |
|   |     | Non-repudiation protects       | event occurred,         |
|   |     | individuals against later      |                         |
|   |     | claims by an author of not     | • A success or failure  |
|   |     | having authored a particular   | indicator, where        |
|   |     | document, a sender of not      | appropriate             |
|   |     | having transmitted a message,  |                         |
|   |     | a receiver of not having       | • The identity of the   |
|   |     | received a message, or a       | entity and/or operator  |
|   |     | signatory of having signed a   | (of the FBCA or Entity  |
|   |     | document. Non-repudiation      | CA) that caused the     |
|   |     | services can be used to        | event,                  |
|   |     | determine if information       |                         |
|   |     | originated from an individual, | Detailed audit          |
|   |     | or if an individual took       | requirements are listed |
|   |     | specific actions (e.g.,        | in the table below      |
|   |     | sending an email, signing a    | according to the level  |
|   |     | contract, approving a          | of assurance. The FBCA  |
|   |     | procurement request) or        | shall record the events |
|   |     | received specific information. | identified in the table |
|   |     | Non-repudiation services are   | for High Assurance.     |
|   |     | obtained by employing various  |                         |
|   |     | techniques or mechanisms       | All security auditing   |
|   |     | (e.g., digital signatures,     | capabilities of the     |
|   |     | digital message receipts, time | FBCA or Entity CA       |
|   |     | stamps).                       | operating system and CA |
|   |     |                                | applications required   |
|   |     |                                | by this CP shall be     |
|   |     |                                | enabled. As a result,   |
|   |     |                                | most of the events      |
|   |     |                                | identified in the table |
|   |     |                                | shall be automatically  |
|   |     |                                | recorded. Where events  |
|   |     |                                | cannot be automatically |
|   |     |                                | recorded, the CA shall  |
|   |     |                                | implement manual        |
|   |     |                                | procedures to satisfy   |
|   |     |                                | this requirement.       |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | AU  | Control:                       | FBCA Section:           |
| 6 | -11 |                                |                         |
| . |     | The organization retains audit | 5.5.2 Retention Period  |
|   | AU  | logs for *\[Assignment:        | for Archive             |
|   | DIT | organization-defined time      |                         |
|   | RET | period\]* to provide support   | The minimum retention   |
|   | ENT | for after-the-fact             | periods for archive     |
|   | ION | investigations of security     | data are identified     |
|   |     | incidents and to meet          | below. Executive branch |
|   |     | regulatory and organizational  | agencies must follow    |
|   |     | information retention          | either the General      |
|   |     | requirements.                  | Records Schedule        |
|   |     |                                | established by the      |
|   |     | Enhancements:                  | National Archives and   |
|   |     |                                | Records Administration  |
|   |     | None.                          | or an agency-specific   |
|   |     |                                | schedule as applicable. |
|   |     | Supplemental Guidance:         | All other entities      |
|   |     |                                | shall comply with their |
|   |     | NIST Special Publication       | respective records      |
|   |     | 800-61 provides guidance on    | retention policies in   |
|   |     | computer security incident     | accordance with         |
|   |     | handling and audit log         | whatever laws apply to  |
|   |     | retention.                     | those entities.         |
|   |     |                                |                         |
|   |     |                                | This minimum retention  |
|   |     |                                | period for these        |
|   |     |                                | records is intended     |
|   |     |                                | only to facilitate the  |
|   |     |                                | operation of the FBCA   |
|   |     |                                | and the entities' CAs.  |
|   |     |                                |                         |
|   |     |                                | Assurance Level Minimum |
|   |     |                                | Retention Period        |
|   |     |                                |                         |
|   |     |                                | Rudimentary 7 Years & 6 |
|   |     |                                | Months                  |
|   |     |                                |                         |
|   |     |                                | Basic 7 Years & 6       |
|   |     |                                | Months                  |
|   |     |                                |                         |
|   |     |                                | Medium                  |
|   |     |                                |                         |
|   |     |                                | (all policies) 10 Years |
|   |     |                                | & 6 Months              |
|   |     |                                |                         |
|   |     |                                | High 20 Years & 6       |
|   |     |                                | Months                  |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | C   | Control:                       | FBCA Section:           |
| 7 | A-1 |                                |                         |
| . |     | The organization develops,     | Dissemination:          |
|   | CE  | disseminates, and periodically |                         |
|   | RTI | reviews/updates: (i) formal,   | 2.2.2 The FPKI          |
|   | FIC | documented, security           | Operational Authority   |
|   | ATI | assessment and certification   | shall publish           |
|   | ON, | and accreditation policies     | information concerning  |
|   | AC  | that address purpose, scope,   | the FBCA necessary to   |
|   | CRE | roles, responsibilities,       | support its use and     |
|   | DIT | management commitment,         | operation. The FBCA CP  |
|   | ATI | coordination among             | shall be publicly       |
|   | ON, | organizational entities, and   | available on the FPKI   |
|   | AND | compliance; and (ii) formal,   | PA website (see         |
|   | SE  | documented procedures to       | http                    |
|   | CUR | facilitate the implementation  | ://www.cio.gov/fpkipa). |
|   | ITY | of the security assessment and |                         |
|   | A   | certification and              | 2.2.3 This \[FBCA\] CP  |
|   | SSE | accreditation policies and     | and any subsequent      |
|   | SSM | associated assessment,         | changes shall be made   |
|   | ENT | certification, and             | publicly available      |
|   | PO  | accreditation controls.        | within one week of      |
|   | LIC |                                | approval                |
|   | IES | Enhancements:                  |                         |
|   | AND |                                | Section 8: The FPKI     |
|   | P   | None.                          | Operational Authority   |
|   | ROC |                                | shall have a compliance |
|   | EDU | Supplemental Guidance:         | audit mechanism in      |
|   | RES |                                | place to ensure that    |
|   |     | The security assessment and    | the requirements of     |
|   |     | certification and              | this CP and the FBCA    |
|   |     | accreditation policies and     | CPS are being           |
|   |     | procedures are consistent with | implemented and         |
|   |     | applicable federal laws,       | enforced.               |
|   |     | directives, policies,          |                         |
|   |     | regulations, standards, and    | Entity CAs shall have a |
|   |     | guidance. The security         | compliance audit        |
|   |     | assessment and certification   | mechanism in place to   |
|   |     | and accreditation policies can | ensure that the         |
|   |     | be included as part of the     | requirements of their   |
|   |     | general information security   | CP/CPS are being        |
|   |     | policy for the organization.   | implemented and         |
|   |     | Security assessment and        | enforced.               |
|   |     | certification and              |                         |
|   |     | accreditation procedures can   | This specification does |
|   |     | be developed for the security  | not impose a            |
|   |     | program in general, and for a  | requirement for any     |
|   |     | particular information system, | particular assessment   |
|   |     | when required. NIST Special    | methodology.            |
|   |     | Publication 800-53A provides   |                         |
|   |     | guidance on security control   | 8.1 The FBCA, Entity    |
|   |     | assessments. NIST Special      | Principal CAs and RAs   |
|   |     | Publication 800-37 provides    | and their subordinate   |
|   |     | guidance on processing         | CAs and RAs shall be    |
|   |     | security certification and     | subject to a periodic   |
|   |     | accreditation. NIST Special    | compliance audit at     |
|   |     | Publication 800-12 provides    | least once per year for |
|   |     | guidance on security policies  | High, Medium Hardware,  |
|   |     | and procedures.                | and Medium Assurance,   |
|   |     |                                |                         |
|   |     |                                | The FBCA and Entity     |
|   |     |                                | Principal CAs have the  |
|   |     |                                | right to require        |
|   |     |                                | periodic and aperiodic  |
|   |     |                                | compliance audits or    |
|   |     |                                | inspections of          |
|   |     |                                | subordinate CA or RA    |
|   |     |                                | operations to validate  |
|   |     |                                | that the subordinate    |
|   |     |                                | entities are operating  |
|   |     |                                | in accordance with the  |
|   |     |                                | security practices and  |
|   |     |                                | procedures described in |
|   |     |                                | their respective CPS.   |
|   |     |                                | Further, the Federal    |
|   |     |                                | PKI Policy Authority    |
|   |     |                                | has the right to        |
|   |     |                                | require aperiodic       |
|   |     |                                | compliance audits of    |
|   |     |                                | Entity Principal CAs    |
|   |     |                                | (and, when needed,      |
|   |     |                                | their subordinate CAs)  |
|   |     |                                | that interoperate with  |
|   |     |                                | the FBCA under this CP. |
|   |     |                                |                         |
|   |     |                                | 8.4 The compliance      |
|   |     |                                | audit of the FBCA shall |
|   |     |                                | verify that the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | is implementing all     |
|   |     |                                | provisions of a CPS     |
|   |     |                                | approved by the FPKI    |
|   |     |                                | Policy Authority        |
|   |     |                                | consistent with this    |
|   |     |                                | CP.                     |
|   |     |                                |                         |
|   |     |                                | The purpose of a        |
|   |     |                                | compliance audit of an  |
|   |     |                                | Entity PKI shall be to  |
|   |     |                                | verify that an entity   |
|   |     |                                | subject to the          |
|   |     |                                | requirements of an      |
|   |     |                                | Entity CP is complying  |
|   |     |                                | with the requirements   |
|   |     |                                | of those documents      |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | C   | Control:                       | FBCA Section:           |
| 8 | A-2 |                                |                         |
| . |     | The organization conducts an   | Section 8.1 specifies   |
|   | SE  | assessment of the security     | that the CA has the     |
|   | CUR | controls in the information    | right to require        |
|   | ITY | system *\[Assignment:          | periodic compliance     |
|   | AS  | organization-defined           | audits or inspections   |
|   | SES | frequency, at least            | of subordinate CA or RA |
|   | SME | annuall*y\] to determine the   | operations to validate  |
|   | NTS | extent to which the controls   | that the subordinate    |
|   |     | are implemented correctly,     | entities are operating  |
|   |     | operating as intended, and     | in accordance with the  |
|   |     | producing the desired outcome  | security practices and  |
|   |     | with respect to meeting the    | procedures described in |
|   |     | security requirements for the  | their respective CPS.   |
|   |     | system.                        | The FBCA, Entity        |
|   |     |                                | Principal CAs and RAs   |
|   |     | Enhancements:                  | and their subordinate   |
|   |     |                                | CAs and RAs shall be    |
|   |     | None.                          | subject to a periodic   |
|   |     |                                | compliance audit at     |
|   |     | Supplemental Guidance:         | least once per year for |
|   |     |                                | High, Medium Hardware,  |
|   |     | This control is intended to    | and Medium Assurance,   |
|   |     | support the FISMA requirement  |                         |
|   |     | that the management,           |                         |
|   |     | operational, and technical     |                         |
|   |     | controls in each information   |                         |
|   |     | system contained in the        |                         |
|   |     | inventory of major information |                         |
|   |     | systems be tested with a       |                         |
|   |     | frequency depending on risk,   |                         |
|   |     | but no less than annually. The |                         |
|   |     | FISMA requirement for (at      |                         |
|   |     | least) annual security control |                         |
|   |     | assessments should not be      |                         |
|   |     | interpreted by organizations   |                         |
|   |     | as adding additional           |                         |
|   |     | assessment requirements to     |                         |
|   |     | those requirements already in  |                         |
|   |     | place. Organizations can       |                         |
|   |     | satisfy the FISMA requirement  |                         |
|   |     | by using the security control  |                         |
|   |     | assessment results from any of |                         |
|   |     | the following sources,         |                         |
|   |     | including: (i) security        |                         |
|   |     | certifications conducted as    |                         |
|   |     | part of a routine information  |                         |
|   |     | system accreditation or        |                         |
|   |     | reaccreditation process; (ii)  |                         |
|   |     | ongoing continuous monitoring  |                         |
|   |     | activities; (iii) self         |                         |
|   |     | assessments; or (iv) routine   |                         |
|   |     | testing and evaluation of the  |                         |
|   |     | information system as part of  |                         |
|   |     | the ongoing system development |                         |
|   |     | life cycle process. Reuse of   |                         |
|   |     | assessment information is      |                         |
|   |     | critical in achieving a        |                         |
|   |     | broad-based, cost-effective,   |                         |
|   |     | and fully integrated security  |                         |
|   |     | program capable of producing   |                         |
|   |     | the needed evidence to         |                         |
|   |     | determine the\                 |                         |
|   |     | actual security status of the  |                         |
|   |     | information system.NIST        |                         |
|   |     | Special Publications 800-53A   |                         |
|   |     | and 800-26 provide guidance on |                         |
|   |     | security control assessments.  |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 3 | C   | Control:                       | FBCA Section:           |
| 9 | A-3 |                                |                         |
| . |     | The organization authorizes    | 1.1.5 The FBCA will     |
|   | IN  | all connections from the       | extend interoperability |
|   | FOR | information system to other    | with non-Federal        |
|   | MAT | information systems outside of | entities only when it   |
|   | ION | the accreditation boundary and | is beneficial to the    |
|   | SYS | monitors/controls the system   | Federal Government.     |
|   | TEM | interconnections on an ongoing |                         |
|   | CO  | basis. Appropriate             |                         |
|   | NNE | organizational officials       |                         |
|   | CTI | approve information system     |                         |
|   | ONS | interconnection agreements.    |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Since FIPS 199 security        |                         |
|   |     | categorizations apply to       |                         |
|   |     | individual information         |                         |
|   |     | systems, the organization      |                         |
|   |     | should carefully consider the  |                         |
|   |     | risks that may be introduced   |                         |
|   |     | when systems are connected to  |                         |
|   |     | other information systems with |                         |
|   |     | different security             |                         |
|   |     | requirements and security      |                         |
|   |     | controls, both within the      |                         |
|   |     | organization and external to   |                         |
|   |     | the organization. Risk         |                         |
|   |     | considerations should also     |                         |
|   |     | include information systems    |                         |
|   |     | sharing the same networks.     |                         |
|   |     | NIST Special Publication       |                         |
|   |     | 800-47 provides guidance on    |                         |
|   |     | interconnecting information    |                         |
|   |     | systems.                       |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 0 | A-4 |                                |                         |
| . | (1) | The organization conducts an   | 8.3 For both the FBCA   |
|   |     | assessment of the security     | and Entity CAs, the     |
|   | SE  | controls in the information    | compliance auditor      |
|   | CUR | system to determine the extent | either shall be a       |
|   | ITY | to which the controls are      | private firm, that is   |
|   | C   | implemented correctly,         | independent from the    |
|   | ERT | operating as intended, and     | entity being audited,   |
|   | IFI | producing the desired outcome  | or it shall be          |
|   | CAT | with respect to meeting the    | sufficiently            |
|   | ION | security requirements for the  | organizationally        |
|   |     | system.                        | separated from that     |
|   |     |                                | entity to provide an    |
|   |     | Enhancements:                  | unbiased, independent   |
|   |     |                                | evaluation. An example  |
|   |     | \(1\) The assessment of the    | of the latter situation |
|   |     | security controls in the       | may be an Agency        |
|   |     | information system for         | inspector general.      |
|   |     | purposes of security\          |                         |
|   |     | certification is conducted by  |                         |
|   |     | an independent certification   |                         |
|   |     | agent or certification team.   |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | A security certification is    |                         |
|   |     | conducted by the organization  |                         |
|   |     | in support of the OMB Circular |                         |
|   |     | A-130, Appendix III            |                         |
|   |     | requirement for accrediting    |                         |
|   |     | the information system. The    |                         |
|   |     | security certification is a    |                         |
|   |     | key factor in all              |                         |
|   |     | authorization (accreditation)  |                         |
|   |     | decisions and is integrated    |                         |
|   |     | into and spans the system      |                         |
|   |     | development life cycle. When   |                         |
|   |     | an independent assessment is   |                         |
|   |     | required, the certification    |                         |
|   |     | agent (or certification team)  |                         |
|   |     | provides an unbiased           |                         |
|   |     | assessment of the security     |                         |
|   |     | controls in the information    |                         |
|   |     | system. Assessor independence  |                         |
|   |     | implies that the certification |                         |
|   |     | agent (or certification team), |                         |
|   |     | whether obtained from within   |                         |
|   |     | the organization or            |                         |
|   |     | externally, is not involved    |                         |
|   |     | with the information system's  |                         |
|   |     | development, implementation,   |                         |
|   |     | or operation. NIST Special     |                         |
|   |     | Publication 800-53A provides   |                         |
|   |     | guidance on the assessment of  |                         |
|   |     | security controls. NIST        |                         |
|   |     | Special Publication 800-37     |                         |
|   |     | provides guidance on security  |                         |
|   |     | certification and              |                         |
|   |     | accreditation.                 |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 1 | A-5 |                                |                         |
| . |     | The organization develops and  | 8.5 When the compliance |
|   | P   | updates \[*Assignment:         | auditor finds a         |
|   | LAN | organization-defined           | discrepancy between how |
|   | OF  | frequency*\], a plan of action | the FBCA is designed or |
|   | ACT | and milestones for the         | is being operated or    |
|   | ION | information system that        | maintained, and the     |
|   | AND | documents the organization's   | requirements of this    |
|   | M   | planned, implemented, and      | CP, the MOAs, or the    |
|   | ILE | evaluated remedial actions to  | applicable CPS, the     |
|   | STO | correct any deficiencies noted | following actions shall |
|   | NES | during the assessment of the   | be performed:           |
|   |     | security controls and to       |                         |
|   |     | reduce or eliminate known      | -   he compliance      |
|   |     | vulnerabilities in the system. |     auditor shall       |
|   |     |                                |     document the        |
|   |     | Enhancements:                  |     discrepancy and     |
|   |     |                                |     provide a copy to   |
|   |     | None.                          |     the FPKI            |
|   |     |                                |     Operational         |
|   |     | Supplemental Guidance:         |     Authority;          |
|   |     |                                |                         |
|   |     | The plan of action and         | -   The FPKI            |
|   |     | milestones updates are based   |     Operational         |
|   |     | on the findings from security  |     Authority will      |
|   |     | control assessments, security  |     provide a copy of   |
|   |     | impact analyses, and           |     the discrepancy     |
|   |     | continuous monitoring          |     documentation to    |
|   |     | activities. The plan of action |     the Federal PKI     |
|   |     | and milestones is a key        |     Policy Authority    |
|   |     | document in the security       |     Chair;              |
|   |     | accreditation package          |                         |
|   |     | developed for the authorizing  | -   The FPKI            |
|   |     | official. NIST Special         |     Operational         |
|   |     | Publication 800-37 provides    |     Authority will      |
|   |     | guidance on the security       |     report findings and |
|   |     | certification and              |     corrective action   |
|   |     | accreditation of information   |     to the Federal PKI  |
|   |     | systems. NIST Special          |     Policy Authority;   |
|   |     | Publication 800-30 provides    |                         |
|   |     | guidance on risk mitigation.   | -   The FPKI            |
|   |     |                                |     Operational         |
|   |     |                                |     Authority shall     |
|   |     |                                |     determine what      |
|   |     |                                |     further             |
|   |     |                                |     notifications or    |
|   |     |                                |     actions are         |
|   |     |                                |     necessary to meet   |
|   |     |                                |     the requirements of |
|   |     |                                |     this CP and the     |
|   |     |                                |     MOAs, and then      |
|   |     |                                |     proceed to make     |
|   |     |                                |     such notifications  |
|   |     |                                |     and take such       |
|   |     |                                |     actions without     |
|   |     |                                |     delay.              |
|   |     |                                |                         |
|   |     |                                | -   Depending upon the  |
|   |     |                                |     nature and severity |
|   |     |                                |     of the discrepancy, |
|   |     |                                |     and how quickly it  |
|   |     |                                |     can be corrected,   |
|   |     |                                |     the Federal PKI     |
|   |     |                                |     Policy Authority    |
|   |     |                                |     may direct the FPKI |
|   |     |                                |     Operational         |
|   |     |                                |     Authority to take   |
|   |     |                                |     additional actions  |
|   |     |                                |     as appropriate,     |
|   |     |                                |     including           |
|   |     |                                |     temporarily halting |
|   |     |                                |     operation of the    |
|   |     |                                |     FBCA.               |
|   |     |                                |                         |
|   |     |                                | When the Entity         |
|   |     |                                | compliance auditor      |
|   |     |                                | finds a discrepancy     |
|   |     |                                | between how the Entity  |
|   |     |                                | CA is designed or is    |
|   |     |                                | being operated or       |
|   |     |                                | maintained, and the     |
|   |     |                                | requirements of the     |
|   |     |                                | Entity CP, any          |
|   |     |                                | applicable MOAs, or the |
|   |     |                                | applicable CPS, the     |
|   |     |                                | following actions shall |
|   |     |                                | be performed:           |
|   |     |                                |                         |
|   |     |                                | -   The compliance      |
|   |     |                                |     auditor shall       |
|   |     |                                |     document the        |
|   |     |                                |     discrepancy;        |
|   |     |                                |                         |
|   |     |                                | -   The compliance      |
|   |     |                                |     auditor shall       |
|   |     |                                |     notify the          |
|   |     |                                |     responsible party   |
|   |     |                                |     promptly;           |
|   |     |                                |                         |
|   |     |                                | -   The Entity PKI      |
|   |     |                                |     shall determine     |
|   |     |                                |     what further        |
|   |     |                                |     notifications or    |
|   |     |                                |     actions are         |
|   |     |                                |     necessary to meet   |
|   |     |                                |     the requirements of |
|   |     |                                |     the Entity CP, CPS, |
|   |     |                                |     and any relevant    |
|   |     |                                |     MOA provisions. The |
|   |     |                                |     Entity PKI shall    |
|   |     |                                |     proceed to make     |
|   |     |                                |     such notifications  |
|   |     |                                |     and take such       |
|   |     |                                |     actions without     |
|   |     |                                |     delay.              |
|   |     |                                |                         |
|   |     |                                | When the Federal PKI    |
|   |     |                                | Policy Authority        |
|   |     |                                | receives a report of    |
|   |     |                                | audit deficiency from   |
|   |     |                                | an Entity PKI, the      |
|   |     |                                | Federal PKI Policy      |
|   |     |                                | Authority may direct    |
|   |     |                                | the FPKI Operational    |
|   |     |                                | Authority to take       |
|   |     |                                | additional actions to   |
|   |     |                                | protect the level of    |
|   |     |                                | trust in the            |
|   |     |                                | infrastructure.         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 2 | A-6 |                                |                         |
| . |     | The organization authorizes    | 1.3.1.2 After an Entity |
|   | SE  | (i.e., accredits) the          | is authorized to        |
|   | CUR | information system for         | interoperate using the  |
|   | ITY | processing before operations   | FBCA, ensuring          |
|   | A   | and updates the authorization  | continued conformance   |
|   | CCR | *\[Assignment:                 | of that Entity with     |
|   | EDI | organization-defined           | applicable requirements |
|   | TAT | frequencyfrequency, at least   | as a condition for      |
|   | ION | every three years\].* A senior | allowing continued      |
|   |     | organizational official signs  | interoperability using  |
|   |     | and approves the security      | the FBCA.               |
|   |     | accreditation.                 |                         |
|   |     |                                | 1.3.1.3 The FPKI        |
|   |     | Enhancements:                  | Operational Authority   |
|   |     |                                | is the organization     |
|   |     | None.                          | that operates and       |
|   |     |                                | maintains the FBCA on   |
|   |     | Supplemental Guidance:         | behalf of the U.S.      |
|   |     |                                | Government, subject to  |
|   |     | OMB Circular A-130, Appendix   | the direction of the    |
|   |     | III, establishes policy for    | FPKIPA.                 |
|   |     | security accreditations of     |                         |
|   |     | federal information systems.   | 1.3.1.4 The Program     |
|   |     | The organization assesses the  | Manager is the          |
|   |     | security controls employed     | individual within the   |
|   |     | within the information system  | FPKI Operational        |
|   |     | before and in support of the   | Authority who has       |
|   |     | security accreditation.        | principal               |
|   |     | Security assessments conducted | responsibility for      |
|   |     | in support of security         | overseeing the proper   |
|   |     | accreditations are called      | operation of the FBCA   |
|   |     | security certifications. NIST  | including the FBCA      |
|   |     | Special Publication 800-37     | repository, and         |
|   |     | provides guidance on the       | selecting the FPKI      |
|   |     | security certification and     | Operational Authority   |
|   |     | accreditation of information   | Staff. The Program      |
|   |     | systems.                       | Manager is selected by  |
|   |     |                                | the FPKI Operational    |
|   |     |                                | Authority and reports   |
|   |     |                                | to the FPKIPA. The FPKI |
|   |     |                                | Operational Authority   |
|   |     |                                | Program Manager must    |
|   |     |                                | hold a Top Secret       |
|   |     |                                | security clearance.     |
|   |     |                                |                         |
|   |     |                                | 4.1 Entities seeking to |
|   |     |                                | cross-certify with the  |
|   |     |                                | FBCA shall fulfill the  |
|   |     |                                | application             |
|   |     |                                | requirements as         |
|   |     |                                | specified in the U.S.   |
|   |     |                                | Government Public Key   |
|   |     |                                | Infrastructure          |
|   |     |                                | Cross-Certification     |
|   |     |                                | Criteria and            |
|   |     |                                | Methodology. The        |
|   |     |                                | Federal PKI Policy      |
|   |     |                                | Authority shall act on  |
|   |     |                                | the application and,    |
|   |     |                                | upon making a           |
|   |     |                                | determination to issue  |
|   |     |                                | a certificate and       |
|   |     |                                | entering into the MOA   |
|   |     |                                | with the Entity, shall  |
|   |     |                                | authorize the FPKI      |
|   |     |                                | Operational Authority   |
|   |     |                                | to issue the            |
|   |     |                                | cross-certificate to    |
|   |     |                                | the Entity.             |
|   |     |                                |                         |
|   |     |                                | The FBCA may issue      |
|   |     |                                | end-entity certificates |
|   |     |                                | to trusted personnel    |
|   |     |                                | where necessary for the |
|   |     |                                | internal operations of  |
|   |     |                                | the FBCA. The FBCA will |
|   |     |                                | not issue end-entity    |
|   |     |                                | certificates for any    |
|   |     |                                | other reasons.          |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   | *   |                                |                         |
|   | *NO |                                |                         |
|   | T** |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 3 | A-7 |                                |                         |
| . |     | The organization monitors the  | 5.4 Audit log files     |
|   | C   | security controls in the       | shall be generated for  |
|   | ONT | information system on an       | all events relating to  |
|   | INU | ongoing basis.                 | the security of the     |
|   | OUS |                                | FBCA or Entity CAs.     |
|   | M   | Enhancements:                  |                         |
|   | ONI |                                | 5.4.x \[List of         |
|   | TOR | None.                          | specific events         |
|   | ING |                                | audited\]               |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | 5.4.2 Audit log files   |
|   |     | Continuous monitoring          | shall be generated for  |
|   |     | activities include             | all events relating to  |
|   |     | configuration management and   | the security of the     |
|   |     | control of information system  | FBCA or Entity CAs.     |
|   |     | components, security impact    |                         |
|   |     | analyses of changes to the     | Medium (all policies):  |
|   |     | system, ongoing assessment of  |                         |
|   |     | security controls, and status  | At least once every two |
|   |     | reporting. The organization    | months                  |
|   |     | establishes the selection      |                         |
|   |     | criteria for control           | Statistically           |
|   |     | monitoring and subsequently    | significant set of      |
|   |     | selects a subset of the        | security audit data     |
|   |     | security controls employed     | generated by Entity CAs |
|   |     | within the information system  | since the last review   |
|   |     | for purposes of continuous     | shall be examined       |
|   |     | monitoring. NIST Special       | (where the confidence   |
|   |     | Publication 800-37 provides    | intervals for each      |
|   |     | guidance on the continuous     | category of security    |
|   |     | monitoring process. NIST       | audit data are          |
|   |     | Special Publication 800-53A    | determined by the       |
|   |     | provides guidance on the       | security ramifications  |
|   |     | assessment of security         | of the category and the |
|   |     | controls.                      | availability of tools   |
|   |     |                                | to perform such a       |
|   |     |                                | review), as well as a   |
|   |     |                                | reasonable search for   |
|   |     |                                | any evidence of         |
|   |     |                                | malicious activity      |
|   |     |                                |                         |
|   |     |                                | High: At least once per |
|   |     |                                | month.                  |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 4 | M-1 |                                |                         |
| . |     | The organization develops,     | Dissemination:          |
|   | C   | disseminates, and periodically |                         |
|   | ONF | reviews/updates: (i) a formal, | 2.2.2 The FPKI          |
|   | IGU | documented, configuration      | Operational Authority   |
|   | RAT | management policy that         | shall publish           |
|   | ION | addresses purpose, scope,      | information concerning  |
|   | M   | roles, responsibilities,       | the FBCA necessary to   |
|   | ANA | management commitment,         | support its use and     |
|   | GEM | coordination among             | operation. The FBCA CP  |
|   | ENT | organizational entities, and   | shall be publicly       |
|   | POL | compliance; and (ii) formal,   | available on the FPKI   |
|   | ICY | documented procedures to       | PA website (see         |
|   | AND | facilitate the implementation  | http                    |
|   | P   | of the configuration           | ://www.cio.gov/fpkipa). |
|   | ROC | management policy and          |                         |
|   | EDU | associated configuration       | 5.4.1 Types of events   |
|   | RES | management controls.           | recorded                |
|   |     |                                |                         |
|   |     | Enhancements:                  | CA server Configuration |
|   |     |                                | and system changes are  |
|   |     | None.                          | auditable events        |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | 5.4.4 FBCA (or Entity   |
|   |     |                                | CA) system              |
|   |     | The configuration management   | configuration and       |
|   |     | policy and procedures are      | procedures must be      |
|   |     | consistent with applicable     | implemented together to |
|   |     | federal laws, directives,      | ensure that:            |
|   |     | policies, regulations,         |                         |
|   |     | standards, and guidance. The   | -   Only personnel      |
|   |     | configuration management       |     assigned to trusted |
|   |     | policy can be included as part |     roles have read     |
|   |     | of the general information     |     access to the logs; |
|   |     | security policy for the        |                         |
|   |     | organization. Configuration    | -   Only authorized     |
|   |     | management procedures can be   |     people may archive  |
|   |     | developed for the security     |     audit logs; and,    |
|   |     | program in general, and for a  |                         |
|   |     | particular information system, | -   Audit logs are not  |
|   |     | when required. NIST Special    |     modified.           |
|   |     | Publication 800-12 provides    |                         |
|   |     | guidance on security policies  | 5.5.1 Types of events   |
|   |     | and procedures.                | archived                |
|   |     |                                |                         |
|   |     |                                | System configuration    |
|   |     |                                | Information is archived |
|   |     |                                | along with              |
|   |     |                                | modifications and       |
|   |     |                                | update information.     |
|   |     |                                |                         |
|   |     |                                | 6.6.2 Security          |
|   |     |                                | management Controls     |
|   |     |                                |                         |
|   |     |                                | The configuration of    |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system as well as any   |
|   |     |                                | modifications and       |
|   |     |                                | upgrades shall be       |
|   |     |                                | documented and          |
|   |     |                                | controlled. There shall |
|   |     |                                | be a mechanism for      |
|   |     |                                | detecting unauthorized  |
|   |     |                                | modification to the     |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | software or             |
|   |     |                                | configuration. A formal |
|   |     |                                | configuration           |
|   |     |                                | management methodology  |
|   |     |                                | shall be used for       |
|   |     |                                | installation and        |
|   |     |                                | ongoing maintenance of  |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system.                 |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 5 | M-2 |                                |                         |
| . | (1) | The organization develops,     | 5.4.1 Types of events   |
|   |     | documents, and maintains a     | recorded                |
|   | BA  | current, baseline              |                         |
|   | SEL | configuration of the           | Auditable events:       |
|   | INE | information system, an         |                         |
|   | C   | inventory of the system's      | CA Configuration        |
|   | ONF | constituent components, and    |                         |
|   | IGU | relevant ownership             | Configuration changes   |
|   | RAT | information.                   | to the CA server        |
|   | ION |                                | involving: Hardware,    |
|   | AND | Enhancements:                  | Software, Operating     |
|   | SYS |                                | System Patches,         |
|   | TEM | \(1\) The organization updates | Security Profiles.      |
|   | COM | the baseline configuration of  |                         |
|   | PON | the information system and     | 5.5.1 Types of events   |
|   | ENT | inventory of system components | archived                |
|   | INV | as an integral part of         |                         |
|   | ENT | information system component   | System and equipment    |
|   | ORY | installations.\                | configuration           |
|   |     | (2) The organization employs   |                         |
|   |     | automated mechanisms to        | Modifications and       |
|   |     | maintain an up-to-date,        | updates to system or    |
|   |     | complete, accurate,\           | configuration           |
|   |     | and readily available baseline |                         |
|   |     | configuration of the           | 6.6.2 Security          |
|   |     | information system and         | management Controls     |
|   |     | inventory of information\      |                         |
|   |     | system components.             | The configuration of    |
|   |     |                                | the FBCA or Entity CA   |
|   |     | Supplemental Guidance:         | system as well as any   |
|   |     |                                | modifications and       |
|   |     | The configuration of the       | upgrades shall be       |
|   |     | information system is          | documented and          |
|   |     | consistent with the Federal    | controlled. There shall |
|   |     | Enterprise Architecture and    | be a mechanism for      |
|   |     | the organization's information | detecting unauthorized  |
|   |     | system architecture. The       | modification to the     |
|   |     | inventory of information       | FBCA or Entity CA       |
|   |     | system components includes     | software or             |
|   |     | manufacturer, type, serial     | configuration. A formal |
|   |     | number, version number,        | configuration           |
|   |     | information system/component   | management methodology  |
|   |     | owner, and location (i.e.,     | shall be used for       |
|   |     | physical location and logical  | installation and        |
|   |     | position within the            | ongoing maintenance of  |
|   |     | information system             | the FBCA or Entity CA   |
|   |     | architecture). The inventory   | system. The FBCA or     |
|   |     | also designates those          | Entity CA software,     |
|   |     | information system components  | when first loaded,      |
|   |     | required to implement and/or   | shall be verified as    |
|   |     | conduct contingency planning   | being that supplied     |
|   |     | operations.                    | from the vendor, with   |
|   |     |                                | no modifications, and   |
|   |     |                                | be the version intended |
|   |     |                                | for use. For the FBCA,  |
|   |     |                                | the integrity of the    |
|   |     |                                | software shall be       |
|   |     |                                | verified by the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | at least weekly (e.g.,  |
|   |     |                                | in conjunction with CRL |
|   |     |                                | publication).           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 6 | M-3 |                                |                         |
| . |     | The organization documents and | 1.  The administrator   |
|   | C   | controls changes to the        |     role is responsible |
|   | ONF | information system.            |     for:                |
|   | IGU | Appropriate organizational     |                         |
|   | RAT | officials approve information  | -   Installation,       |
|   | ION | system changes in accordance   |     configuration, and  |
|   | CHA | with organizational policies   |     maintenance of the  |
|   | NGE | and procedures.                |     CA;                 |
|   | C   |                                |                         |
|   | ONT | Enhancements:                  | 5.4.1 Types of events   |
|   | ROL |                                | recorded                |
|   |     | \(1\) The organization employs |                         |
|   |     | automated mechanisms to: (i)   | Auditable events:       |
|   |     | document proposed changes to   |                         |
|   |     | the\                           | CA Configuration        |
|   |     | information system; (ii)       |                         |
|   |     | notify appropriate approval    | Configuration changes   |
|   |     | authorities; (iii) highlight   | to the CA server        |
|   |     | approvals that have\           | involving: Hardware,    |
|   |     | not been received in a timely  | Software, Operating     |
|   |     | manner; (iv) inhibit change    | System Patches,         |
|   |     | until necessary approvals are  | Security Profiles.      |
|   |     | received;\                     |                         |
|   |     | and (v) document completed     | 5.5.1 Types of events   |
|   |     | changes to the information     | archived                |
|   |     | system.                        |                         |
|   |     |                                | System and equipment    |
|   |     | Supplemental Guidance:         | configuration           |
|   |     |                                |                         |
|   |     | Configuration change control   | Modifications and       |
|   |     | involves the systematic        | updates to system or    |
|   |     | proposal, justification,       | configuration           |
|   |     | test/evaluation, review, and   |                         |
|   |     | disposition of proposed        | 6.6.2 Security          |
|   |     | changes. The organization      | management Controls     |
|   |     | includes emergency changes in  |                         |
|   |     | the configuration change       | The configuration of    |
|   |     | control process.               | the FBCA or Entity CA   |
|   |     |                                | system as well as any   |
|   |     |                                | modifications and       |
|   |     |                                | upgrades shall be       |
|   |     |                                | documented and          |
|   |     |                                | controlled. There shall |
|   |     |                                | be a mechanism for      |
|   |     |                                | detecting unauthorized  |
|   |     |                                | modification to the     |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | software or             |
|   |     |                                | configuration. A formal |
|   |     |                                | configuration           |
|   |     |                                | management methodology  |
|   |     |                                | shall be used for       |
|   |     |                                | installation and        |
|   |     |                                | ongoing maintenance of  |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system. The FBCA or     |
|   |     |                                | Entity CA software,     |
|   |     |                                | when first loaded,      |
|   |     |                                | shall be verified as    |
|   |     |                                | being that supplied     |
|   |     |                                | from the vendor, with   |
|   |     |                                | no modifications, and   |
|   |     |                                | be the version intended |
|   |     |                                | for use. For the FBCA,  |
|   |     |                                | the integrity of the    |
|   |     |                                | software shall be       |
|   |     |                                | verified by the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | at least weekly (e.g.,  |
|   |     |                                | in conjunction with CRL |
|   |     |                                | publication).           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 7 | M-4 |                                |                         |
| . |     | The organization monitors      | 5.4.1 Types of events   |
|   | M   | changes to the information     | recorded                |
|   | ONI | system and conducts security   |                         |
|   | TOR | impact analyses to determine   | Auditable events:       |
|   | ING | the effects of the changes.    |                         |
|   | C   |                                | CA Configuration        |
|   | ONF | Enhancements:                  |                         |
|   | IGU |                                | Configuration changes   |
|   | RAT | None.                          | to the CA server        |
|   | ION |                                | involving: Hardware,    |
|   | C   | Supplemental Guidance:         | Software, Operating     |
|   | HAN |                                | System Patches,         |
|   | GES | The organization documents the | Security Profiles.      |
|   |     | installation of information    |                         |
|   |     | system components. After the   | 5.5.1 Types of events   |
|   |     | information system is changed, | archived                |
|   |     | the organizations checks the   |                         |
|   |     | security features to ensure    | System and equipment    |
|   |     | the features are still         | configuration           |
|   |     | functioning properly. The      |                         |
|   |     | organization audits activities | Modifications and       |
|   |     | associated with configuration  | updates to system or    |
|   |     | changes to the information     | configuration           |
|   |     | system.                        |                         |
|   |     |                                | 6.6.2 Security          |
|   |     |                                | management Controls     |
|   |     |                                |                         |
|   |     |                                | The configuration of    |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system as well as any   |
|   |     |                                | modifications and       |
|   |     |                                | upgrades shall be       |
|   |     |                                | documented and          |
|   |     |                                | controlled. There shall |
|   |     |                                | be a mechanism for      |
|   |     |                                | detecting unauthorized  |
|   |     |                                | modification to the     |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | software or             |
|   |     |                                | configuration. A formal |
|   |     |                                | configuration           |
|   |     |                                | management methodology  |
|   |     |                                | shall be used for       |
|   |     |                                | installation and        |
|   |     |                                | ongoing maintenance of  |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system. The FBCA or     |
|   |     |                                | Entity CA software,     |
|   |     |                                | when first loaded,      |
|   |     |                                | shall be verified as    |
|   |     |                                | being that supplied     |
|   |     |                                | from the vendor, with   |
|   |     |                                | no modifications, and   |
|   |     |                                | be the version intended |
|   |     |                                | for use. For the FBCA,  |
|   |     |                                | the integrity of the    |
|   |     |                                | software shall be       |
|   |     |                                | verified by the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | at least weekly (e.g.,  |
|   |     |                                | in conjunction with CRL |
|   |     |                                | publication).           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 8 | M-5 |                                |                         |
| . |     | The organization enforces      | 5.1.2.1 Physical Access |
|   | ACC | physical and logical access    | for CA equipment        |
|   | ESS | restrictions associated with   |                         |
|   | RES | changes to the information     | The FBCA and Entity CA  |
|   | TRI | system and generates, retains, | equipment shall always  |
|   | CTI | and reviews records reflecting | be protected from       |
|   | ONS | all such changes.              | unauthorized access.    |
|   | FOR |                                | The security mechanisms |
|   | CHA | Enhancements:                  | shall be commensurate   |
|   | NGE |                                | with the level of       |
|   |     | \(1\) The organization employs | threat in the equipment |
|   |     | automated mechanisms to        | environment. Since the  |
|   |     | enforce access restrictions    | FBCA must plan to issue |
|   |     | and support\                   | certificates at all     |
|   |     | auditing of the enforcement    | levels of assurance, it |
|   |     | actions.                       | shall be operated and   |
|   |     |                                | controlled on the       |
|   |     | Supplemental Guidance:         | presumption that it     |
|   |     |                                | will be issuing at      |
|   |     | Planned or unplanned changes   | least one High          |
|   |     | to the hardware, software,     | Assurance certificate.  |
|   |     | and/or firmware components of  |                         |
|   |     | the information system can     | The physical security   |
|   |     | have significant effects on    | requirements pertaining |
|   |     | the overall security of the    | to CAs that issue Basic |
|   |     | system. Accordingly, the       | Assurance certificates  |
|   |     | organization ensures that only | are:                    |
|   |     | qualified and authorized       |                         |
|   |     | individuals obtain access to   | -   Ensure no           |
|   |     | information system components  |     unauthorized access |
|   |     | for purposes of initiating     |     to the hardware is  |
|   |     | changes, upgrades, and/or      |     permitted           |
|   |     | modifications. Appropriate     |                         |
|   |     | organizational officials       | -   Ensure all          |
|   |     | approve individual access      |     removable media and |
|   |     | privileges.                    |     paper containing    |
|   |     |                                |     sensitive           |
|   |     |                                |     plain-text          |
|   |     |                                |     information is      |
|   |     |                                |     stored in secure    |
|   |     |                                |     containers          |
|   |     |                                |                         |
|   |     |                                | In addition to those    |
|   |     |                                | requirements, the       |
|   |     |                                | following requirements  |
|   |     |                                | shall apply to CAs that |
|   |     |                                | issue Medium, Medium    |
|   |     |                                | Hardware, or High       |
|   |     |                                | assurance certificates: |
|   |     |                                |                         |
|   |     |                                | -   Ensure manual or    |
|   |     |                                |     electronic          |
|   |     |                                |     monitoring for      |
|   |     |                                |     unauthorized        |
|   |     |                                |     intrusion at all    |
|   |     |                                |     times               |
|   |     |                                |                         |
|   |     |                                | -   Ensure an access    |
|   |     |                                |     log is maintained   |
|   |     |                                |     and inspected       |
|   |     |                                |     periodically        |
|   |     |                                |                         |
|   |     |                                | -   Require two person  |
|   |     |                                |     physical access     |
|   |     |                                |     control to both the |
|   |     |                                |     cryptographic       |
|   |     |                                |     module and computer |
|   |     |                                |     system              |
|   |     |                                |                         |
|   |     |                                | Removable cryptographic |
|   |     |                                | modules, activation     |
|   |     |                                | information used to     |
|   |     |                                | access or enable        |
|   |     |                                | cryptographic modules,  |
|   |     |                                | and other sensitive CA  |
|   |     |                                | equipment shall be      |
|   |     |                                | placed in secure        |
|   |     |                                | containers when not in  |
|   |     |                                | use. Activation data    |
|   |     |                                | shall either be         |
|   |     |                                | memorized, or recorded  |
|   |     |                                | and stored in a manner  |
|   |     |                                | commensurate with the   |
|   |     |                                | security afforded the   |
|   |     |                                | cryptographic module,   |
|   |     |                                | and shall not be stored |
|   |     |                                | with the cryptographic  |
|   |     |                                | module.                 |
|   |     |                                |                         |
|   |     |                                | A security check of the |
|   |     |                                | facility housing the    |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | equipment (operating at |
|   |     |                                | the Basic Assurance     |
|   |     |                                | level or higher) shall  |
|   |     |                                | occur if the facility   |
|   |     |                                | is to be left           |
|   |     |                                | unattended. At a        |
|   |     |                                | minimum, the check      |
|   |     |                                | shall verify the        |
|   |     |                                | following:              |
|   |     |                                |                         |
|   |     |                                | -   The equipment is in |
|   |     |                                |     a state appropriate |
|   |     |                                |     to the current mode |
|   |     |                                |     of operation (e.g., |
|   |     |                                |     that cryptographic  |
|   |     |                                |     modules are in      |
|   |     |                                |     place when "open",  |
|   |     |                                |     and secured when    |
|   |     |                                |     "closed"; and for   |
|   |     |                                |     the FBCA, that all  |
|   |     |                                |     equipment other     |
|   |     |                                |     than the repository |
|   |     |                                |     is shut down);      |
|   |     |                                |                         |
|   |     |                                | -   Any security        |
|   |     |                                |     containers are      |
|   |     |                                |     properly secured;   |
|   |     |                                |                         |
|   |     |                                | -   Physical security   |
|   |     |                                |     systems (e.g., door |
|   |     |                                |     locks, vent covers) |
|   |     |                                |     are functioning     |
|   |     |                                |     properly; and       |
|   |     |                                |                         |
|   |     |                                | -   The area is secured |
|   |     |                                |     against             |
|   |     |                                |     unauthorized        |
|   |     |                                |     access.             |
|   |     |                                |                         |
|   |     |                                | A person or group of    |
|   |     |                                | persons shall be made   |
|   |     |                                | explicitly responsible  |
|   |     |                                | for making such checks. |
|   |     |                                | When a group of persons |
|   |     |                                | is responsible, a log   |
|   |     |                                | identifying the person  |
|   |     |                                | performing a check at   |
|   |     |                                | each instance shall be  |
|   |     |                                | maintained. If the      |
|   |     |                                | facility is not         |
|   |     |                                | continuously attended,  |
|   |     |                                | the last person to      |
|   |     |                                | depart shall initial a  |
|   |     |                                | sign-out sheet that     |
|   |     |                                | indicates the date and  |
|   |     |                                | time, and asserts that  |
|   |     |                                | all necessary physical  |
|   |     |                                | protection mechanisms   |
|   |     |                                | are in place and        |
|   |     |                                | activated.              |
|   |     |                                |                         |
|   |     |                                | 5.1.2.2 Physical Access |
|   |     |                                | for RA Equipment        |
|   |     |                                |                         |
|   |     |                                | RA equipment shall be   |
|   |     |                                | protected from          |
|   |     |                                | unauthorized access     |
|   |     |                                | while the cryptographic |
|   |     |                                | module is installed and |
|   |     |                                | activated. The RA shall |
|   |     |                                | implement physical      |
|   |     |                                | access controls to      |
|   |     |                                | reduce the risk of      |
|   |     |                                | equipment tampering     |
|   |     |                                | even when the           |
|   |     |                                | cryptographic module is |
|   |     |                                | not installed and       |
|   |     |                                | activated. These        |
|   |     |                                | security mechanisms     |
|   |     |                                | shall be commensurate   |
|   |     |                                | with the level of       |
|   |     |                                | threat in the RA        |
|   |     |                                | equipment environment.  |
|   |     |                                |                         |
|   |     |                                | 5.4.1 Types of events   |
|   |     |                                | recorded                |
|   |     |                                |                         |
|   |     |                                | Auditable events:       |
|   |     |                                |                         |
|   |     |                                | CA Configuration        |
|   |     |                                |                         |
|   |     |                                | Configuration changes   |
|   |     |                                | to the CA server        |
|   |     |                                | involving: Hardware,    |
|   |     |                                | Software, Operating     |
|   |     |                                | System Patches,         |
|   |     |                                | Security Profiles.      |
|   |     |                                |                         |
|   |     |                                | 5.5.1 Types of events   |
|   |     |                                | archived                |
|   |     |                                |                         |
|   |     |                                | System and equipment    |
|   |     |                                | configuration           |
|   |     |                                |                         |
|   |     |                                | Modifications and       |
|   |     |                                | updates to system or    |
|   |     |                                | configuration           |
|   |     |                                |                         |
|   |     |                                | 6.5.1 Specific Computer |
|   |     |                                | Security Technical      |
|   |     |                                | Requirements            |
|   |     |                                |                         |
|   |     |                                | For the FBCA, the       |
|   |     |                                | computer security       |
|   |     |                                | functions listed below  |
|   |     |                                | are required. These     |
|   |     |                                | functions may be        |
|   |     |                                | provided by the         |
|   |     |                                | operating system, or    |
|   |     |                                | through a combination   |
|   |     |                                | of operating system,    |
|   |     |                                | software, and physical  |
|   |     |                                | safeguards. The FBCA    |
|   |     |                                | and its ancillary parts |
|   |     |                                | shall include the       |
|   |     |                                | following               |
|   |     |                                | functionality:          |
|   |     |                                |                         |
|   |     |                                | -   Require             |
|   |     |                                |     authenticated       |
|   |     |                                |     logins              |
|   |     |                                |                         |
|   |     |                                | -   Provide             |
|   |     |                                |     Discretionary       |
|   |     |                                |     Access Control      |
|   |     |                                |                         |
|   |     |                                | -   Provide a security  |
|   |     |                                |     audit capability    |
|   |     |                                |                         |
|   |     |                                | -   Restrict access     |
|   |     |                                |     control to FBCA     |
|   |     |                                |     services and PKI    |
|   |     |                                |     roles               |
|   |     |                                |                         |
|   |     |                                | -   Enforce separation  |
|   |     |                                |     of duties for PKI   |
|   |     |                                |     roles               |
|   |     |                                |                         |
|   |     |                                | -   Require             |
|   |     |                                |     identification and  |
|   |     |                                |     authentication of   |
|   |     |                                |     PKI roles and       |
|   |     |                                |     associated          |
|   |     |                                |     identities          |
|   |     |                                |                         |
|   |     |                                | -   Prohibit object     |
|   |     |                                |     re-use or require   |
|   |     |                                |     separation for FBCA |
|   |     |                                |     random access       |
|   |     |                                |     memory              |
|   |     |                                |                         |
|   |     |                                | -   Require use of      |
|   |     |                                |     cryptography for    |
|   |     |                                |     session             |
|   |     |                                |     communication and   |
|   |     |                                |     database security   |
|   |     |                                |                         |
|   |     |                                | -   Archive FBCA        |
|   |     |                                |     history and audit   |
|   |     |                                |     data                |
|   |     |                                |                         |
|   |     |                                | -   Require self-test   |
|   |     |                                |     security related    |
|   |     |                                |     FBCA services       |
|   |     |                                |                         |
|   |     |                                | -   Require a trusted   |
|   |     |                                |     path for            |
|   |     |                                |     identification of   |
|   |     |                                |     PKI roles and       |
|   |     |                                |     associated          |
|   |     |                                |     identities          |
|   |     |                                |                         |
|   |     |                                | -   Require a recovery  |
|   |     |                                |     mechanisms for keys |
|   |     |                                |     and the FBCA system |
|   |     |                                |                         |
|   |     |                                | -   Enforce domain      |
|   |     |                                |     integrity           |
|   |     |                                |     boundaries for      |
|   |     |                                |     security critical   |
|   |     |                                |     processes           |
|   |     |                                |                         |
|   |     |                                | For Entity CAs, the     |
|   |     |                                | computer security       |
|   |     |                                | functions listed below  |
|   |     |                                | are required. These     |
|   |     |                                | functions may be        |
|   |     |                                | provided by the         |
|   |     |                                | operating system, or    |
|   |     |                                | through a combination   |
|   |     |                                | of operating system,    |
|   |     |                                | software, and physical  |
|   |     |                                | safeguards. The Entity  |
|   |     |                                | CA and its ancillary    |
|   |     |                                | parts shall include the |
|   |     |                                | following               |
|   |     |                                | functionality:          |
|   |     |                                |                         |
|   |     |                                | -   authenticate the    |
|   |     |                                |     identity of users   |
|   |     |                                |     before permitting   |
|   |     |                                |     access to the       |
|   |     |                                |     system or           |
|   |     |                                |     applications;       |
|   |     |                                |                         |
|   |     |                                | -   manage privileges   |
|   |     |                                |     of users to limit   |
|   |     |                                |     users to their      |
|   |     |                                |     assigned roles;     |
|   |     |                                |                         |
|   |     |                                | -   generate and        |
|   |     |                                |     archive audit       |
|   |     |                                |     records for all     |
|   |     |                                |     transactions; (see  |
|   |     |                                |     Section 5.4)        |
|   |     |                                |                         |
|   |     |                                | -   enforce domain      |
|   |     |                                |     integrity           |
|   |     |                                |     boundaries for      |
|   |     |                                |     security critical   |
|   |     |                                |     processes; and      |
|   |     |                                |                         |
|   |     |                                | -   support recovery    |
|   |     |                                |     from key or system  |
|   |     |                                |     failure.            |
|   |     |                                |                         |
|   |     |                                | 6.6.2 Security          |
|   |     |                                | management Controls     |
|   |     |                                |                         |
|   |     |                                | The configuration of    |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system as well as any   |
|   |     |                                | modifications and       |
|   |     |                                | upgrades shall be       |
|   |     |                                | documented and          |
|   |     |                                | controlled. There shall |
|   |     |                                | be a mechanism for      |
|   |     |                                | detecting unauthorized  |
|   |     |                                | modification to the     |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | software or             |
|   |     |                                | configuration. A formal |
|   |     |                                | configuration           |
|   |     |                                | management methodology  |
|   |     |                                | shall be used for       |
|   |     |                                | installation and        |
|   |     |                                | ongoing maintenance of  |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | system. The FBCA or     |
|   |     |                                | Entity CA software,     |
|   |     |                                | when first loaded,      |
|   |     |                                | shall be verified as    |
|   |     |                                | being that supplied     |
|   |     |                                | from the vendor, with   |
|   |     |                                | no modifications, and   |
|   |     |                                | be the version intended |
|   |     |                                | for use. For the FBCA,  |
|   |     |                                | the integrity of the    |
|   |     |                                | software shall be       |
|   |     |                                | verified by the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | at least weekly (e.g.,  |
|   |     |                                | in conjunction with CRL |
|   |     |                                | publication).           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 4 | C   | Control:                       | FBCA Section:           |
| 9 | M-6 |                                |                         |
| . |     | The organization: (i)          | 6.5                     |
|   | C   | establishes mandatory          |                         |
|   | ONF | configuration settings for     | 6.6                     |
|   | IGU | information technology         |                         |
|   | RAT | products employed within the   |                         |
|   | ION | information system; (ii)       |                         |
|   | SE  | configures the security        |                         |
|   | TTI | settings of information        |                         |
|   | NGS | technology products to the     |                         |
|   |     | most restrictive mode          |                         |
|   |     | consistent with operational    |                         |
|   |     | requirements; (iii) documents  |                         |
|   |     | the configuration settings;    |                         |
|   |     | and (iv) enforces the          |                         |
|   |     | configuration settings in all  |                         |
|   |     | components of the information  |                         |
|   |     | system.                        |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization employs |                         |
|   |     | automated mechanisms to        |                         |
|   |     | centrally manage, apply, and   |                         |
|   |     | verify configuration settings. |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | NIST Special Publication       |                         |
|   |     | 800-70 provides guidance on    |                         |
|   |     | producing and using            |                         |
|   |     | configuration settings for     |                         |
|   |     | information technology         |                         |
|   |     | products employed in           |                         |
|   |     | organizational information     |                         |
|   |     | systems.                       |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 0 | M-7 |                                |                         |
| . |     | The organization configures    | 6.6.1 System            |
|   | LE  | the information system to      | Development Controls    |
|   | AST | provide only essential         |                         |
|   | F   | capabilities and specifically  | The System Development  |
|   | UNC | prohibits and/or restricts the | Controls for the FBCA   |
|   | TIO | use of the following           | and Entity CAs at the   |
|   | NAL | functions, ports, protocols,   | Basic Assurance level   |
|   | ITY | and/or services:               | and above are as        |
|   |     | \[*Assignment:                 | follows:                |
|   |     | organization-defined list of   |                         |
|   |     | prohibited and/or restricted   | -   The CA hardware and |
|   |     | functions, ports, protocols,   |     software shall be   |
|   |     | and/or services*\].            |     dedicated to        |
|   |     |                                |     performing one      |
|   |     | Enhancements:                  |     task: the CA. There |
|   |     |                                |     shall be no other   |
|   |     | \(1\) The organization reviews |     applications;       |
|   |     | the information system         |     hardware devices,   |
|   |     | \[Assignment:                  |     network             |
|   |     | organization-defined           |     connections, or     |
|   |     | frequency\], to\               |     component software  |
|   |     | identify and eliminate         |     installed which are |
|   |     | unnecessary functions, ports,  |     not part of the CA  |
|   |     | protocols, and/or services.    |     operation.          |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | 6.7 Network Security    |
|   |     |                                | Controls                |
|   |     | Information systems are        |                         |
|   |     | capable of providing a wide    | Network security        |
|   |     | variety of functions and       | controls shall be       |
|   |     | services. Some of the          | employed to protect the |
|   |     | functions and services,        | FBCA and the FBCA       |
|   |     | provided by default, may not   | Internal Directory.     |
|   |     | be necessary to support        | Networking equipment    |
|   |     | essential organizational       | shall turn off unused   |
|   |     | operations (e.g., key          | network ports and       |
|   |     | missions, functions). The      | services. Any network   |
|   |     | functions and services         | software installed on   |
|   |     | provided by information        | the FBCA equipment      |
|   |     | systems should be carefully    | shall be necessary to   |
|   |     | reviewed to determine which    | the functioning of the  |
|   |     | functions and services are     | FBCA.                   |
|   |     | candidates for elimination     |                         |
|   |     | (e.g., Voice Over Internet     | The FBCA Border         |
|   |     | Protocol, Instant Messaging,   | Directory shall be      |
|   |     | File Transfer Protocol, Hyper  | connected to the        |
|   |     | Text Transfer Protocol, file   | Internet and provide    |
|   |     | sharing).                      | continuous service      |
|   |     |                                | (except, when           |
|   |     |                                | necessary, for brief    |
|   |     |                                | periods of maintenance  |
|   |     |                                | or backup).             |
|   |     |                                |                         |
|   |     |                                | Any boundary control    |
|   |     |                                | devices used to protect |
|   |     |                                | the Border directory or |
|   |     |                                | FBCA local area network |
|   |     |                                | shall deny all but the  |
|   |     |                                | necessary services to   |
|   |     |                                | the PKI equipment even  |
|   |     |                                | if those services are   |
|   |     |                                | enabled for other       |
|   |     |                                | devices on the network. |
|   |     |                                |                         |
|   |     |                                | Entity CAs and          |
|   |     |                                | directories shall       |
|   |     |                                | employ appropriate      |
|   |     |                                | network security        |
|   |     |                                | controls. Networking    |
|   |     |                                | equipment shall turn    |
|   |     |                                | off unused network      |
|   |     |                                | ports and services. Any |
|   |     |                                | network software        |
|   |     |                                | present shall be        |
|   |     |                                | necessary to the        |
|   |     |                                | functioning of the      |
|   |     |                                | equipment.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 1 | P-1 |                                |                         |
| . |     | The organization develops,     | Dissemination:          |
|   | CO  | disseminates, and periodically |                         |
|   | NTI | reviews/updates: (i) a formal, | 2.2.2 The FPKI          |
|   | NGE | documented, contingency        | Operational Authority   |
|   | NCY | planning policy that addresses | shall publish           |
|   | PL  | purpose, scope, roles,         | information concerning  |
|   | ANN | responsibilities, management   | the FBCA necessary to   |
|   | ING | commitment, coordination among | support its use and     |
|   | POL | organizational entities, and   | operation. The FBCA CP  |
|   | ICY | compliance; and (ii) formal,   | shall be publicly       |
|   | AND | documented procedures to       | available on the FPKI   |
|   | P   | facilitate the implementation  | PA website (see         |
|   | ROC | of the contingency planning    | http                    |
|   | EDU | policy and associated          | ://www.cio.gov/fpkipa). |
|   | RES | contingency planning controls. |                         |
|   |     |                                | Section 8: The FPKI     |
|   |     | Enhancements:                  | Operational Authority   |
|   |     |                                | shall have a compliance |
|   |     | None.                          | audit mechanism in      |
|   |     |                                | place to ensure that    |
|   |     | Supplemental Guidance:         | the requirements of     |
|   |     |                                | this CP and the FBCA    |
|   |     | The contingency planning       | CPS are being           |
|   |     | policy and procedures are      | implemented and         |
|   |     | consistent with applicable     | enforced.               |
|   |     | federal laws, directives,      |                         |
|   |     | policies, regulations,         | Entity CAs shall have a |
|   |     | standards, and guidance. The   | compliance audit        |
|   |     | contingency planning policy    | mechanism in place to   |
|   |     | can be included as part of the | ensure that the         |
|   |     | general information security   | requirements of their   |
|   |     | policy for the organization.   | CP/CPS are being        |
|   |     | Contingency planning           | implemented and         |
|   |     | procedures can be developed    | enforced.               |
|   |     | for the security program in    |                         |
|   |     | general, and for a particular  | 5.1.8 For the FBCA and  |
|   |     | information system, when       | Entity CAs operating at |
|   |     | required. NIST Special         | the Basic Assurance     |
|   |     | Publication 800-34 provides    | level or higher, full   |
|   |     | guidance on contingency        | system backups          |
|   |     | planning. NIST Special         | sufficient to recover   |
|   |     | Publication 800-12 provides    | from system failure     |
|   |     | guidance on security policies  | shall be made on a      |
|   |     | and procedures.                | periodic schedule.      |
|   |     |                                | Backups are to be       |
|   |     |                                | performed and stored    |
|   |     |                                | off-site not less than  |
|   |     |                                | once per week. At least |
|   |     |                                | one full backup copy    |
|   |     |                                | shall be stored at an   |
|   |     |                                | off-site location       |
|   |     |                                | separate from the FBCA  |
|   |     |                                | or Entity CA equipment. |
|   |     |                                | Only the latest full    |
|   |     |                                | backup need be          |
|   |     |                                | retained. The backup    |
|   |     |                                | shall be stored at a    |
|   |     |                                | site with physical and  |
|   |     |                                | procedural controls     |
|   |     |                                | commensurate to that of |
|   |     |                                | the operational FBCA or |
|   |     |                                | Entity CA               |
|   |     |                                |                         |
|   |     |                                | 5.7.4 The FPKI          |
|   |     |                                | Operational Authority   |
|   |     |                                | shall operate a hot     |
|   |     |                                | backup site, whose      |
|   |     |                                | purpose is to ensure    |
|   |     |                                | continuity of           |
|   |     |                                | operations in the event |
|   |     |                                | of failure of the       |
|   |     |                                | primary site. The FBCA  |
|   |     |                                | operations shall be     |
|   |     |                                | designed to restore     |
|   |     |                                | full service within six |
|   |     |                                | (6) hours of primary    |
|   |     |                                | system failure.         |
|   |     |                                |                         |
|   |     |                                | 8.1 The FBCA, Entity    |
|   |     |                                | Principal CAs and RAs   |
|   |     |                                | and their subordinate   |
|   |     |                                | CAs and RAs shall be    |
|   |     |                                | subject to a periodic   |
|   |     |                                | compliance audit at     |
|   |     |                                | least once per year for |
|   |     |                                | High, Medium Hardware,  |
|   |     |                                | and Medium Assurance.   |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 2 | P-2 |                                |                         |
| . | (1) | The organization develops and  | 5.7                     |
|   |     | implements a contingency plan  |                         |
|   | CO  | for the information system     |                         |
|   | NTI | addressing contingency roles,  |                         |
|   | NGE | responsibilities, assigned     |                         |
|   | NCY | individuals with contact       |                         |
|   | P   | information, and activities    |                         |
|   | LAN | associated with restoring the  |                         |
|   |     | system after a disruption or   |                         |
|   |     | failure. Designated officials  |                         |
|   |     | within the organization review |                         |
|   |     | and approve the contingency    |                         |
|   |     | plan and distribute copies of  |                         |
|   |     | the plan to key contingency    |                         |
|   |     | personnel.                     |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization         |                         |
|   |     | coordinates contingency plan   |                         |
|   |     | development with               |                         |
|   |     | organizational elements        |                         |
|   |     | responsible for related plans  |                         |
|   |     | (e.g., Business Continuity     |                         |
|   |     | Plan, Disaster Recovery Plan,  |                         |
|   |     | Continuity of Operations Plan, |                         |
|   |     | Business Recovery Plan,        |                         |
|   |     | Incident Response Plan).       |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 3 | P-3 |                                |                         |
| . |     | The organization trains        | 5.3.3 Training          |
|   | CO  | personnel in their contingency | Requirements            |
|   | NTI | roles and responsibilities     |                         |
|   | NGE | with respect to the            | All personnel           |
|   | NCY | information system and         | performing duties with  |
|   | TR  | provides refresher training    | respect to the          |
|   | AIN | \[*Assignment:                 | operation of the FBCA   |
|   | ING | organization-defined           | or Entity CA shall      |
|   |     | frequency, at least            | receive comprehensive   |
|   |     | annually*\].                   | training in all         |
|   |     |                                | operational duties they |
|   |     | Enhancements:                  | are expected to         |
|   |     |                                | perform, including      |
|   |     | \(1\) The organization         | disaster recovery and   |
|   |     | incorporates simulated events  | business continuity     |
|   |     | into contingency training to   | procedures.             |
|   |     | facilitate effective\          |                         |
|   |     | response by personnel in       |                         |
|   |     | crisis situations.\            |                         |
|   |     | (2) The organization employs   |                         |
|   |     | automated mechanisms to        |                         |
|   |     | provide a more thorough and    |                         |
|   |     | realistic\                     |                         |
|   |     | training environment.          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 4 | P-4 |                                |                         |
| . | (1) | The organization tests the     |                         |
|   |     | contingency plan for the       |                         |
|   | CO  | information system             |                         |
|   | NTI | \[*Assignment:                 |                         |
|   | NGE | organization-defined           |                         |
|   | NCY | frequency, at least            |                         |
|   | P   | annually*\] using              |                         |
|   | LAN | \[*Assignment:                 |                         |
|   | T   | organization-defined tests and |                         |
|   | EST | exercises*\] to determine the  |                         |
|   | ING | plan's effectiveness and the   |                         |
|   |     | organization's readiness to    |                         |
|   |     | execute the plan. Appropriate  |                         |
|   |     | officials within the           |                         |
|   |     | organization review the        |                         |
|   |     | contingency plan test results  |                         |
|   |     | and initiate corrective        |                         |
|   |     | actions.                       |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization         |                         |
|   |     | coordinates contingency plan   |                         |
|   |     | testing with organizational    |                         |
|   |     | elements responsible for       |                         |
|   |     | related plans (e.g., Business  |                         |
|   |     | Continuity Plan, Disaster      |                         |
|   |     | Recovery Plan, Continuity of   |                         |
|   |     | Operations Plan, Business      |                         |
|   |     | Recovery Plan, Incident        |                         |
|   |     | Response Plan).\               |                         |
|   |     | (2) The organization tests the |                         |
|   |     | contingency plan at the        |                         |
|   |     | alternate processing site to   |                         |
|   |     | familiarize\                   |                         |
|   |     | contingency personnel with the |                         |
|   |     | facility and available         |                         |
|   |     | resources and to evaluate the  |                         |
|   |     | site's\                        |                         |
|   |     | capabilities to support        |                         |
|   |     | contingency operations.\       |                         |
|   |     | (3) The organization employs   |                         |
|   |     | automated mechanisms to more   |                         |
|   |     | thoroughly and effectively     |                         |
|   |     | test the\                      |                         |
|   |     | contingency plan.              |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | There are several methods for  |                         |
|   |     | testing contingency plans to   |                         |
|   |     | identify potential weaknesses  |                         |
|   |     | (e.g., full-scale contingency  |                         |
|   |     | plan testing,                  |                         |
|   |     | functional/tabletop            |                         |
|   |     | exercises).                    |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 5 | P-5 |                                |                         |
| . |     | The organization reviews the   |                         |
|   | CO  | contingency plan for the       |                         |
|   | NTI | information system             |                         |
|   | NGE | \[*Assignment:                 |                         |
|   | NCY | organization-defined           |                         |
|   | P   | frequency, at least            |                         |
|   | LAN | annually*\] and revises the    |                         |
|   | UPD | plan to address                |                         |
|   | ATE | system/organizational changes  |                         |
|   |     | or problems encountered during |                         |
|   |     | plan implementation,           |                         |
|   |     | execution, or testing.         |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Organizational changes include |                         |
|   |     | changes in mission, functions, |                         |
|   |     | or business processes          |                         |
|   |     | supported by the information   |                         |
|   |     | system. The organization       |                         |
|   |     | communicates changes to        |                         |
|   |     | appropriate organizational     |                         |
|   |     | elements responsible for       |                         |
|   |     | related plans (e.g., Business  |                         |
|   |     | Continuity Plan, Disaster      |                         |
|   |     | Recovery Plan, Continuity of   |                         |
|   |     | Operations Plan, Business      |                         |
|   |     | Recovery Plan, Incident        |                         |
|   |     | Response Plan).                |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 6 | P-6 |                                |                         |
| . | (1) | The organization identifies an | 5.7.4 The FPKI          |
|   |     | alternate storage site and     | Operational Authority   |
|   | ALT | initiates necessary agreements | shall operate a hot     |
|   | ERN | to permit the storage of       | backup site, whose      |
|   | ATE | information system backup      | purpose is to ensure    |
|   | S   | information.                   | continuity of           |
|   | TOR |                                | operations in the event |
|   | AGE | Enhancements:                  | of failure of the       |
|   | SI  |                                | primary site. The FBCA  |
|   | TES | \(1\) The alternate storage    | operations shall be     |
|   |     | site is geographically         | designed to restore     |
|   |     | separated from the primary     | full service within six |
|   |     | storage site so as not to be   | (6) hours of primary    |
|   |     | susceptible to the same        | system failure.         |
|   |     | hazards.\                      |                         |
|   |     | (2) The alternate storage site | 5.1.8                   |
|   |     | is configured to facilitate    |                         |
|   |     | timely and effective recovery  | For the FBCA and Entity |
|   |     | operations.\                   | CAs operating at the    |
|   |     | (3) The organization           | Basic Assurance level   |
|   |     | identifies potential           | or higher, full system  |
|   |     | accessibility problems to the  | backups sufficient to   |
|   |     | alternate storage site in the\ | recover from system     |
|   |     | event of an area-wide          | failure shall be made   |
|   |     | disruption or disaster and     | on a periodic schedule. |
|   |     | outlines explicit mitigation   | Backups are to be       |
|   |     | actions.                       | performed and stored    |
|   |     |                                | off-site not less than  |
|   |     | Supplemental Guidance:         | once per week. At least |
|   |     |                                | one full backup copy    |
|   |     | None.                          | shall be stored at an   |
|   |     |                                | off-site location       |
|   |     |                                | separate from the FBCA  |
|   |     |                                | or Entity CA equipment. |
|   |     |                                | Only the latest full    |
|   |     |                                | backup need be          |
|   |     |                                | retained. The backup    |
|   |     |                                | shall be stored at a    |
|   |     |                                | site with physical and  |
|   |     |                                | procedural controls     |
|   |     |                                | commensurate to that of |
|   |     |                                | the operational FBCA or |
|   |     |                                | Entity CA.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | at  |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 7 | P-7 |                                |                         |
| . | (1) | The organization identifies an | 5.7.4 The FPKI          |
|   | (2) | alternate processing site and  | Operational Authority   |
|   | (3) | initiates necessary agreements | shall operate a hot     |
|   |     | to permit the resumption of    | backup site, whose      |
|   | ALT | information system operations  | purpose is to ensure    |
|   | ERN | for critical mission/business  | continuity of           |
|   | ATE | functions within               | operations in the event |
|   | P   | \[*Assignment:                 | of failure of the       |
|   | ROC | organization-defined time      | primary site. The FBCA  |
|   | ESS | period*\] when the primary     | operations shall be     |
|   | ING | processing capabilities are    | designed to restore     |
|   | SI  | unavailable.                   | full service within six |
|   | TES |                                | (6) hours of primary    |
|   |     | Enhancements:                  | system failure.         |
|   |     |                                |                         |
|   |     | \(1\) The alternate processing |                         |
|   |     | site is geographically         |                         |
|   |     | separated from the primary     |                         |
|   |     | processing site so as not to   |                         |
|   |     | be susceptible to the same     |                         |
|   |     | hazards.\                      |                         |
|   |     | (2) The organization           |                         |
|   |     | identifies potential           |                         |
|   |     | accessibility problems to the  |                         |
|   |     | alternate processing site in   |                         |
|   |     | the event of an area-wide      |                         |
|   |     | disruption or disaster and     |                         |
|   |     | outlines explicit mitigation   |                         |
|   |     | actions.\                      |                         |
|   |     | (3) Alternate processing site  |                         |
|   |     | agreements contain             |                         |
|   |     | priority-of-service provisions |                         |
|   |     | in accordance with the         |                         |
|   |     | organization's availability    |                         |
|   |     | requirements.\                 |                         |
|   |     | (4) The alternate processing   |                         |
|   |     | site is fully configured to    |                         |
|   |     | support a minimum required     |                         |
|   |     | operational capability and     |                         |
|   |     | ready to use as the            |                         |
|   |     | operational site.              |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Equipment and supplies         |                         |
|   |     | required to resume operations  |                         |
|   |     | within the                     |                         |
|   |     | organization-defined time      |                         |
|   |     | period are either available at |                         |
|   |     | the alternate site or          |                         |
|   |     | contracts are in place to      |                         |
|   |     | support delivery to the site.  |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 8 | P-8 |                                |                         |
| . | (1) | The organization identifies    | 5.7.4 The FBCA          |
|   | (2) | primary and alternate          | directory system shall  |
|   |     | telecommunications services to | be deployed so as to    |
|   | TEL | support the information system | provide 24 hour, 365    |
|   | ECO | and initiates necessary        | day per year            |
|   | MMU | agreements to permit the       | availability. The FPKI  |
|   | NIC | resumption of system           | Operational Authority   |
|   | ATI | operations for critical        | shall implement         |
|   | ONS | mission/business functions     | features to provide     |
|   | SE  | within \[*Assignment:          | high levels of          |
|   | RVI | organization-defined time      | directory reliability.  |
|   | CES | period*\] when the primary     |                         |
|   |     | telecommunications             | The FPKI Operational    |
|   |     | capabilities are unavailable.  | Authority shall operate |
|   |     |                                | a hot backup site,      |
|   |     | Enhancements:                  | whose purpose is to     |
|   |     |                                | ensure continuity of    |
|   |     | \(1\) Primary and alternate    | operations in the event |
|   |     | telecommunications service     | of failure of the       |
|   |     | agreements contain             | primary site. The FBCA  |
|   |     | priority-of-service provisions | operations shall be     |
|   |     | in accordance with the         | designed to restore     |
|   |     | organization's availability    | full service within six |
|   |     | requirements.\                 | (6) hours of primary    |
|   |     | (2) Alternate                  | system failure.         |
|   |     | telecommunications services do |                         |
|   |     | not share a single point of    |                         |
|   |     | failure with primary           |                         |
|   |     | telecommunications services.\  |                         |
|   |     | (3) Alternate                  |                         |
|   |     | telecommunications service     |                         |
|   |     | providers are sufficiently     |                         |
|   |     | separated from primary         |                         |
|   |     | service\                       |                         |
|   |     | providers so as not to be      |                         |
|   |     | susceptible to the same        |                         |
|   |     | hazards.\                      |                         |
|   |     | (4) Primary and alternate      |                         |
|   |     | telecommunications service     |                         |
|   |     | providers have adequate        |                         |
|   |     | contingency plans.             |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | In the event that the primary  |                         |
|   |     | and/or alternate               |                         |
|   |     | telecommunications services    |                         |
|   |     | are provided by a wireline     |                         |
|   |     | carrier, the organization      |                         |
|   |     | should ensure that it requests |                         |
|   |     | Telecommunications Service     |                         |
|   |     | Priority (TSP) for all         |                         |
|   |     | telecommunications services    |                         |
|   |     | used for national security     |                         |
|   |     | emergency preparedness (See    |                         |
|   |     | http://tsp.ncs.gov for a full  |                         |
|   |     | explanation of the TSP         |                         |
|   |     | program).                      |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   | :   |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 5 | C   | Control:                       | FBCA Section:           |
| 9 | P-9 |                                |                         |
| . | (1) | The organization conducts      | 5.1.8 For the FBCA and  |
|   |     | backups of user-level and      | Entity CAs operating at |
|   | IN  | system-level information       | the Basic Assurance     |
|   | FOR | (including system state        | level or higher, full   |
|   | MAT | information) contained in the  | system backups          |
|   | ION | information system             | sufficient to recover   |
|   | SYS | \[*Assignment:                 | from system failure     |
|   | TEM | organization-defined           | shall be made on a      |
|   | BAC | frequency*\] and stores backup | periodic schedule.      |
|   | KUP | information at an              | Backups are to be       |
|   |     | appropriately secured          | performed and stored    |
|   |     | location.                      | off-site not less than  |
|   |     |                                | once per week. At least |
|   |     | Enhancements:                  | one full backup copy    |
|   |     |                                | shall be stored at an   |
|   |     | \(1\) The organization tests   | off-site location       |
|   |     | backup information             | separate from the FBCA  |
|   |     | \[Assignment:                  | or Entity CA equipment. |
|   |     | organization-defined           | Only the latest full    |
|   |     | frequency\] to ensure media    | backup need be          |
|   |     | reliability and information    | retained. The backup    |
|   |     | integrity.\                    | shall be stored at a    |
|   |     | (2) The organization           | site with physical and  |
|   |     | selectively uses backup        | procedural controls     |
|   |     | information in the restoration | commensurate to that of |
|   |     | of information system\         | the operational FBCA or |
|   |     | functions as part of           | Entity CA.              |
|   |     | contingency plan testing.\     |                         |
|   |     | (3) The organization stores    |                         |
|   |     | backup copies of the operating |                         |
|   |     | system and other critical      |                         |
|   |     | information\                   |                         |
|   |     | system software in a separate  |                         |
|   |     | facility or in a fire-rated    |                         |
|   |     | container that is not          |                         |
|   |     | collocated with the\           |                         |
|   |     | operational software.\         |                         |
|   |     | (4) The organization encrypts  |                         |
|   |     | backup information.            |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The frequency of information   |                         |
|   |     | system backups and the         |                         |
|   |     | transfer rate of backup        |                         |
|   |     | information to alternate       |                         |
|   |     | storage sites (if so           |                         |
|   |     | designated) are consistent     |                         |
|   |     | with the organization's        |                         |
|   |     | recovery time objectives and   |                         |
|   |     | recovery point objectives.     |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | CP  | Control:                       | FBCA Section:           |
| 0 | -10 |                                |                         |
| . |     | The organization employs       | 5.1.8 For the FBCA and  |
|   | IN  | mechanisms with supporting     | Entity CAs operating at |
|   | FOR | procedures to allow the        | the Basic Assurance     |
|   | MAT | information system to be       | level or higher, full   |
|   | ION | recovered and reconstituted to | system backups          |
|   | SYS | the system's original state    | sufficient to recover   |
|   | TEM | after a disruption or failure. | from system failure     |
|   | RE  |                                | shall be made on a      |
|   | COV | Enhancements:                  | periodic schedule.      |
|   | ERY |                                | Backups are to be       |
|   | AND | \(1\) The organization         | performed and stored    |
|   | RE  | includes a full recovery and   | off-site not less than  |
|   | CON | reconstitution of the          | once per week. At least |
|   | STI | information system as part of\ | one full backup copy    |
|   | TUT | contingency plan testing.      | shall be stored at an   |
|   | ION |                                | off-site location       |
|   |     | Supplemental Guidance:         | separate from the FBCA  |
|   |     |                                | or Entity CA equipment. |
|   |     | Secure information system      | Only the latest full    |
|   |     | recovery and reconstitution to | backup need be          |
|   |     | the system's original state    | retained. The backup    |
|   |     | means that all system          | shall be stored at a    |
|   |     | parameters (either default or  | site with physical and  |
|   |     | organization-established) are  | procedural controls     |
|   |     | reset, patches are             | commensurate to that of |
|   |     | reinstalled, configuration     | the operational FBCA or |
|   |     | settings are reestablished,    | Entity CA.              |
|   |     | system documentation and       |                         |
|   |     | operating procedures are       | 5.7.4 The FPKI          |
|   |     | available, application and     | Operational Authority   |
|   |     | system software is             | shall operate a hot     |
|   |     | reinstalled, information from  | backup site, whose      |
|   |     | the most recent backups is     | purpose is to ensure    |
|   |     | available, and the system is   | continuity of           |
|   |     | fully tested.                  | operations in the event |
|   |     |                                | of failure of the       |
|   |     |                                | primary site. The FBCA  |
|   |     |                                | operations shall be     |
|   |     |                                | designed to restore     |
|   |     |                                | full service within six |
|   |     |                                | (6) hours of primary    |
|   |     |                                | system failure.         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 1 | A-1 |                                |                         |
| . |     | The organization develops,     | Dissemination:          |
|   | ID  | disseminates, and periodically |                         |
|   | ENT | reviews/updates: (i) a formal, | 2.2.2 The FPKI          |
|   | IFI | documented, identification and | Operational Authority   |
|   | CAT | authentication policy that     | shall publish           |
|   | ION | addresses purpose, scope,      | information concerning  |
|   | AND | roles, responsibilities,       | the FBCA necessary to   |
|   | AU  | management commitment,         | support its use and     |
|   | THE | coordination among             | operation. The FBCA CP  |
|   | NTI | organizational entities, and   | shall be publicly       |
|   | CAT | compliance; and (ii) formal,   | available on the FPKI   |
|   | ION | documented procedures to       | PA website (see         |
|   | POL | facilitate the implementation  | <http:                  |
|   | ICY | of the identification and      | //www.cio.gov/fpkipa>). |
|   | AND | authentication policy and      |                         |
|   | P   | associated identification and  | 3.2.3.1 For             |
|   | ROC | authentication controls.       | Subscribers, the FPKI   |
|   | EDU |                                | Operational Authority   |
|   | RES | Enhancements:                  | or Entity CA, and/or    |
|   |     |                                | associated RAs shall    |
|   |     | None.                          | ensure that the         |
|   |     |                                | applicant's identity    |
|   |     | Supplemental Guidance:         | information is verified |
|   |     |                                | in accordance with the  |
|   |     | The identification and         | process established by  |
|   |     | authentication policy and      | the applicable CP and   |
|   |     | procedures are consistent      | CPS                     |
|   |     | with: (i) FIPS 201 and Special |                         |
|   |     | Publications 800-73, 800-76,   | The FPKI Operational    |
|   |     | and 800-78; and (ii) other     | Authority, Entity CAs   |
|   |     | applicable federal laws,       | and/or RAs shall record |
|   |     | directives, policies,          | the information set     |
|   |     | regulations, standards, and    | forth below for         |
|   |     | guidance. The identification   | issuance of each        |
|   |     | and authentication policy can  | certificate:            |
|   |     | be included as part of the     |                         |
|   |     | general information security   | -   The identity of the |
|   |     | policy for the organization.   |     person performing   |
|   |     | Identification and             |     the identification; |
|   |     | authentication procedures can  |                         |
|   |     | be developed for the security  | -   A signed            |
|   |     | program in general, and for a  |     declaration by that |
|   |     | particular information system, |     person that he or   |
|   |     | when required. NIST Special    |     she verified the    |
|   |     | Publication 800-12 provides    |     identity of the     |
|   |     | guidance on security policies  |     applicant as        |
|   |     | and procedures. NIST Special   |     required using the  |
|   |     | Publication 800-63 provides    |     format set forth at |
|   |     | guidance on remote electronic  |     28 U.S.C. 1746      |
|   |     | authentication.                |     (declaration under  |
|   |     |                                |     penalty of perjury) |
|   |     |                                |     or comparable       |
|   |     |                                |     procedure under     |
|   |     |                                |     local law;          |
|   |     |                                |                         |
|   |     |                                | -   If in-person        |
|   |     |                                |     identity proofing   |
|   |     |                                |     is done, a unique   |
|   |     |                                |     identifying         |
|   |     |                                |     number(s) from the  |
|   |     |                                |     ID(s) of the        |
|   |     |                                |     applicant, or a     |
|   |     |                                |     facsimile of the    |
|   |     |                                |     ID(s);              |
|   |     |                                |                         |
|   |     |                                | -   The date of the     |
|   |     |                                |     verification; and   |
|   |     |                                |                         |
|   |     |                                | -   A declaration of    |
|   |     |                                |     identity signed by  |
|   |     |                                |     the applicant using |
|   |     |                                |     a handwritten       |
|   |     |                                |     signature and       |
|   |     |                                |     performed in the    |
|   |     |                                |     presence of the     |
|   |     |                                |     person performing   |
|   |     |                                |     the identity        |
|   |     |                                |     authentication,     |
|   |     |                                |     using the format    |
|   |     |                                |     set forth at 28     |
|   |     |                                |     U.S.C. 1746         |
|   |     |                                |     (declaration under  |
|   |     |                                |     penalty of perjury) |
|   |     |                                |     or comparable       |
|   |     |                                |     procedure under     |
|   |     |                                |     local law.          |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 2 | A-2 |                                |                         |
| . |     | The information system         | 5.1.2.1 Physical Access |
|   | U   | uniquely identifies and        | for CA Equipment        |
|   | SER | authenticates users (or        |                         |
|   | ID  | processes acting on behalf of  | The physical security   |
|   | ENT | users).                        | requirements pertaining |
|   | IFI |                                | to CAs that issue Basic |
|   | CAT | Enhancements:                  | Assurance certificates  |
|   | ION |                                | are:                    |
|   | AND | \(1\) The information system   |                         |
|   | AU  | employs multifactor            | -   Ensure no           |
|   | THE | authentication.                |     unauthorized access |
|   | NTI |                                |     to the hardware is  |
|   | CAT | Supplemental Guidance:         |     permitted           |
|   | ION |                                |                         |
|   |     | Authentication of user         | 5.2.3 Identification    |
|   |     | identities is accomplished     | and Authentication for  |
|   |     | through the use of passwords,  | Each Role               |
|   |     | tokens, biometrics, or in the  |                         |
|   |     | case of multifactor            | At all assurance levels |
|   |     | authentication, some           | other than Rudimentary, |
|   |     | combination therein. FIPS 201  | an individual shall     |
|   |     | and Special Publications       | identify and            |
|   |     | 800-73, 800-76, and 800-78     | authenticate            |
|   |     | specify a personal identity    | him/herself before      |
|   |     | verification (PIV) card token  | being permitted to      |
|   |     | for use in the unique          | perform any actions set |
|   |     | identification and             | forth above for that    |
|   |     | authentication of federal      | role or identity.       |
|   |     | employees and contractors.     |                         |
|   |     | NIST Special Publication       |                         |
|   |     | 800-63 provides guidance on    |                         |
|   |     | remote electronic              |                         |
|   |     | authentication including       |                         |
|   |     | strength of authentication     |                         |
|   |     | mechanisms. For other than     |                         |
|   |     | remote situations, when users  |                         |
|   |     | identify and authenticate to   |                         |
|   |     | information systems within a   |                         |
|   |     | specified security perimeter   |                         |
|   |     | which is considered to offer   |                         |
|   |     | sufficient protection, NIST    |                         |
|   |     | Special Publication 800-63     |                         |
|   |     | guidance should be applied as  |                         |
|   |     | follows: (i) for low-impact    |                         |
|   |     | information systems, tokens    |                         |
|   |     | that meet Level 1, 2, 3, or 4  |                         |
|   |     | requirements are acceptable;   |                         |
|   |     | (ii) for moderate-impact       |                         |
|   |     | information systems, tokens    |                         |
|   |     | that meet Level 2, 3, or 4     |                         |
|   |     | requirements are acceptable;   |                         |
|   |     | and (iii) for high-impact      |                         |
|   |     | information systems, tokens    |                         |
|   |     | that meet Level 3 or 4         |                         |
|   |     | requirements are acceptable.   |                         |
|   |     | In addition to identifying and |                         |
|   |     | authenticating users at the    |                         |
|   |     | information system level,      |                         |
|   |     | identification and             |                         |
|   |     | authentication mechanisms are  |                         |
|   |     | employed at the application    |                         |
|   |     | level, when necessary, to      |                         |
|   |     | provide increased information  |                         |
|   |     | security for the organization. |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | En  |                                |                         |
|   | tit |                                |                         |
|   | ies |                                |                         |
|   | at  |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 3 | A-3 |                                |                         |
| . |     | The information system         | 3.2.3.3 Some computing  |
|   | DEV | identifies and authenticates   | and communications      |
|   | ICE | specific devices before        | devices (routers,       |
|   | ID  | establishing a connection.     | firewalls, servers,     |
|   | ENT |                                | etc.) will be named as  |
|   | IFI | Enhancements:                  | certificate subjects.   |
|   | CAT |                                | In such cases, the      |
|   | ION | None.                          | device must have a      |
|   | AND |                                | human sponsor. The      |
|   | AU  | Supplemental Guidance:         | sponsor is responsible  |
|   | THE |                                | for providing the       |
|   | NTI | The information system         | following registration  |
|   | CAT | typically uses either shared   | information:            |
|   | ION | known information (e.g., Media |                         |
|   |     | Access Control (MAC) or        | -   Equipment           |
|   |     | Transmission Control           |     identification      |
|   |     | Program/Internet Protocol      |     (e.g., serial       |
|   |     | (TCP/IP) addresses) or an      |     number) or service  |
|   |     | organizational authentication  |     name (e.g., DNS     |
|   |     | solution (e.g., IEEE 802.1x    |     name)               |
|   |     | and Extensible Authentication  |                         |
|   |     | Protocol (EAP) or a Radius     | -   Equipment public    |
|   |     | server with EAP-Transport      |     keys                |
|   |     | Layer Security (TLS)           |                         |
|   |     | authentication) to identify    | -   Equipment           |
|   |     | and authenticate devices on    |     authorizations and  |
|   |     | local and/or wide area         |     attributes (if any  |
|   |     | networks. The strength of the  |     are to be included  |
|   |     | device authentication          |     in the certificate) |
|   |     | mechanism is based on the FIPS |                         |
|   |     | 199 security categorization of | -   Contact information |
|   |     | the information system.        |     to enable the CA or |
|   |     |                                |     RA to communicate   |
|   |     |                                |     with the sponsor    |
|   |     |                                |     when required       |
|   |     |                                |                         |
|   |     |                                | The registration        |
|   |     |                                | information shall be    |
|   |     |                                | verified to an          |
|   |     |                                | assurance level         |
|   |     |                                | commensurate with the   |
|   |     |                                | certificate assurance   |
|   |     |                                | level being requested.  |
|   |     |                                | Acceptable methods for  |
|   |     |                                | performing this         |
|   |     |                                | authentication and      |
|   |     |                                | integrity checking      |
|   |     |                                | include, but are not    |
|   |     |                                | limited to:             |
|   |     |                                |                         |
|   |     |                                | -   Verification of     |
|   |     |                                |     digitally signed    |
|   |     |                                |     messages sent from  |
|   |     |                                |     the sponsor (using  |
|   |     |                                |     certificates of     |
|   |     |                                |     equivalent or       |
|   |     |                                |     greater assurance   |
|   |     |                                |     than that being     |
|   |     |                                |     requested).         |
|   |     |                                |                         |
|   |     |                                | In person registration  |
|   |     |                                | by the sponsor, with    |
|   |     |                                | the identity of the     |
|   |     |                                | sponsor confirmed       |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 4 | A-4 |                                |                         |
| . |     | The organization manages user  | 5.2.1 Trusted Roles     |
|   | I   | identifiers by: (i) uniquely   |                         |
|   | DEN | identifying each user; (ii)    | A trusted role is one   |
|   | TIF | verifying the identity of each | whose incumbent         |
|   | IER | user; (iii) receiving          | performs functions that |
|   | M   | authorization to issue a user  | can introduce security  |
|   | ANA | identifier from an appropriate | problems if not carried |
|   | GEM | organization official; (iv)    | out properly, whether   |
|   | ENT | ensuring that the user         | accidentally or         |
|   |     | identifier is issued to the    | maliciously. The people |
|   |     | intended party; (v) disabling  | selected to fill these  |
|   |     | user identifier after          | roles must be           |
|   |     | *\[Assignment:                 | extraordinarily         |
|   |     | organization-defined time      | responsible or the      |
|   |     | period\]* of inactivity; and   | integrity of the CA is  |
|   |     | (vi) archiving user            | weakened. The functions |
|   |     | identifiers.                   | performed in these      |
|   |     |                                | roles form the basis of |
|   |     | Enhancements:                  | trust for all uses of   |
|   |     |                                | the FBCA or an Entity   |
|   |     | None.                          | CA. Two approaches are  |
|   |     |                                | taken to increase the   |
|   |     | Supplemental Guidance:         | likelihood that these   |
|   |     |                                | roles can be            |
|   |     | Identifier management is not   | successfully carried    |
|   |     | applicable to shared           | out. The first ensures  |
|   |     | information system accounts    | that the person filling |
|   |     | (e.g., guest and anonymous     | the role is trustworthy |
|   |     | accounts). FIPS 201 and        | and properly trained.   |
|   |     | Special Publications 800-73,   | The second distributes  |
|   |     | 800-76, and 800-78 specify a   | the functions among     |
|   |     | personal identity verification | more than one person,   |
|   |     | (PIV) card token for use in    | so that any malicious   |
|   |     | the unique identification and  | activity would require  |
|   |     | authentication of federal      | collusion.              |
|   |     | employees and contractors.     |                         |
|   |     |                                | 5.2.3 Identification    |
|   |     |                                | and Authentication for  |
|   |     |                                | Each Role               |
|   |     |                                |                         |
|   |     |                                | At all assurance levels |
|   |     |                                | other than Rudimentary, |
|   |     |                                | an individual shall     |
|   |     |                                | identify and            |
|   |     |                                | authenticate            |
|   |     |                                | him/herself before      |
|   |     |                                | being permitted to      |
|   |     |                                | perform any actions set |
|   |     |                                | forth above for that    |
|   |     |                                | role or identity.       |
|   |     |                                |                         |
|   |     |                                | 5.2.4 Individual        |
|   |     |                                | personnel shall be      |
|   |     |                                | specifically designated |
|   |     |                                | to the four roles       |
|   |     |                                | defined in Section      |
|   |     |                                | 5.2.1 above.            |
|   |     |                                | Individuals may assume  |
|   |     |                                | more than one role;     |
|   |     |                                | however, no one         |
|   |     |                                | individual shall assume |
|   |     |                                | both the Officer and    |
|   |     |                                | Administrator roles.    |
|   |     |                                | This may be enforced    |
|   |     |                                | procedurally. No        |
|   |     |                                | individual shall be     |
|   |     |                                | assigned more than one  |
|   |     |                                | identity.               |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | at  |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 5 | A-5 |                                |                         |
| . |     | The organization manages       | 5.2.1 Trusted Roles     |
|   | A   | information system             |                         |
|   | UTH | authenticators (e.g., tokens,  | A trusted role is one   |
|   | ENT | PKI certificates, biometrics,  | whose incumbent         |
|   | ICA | passwords, key cards) by: (i)  | performs functions that |
|   | TOR | defining initial authenticator | can introduce security  |
|   | M   | content; (ii) establishing     | problems if not carried |
|   | ANA | administrative procedures for  | out properly, whether   |
|   | GEM | initial authenticator          | accidentally or         |
|   | ENT | distribution, for              | maliciously. The people |
|   |     | lost/compromised, or damaged   | selected to fill these  |
|   |     | authenticators, and for        | roles must be           |
|   |     | revoking authenticators; and   | extraordinarily         |
|   |     | (iii) changing default         | responsible or the      |
|   |     | authenticators upon            | integrity of the CA is  |
|   |     | information system             | weakened. The functions |
|   |     | installation.                  | performed in these      |
|   |     |                                | roles form the basis of |
|   |     | Enhancements:                  | trust for all uses of   |
|   |     |                                | the FBCA or an Entity   |
|   |     | None.                          | CA. Two approaches are  |
|   |     |                                | taken to increase the   |
|   |     | Supplemental Guidance:         | likelihood that these   |
|   |     |                                | roles can be            |
|   |     | Users take reasonable measures | successfully carried    |
|   |     | to safeguard authenticators    | out. The first ensures  |
|   |     | including maintaining          | that the person filling |
|   |     | possession of their individual | the role is trustworthy |
|   |     | authenticators, not loaning or | and properly trained.   |
|   |     | sharing authenticators with    | The second distributes  |
|   |     | others, and reporting lost or  | the functions among     |
|   |     | compromised authenticators     | more than one person,   |
|   |     | immediately. For               | so that any malicious   |
|   |     | password-based authentication, | activity would require  |
|   |     | the information system: (i)    | collusion.              |
|   |     | protects passwords from        |                         |
|   |     | unauthorized disclosure and    | 5.2.3 Identification    |
|   |     | modification when stored and   | and Authentication for  |
|   |     | transmitted; (ii) prohibits    | Each Role               |
|   |     | passwords from being displayed |                         |
|   |     | when entered; (iii) enforces   | At all assurance levels |
|   |     | password minimum and maximum   | other than Rudimentary, |
|   |     | lifetime restrictions; and     | an individual shall     |
|   |     | (iv) prohibits password reuse  | identify and            |
|   |     | for a specified number of      | authenticate            |
|   |     | generations. For PKI-based     | him/herself before      |
|   |     | authentication, the            | being permitted to      |
|   |     | information system: (i)        | perform any actions set |
|   |     | validates certificates by      | forth above for that    |
|   |     | constructing a certification   | role or identity.       |
|   |     | path to an accepted trust      |                         |
|   |     | anchor; (ii) establishes user  | 5.2.4 Individual        |
|   |     | control of the corresponding   | personnel shall be      |
|   |     | private key; and (iii) maps    | specifically designated |
|   |     | the authenticated identity to  | to the four roles       |
|   |     | the user account. FIPS 201 and | defined in Section      |
|   |     | Special Publications 800-73,   | 5.2.1 above.            |
|   |     | 800-76, and 800-78 specify a   | Individuals may assume  |
|   |     | personal identity verification | more than one role;     |
|   |     | (PIV) card token for use in    | however, no one         |
|   |     | the unique identification and  | individual shall assume |
|   |     | authentication of federal      | both the Officer and    |
|   |     | employees and contractors.     | Administrator roles.    |
|   |     | NIST Special Publication       | This may be enforced    |
|   |     | 800-63 provides guidance on    | procedurally. No        |
|   |     | remote electronic              | individual shall be     |
|   |     | authentication.                | assigned more than one  |
|   |     |                                | identity.               |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | at  |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 6 | A-6 |                                |                         |
| . |     | The information system         |                         |
|   | A   | obscures feedback of           |                         |
|   | UTH | authentication information     |                         |
|   | ENT | during the authentication      |                         |
|   | ICA | process to protect the         |                         |
|   | TOR | information from possible      |                         |
|   | FE  | exploitation/use by            |                         |
|   | EDB | unauthorized individuals.      |                         |
|   | ACK |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The information system may     |                         |
|   |     | obscure feedback of            |                         |
|   |     | authentication information     |                         |
|   |     | during the authentication      |                         |
|   |     | process (e.g., displaying      |                         |
|   |     | asterisks when a user types in |                         |
|   |     | a password). The feedback from |                         |
|   |     | the information system         |                         |
|   |     | provides sufficient            |                         |
|   |     | information for a legitimate   |                         |
|   |     | user to understand why access  |                         |
|   |     | is not being granted (e.g.,    |                         |
|   |     | made a keystroke mistake,      |                         |
|   |     | forgot the password) and, at   |                         |
|   |     | the same time, does not        |                         |
|   |     | provide information that would |                         |
|   |     | allow an unauthorized user to  |                         |
|   |     | compromise the authentication  |                         |
|   |     | mechanism.                     |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 7 | A-7 |                                |                         |
| . |     | For authentication to a        | 6.1.1.1 Cryptographic   |
|   | C   | cryptographic module, the      | keying material used to |
|   | RYP | information system employs     | sign certificates, CRLs |
|   | TOG | authentication methods that    | or status information   |
|   | RAP | meet the requirements of FIPS  | by the FBCA shall be    |
|   | HIC | 140-2.                         | generated in FIPS 140   |
|   | MOD |                                | validated cryptographic |
|   | ULE | Enhancements:                  | modules. Cryptographic  |
|   | AU  |                                | keying material used to |
|   | THE | None.                          | sign certificates, CRLs |
|   | NTI |                                | or status information   |
|   | CAT | Supplemental Guidance:         | by Entity CAs shall be  |
|   | ION |                                | generated in FIPS 140   |
|   |     | Where the cryptographic module | validated cryptographic |
|   |     | is a personal identity         | modules or modules      |
|   |     | verification (PIV) card token  | validated under         |
|   |     | for use in the unique          | equivalent              |
|   |     | identification and             | international           |
|   |     | authentication of federal      | standards.              |
|   |     | employees and contractors, the |                         |
|   |     | module conforms to FIPS 201    |                         |
|   |     | and Special Publications       |                         |
|   |     | 800-73 and 800-78. Module      |                         |
|   |     | testing is in accordance with  |                         |
|   |     | NIST Special Publication       |                         |
|   |     | 800-85.                        |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 8 | R-1 |                                |                         |
| . |     | The organization develops,     | Dissemination:          |
|   | IN  | disseminates, and periodically |                         |
|   | CID | reviews/updates: (i) a formal, | 2.2.2 The FPKI          |
|   | ENT | documented, incident response  | Operational Authority   |
|   | RE  | policy that addresses purpose, | shall publish           |
|   | SPO | scope, roles,                  | information concerning  |
|   | NSE | responsibilities, management   | the FBCA necessary to   |
|   | POL | commitment, coordination among | support its use and     |
|   | ICY | organizational entities, and   | operation. The FBCA CP  |
|   | AND | compliance; and (ii) formal,   | shall be publicly       |
|   | P   | documented procedures to       | available on the FPKI   |
|   | ROC | facilitate the implementation  | PA website (see         |
|   | EDU | of the incident response       | <http:                  |
|   | RES | policy and associated incident | //www.cio.gov/fpkipa>). |
|   |     | response controls.             |                         |
|   |     |                                | 5.7.1 The members of    |
|   |     | Enhancements:                  | the Federal PKI Policy  |
|   |     |                                | Authority shall be      |
|   |     | None.                          | notified if any of the  |
|   |     |                                | following cases occur:  |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | -   suspected or        |
|   |     | The incident response policy   |     detected compromise |
|   |     | and procedures are consistent  |     of the FBCA         |
|   |     | with applicable federal laws,  |     systems;            |
|   |     | directives, policies,          |                         |
|   |     | regulations, standards, and    | -   physical or         |
|   |     | guidance. The incident         |     electronic attempts |
|   |     | response policy can be         |     to penetrate FBCA   |
|   |     | included as part of the        |     systems;            |
|   |     | general information security   |                         |
|   |     | policy for the organization.   | -   denial of service   |
|   |     | Incident response procedures   |     attacks on FBCA     |
|   |     | can be developed for the       |     components;         |
|   |     | security program in general,   |                         |
|   |     | and for a particular           | -   any incident        |
|   |     | information system, when       |     preventing the FBCA |
|   |     | required. NIST Special         |     from issuing a CRL  |
|   |     | Publication 800-61 provides    |     within 24 hours of  |
|   |     | guidance on incident handling  |     the time specified  |
|   |     | and reporting. NIST Special    |     in the next update  |
|   |     | Publication 800-12 provides    |     field of its        |
|   |     | guidance on security policies  |     currently valid     |
|   |     | and procedures.                |     CRL.                |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority shall         |
|   |     |                                | reestablish operational |
|   |     |                                | capabilities as quickly |
|   |     |                                | as possible in          |
|   |     |                                | accordance with         |
|   |     |                                | procedures set forth in |
|   |     |                                | the FBCA CPS.           |
|   |     |                                |                         |
|   |     |                                | Entity CAs shall        |
|   |     |                                | provide notice as       |
|   |     |                                | required by the         |
|   |     |                                | applicable MOA.         |
|   |     |                                |                         |
|   |     |                                | 5.7.2 When computing    |
|   |     |                                | resources, software,    |
|   |     |                                | and/or data are         |
|   |     |                                | corrupted, the FBCA and |
|   |     |                                | Entity CAs shall        |
|   |     |                                | respond as follows:     |
|   |     |                                |                         |
|   |     |                                | -   If the CA signature |
|   |     |                                |     keys are not        |
|   |     |                                |     destroyed**,** CA   |
|   |     |                                |     operation shall be  |
|   |     |                                |     reestablished,      |
|   |     |                                |     giving priority to  |
|   |     |                                |     the ability to      |
|   |     |                                |     generate            |
|   |     |                                |     certificate status  |
|   |     |                                |     information within  |
|   |     |                                |     the CRL issuance    |
|   |     |                                |     schedule            |
|   |     |                                |                         |
|   |     |                                | -   If the CA signature |
|   |     |                                |     keys are            |
|   |     |                                |     destroyed**,** CA   |
|   |     |                                |     operation shall be  |
|   |     |                                |     reestablished as    |
|   |     |                                |     quickly as          |
|   |     |                                |     possible, giving    |
|   |     |                                |     priority to the     |
|   |     |                                |     generation of a new |
|   |     |                                |     CA key pair.        |
|   |     |                                |                         |
|   |     |                                | 5.7.3 If the FBCA or    |
|   |     |                                | Entity CA signature     |
|   |     |                                | keys are compromised or |
|   |     |                                | lost (such that         |
|   |     |                                | compromise is possible  |
|   |     |                                | even though not         |
|   |     |                                | certain):               |
|   |     |                                |                         |
|   |     |                                | -   The Federal PKI     |
|   |     |                                |     Policy Authority    |
|   |     |                                |     and all of its      |
|   |     |                                |     member entities     |
|   |     |                                |     shall be notified   |
|   |     |                                |     so that entities    |
|   |     |                                |     may issue CRLs      |
|   |     |                                |     revoking any        |
|   |     |                                |     cross-certificates  |
|   |     |                                |     issued to the       |
|   |     |                                |     compromised CA;     |
|   |     |                                |                         |
|   |     |                                | -   A new FBCA or       |
|   |     |                                |     Entity CA key pair  |
|   |     |                                |     shall be generated  |
|   |     |                                |     by the FBCA or      |
|   |     |                                |     Entity CA in        |
|   |     |                                |     accordance with     |
|   |     |                                |     procedures set      |
|   |     |                                |     forth in the FBCA   |
|   |     |                                |     or Entity CPS; and  |
|   |     |                                |                         |
|   |     |                                | -   New FBCA or Entity  |
|   |     |                                |     CA certificates     |
|   |     |                                |     shall be issued to  |
|   |     |                                |     Entities also in    |
|   |     |                                |     accordance with the |
|   |     |                                |     FBCA or Entity CPS. |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority or Entity CA  |
|   |     |                                | governing body shall    |
|   |     |                                | also investigate and    |
|   |     |                                | report to the Federal   |
|   |     |                                | PKI Policy Authority    |
|   |     |                                | what caused the         |
|   |     |                                | compromise or loss, and |
|   |     |                                | what measures have been |
|   |     |                                | taken to preclude       |
|   |     |                                | recurrence.             |
|   |     |                                |                         |
|   |     |                                | 5.7.4 The FBCA          |
|   |     |                                | directory system shall  |
|   |     |                                | be deployed so as to    |
|   |     |                                | provide 24 hour, 365    |
|   |     |                                | day per year            |
|   |     |                                | availability. The FPKI  |
|   |     |                                | Operational Authority   |
|   |     |                                | shall implement         |
|   |     |                                | features to provide     |
|   |     |                                | high levels of          |
|   |     |                                | directory reliability.  |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority shall operate |
|   |     |                                | a hot backup site,      |
|   |     |                                | whose purpose is to     |
|   |     |                                | ensure continuity of    |
|   |     |                                | operations in the event |
|   |     |                                | of failure of the       |
|   |     |                                | primary site. The FBCA  |
|   |     |                                | operations shall be     |
|   |     |                                | designed to restore     |
|   |     |                                | full service within six |
|   |     |                                | (6) hours of primary    |
|   |     |                                | system failure.         |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority or Entity     |
|   |     |                                | Principal CA shall at   |
|   |     |                                | the earliest feasible   |
|   |     |                                | time securely advise    |
|   |     |                                | the Federal PKI Policy  |
|   |     |                                | Authority and all of    |
|   |     |                                | its member entities in  |
|   |     |                                | the event of a disaster |
|   |     |                                | where the FBCA or       |
|   |     |                                | Entity Principal CA     |
|   |     |                                | installation is         |
|   |     |                                | physically damaged and  |
|   |     |                                | all copies of the FBCA  |
|   |     |                                | or Entity Principal CA  |
|   |     |                                | signature keys are      |
|   |     |                                | destroyed.              |
|   |     |                                |                         |
|   |     |                                | Relying Parties may     |
|   |     |                                | decide of their own     |
|   |     |                                | volition whether to     |
|   |     |                                | continue to use         |
|   |     |                                | certificates signed     |
|   |     |                                | with the destroyed      |
|   |     |                                | private key pending     |
|   |     |                                | reestablishment of FBCA |
|   |     |                                | operation with new      |
|   |     |                                | certificates.           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 6 | I   | Control:                       | FBCA Section:           |
| 9 | R-2 |                                |                         |
| . |     | The organization trains        | 5.3.3 All personnel     |
|   | IN  | personnel in their incident    | performing duties with  |
|   | CID | response roles and             | respect to the          |
|   | ENT | responsibilities with respect  | operation of the FBCA   |
|   | RE  | to the information system and  | or Entity CA shall      |
|   | SPO | provides refresher training    | receive comprehensive   |
|   | NSE | *\[Assignment:                 | training in all         |
|   | TR  | organization-defined           | operational duties they |
|   | AIN | frequency, at least            | are expected to         |
|   | ING | annually\]*.                   | perform, including      |
|   |     |                                | disaster recovery and   |
|   |     | Enhancements:                  | business continuity     |
|   |     |                                | procedures.             |
|   |     | \(1\) The organization         |                         |
|   |     | incorporates simulated events  | 5.3.4 Individuals       |
|   |     | into incident response         | responsible for PKI     |
|   |     | training to facilitate\        | roles shall be aware of |
|   |     | effective response by          | changes in the FBCA and |
|   |     | personnel in crisis            | Entity CA operation.    |
|   |     | situations.\                   | Any significant change  |
|   |     | (2) The organization employs   | to the operations shall |
|   |     | automated mechanisms to        | have a training         |
|   |     | provide a more thorough and    | (awareness) plan, and   |
|   |     | realistic\                     | the execution of such   |
|   |     | training environment.          | plan shall be           |
|   |     |                                | documented.             |
|   |     | Supplemental Guidance:         | Documentation shall be  |
|   |     |                                | maintained identifying  |
|   |     | None.                          | all personnel who       |
|   |     |                                | received training and   |
|   |     |                                | the level of training   |
|   |     |                                | completed.              |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | I   | Control:                       | FBCA Section:           |
| 0 | R-3 |                                |                         |
| . |     | The organization tests the     |                         |
|   | IN  | incident response capability   |                         |
|   | CID | for the information system     |                         |
|   | ENT | \[*Assignment:                 |                         |
|   | RE  | organization-defined           |                         |
|   | SPO | frequency, at least            |                         |
|   | NSE | annually*\] using              |                         |
|   | T   | \[*Assignment:                 |                         |
|   | EST | organization-defined tests and |                         |
|   | ING | exercises*\] to determine the  |                         |
|   |     | incident response              |                         |
|   |     | effectiveness and documents    |                         |
|   |     | the results.                   |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization employs |                         |
|   |     | automated mechanisms to more   |                         |
|   |     | thoroughly and effectively     |                         |
|   |     | test the incident response     |                         |
|   |     | capability.                    |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | I   | Control:                       | FBCA Section:           |
| 1 | R-4 |                                |                         |
| . | (1) | The organization implements an | 5.7.1 The members of    |
|   |     | incident handling capability   | the Federal PKI Policy  |
|   | IN  | for security incidents that    | Authority shall be      |
|   | CID | includes preparation,          | notified if any of the  |
|   | ENT | detection and analysis,        | following cases occur:  |
|   | HA  | containment, eradication, and  |                         |
|   | NDL | recovery.                      | -   suspected or        |
|   | ING |                                |     detected compromise |
|   |     | Enhancements:                  |     of the FBCA         |
|   |     |                                |     systems;            |
|   |     | \(1\) The organization employs |                         |
|   |     | automated mechanisms to        | -   physical or         |
|   |     | support the incident handling  |     electronic attempts |
|   |     | process.                       |     to penetrate FBCA   |
|   |     |                                |     systems;            |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | -   denial of service   |
|   |     | The organization incorporates  |     attacks on FBCA     |
|   |     | the lessons learned from       |     components;         |
|   |     | ongoing incident handling      |                         |
|   |     | activities into the incident   | -   any incident        |
|   |     | response procedures and        |     preventing the FBCA |
|   |     | implements the procedures      |     from issuing a CRL  |
|   |     | accordingly.                   |     within 24 hours of  |
|   |     |                                |     the time specified  |
|   |     |                                |     in the next update  |
|   |     |                                |     field of its        |
|   |     |                                |     currently valid     |
|   |     |                                |     CRL.                |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority shall         |
|   |     |                                | reestablish operational |
|   |     |                                | capabilities as quickly |
|   |     |                                | as possible in          |
|   |     |                                | accordance with         |
|   |     |                                | procedures set forth in |
|   |     |                                | the FBCA CPS.           |
|   |     |                                |                         |
|   |     |                                | Entity CAs shall        |
|   |     |                                | provide notice as       |
|   |     |                                | required by the         |
|   |     |                                | applicable MOA.         |
|   |     |                                |                         |
|   |     |                                | 5.7.2 When computing    |
|   |     |                                | resources, software,    |
|   |     |                                | and/or data are         |
|   |     |                                | corrupted, the FBCA and |
|   |     |                                | Entity CAs shall        |
|   |     |                                | respond as follows:     |
|   |     |                                |                         |
|   |     |                                | -   If the CA signature |
|   |     |                                |     keys are not        |
|   |     |                                |     destroyed**,** CA   |
|   |     |                                |     operation shall be  |
|   |     |                                |     reestablished,      |
|   |     |                                |     giving priority to  |
|   |     |                                |     the ability to      |
|   |     |                                |     generate            |
|   |     |                                |     certificate status  |
|   |     |                                |     information within  |
|   |     |                                |     the CRL issuance    |
|   |     |                                |     schedule            |
|   |     |                                |                         |
|   |     |                                | -   If the CA signature |
|   |     |                                |     keys are            |
|   |     |                                |     destroyed**,** CA   |
|   |     |                                |     operation shall be  |
|   |     |                                |     reestablished as    |
|   |     |                                |     quickly as          |
|   |     |                                |     possible, giving    |
|   |     |                                |     priority to the     |
|   |     |                                |     generation of a new |
|   |     |                                |     CA key pair.        |
|   |     |                                |                         |
|   |     |                                | 5.7.3 If the FBCA or    |
|   |     |                                | Entity CA signature     |
|   |     |                                | keys are compromised or |
|   |     |                                | lost (such that         |
|   |     |                                | compromise is possible  |
|   |     |                                | even though not         |
|   |     |                                | certain):               |
|   |     |                                |                         |
|   |     |                                | -   The Federal PKI     |
|   |     |                                |     Policy Authority    |
|   |     |                                |     and all of its      |
|   |     |                                |     member entities     |
|   |     |                                |     shall be notified   |
|   |     |                                |     so that entities    |
|   |     |                                |     may issue CRLs      |
|   |     |                                |     revoking any        |
|   |     |                                |     cross-certificates  |
|   |     |                                |     issued to the       |
|   |     |                                |     compromised CA;     |
|   |     |                                |                         |
|   |     |                                | -   A new FBCA or       |
|   |     |                                |     Entity CA key pair  |
|   |     |                                |     shall be generated  |
|   |     |                                |     by the FBCA or      |
|   |     |                                |     Entity CA in        |
|   |     |                                |     accordance with     |
|   |     |                                |     procedures set      |
|   |     |                                |     forth in the FBCA   |
|   |     |                                |     or Entity CPS; and  |
|   |     |                                |                         |
|   |     |                                | -   New FBCA or Entity  |
|   |     |                                |     CA certificates     |
|   |     |                                |     shall be issued to  |
|   |     |                                |     Entities also in    |
|   |     |                                |     accordance with the |
|   |     |                                |     FBCA or Entity CPS. |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority or Entity CA  |
|   |     |                                | governing body shall    |
|   |     |                                | also investigate and    |
|   |     |                                | report to the Federal   |
|   |     |                                | PKI Policy Authority    |
|   |     |                                | what caused the         |
|   |     |                                | compromise or loss, and |
|   |     |                                | what measures have been |
|   |     |                                | taken to preclude       |
|   |     |                                | recurrence.             |
|   |     |                                |                         |
|   |     |                                | 5.7.4 The FBCA          |
|   |     |                                | directory system shall  |
|   |     |                                | be deployed so as to    |
|   |     |                                | provide 24 hour, 365    |
|   |     |                                | day per year            |
|   |     |                                | availability. The FPKI  |
|   |     |                                | Operational Authority   |
|   |     |                                | shall implement         |
|   |     |                                | features to provide     |
|   |     |                                | high levels of          |
|   |     |                                | directory reliability.  |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority shall operate |
|   |     |                                | a hot backup site,      |
|   |     |                                | whose purpose is to     |
|   |     |                                | ensure continuity of    |
|   |     |                                | operations in the event |
|   |     |                                | of failure of the       |
|   |     |                                | primary site. The FBCA  |
|   |     |                                | operations shall be     |
|   |     |                                | designed to restore     |
|   |     |                                | full service within six |
|   |     |                                | (6) hours of primary    |
|   |     |                                | system failure.         |
|   |     |                                |                         |
|   |     |                                | The FPKI Operational    |
|   |     |                                | Authority or Entity     |
|   |     |                                | Principal CA shall at   |
|   |     |                                | the earliest feasible   |
|   |     |                                | time securely advise    |
|   |     |                                | the Federal PKI Policy  |
|   |     |                                | Authority and all of    |
|   |     |                                | its member entities in  |
|   |     |                                | the event of a disaster |
|   |     |                                | where the FBCA or       |
|   |     |                                | Entity Principal CA     |
|   |     |                                | installation is         |
|   |     |                                | physically damaged and  |
|   |     |                                | all copies of the FBCA  |
|   |     |                                | or Entity Principal CA  |
|   |     |                                | signature keys are      |
|   |     |                                | destroyed.              |
|   |     |                                |                         |
|   |     |                                | Relying Parties may     |
|   |     |                                | decide of their own     |
|   |     |                                | volition whether to     |
|   |     |                                | continue to use         |
|   |     |                                | certificates signed     |
|   |     |                                | with the destroyed      |
|   |     |                                | private key pending     |
|   |     |                                | reestablishment of FBCA |
|   |     |                                | operation with new      |
|   |     |                                | certificates.           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | I   | Control:                       | FBCA Section:           |
| 2 | R-5 |                                |                         |
| . |     | The organization tracks and    | 5.4 Audit log files     |
|   | IN  | documents information system   | shall be generated for  |
|   | CID | security incidents on an       | all events relating to  |
|   | ENT | ongoing basis.                 | the security of the     |
|   | M   |                                | FBCA or Entity CAs.     |
|   | ONI | Enhancements:                  | Where possible, the     |
|   | TOR |                                | security audit logs     |
|   | ING | \(1\) The organization employs | shall be automatically  |
|   |     | automated mechanisms to assist | collected. Where this   |
|   |     | in the tracking of security    | is not possible, a      |
|   |     | incidents and in the           | logbook, paper form, or |
|   |     | collection and analysis of     | other physical          |
|   |     | incident information.          | mechanism shall be      |
|   |     |                                | used. All security      |
|   |     | Supplemental Guidance:         | audit logs, both        |
|   |     |                                | electronic and          |
|   |     | None.                          | non-electronic, shall   |
|   |     |                                | be retained and made    |
|   |     |                                | available during        |
|   |     |                                | compliance audits.      |
|   |     |                                |                         |
|   |     |                                | 5.4.1 A message from    |
|   |     |                                | any source received by  |
|   |     |                                | the FBCA or Entity CA   |
|   |     |                                | requesting an action    |
|   |     |                                | related to the          |
|   |     |                                | operational state of    |
|   |     |                                | the CA is an auditable  |
|   |     |                                | event. At a minimum,    |
|   |     |                                | each audit record shall |
|   |     |                                | include the following   |
|   |     |                                | (either recorded        |
|   |     |                                | automatically or        |
|   |     |                                | manually for each       |
|   |     |                                | auditable event):       |
|   |     |                                |                         |
|   |     |                                | -   The type of event,  |
|   |     |                                |                         |
|   |     |                                | -   The date and time   |
|   |     |                                |     the event occurred, |
|   |     |                                |                         |
|   |     |                                | -   A success or        |
|   |     |                                |     failure indicator,  |
|   |     |                                |     where appropriate   |
|   |     |                                |                         |
|   |     |                                | -   The identity of the |
|   |     |                                |     entity and/or       |
|   |     |                                |     operator (of the    |
|   |     |                                |     FBCA or Entity CA)  |
|   |     |                                |     that caused the     |
|   |     |                                |     event,              |
|   |     |                                |                         |
|   |     |                                | > All security auditing |
|   |     |                                | > capabilities of the   |
|   |     |                                | > FBCA or Entity CA     |
|   |     |                                | > operating system and  |
|   |     |                                | > CA applications       |
|   |     |                                | > required by this CP   |
|   |     |                                | > shall be enabled. As  |
|   |     |                                | > a result, most of the |
|   |     |                                | > events ...shall be    |
|   |     |                                | > automatically         |
|   |     |                                | > recorded. Where       |
|   |     |                                | > events cannot be      |
|   |     |                                | > automatically         |
|   |     |                                | > recorded, the CA      |
|   |     |                                | > shall implement       |
|   |     |                                | > manual procedures to  |
|   |     |                                | > satisfy this          |
|   |     |                                | > requirement.          |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | I   | Control:                       | FBCA Section:           |
| 3 | R-6 |                                |                         |
| . | (1) | The organization promptly      | 5.7.1 The members of    |
|   |     | reports incident information   | the Federal PKI Policy  |
|   | IN  | to appropriate authorities.    | Authority shall be      |
|   | CID |                                | notified if any of the  |
|   | ENT | Enhancements:                  | following cases occur:  |
|   | REP |                                |                         |
|   | ORT | \(1\) The organization employs | -   suspected or        |
|   | ING | automated mechanisms to assist |     detected compromise |
|   |     | in the reporting of security   |     of the FBCA         |
|   |     | incidents.                     |     systems;            |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | -   physical or         |
|   |     |                                |     electronic attempts |
|   |     | The types of incident          |     to penetrate FBCA   |
|   |     | information reported, the      |     systems;            |
|   |     | content and timeliness of the  |                         |
|   |     | reports, and the list of       | -   denial of service   |
|   |     | designated reporting           |     attacks on FBCA     |
|   |     | authorities or organizations   |     components;         |
|   |     | are consistent with applicable |                         |
|   |     | federal laws, directives,      | -   any incident        |
|   |     | policies, regulations,         |     preventing the FBCA |
|   |     | standards, and guidance. In    |     from issuing a CRL  |
|   |     | addition to incident           |     within 24 hours of  |
|   |     | information, weaknesses and    |     the time specified  |
|   |     | vulnerabilities in the         |     in the next update  |
|   |     | information system are         |     field of its        |
|   |     | reported to appropriate        |     currently valid     |
|   |     | organizational officials in a  |     CRL.                |
|   |     | timely manner to prevent       |                         |
|   |     | security incidents. NIST       | The FPKI Operational    |
|   |     | Special Publication 800-61     | Authority shall         |
|   |     | provides guidance on incident  | reestablish operational |
|   |     | reporting.                     | capabilities as quickly |
|   |     |                                | as possible in          |
|   |     |                                | accordance with         |
|   |     |                                | procedures set forth in |
|   |     |                                | the FBCA CPS.           |
|   |     |                                |                         |
|   |     |                                | Entity CAs shall        |
|   |     |                                | provide notice as       |
|   |     |                                | required by the         |
|   |     |                                | applicable MOA.         |
|   |     |                                |                         |
|   |     |                                | 5.7.4 The FPKI          |
|   |     |                                | Operational Authority   |
|   |     |                                | or Entity Principal CA  |
|   |     |                                | shall at the earliest   |
|   |     |                                | feasible time securely  |
|   |     |                                | advise the Federal PKI  |
|   |     |                                | Policy Authority and    |
|   |     |                                | all of its member       |
|   |     |                                | entities in the event   |
|   |     |                                | of a disaster where the |
|   |     |                                | FBCA or Entity          |
|   |     |                                | Principal CA            |
|   |     |                                | installation is         |
|   |     |                                | physically damaged and  |
|   |     |                                | all copies of the FBCA  |
|   |     |                                | or Entity Principal CA  |
|   |     |                                | signature keys are      |
|   |     |                                | destroyed               |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | I   | Control:                       | FBCA Section:           |
| 4 | R-7 |                                |                         |
| . | (1) | The organization provides an   |                         |
|   |     | incident support resource that |                         |
|   | IN  | offers advice and assistance   |                         |
|   | CID | to users of the information    |                         |
|   | ENT | system for the handling and    |                         |
|   | RE  | reporting of security          |                         |
|   | SPO | incidents. The support         |                         |
|   | NSE | resource is an integral part   |                         |
|   | A   | of the organization's incident |                         |
|   | SSI | response capability.           |                         |
|   | STA |                                |                         |
|   | NCE | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization employs |                         |
|   |     | automated mechanisms to        |                         |
|   |     | increase the availability of   |                         |
|   |     | incident response-related      |                         |
|   |     | information and support.       |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Possible implementations of    |                         |
|   |     | incident support resources in  |                         |
|   |     | an organization include a help |                         |
|   |     | desk or an assistance group    |                         |
|   |     | and access to forensics        |                         |
|   |     | services, when required.       |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | M   | Control:                       | FBCA Section:           |
| 5 | A-1 |                                |                         |
| . |     | The organization develops,     | Dissemination:          |
|   | SYS | disseminates, and periodically |                         |
|   | TEM | reviews/updates: (i) a formal, | 2.2.2 The FPKI          |
|   | MA  | documented, information system | Operational Authority   |
|   | INT | maintenance policy that        | shall publish           |
|   | ENA | addresses purpose, scope,      | information concerning  |
|   | NCE | roles, responsibilities,       | the FBCA necessary to   |
|   | POL | management commitment,         | support its use and     |
|   | ICY | coordination among             | operation. The FBCA CP  |
|   | AND | organizational entities, and   | shall be publicly       |
|   | P   | compliance; and (ii) formal,   | available on the FPKI   |
|   | ROC | documented procedures to       | PA website (see         |
|   | EDU | facilitate the implementation  | <http:                  |
|   | RES | of the information system      | //www.cio.gov/fpkipa>). |
|   |     | maintenance policy and         |                         |
|   |     | associated system maintenance  | Roles and               |
|   |     | controls.                      | Responsibilities:       |
|   |     |                                |                         |
|   |     | Enhancements:                  | 1.3.1.3 The FPKI        |
|   |     |                                | Operational Authority   |
|   |     | None.                          | is the organization     |
|   |     |                                | that operates and       |
|   |     | Supplemental Guidance:         | maintains the FBCA on   |
|   |     |                                | behalf of the U.S.      |
|   |     | The information system         | Government, subject to  |
|   |     | maintenance policy and         | the direction of the    |
|   |     | procedures are consistent with | FPKIPA.                 |
|   |     | applicable federal laws,       |                         |
|   |     | directives, policies,          | 5.2.1 1. Administrator  |
|   |     | regulations, standards, and    | -- authorized to        |
|   |     | guidance. The information      | install, configure, and |
|   |     | system maintenance policy can  | maintain the CA;        |
|   |     | be included as part of the     | establish and maintain  |
|   |     | general information security   | user accounts;          |
|   |     | policy for the organization.   | configure profiles and  |
|   |     | System maintenance procedures  | audit parameters; and   |
|   |     | can be developed for the       | generate component      |
|   |     | security program in general,   | keys. Auditor --        |
|   |     | and for a particular           | authorized to maintain  |
|   |     | information system, when       | audit logs. Operator -- |
|   |     | required. NIST Special         | authorized to perform   |
|   |     | Publication 800-12 provides    | system backup and       |
|   |     | guidance on security policies  | recovery.               |
|   |     | and procedures.                |                         |
|   |     |                                | 5.2.1.1 The             |
|   |     |                                | administrator role is   |
|   |     |                                | responsible for:        |
|   |     |                                |                         |
|   |     |                                | Installation,           |
|   |     |                                | configuration, and      |
|   |     |                                | maintenance of the CA.  |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | M   | Control:                       | FBCA Section:           |
| 6 | A-2 |                                |                         |
| . | (1) | The organization schedules,    | 1.3.1.3 The FPKI        |
|   |     | performs, and documents        | Operational Authority   |
|   | PE  | routine preventative and       | is the organization     |
|   | RIO | regular maintenance on the     | that operates and       |
|   | DIC | components of the information  | maintains the FBCA on   |
|   | MA  | system in accordance with      | behalf of the U.S.      |
|   | INT | manufacturer or vendor         | Government, subject to  |
|   | ENA | specifications and/or          | the direction of the    |
|   | NCE | organizational requirements.   | FPKIPA.                 |
|   |     |                                |                         |
|   |     | Enhancements:                  | 5.2.1 1. Administrator  |
|   |     |                                | -- authorized to        |
|   |     | \(1\) The organization         | install, configure, and |
|   |     | maintains a maintenance log    | maintain the CA;        |
|   |     | for the information system     | establish and maintain  |
|   |     | that includes: (i) the date    | user accounts;          |
|   |     | and time of maintenance; (ii)  | configure profiles and  |
|   |     | name of the individual         | audit parameters; and   |
|   |     | performing the maintenance;    | generate component      |
|   |     | (iii) name of escort, if       | keys. Auditor --        |
|   |     | necessary; (iv) a description  | authorized to maintain  |
|   |     | of the maintenance performed;  | audit logs. Operator -- |
|   |     | and (v) a list of equipment    | authorized to perform   |
|   |     | removed or replaced (including | system backup and       |
|   |     | identification numbers, if     | recovery.               |
|   |     | applicable).\                  |                         |
|   |     | (2) The organization employs   | 5.2.1.1 The             |
|   |     | automated mechanisms to ensure | administrator role is   |
|   |     | that periodic maintenance is\  | responsible for:        |
|   |     | scheduled and conducted as     |                         |
|   |     | required, and that a log of    | Installation,           |
|   |     | maintenance actions, both      | configuration, and      |
|   |     | needed and\                    | maintenance of the CA.  |
|   |     | completed, is up-to date,      |                         |
|   |     | accurate, complete, and        | 6.6.2 A formal          |
|   |     | available.                     | configuration           |
|   |     |                                | management methodology  |
|   |     | Supplemental Guidance:         | shall be used for       |
|   |     |                                | installation and        |
|   |     | Appropriate organizational     | ongoing maintenance of  |
|   |     | officials approve the removal  | the FBCA or Entity CA   |
|   |     | of the information system or   | system.                 |
|   |     | information system components  |                         |
|   |     | from the facility when repairs |                         |
|   |     | are necessary. If the          |                         |
|   |     | information system or          |                         |
|   |     | component of the system        |                         |
|   |     | requires off-site repair, the  |                         |
|   |     | organization removes all       |                         |
|   |     | information from associated    |                         |
|   |     | media using approved           |                         |
|   |     | procedures. After maintenance  |                         |
|   |     | is performed on the            |                         |
|   |     | information system, the        |                         |
|   |     | organization checks the        |                         |
|   |     | security features to ensure    |                         |
|   |     | that they are still            |                         |
|   |     | functioning properly.          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | M   | Control:                       | FBCA Section:           |
| 7 | A-3 |                                |                         |
| . |     | The organization approves,     | 6.6.1                   |
|   | MA  | controls, and monitors the use |                         |
|   | INT | of information system          |                         |
|   | ENA | maintenance tools and          |                         |
|   | NCE | maintains the tools on an      |                         |
|   | TO  | ongoing basis.                 |                         |
|   | OLS |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization         |                         |
|   |     | inspects all maintenance tools |                         |
|   |     | (e.g., diagnostic and test     |                         |
|   |     | equipment) carried into a\     |                         |
|   |     | facility by maintenance        |                         |
|   |     | personnel for obvious improper |                         |
|   |     | modifications.\                |                         |
|   |     | (2) The organization checks    |                         |
|   |     | all media containing           |                         |
|   |     | diagnostic test programs       |                         |
|   |     | (e.g., software or firmware\   |                         |
|   |     | used for system maintenance or |                         |
|   |     | diagnostics) for malicious     |                         |
|   |     | code before the media are used |                         |
|   |     | in the\                        |                         |
|   |     | information system.\           |                         |
|   |     | (3) The organization checks    |                         |
|   |     | all maintenance equipment with |                         |
|   |     | the capability of retaining    |                         |
|   |     | information to\                |                         |
|   |     | ensure that no organizational  |                         |
|   |     | information is written on the  |                         |
|   |     | equipment or the equipment is\ |                         |
|   |     | appropriately sanitized before |                         |
|   |     | release; if the equipment      |                         |
|   |     | cannot be sanitized, the       |                         |
|   |     | equipment\                     |                         |
|   |     | remains within the facility or |                         |
|   |     | is destroyed, unless an        |                         |
|   |     | appropriate organization       |                         |
|   |     | official explicitly\           |                         |
|   |     | authorizes an exception.\      |                         |
|   |     | (4) The organization employs   |                         |
|   |     | automated mechanisms to ensure |                         |
|   |     | only authorized personnel use\ |                         |
|   |     | maintenance tools.             |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | M   | Control:                       | FBCA Section:           |
| 8 | A-4 |                                |                         |
| . | (1) | The organization approves,     |                         |
|   | (2) | controls, and monitors         |                         |
|   |     | remotely executed maintenance  |                         |
|   | REM | and diagnostic activities.     |                         |
|   | OTE |                                |                         |
|   | MA  | Enhancements:                  |                         |
|   | INT |                                |                         |
|   | ENA | \(1\) The organization audits  |                         |
|   | NCE | all remote maintenance         |                         |
|   |     | sessions, and appropriate      |                         |
|   |     | organizational\                |                         |
|   |     | personnel review the audit     |                         |
|   |     | logs of the remote sessions.\  |                         |
|   |     | (2) The organization addresses |                         |
|   |     | the installation and use of    |                         |
|   |     | remote diagnostic links in the |                         |
|   |     | security plan\                 |                         |
|   |     | for the information system.\   |                         |
|   |     | (3) Remote diagnostic or       |                         |
|   |     | maintenance services are       |                         |
|   |     | acceptable if performed by a   |                         |
|   |     | service or\                    |                         |
|   |     | organization that implements   |                         |
|   |     | for its own information system |                         |
|   |     | the same level of security as  |                         |
|   |     | that\                          |                         |
|   |     | implemented on the information |                         |
|   |     | system being serviced.         |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The organization describes the |                         |
|   |     | use of remote diagnostic tools |                         |
|   |     | in the security plan for the   |                         |
|   |     | information system. The        |                         |
|   |     | organization maintains         |                         |
|   |     | maintenance logs for all       |                         |
|   |     | remote maintenance,            |                         |
|   |     | diagnostic, and service        |                         |
|   |     | activities. Appropriate        |                         |
|   |     | organization officials         |                         |
|   |     | periodically review            |                         |
|   |     | maintenance logs. Other        |                         |
|   |     | techniques to consider for     |                         |
|   |     | improving the security of      |                         |
|   |     | remote maintenance include:    |                         |
|   |     | (i) encryption and decryption  |                         |
|   |     | of diagnostic communications;  |                         |
|   |     | (ii) strong identification and |                         |
|   |     | authentication techniques,     |                         |
|   |     | such as Level 3 or 4 tokens as |                         |
|   |     | described in NIST Special      |                         |
|   |     | Publication 800-63; and (iii)  |                         |
|   |     | remote disconnect              |                         |
|   |     | verification. When remote      |                         |
|   |     | maintenance is completed, the  |                         |
|   |     | organization (or information   |                         |
|   |     | system in certain cases)       |                         |
|   |     | terminates all sessions and    |                         |
|   |     | remote connections. If         |                         |
|   |     | password-based authentication  |                         |
|   |     | is used during remote          |                         |
|   |     | maintenance, the organization  |                         |
|   |     | changes the passwords          |                         |
|   |     | following each remote          |                         |
|   |     | maintenance service. For       |                         |
|   |     | high-impact information        |                         |
|   |     | systems, if remote diagnostic  |                         |
|   |     | or maintenance services are    |                         |
|   |     | required from a service or     |                         |
|   |     | organization that does not     |                         |
|   |     | implement for its own          |                         |
|   |     | information system the same    |                         |
|   |     | level of security as that      |                         |
|   |     | implemented on the system      |                         |
|   |     | being serviced, the system     |                         |
|   |     | being serviced is sanitized    |                         |
|   |     | and physically separated from  |                         |
|   |     | other information systems      |                         |
|   |     | before the connection of the   |                         |
|   |     | remote access line. If the     |                         |
|   |     | information system cannot be   |                         |
|   |     | sanitized (e.g., due to a      |                         |
|   |     | system failure), remote        |                         |
|   |     | maintenance is not allowed.    |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 7 | M   | Control:                       | FBCA Section:           |
| 9 | A-5 |                                |                         |
| . |     | The organization maintains a   | 5.2.1.1 The             |
|   | MA  | list of personnel authorized   | administrator role is   |
|   | INT | to perform maintenance on the  | responsible for:        |
|   | ENA | information system. Only       |                         |
|   | NCE | authorized personnel perform   | -   Installation,       |
|   | PER | maintenance on the information |     configuration, and  |
|   | SON | system.                        |     maintenance of the  |
|   | NEL |                                |     CA;                 |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Maintenance personnel have     |                         |
|   |     | appropriate access             |                         |
|   |     | authorizations to the          |                         |
|   |     | information system when        |                         |
|   |     | maintenance activities allow   |                         |
|   |     | access to organizational       |                         |
|   |     | information. When maintenance  |                         |
|   |     | personnel do not have needed   |                         |
|   |     | access authorizations,         |                         |
|   |     | organizational personnel with  |                         |
|   |     | appropriate access             |                         |
|   |     | authorizations supervise       |                         |
|   |     | maintenance personnel during   |                         |
|   |     | the performance of maintenance |                         |
|   |     | activities on the information  |                         |
|   |     | system.                        |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | 5.2.1.1 The             |
| 0 | A-6 |                                | administrator role is   |
| . |     | The organization obtains       | responsible for:        |
|   | TIM | maintenance support and spare  |                         |
|   | ELY | parts for \[*Assignment:       | Installation,           |
|   | MA  | organization-defined list of   | configuration, and      |
|   | INT | key information system         | maintenance of the CA   |
|   | ENA | components*\] within           |                         |
|   | NCE | \[*Assignment:                 | 6.6.2 A formal          |
|   |     | organization-defined time      | configuration           |
|   |     | period*\] of failure.          | management methodology  |
|   |     |                                | shall be used for       |
|   |     | Enhancements:                  | installation and        |
|   |     |                                | ongoing maintenance of  |
|   |     | None.                          | the FBCA or Entity CA   |
|   |     |                                | system.                 |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | FBCA Section:           |
| 1 | P-1 |                                |                         |
| . |     | The organization develops,     | 5.1.2.1 Physical Access |
|   | ME  | disseminates, and periodically | for CA Equipment        |
|   | DIA | reviews/updates: (i) a formal, |                         |
|   | P   | documented, media protection   | -   Ensure all          |
|   | ROT | policy that addresses purpose, |     removable media and |
|   | ECT | scope, roles,                  |     paper containing    |
|   | ION | responsibilities, management   |     sensitive           |
|   | POL | commitment, coordination among |     plain-text          |
|   | ICY | organizational entities, and   |     information is      |
|   | AND | compliance; and (ii) formal,   |     stored in secure    |
|   | P   | documented procedures to       |     containers          |
|   | ROC | facilitate the implementation  |                         |
|   | EDU | of the media protection policy | 5.1.6 Media Storage     |
|   | RES | and associated media           |                         |
|   |     | protection controls.           | FBCA and Entity CA      |
|   |     |                                | media shall be stored   |
|   |     | Enhancements:                  | so as to protect it     |
|   |     |                                | from accidental damage  |
|   |     | None.                          | (water, fire,           |
|   |     |                                | electromagnetic).       |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | 5.5.3 Protection of     |
|   |     | The media protection policy    | Archive                 |
|   |     | and procedures are consistent  |                         |
|   |     | with applicable federal laws,  | Archive media shall be  |
|   |     | directives, policies,          | stored in a safe,       |
|   |     | regulations, standards, and    | secure storage facility |
|   |     | guidance. The media protection | separate from the FBCA  |
|   |     | policy can be included as part | or Entity CA itself.    |
|   |     | of the general information     |                         |
|   |     | security policy for the        | If the original media   |
|   |     | organization. Media protection | cannot retain the data  |
|   |     | procedures can be developed    | for the required        |
|   |     | for the security program in    | period, a mechanism to  |
|   |     | general, and for a particular  | periodically transfer   |
|   |     | information system, when       | the archived data to    |
|   |     | required. NIST Special         | new media shall be      |
|   |     | Publication 800-12 provides    | defined by the archive  |
|   |     | guidance on security policies  | site                    |
|   |     | and procedures.                |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | FBCA Section:           |
| 2 | P-2 |                                |                         |
| . |     | The organization ensures that  | 5.1.2.1 Physical Access |
|   | ME  | only authorized users have     | for CA Equipment        |
|   | DIA | access to information in       |                         |
|   | ACC | printed form or on digital     | -   Ensure all          |
|   | ESS | media removed from the         |     removable media and |
|   |     | information system.            |     paper containing    |
|   |     |                                |     sensitive           |
|   |     | Enhancements:                  |     plain-text          |
|   |     |                                |     information is      |
|   |     | \(1\) Unless guard stations    |     stored in secure    |
|   |     | control access to media        |     containers          |
|   |     | storage areas, the             |                         |
|   |     | organization employs           |                         |
|   |     | automated\                     |                         |
|   |     | mechanisms to ensure only      |                         |
|   |     | authorized access to such      |                         |
|   |     | storage areas and to audit     |                         |
|   |     | access attempts\               |                         |
|   |     | and access granted.            |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | FBCA Section:           |
| 3 | P-3 |                                |                         |
| . |     | The organization affixes       |                         |
|   | ME  | external labels to removable   |                         |
|   | DIA | information storage media and  |                         |
|   | LA  | information system output      |                         |
|   | BEL | indicating the distribution    |                         |
|   | ING | limitations and handling       |                         |
|   |     | caveats of the information.    |                         |
|   |     | The organization exempts the   |                         |
|   |     | following specific types of    |                         |
|   |     | media or hardware components   |                         |
|   |     | from labeling so long as they  |                         |
|   |     | remain within a secure         |                         |
|   |     | environment: \[*Assignment:    |                         |
|   |     | organization-defined list of   |                         |
|   |     | media types and hardware       |                         |
|   |     | components*\].                 |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The organization marks         |                         |
|   |     | human-readable output          |                         |
|   |     | appropriately in accordance    |                         |
|   |     | with applicable policies and   |                         |
|   |     | procedures. At a minimum, the  |                         |
|   |     | organization affixes printed   |                         |
|   |     | output that is not otherwise   |                         |
|   |     | appropriately marked, with     |                         |
|   |     | cover sheets and labels        |                         |
|   |     | digital media with the         |                         |
|   |     | distribution limitations,      |                         |
|   |     | handling caveats, and          |                         |
|   |     | applicable security markings,  |                         |
|   |     | if any, of the information.    |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | FBCA Section:           |
| 4 | P-4 |                                |                         |
| . |     | The organization physically    | 5.1.2.1 Physical Access |
|   | ME  | controls and securely stores   | for CA Equipment        |
|   | DIA | information system media, both |                         |
|   | S   | paper and digital, based on    | -   Ensure all          |
|   | TOR | the highest FIPS 199 security  |     removable media and |
|   | AGE | category of the information    |     paper containing    |
|   |     | recorded on the media.         |     sensitive           |
|   |     |                                |     plain-text          |
|   |     | Enhancements:                  |     information is      |
|   |     |                                |     stored in secure    |
|   |     | None.                          |     containers          |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | Removable cryptographic |
|   |     |                                | modules, activation     |
|   |     | The organization protects      | information used to     |
|   |     | information system media until | access or enable        |
|   |     | the media are destroyed or     | cryptographic modules,  |
|   |     | sanitized using approved       | and other sensitive CA  |
|   |     | equipment, techniques, and     | equipment shall be      |
|   |     | procedures. The organization   | placed in secure        |
|   |     | protects unmarked media at the | containers when not in  |
|   |     | highest FIPS 199 security      | use. Activation data    |
|   |     | category for the information   | shall either be         |
|   |     | system until the media are     | memorized, or recorded  |
|   |     | reviewed and appropriately     | and stored in a manner  |
|   |     | labeled.                       | commensurate with the   |
|   |     |                                | security afforded the   |
|   |     |                                | cryptographic module,   |
|   |     |                                | and shall not be stored |
|   |     |                                | with the cryptographic  |
|   |     |                                | module                  |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | FBCA Section:           |
| 5 | P-5 |                                |                         |
| . |     | The organization controls      | 5.1.2.1 Physical Access |
|   | ME  | information system media       | for CA Equipment        |
|   | DIA | (paper and digital) and        |                         |
|   | TRA | restricts the pickup, receipt, | -   Ensure all          |
|   | NSP | transfer, and delivery of such |     removable media and |
|   | ORT | media to authorized personnel. |     paper containing    |
|   |     |                                |     sensitive           |
|   |     | Enhancements:                  |     plain-text          |
|   |     |                                |     information is      |
|   |     | None.                          |     stored in secure    |
|   |     |                                |     containers          |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | 5.5.3 Protection of     |
|   |     | None.                          | Archive                 |
|   |     |                                |                         |
|   |     |                                | No unauthorized user    |
|   |     |                                | shall be permitted to   |
|   |     |                                | write to or delete the  |
|   |     |                                | archive. For the FBCA,  |
|   |     |                                | archived records may be |
|   |     |                                | moved to another medium |
|   |     |                                | when authorized by the  |
|   |     |                                | FPKI Operational        |
|   |     |                                | Authority               |
|   |     |                                | Administrator. Archive  |
|   |     |                                | media shall be stored   |
|   |     |                                | in a safe, secure       |
|   |     |                                | storage facility        |
|   |     |                                | separate from the FBCA  |
|   |     |                                | or Entity CA itself     |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | M   | Control:                       | FBCA Section:           |
| 6 | P-6 |                                |                         |
| . |     | The organization: (i)          | 6.2.10 Method of        |
|   | ME  | sanitizes information system   | Destroying Subscriber   |
|   | DIA | media, both paper and digital, | Private Signature Keys  |
|   | SAN | prior to disposal or release   |                         |
|   | ITI | for reuse; (ii) The            | Subscriber private      |
|   | ZAT | organization tracks,           | signature keys shall be |
|   | ION | documents, and verifies media  | destroyed when they are |
|   | AND | sanitization actions; and      | no longer needed, or    |
|   | DI  | (iii) periodically tests       | when the certificates   |
|   | SPO | sanitization equipment and     | to which they           |
|   | SAL | procedures to ensure correct   | correspond expire or    |
|   |     | performance.                   | are revoked. For        |
|   |     |                                | software cryptographic  |
|   |     | Enhancements:                  | modules, this can be    |
|   |     |                                | overwriting the data.   |
|   |     | None.                          | For hardware            |
|   |     |                                | cryptographic modules,  |
|   |     | Supplemental Guidance:         | this will likely be     |
|   |     |                                | executing a "zeroize"   |
|   |     | Sanitization is the process    | command. Physical       |
|   |     | used to remove information     | destruction of hardware |
|   |     | from information system media  | should not be required. |
|   |     | such that there is reasonable  |                         |
|   |     | assurance, in proportion to    | 4.9.3 Procedure for     |
|   |     | the confidentiality of the     | Revocation Request      |
|   |     | information, that the          |                         |
|   |     | information cannot be          | Where subscribers use   |
|   |     | retrieved or reconstructed.    | hardware tokens,        |
|   |     | Sanitization techniques,       | revocation is optional  |
|   |     | including clearing, purging,   | if all the following    |
|   |     | and destroying media           | conditions are met:     |
|   |     | information, ensure that       |                         |
|   |     | organizational information is  | -   the revocation      |
|   |     | not disclosed to unauthorized  |     request was not for |
|   |     | individuals when such media is |     key compromise;     |
|   |     | reused or disposed. The        |                         |
|   |     | organization uses its          | -   the hardware token  |
|   |     | discretion on sanitization     |     does not permit the |
|   |     | techniques and procedures for  |     user to export the  |
|   |     | media containing information   |     signature private   |
|   |     | deemed to be in the public     |     key;                |
|   |     | domain or deemed to have no    |                         |
|   |     | adverse impact on the          | -   the Subscriber      |
|   |     | organization if released for   |     surrendered the     |
|   |     | reuse or disposed. The         |     token to the PKI;   |
|   |     | National Security Agency       |                         |
|   |     | provides media sanitization    | -   the token was       |
|   |     | guidance and maintains a       |     zeroized or         |
|   |     | listing of approved            |     destroyed promptly  |
|   |     | sanitization products at       |     upon surrender;     |
|   |     | http://www.                    |                         |
|   |     | nsa.gov/ia/government/mdg.cfm. | the token has been      |
|   |     | NIST Special Publication       | protected from          |
|   |     | 800-88 provides guidance on    | malicious use between   |
|   |     | media sanitization.            | surrender and           |
|   |     |                                | zeroization or          |
|   |     |                                | destruction             |
|   |     |                                |                         |
|   |     |                                | 5.1.7 Waste Disposal    |
|   |     |                                |                         |
|   |     |                                | Sensitive waste         |
|   |     |                                | material shall be       |
|   |     |                                | disposed of in a secure |
|   |     |                                | fashion.                |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | P   | Control:                       | FBCA Section:           |
| 7 | E-1 |                                |                         |
| . |     | The organization develops,     | 5.1.2.1 Physical Access |
|   |     | disseminates, and periodically | for CA Equipment        |
|   |     | reviews/updates: (i) a formal, |                         |
|   |     | documented, physical and       | The FBCA and Entity CA  |
|   |     | environmental protection       | equipment shall always  |
|   |     | policy that addresses purpose, | be protected from       |
|   |     | scope, roles,                  | unauthorized access.    |
|   |     | responsibilities, and          | The security mechanisms |
|   |     | compliance; and (ii) formal,   | shall be commensurate   |
|   |     | documented procedures to       | with the level of       |
|   |     | facilitate the implementation  | threat in the equipment |
|   |     | of the physical and            | environment.            |
|   |     | environmental protection       |                         |
|   |     | policy and associated physical | A person or group of    |
|   |     | and environmental protection   | persons shall be made   |
|   |     | controls.                      | explicitly responsible  |
|   |     |                                | for making such checks. |
|   |     | Enhancements:                  | When a group of persons |
|   |     |                                | is responsible, a log   |
|   |     | None.                          | identifying the person  |
|   |     |                                | performing a check at   |
|   |     | Supplemental Guidance:         | each instance shall be  |
|   |     |                                | maintained. If the      |
|   |     | The physical and environmental | facility is not         |
|   |     | protection policy and          | continuously attended,  |
|   |     | procedures are consistent with | the last person to      |
|   |     | applicable federal laws,       | depart shall initial a  |
|   |     | directives, policies,          | sign-out sheet that     |
|   |     | regulations, standards, and    | indicates the date and  |
|   |     | guidance. The physical and     | time, and asserts that  |
|   |     | environmental protection       | all necessary physical  |
|   |     | policy can be included as part | protection mechanisms   |
|   |     | of the general information     | are in place and        |
|   |     | security policy for the        | activated               |
|   |     | organization. Physical and     |                         |
|   |     | environmental protection       | 5.1.3 Power and Air     |
|   |     | procedures can be developed    | Condiitoning            |
|   |     | for the security program in    |                         |
|   |     | general, and for a particular  | The FBCA and Entity CAs |
|   |     | information system, when       | (operating at the Basic |
|   |     | required. NIST Special         | Assurance level or      |
|   |     | Publication 800-12 provides    | higher) shall have      |
|   |     | guidance on security policies  | backup capability       |
|   |     | and procedures.                | sufficient to           |
|   |     |                                | automatically lock out  |
|   |     |                                | input, finish any       |
|   |     |                                | pending actions, and    |
|   |     |                                | record the state of the |
|   |     |                                | equipment before lack   |
|   |     |                                | of power or air         |
|   |     |                                | conditioning causes a   |
|   |     |                                | shutdown.               |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | P   | Control:                       | FBCA Section:           |
| 8 | E-2 |                                |                         |
| . |     | The organization develops and  | 5.1.1 Site Location and |
|   | PH  | keeps current lists of         | Construction            |
|   | YSI | personnel with authorized      |                         |
|   | CAL | access to facilities           | The location and        |
|   | ACC | containing information systems | construction of the     |
|   | ESS | (except for those areas within | facility housing the    |
|   | AU  | the facilities officially      | FBCA and Entity CA      |
|   | THO | designated as publicly         | equipment shall be      |
|   | RIZ | accessible) and issues         | consistent with         |
|   | ATI | appropriate authorization      | facilities used to      |
|   | ONS | credentials (e.g., badges,     | house high value,       |
|   |     | identification cards, smart    | sensitive information.  |
|   |     | cards). Designated officials   | The site location and   |
|   |     | within the organization review | construction, when      |
|   |     | and approve the access list    | combined with other     |
|   |     | and authorization credentials  | physical security       |
|   |     | \[*Assignment:                 | protection mechanisms   |
|   |     | organization-defined           | such as guards and      |
|   |     | frequency, at least            | intrusion sensors,      |
|   |     | annually*\].                   | shall provide robust    |
|   |     |                                | protection against      |
|   |     | Enhancements:                  | unauthorized access to  |
|   |     |                                | the FBCA and Entity CA  |
|   |     | None.                          | equipment and records   |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | #### 5.1.2.1 Physical   |
|   |     |                                | Access for CA Equipment |
|   |     | The organization promptly      |                         |
|   |     | removes personnel no longer    | The physical security   |
|   |     | requiring access from access   | requirements pertaining |
|   |     | lists.                         | to CAs that issue Basic |
|   |     |                                | Assurance certificates  |
|   |     |                                | are:                    |
|   |     |                                |                         |
|   |     |                                | -   Ensure no           |
|   |     |                                |     unauthorized access |
|   |     |                                |     to the hardware is  |
|   |     |                                |     permitted           |
|   |     |                                |                         |
|   |     |                                | 5.1.2.2 Physical Access |
|   |     |                                | for RA Equipment        |
|   |     |                                |                         |
|   |     |                                | RA equipment shall be   |
|   |     |                                | protected from          |
|   |     |                                | unauthorized access     |
|   |     |                                | while the cryptographic |
|   |     |                                | module is installed and |
|   |     |                                | activated               |
|   |     |                                |                         |
|   |     |                                | 5.2.3 Identification    |
|   |     |                                | and Authentication for  |
|   |     |                                | Each Role               |
|   |     |                                |                         |
|   |     |                                | At all assurance levels |
|   |     |                                | other than Rudimentary, |
|   |     |                                | an individual shall     |
|   |     |                                | identify and            |
|   |     |                                | authenticate            |
|   |     |                                | him/herself before      |
|   |     |                                | being permitted to      |
|   |     |                                | perform any actions set |
|   |     |                                | forth above for that    |
|   |     |                                | role or identity        |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 8 | P   | Control:                       | FBCA Section:           |
| 9 | E-3 |                                |                         |
| . |     | The organization controls all  | 5.1.1 Site Location and |
|   | PH  | physical access points         | Construction            |
|   | YSI | (including designated          |                         |
|   | CAL | entry/exit points) to          | The location and        |
|   | ACC | facilities containing          | construction of the     |
|   | ESS | information systems (except    | facility housing the    |
|   | C   | for those areas within the     | FBCA and Entity CA      |
|   | ONT | facilities officially          | equipment shall be      |
|   | ROL | designated as publicly         | consistent with         |
|   |     | accessible) and verifies       | facilities used to      |
|   |     | individual access              | house high value,       |
|   |     | authorizations before granting | sensitive information.  |
|   |     | access to the facilities. The  | The site location and   |
|   |     | organization also controls     | construction, when      |
|   |     | access to areas officially     | combined with other     |
|   |     | designated as publicly         | physical security       |
|   |     | accessible, as appropriate, in | protection mechanisms   |
|   |     | accordance with the            | such as guards and      |
|   |     | organization's assessment of   | intrusion sensors,      |
|   |     | risk.                          | shall provide robust    |
|   |     |                                | protection against      |
|   |     | Enhancements:                  | unauthorized access to  |
|   |     |                                | the FBCA and Entity CA  |
|   |     | None.                          | equipment and records   |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         | #### 5.1.2.1 Physical   |
|   |     |                                | Access for CA Equipment |
|   |     | The organization uses physical |                         |
|   |     | access devices (e.g., keys,    | The physical security   |
|   |     | locks, combinations, card      | requirements pertaining |
|   |     | readers) and/or guards to      | to CAs that issue Basic |
|   |     | control entry to facilities    | Assurance certificates  |
|   |     | containing information         | are:                    |
|   |     | systems. The organization      |                         |
|   |     | secures keys, combinations,    | -   Ensure no           |
|   |     | and other access devices and   |     unauthorized access |
|   |     | inventories those devices      |     to the hardware is  |
|   |     | regularly. The organization    |     permitted           |
|   |     | changes combinations and keys: |                         |
|   |     | (i) periodically; and (ii)     | 5.1.2.2 Physical Access |
|   |     | when keys are lost,            | for RA Equipment        |
|   |     | combinations are compromised,  |                         |
|   |     | or individuals are transferred | RA equipment shall be   |
|   |     | or terminated. After an        | protected from          |
|   |     | emergency-related event, the   | unauthorized access     |
|   |     | organization restricts reentry | while the cryptographic |
|   |     | to facilities to authorized    | module is installed and |
|   |     | individuals only. Workstations | activated               |
|   |     | and associated peripherals     |                         |
|   |     | connected to (and part of) an  | 5.2.3 Identification    |
|   |     | organizational information     | and Authentication for  |
|   |     | system may be located in areas | Each Role               |
|   |     | designated as publicly         |                         |
|   |     | accessible with access to such | At all assurance levels |
|   |     | devices being appropriately    | other than Rudimentary, |
|   |     | controlled. Where federal      | an individual shall     |
|   |     | Personal Identity Verification | identify and            |
|   |     | (PIV) credential is used as an | authenticate            |
|   |     | identification token and       | him/herself before      |
|   |     | token-based access control is  | being permitted to      |
|   |     | employed, the\                 | perform any actions set |
|   |     | access control system conforms | forth above for that    |
|   |     | to the requirements of FIPS    | role or identity        |
|   |     | 201 and NIST Special           |                         |
|   |     | Publication 800-73. If the     |                         |
|   |     | token-based access control     |                         |
|   |     | function employs cryptographic |                         |
|   |     | verification, the access       |                         |
|   |     | control system conforms to the |                         |
|   |     | requirements of NIST Special   |                         |
|   |     | Publication 800-78. If the     |                         |
|   |     | token-based access control     |                         |
|   |     | function employs biometric     |                         |
|   |     | verification, the access       |                         |
|   |     | control system conforms to the |                         |
|   |     | requirements of NIST Special   |                         |
|   |     | Publication 800-76.            |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | P   | Control:                       | FBCA Section:           |
| 0 | E-4 |                                |                         |
| . |     | The organization controls      |                         |
|   | ACC | physical access to information |                         |
|   | ESS | system distribution and        |                         |
|   | C   | transmission lines within      |                         |
|   | ONT | organizational facilities to   |                         |
|   | ROL | prevent accidental damage,     |                         |
|   | FOR | eavesdropping, in-transit      |                         |
|   | TRA | modification, disruption, or   |                         |
|   | NSM | physical tampering.            |                         |
|   | ISS |                                |                         |
|   | ION | Enhancements:                  |                         |
|   | MED |                                |                         |
|   | IUM | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Protective measures to control |                         |
|   |     | physical access to information |                         |
|   |     | system distribution and        |                         |
|   |     | transmission lines include:    |                         |
|   |     | (i) locked wiring closets;     |                         |
|   |     | (ii) disconnected or locked    |                         |
|   |     | spare jacks; and/or (iii)      |                         |
|   |     | protection of cabling by       |                         |
|   |     | conduit or cable trays.        |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | P   | Control:                       | FBCA Section:           |
| 1 | E-5 |                                |                         |
| . |     | The organization controls      | 5.1.1 Site Location and |
|   | ACC | physical access to information | Construction            |
|   | ESS | system devices that display    |                         |
|   | C   | information to prevent         | The location and        |
|   | ONT | unauthorized individuals from  | construction of the     |
|   | ROL | observing the display output.  | facility housing the    |
|   | FOR |                                | FBCA and Entity CA      |
|   | D   | Enhancements:                  | equipment shall be      |
|   | ISP |                                | consistent with         |
|   | LAY | None.                          | facilities used to      |
|   | MED |                                | house high value,       |
|   | IUM | Supplemental Guidance:         | sensitive information.  |
|   |     |                                | The site location and   |
|   |     | None.                          | construction, when      |
|   |     |                                | combined with other     |
|   |     |                                | physical security       |
|   |     |                                | protection mechanisms   |
|   |     |                                | such as guards and      |
|   |     |                                | intrusion sensors,      |
|   |     |                                | shall provide robust    |
|   |     |                                | protection against      |
|   |     |                                | unauthorized access to  |
|   |     |                                | the FBCA and Entity CA  |
|   |     |                                | equipment and records   |
|   |     |                                |                         |
|   |     |                                | #### 5.1.2.1 Physical   |
|   |     |                                | Access for CA Equipment |
|   |     |                                |                         |
|   |     |                                | The physical security   |
|   |     |                                | requirements pertaining |
|   |     |                                | to CAs that issue Basic |
|   |     |                                | Assurance certificates  |
|   |     |                                | are:                    |
|   |     |                                |                         |
|   |     |                                | -   Ensure no           |
|   |     |                                |     unauthorized access |
|   |     |                                |     to the hardware is  |
|   |     |                                |     permitted           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | P   | Control:                       | FBCA Section:           |
| 2 | E-6 |                                |                         |
| . | (1) | The organization monitors      | 5.1.1 Site Location and |
|   |     | physical access to information | Construction            |
|   | M   | systems to detect and respond  |                         |
|   | ONI | to incidents.                  | The site location and   |
|   | TOR |                                | construction, when      |
|   | ING | Enhancements:                  | combined with other     |
|   | PH  |                                | physical security       |
|   | YSI | \(1\) The organization         | protection mechanisms   |
|   | CAL | monitors real-time intrusion   | such as guards and      |
|   | ACC | alarms and surveillance        | intrusion sensors,      |
|   | ESS | equipment.\                    | shall provide robust    |
|   |     | (2) The organization employs   | protection against      |
|   |     | automated mechanisms to ensure | unauthorized access to  |
|   |     | potential intrusions are       | the FBCA and Entity CA  |
|   |     | recognized\                    | equipment and records.  |
|   |     | and appropriate response       |                         |
|   |     | actions initiated.             | 5.1.2.1 Physical Access |
|   |     |                                | for CA Equipment        |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | In addition to those    |
|   |     | The organization reviews       | requirements, the       |
|   |     | physical access logs           | following requirements  |
|   |     | periodically, investigates     | shall apply to CAs that |
|   |     | apparent security violations   | issue Medium, Medium    |
|   |     | or suspicious physical access  | Hardware, or High       |
|   |     | activities, and takes remedial | assurance certificates: |
|   |     | actions.                       |                         |
|   |     |                                | -   Ensure manual or    |
|   |     |                                |     electronic          |
|   |     |                                |     monitoring for      |
|   |     |                                |     unauthorized        |
|   |     |                                |     intrusion at all    |
|   |     |                                |     times               |
|   |     |                                |                         |
|   |     |                                | A security check of the |
|   |     |                                | facility housing the    |
|   |     |                                | FBCA or Entity CA       |
|   |     |                                | equipment (operating at |
|   |     |                                | the Basic Assurance     |
|   |     |                                | level or higher) shall  |
|   |     |                                | occur if the facility   |
|   |     |                                | is to be left           |
|   |     |                                | unattended. At a        |
|   |     |                                | minimum, the check      |
|   |     |                                | shall verify the        |
|   |     |                                | following:              |
|   |     |                                |                         |
|   |     |                                | -   The equipment is in |
|   |     |                                |     a state appropriate |
|   |     |                                |     to the current mode |
|   |     |                                |     of operation (e.g., |
|   |     |                                |     that cryptographic  |
|   |     |                                |     modules are in      |
|   |     |                                |     place when "open",  |
|   |     |                                |     and secured when    |
|   |     |                                |     "closed"; and for   |
|   |     |                                |     the FBCA, that all  |
|   |     |                                |     equipment other     |
|   |     |                                |     than the repository |
|   |     |                                |     is shut down);      |
|   |     |                                |                         |
|   |     |                                | -   Any security        |
|   |     |                                |     containers are      |
|   |     |                                |     properly secured;   |
|   |     |                                |                         |
|   |     |                                | -   Physical security   |
|   |     |                                |     systems (e.g., door |
|   |     |                                |     locks, vent covers) |
|   |     |                                |     are functioning     |
|   |     |                                |     properly; and       |
|   |     |                                |                         |
|   |     |                                | The area is secured     |
|   |     |                                | against unauthorized    |
|   |     |                                | access.                 |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | P   | Control:                       | FBCA Section:           |
| 3 | E-7 |                                |                         |
| . | (1) | The organization controls      | 5.1.1 Site Location and |
|   |     | physical access to information | Construction            |
|   | V   | systems by authenticating      |                         |
|   | ISI | visitors before authorizing    | The location and        |
|   | TOR | access to facilities or areas  | construction of the     |
|   | C   | other than areas designated as | facility housing the    |
|   | ONT | publicly accessible.           | FBCA and Entity CA      |
|   | ROL |                                | equipment shall be      |
|   |     | Enhancements:                  | consistent with         |
|   |     |                                | facilities used to      |
|   |     | \(1\) The organization escorts | house high value,       |
|   |     | visitors and monitors visitor  | sensitive information.  |
|   |     | activity, when required.       | The site location and   |
|   |     |                                | construction, when      |
|   |     | Supplemental Guidance:         | combined with other     |
|   |     |                                | physical security       |
|   |     | Government contractors and     | protection mechanisms   |
|   |     | others with permanent          | such as guards and      |
|   |     | authorization credentials are  | intrusion sensors,      |
|   |     | not considered visitors.       | shall provide robust    |
|   |     | Personal Identity Verification | protection against      |
|   |     | (PIV) credentials for federal  | unauthorized access to  |
|   |     | government employees and       | the FBCA and Entity CA  |
|   |     | contractors conform to FIPS    | equipment and records   |
|   |     | 201, and the issuing           |                         |
|   |     | organizations for the PIV      |                         |
|   |     | credentials are accredited in  |                         |
|   |     | accordance with the provisions |                         |
|   |     | of NIST Special Publication    |                         |
|   |     | 800-\                          |                         |
|   |     | 79.                            |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | P   | Control:                       | FBCA Section:           |
| 4 | E-8 |                                |                         |
| . |     | The organization maintains a   | 5.1.1 Site Location and |
|   | ACC | visitor access log to          | Construction            |
|   | ESS | facilities (except for those   |                         |
|   | R   | areas within the facilities    | The location and        |
|   | ECO | officially designated as       | construction of the     |
|   | RDS | publicly accessible) that      | facility housing the    |
|   |     | includes: (i) name and         | FBCA and Entity CA      |
|   |     | organization of the person     | equipment shall be      |
|   |     | visiting; (ii) signature of    | consistent with         |
|   |     | the visitor; (iii) form of     | facilities used to      |
|   |     | identification; (iv) date of   | house high value,       |
|   |     | access; (v) time of entry and  | sensitive information.  |
|   |     | departure; (vi) purpose of     | The site location and   |
|   |     | visit; and (vii) name and      | construction, when      |
|   |     | organization of person         | combined with other     |
|   |     | visited. Designated officials  | physical security       |
|   |     | within the organization review | protection mechanisms   |
|   |     | the access logs *\[Assignment: | such as guards and      |
|   |     | organization-defined           | intrusion sensors,      |
|   |     | frequency\]*.                  | shall provide robust    |
|   |     |                                | protection against      |
|   |     | Enhancements:                  | unauthorized access to  |
|   |     |                                | the FBCA and Entity CA  |
|   |     | \(1\) The organization employs | equipment and records   |
|   |     | automated mechanisms to        |                         |
|   |     | facilitate the maintenance and |                         |
|   |     | review of access logs          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | P   | Control:                       | FBCA Section:           |
| 5 | E-9 |                                |                         |
| . |     | The organization protects      | 5.1.3 Power and Air     |
|   | PO  | power equipment and power      | Conditioning            |
|   | WER | cabling for the information    |                         |
|   | EQU | system from damage and         | The FBCA and Entity CAs |
|   | IPM | destruction.                   | (operating at the Basic |
|   | ENT |                                | Assurance level or      |
|   | AND | Enhancements:                  | higher) shall have      |
|   | PO  |                                | backup capability       |
|   | WER | \(1\) The organization employs | sufficient to           |
|   | C   | redundant and parallel power   | automatically lock out  |
|   | ABL | cabling paths.                 | input, finish any       |
|   | ING |                                | pending actions, and    |
|   |     | Supplemental Guidance:         | record the state of the |
|   |     |                                | equipment before lack   |
|   |     | None.                          | of power or air         |
|   |     |                                | conditioning causes a   |
|   |     |                                | shutdown. In addition,  |
|   |     |                                | the FBCA directories    |
|   |     |                                | (containing FBCA issued |
|   |     |                                | certificates and CRLs)  |
|   |     |                                | shall be provided with  |
|   |     |                                | Uninterrupted Power     |
|   |     |                                | sufficient for a        |
|   |     |                                | minimum of six hours    |
|   |     |                                | operation in the        |
|   |     |                                | absence of commercial   |
|   |     |                                | power                   |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | PE  | Control:                       | FBCA Section:           |
| 6 | -10 |                                |                         |
| . |     | For specific locations within  | 5.1.3 Power and Air     |
|   | EME | a facility containing          | Conditioning            |
|   | RGE | concentrations of information  |                         |
|   | NCY | system resources (e.g., data   | The FBCA and Entity CAs |
|   | S   | centers, server rooms,         | (operating at the Basic |
|   | HUT | mainframe rooms), the          | Assurance level or      |
|   | OFF | organization provides the      | higher) shall have      |
|   |     | capability of shutting off     | backup capability       |
|   |     | power to any information       | sufficient to           |
|   |     | technology component that may  | automatically lock out  |
|   |     | be malfunctioning (e.g., due   | input, finish any       |
|   |     | to an electrical fire) or      | pending actions, and    |
|   |     | threatened (e.g., due to a     | record the state of the |
|   |     | water leak) without            | equipment before lack   |
|   |     | endangering personnel by       | of power or air         |
|   |     | requiring them to approach the | conditioning causes a   |
|   |     | equipment.                     | shutdown. In addition,  |
|   |     |                                | the FBCA directories    |
|   |     | Enhancements:                  | (containing FBCA issued |
|   |     |                                | certificates and CRLs)  |
|   |     | None.                          | shall be provided with  |
|   |     |                                | Uninterrupted Power     |
|   |     | Supplemental Guidance:         | sufficient for a        |
|   |     |                                | minimum of six hours    |
|   |     | None.                          | operation in the        |
|   |     |                                | absence of commercial   |
|   |     |                                | power                   |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | PE  | Control:                       | FBCA Section:           |
| 7 | -11 |                                |                         |
| . |     | The organization provides a    | 5.1.3 Power and Air     |
|   | EME | short-term uninterruptible     | Conditioning            |
|   | RGE | power supply to facilitate an  |                         |
|   | NCY | orderly shutdown of the        | The FBCA and Entity CAs |
|   | PO  | information system in the      | (operating at the Basic |
|   | WER | event of a primary power       | Assurance level or      |
|   |     | source loss.                   | higher) shall have      |
|   |     |                                | backup capability       |
|   |     | Enhancements:                  | sufficient to           |
|   |     |                                | automatically lock out  |
|   |     | \(1\) The organization         | input, finish any       |
|   |     | provides a long-term alternate | pending actions, and    |
|   |     | power supply for the           | record the state of the |
|   |     | information system that is\    | equipment before lack   |
|   |     | capable of maintaining         | of power or air         |
|   |     | minimally required operational | conditioning causes a   |
|   |     | capability in the event of an  | shutdown. In addition,  |
|   |     | extended loss of\              | the FBCA directories    |
|   |     | the primary power source.\     | (containing FBCA issued |
|   |     | (2) The organization provides  | certificates and CRLs)  |
|   |     | a long-term alternate power    | shall be provided with  |
|   |     | supply for the information     | Uninterrupted Power     |
|   |     | system that is\                | sufficient for a        |
|   |     | self-contained and not reliant | minimum of six hours    |
|   |     | on external power generation.  | operation in the        |
|   |     |                                | absence of commercial   |
|   |     | Supplemental Guidance:         | power                   |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | En  |                                |                         |
|   | tit |                                |                         |
|   | ies |                                |                         |
|   | at  |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | PE  | Control:                       | FBCA Section:           |
| 8 | -12 |                                |                         |
| . |     | The organization employs and   |                         |
|   | EME | maintains automatic emergency  |                         |
|   | RGE | lighting systems that activate |                         |
|   | NCY | in the event of a power outage |                         |
|   | LI  | or disruption and that cover   |                         |
|   | GHT | emergency exits and evacuation |                         |
|   | ING | routes.                        |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 9 | PE  | Control:                       | FBCA Section:           |
| 9 | -13 |                                |                         |
| . | (1) | The organization employs and   | ### 5.1.5 Fire          |
|   |     | maintains fire suppression and | Prevention & Protection |
|   | F   | detection devices/systems that |                         |
|   | IRE | can be activated in the event  | No stipulation          |
|   | P   | of a fire.                     |                         |
|   | ROT |                                |                         |
|   | ECT | Enhancements:                  |                         |
|   | ION |                                |                         |
|   |     | \(1\) Fire suppression and     |                         |
|   |     | detection devices/systems      |                         |
|   |     | activate automatically in the  |                         |
|   |     | event of a fire.\              |                         |
|   |     | (2) Fire suppression and       |                         |
|   |     | detection devices/systems      |                         |
|   |     | provide automatic notification |                         |
|   |     | of any activation to\          |                         |
|   |     | the organization and emergency |                         |
|   |     | responders.                    |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Fire suppression and detection |                         |
|   |     | devices/systems include, but   |                         |
|   |     | are not limited to, sprinkler  |                         |
|   |     | systems, handheld fire         |                         |
|   |     | extinguishers, fixed fire      |                         |
|   |     | hoses, and smoke detectors.    |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | NOT |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | PE  | Control:                       | FBCA Section:           |
| 0 | -14 |                                |                         |
| 0 |     | The organization regularly     | 5.1.3 Power and Air     |
| . | TE  | maintains within acceptable    | Conditioning            |
|   | MPE | levels and monitors the        |                         |
|   | RAT | temperature and humidity       | The FBCA and Entity CAs |
|   | URE | within facilities containing   | (operating at the Basic |
|   | AND | information systems.           | Assurance level or      |
|   | HU  |                                | higher) shall have      |
|   | MID | Enhancements:                  | backup capability       |
|   | ITY |                                | sufficient to           |
|   | CO  | None.                          | automatically lock out  |
|   | NTR |                                | input, finish any       |
|   | OLS | Supplemental Guidance:         | pending actions, and    |
|   |     |                                | record the state of the |
|   |     | None.                          | equipment before lack   |
|   |     |                                | of power or air         |
|   |     |                                | conditioning causes a   |
|   |     |                                | shutdown. In addition,  |
|   |     |                                | the FBCA directories    |
|   |     |                                | (containing FBCA issued |
|   |     |                                | certificates and CRLs)  |
|   |     |                                | shall be provided with  |
|   |     |                                | Uninterrupted Power     |
|   |     |                                | sufficient for a        |
|   |     |                                | minimum of six hours    |
|   |     |                                | operation in the        |
|   |     |                                | absence of commercial   |
|   |     |                                | power                   |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **C |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X   |                                |                         |
|   | -CE |                                |                         |
|   | RTD |                                |                         |
|   | En  |                                |                         |
|   | tit |                                |                         |
|   | ies |                                |                         |
|   | at  |                                |                         |
|   | Ba  |                                |                         |
|   | sic |                                |                         |
|   | and |                                |                         |
|   | A   |                                |                         |
|   | bov |                                |                         |
|   | e** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | PE  | Control:                       | FBCA Section:           |
| 0 | -15 |                                |                         |
| 1 |     | The organization protects the  | 5.1.4 Water Exposures   |
| . | WA  | information system from water  |                         |
|   | TER | damage resulting from broken   | CA equipment shall be   |
|   | DAM | plumbing lines or other        | installed such that it  |
|   | AGE | sources of water leakage by    | is not in danger of     |
|   | P   | ensuring that master shutoff   | exposure to water       |
|   | ROT | valves are accessible, working | (e.g., on               |
|   | ECT | properly, and known to key     |                         |
|   | ION | personnel.                     | tables or elevated      |
|   |     |                                | floors).                |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | \(1\) The organization employs |                         |
|   |     | automated mechanisms to        |                         |
|   |     | automatically close shutoff    |                         |
|   |     | valves in the\                 |                         |
|   |     | event of a significant water   |                         |
|   |     | leak.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | PE  | Control:                       | FBCA Section:           |
| 0 | -16 |                                |                         |
| 2 |     | The organization controls      |                         |
| . | DE  | information system-related     |                         |
|   | LIV | items (i.e., hardware,         |                         |
|   | ERY | firmware, software) entering   |                         |
|   | AND | and exiting the facility and   |                         |
|   | R   | maintains appropriate records  |                         |
|   | EMO | of those items.                |                         |
|   | VAL |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The organization controls      |                         |
|   |     | delivery areas and, if         |                         |
|   |     | possible, isolates the areas   |                         |
|   |     | from the information system    |                         |
|   |     | and media libraries to avoid   |                         |
|   |     | unauthorized access.           |                         |
|   |     | Appropriate organizational     |                         |
|   |     | officials authorize the        |                         |
|   |     | delivery or removal of         |                         |
|   |     | information system-related     |                         |
|   |     | items belonging to the         |                         |
|   |     | organization.                  |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | PE  | Control:                       | FBCA Section:           |
| 0 | -17 |                                |                         |
| 3 |     | Individuals within the         | 5.1.8: The backup shall |
| . | ALT | organization employ            | be stored at a site     |
|   | ERN | appropriate information system | with physical and       |
|   | ATE | security controls at alternate | procedural controls     |
|   | W   | work sites.                    | commensurate to that of |
|   | ORK |                                | the operational FBCA or |
|   | S   | Enhancements:                  | Entity CA.              |
|   | ITE |                                |                         |
|   |     | None.                          | 5.4.4: The off-site     |
|   |     |                                | storage location for    |
|   |     | Supplemental Guidance:         | audit logs shall be a   |
|   |     |                                | safe, secure location   |
|   |     | NIST Special Publication       | separate from the CA    |
|   |     | 800-46 provides guidance on    | equipment.              |
|   |     | security in telecommuting and  |                         |
|   |     | broadband communications. The  | 6.2.4.1: All copies of  |
|   |     | organization provides a means  | the CA private          |
|   |     | for employees to communicate   | signature key shall be  |
|   |     | with information system        | accounted for and       |
|   |     | security staff in case of      | protected in the same   |
|   |     | security problems.             | manner as the original. |
|   |     |                                |                         |
|   |     |                                | 5.1.8                   |
|   |     |                                |                         |
|   |     |                                | 5.4.4                   |
|   |     |                                |                         |
|   |     |                                | 6.2.4.1                 |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | PE  | Control:                       | FBCA Section:           |
| 0 | -18 |                                |                         |
| 4 |     | The organization positions     | 5.1.2.1 Physical Access |
| . | LO  | information system Components  | to CA Equipment         |
|   | CAT | within the facility to         |                         |
|   | ION | minimize potential damage from | The physical security   |
|   | OF  | physical and environmental     | requirements pertaining |
|   | IN  | hazards and to minimize the    | to CAs that issue Basic |
|   | FOR | opportunity for unauthorized   | Assurance certificates  |
|   | MAT | access.                        | are:                    |
|   | ION |                                |                         |
|   | SYS | Enhancements:                  | -   Ensure no           |
|   | TEM |                                |     unauthorized access |
|   | C   | None.                          |     to the hardware is  |
|   | OMP |                                |     permitted           |
|   | ONE | Supplemental Guidance:         |                         |
|   | NTS |                                | -   Ensure all          |
|   |     | Physical and environmental     |     removable media and |
|   |     | hazards include, for example,  |     paper containing    |
|   |     | flooding, vandalism,           |     sensitive           |
|   |     | electrical interference,       |     plain-text          |
|   |     | electromagnetic radiation,     |     information is      |
|   |     | eating and drinking within     |     stored in secure    |
|   |     | proximity.                     |     containers          |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | PE  | Control:                       | FBCA Section:           |
| 0 | -19 |                                |                         |
| 5 |     | The organization protects the  |                         |
| . | IN  | information system from        |                         |
|   | FOR | information leakage due to     |                         |
|   | MAT | electromagnetic signals        |                         |
|   | ION | emanations.                    |                         |
|   | L   |                                |                         |
|   | EAK | Enhancements:                  |                         |
|   | AGE |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The FIPS 199 security          |                         |
|   |     | categorization (for            |                         |
|   |     | confidentiality) of the        |                         |
|   |     | information system and         |                         |
|   |     | organizational security policy |                         |
|   |     | guides the application of      |                         |
|   |     | safeguards and countermeasures |                         |
|   |     | employed to protect the        |                         |
|   |     | information system against     |                         |
|   |     | information leakage due to     |                         |
|   |     | electromagnetic signals        |                         |
|   |     | emanations.                    |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | *   |                                |                         |
|   | *N/ |                                |                         |
|   | A** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 0 | L-1 |                                |                         |
| 6 |     | The organization develops,     | 6.6.2 Security          |
| . | SE  | disseminates, and periodically | Management Controls     |
|   | CUR | reviews/updates: (i) a formal, |                         |
|   | ITY | documented, security planning  | The configuration of    |
|   | PL  | policy that addresses purpose, | the FBCA or Entity CA   |
|   | ANN | scope, roles,                  | system as well as any   |
|   | ING | responsibilities, management   | modifications and       |
|   | POL | commitment, coordination among | upgrades shall be       |
|   | ICY | organizational entities, and   | documented and          |
|   | AND | compliance; and (ii) formal,   | controlled. There shall |
|   | P   | documented procedures to       | be a mechanism for      |
|   | ROC | facilitate the implementation  | detecting unauthorized  |
|   | EDU | of the security planning       | modification to the     |
|   | RES | policy and associated security | FBCA or Entity CA       |
|   |     | planning controls.             | software or             |
|   |     |                                | configuration. A formal |
|   |     | Enhancements:                  | configuration           |
|   |     |                                | management methodology  |
|   |     | None.                          | shall be used for       |
|   |     |                                | installation and        |
|   |     | Supplemental Guidance:         | ongoing maintenance of  |
|   |     |                                | the FBCA or Entity CA   |
|   |     | The security planning policy   | system. The FBCA or     |
|   |     | and procedures are consistent  | Entity CA software,     |
|   |     | with applicable federal laws,  | when first loaded,      |
|   |     | directives, policies,          | shall be verified as    |
|   |     | regulations, standards, and    | being that supplied     |
|   |     | guidance. The security         | from the vendor, with   |
|   |     | planning policy can be         | no modifications, and   |
|   |     | included as part of the        | be the version intended |
|   |     | general information security   | for use. For the FBCA,  |
|   |     | policy for the organization.   | the integrity of the    |
|   |     | Security planning procedures   | software shall be       |
|   |     | can be developed for the       | verified by the FPKI    |
|   |     | security program in general,   | Operational Authority   |
|   |     | and for a particular           | at least weekly (e.g.,  |
|   |     | information system, when       | in conjunction with CRL |
|   |     | required. NIST Special         | publication).           |
|   |     | Publication 800-18 provides    |                         |
|   |     | guidance on security planning. | 9.4.1 Privacy Plan      |
|   |     | NIST Special Publication       |                         |
|   |     | 800-12 provides guidance on    | The FPKI Operational    |
|   |     | security policies and          | Authority shall conduct |
|   |     | procedures.                    | a Privacy Impact        |
|   |     |                                | Assessment. If deemed   |
|   |     |                                | necessary, the FPKI     |
|   |     |                                | Operational Authority   |
|   |     |                                | shall have a Privacy    |
|   |     |                                | Plan to protect         |
|   |     |                                | personally identifying  |
|   |     |                                | information from        |
|   |     |                                | unauthorized            |
|   |     |                                | disclosure. The Federal |
|   |     |                                | PKI Policy Authority    |
|   |     |                                | shall approve the       |
|   |     |                                | Privacy Plan.           |
|   |     |                                |                         |
|   |     |                                | For Entity CAs, no      |
|   |     |                                | stipulation             |
|   |     |                                |                         |
|   |     |                                | 9.12.1: The Federal PKI |
|   |     |                                | Policy Authority shall  |
|   |     |                                | review this CP at least |
|   |     |                                | once every year.        |
|   |     |                                | Corrections, updates,   |
|   |     |                                | or suggested changes to |
|   |     |                                | this CP shall be        |
|   |     |                                | communicated to every   |
|   |     |                                | Entity Principal CA.    |
|   |     |                                | Such communication must |
|   |     |                                | include a description   |
|   |     |                                | of the change, a change |
|   |     |                                | justification, and      |
|   |     |                                | contact information for |
|   |     |                                | the person requesting   |
|   |     |                                | the change.             |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | NOT |                                |                         |
|   | C   |                                |                         |
|   | OMP |                                |                         |
|   | ARA |                                |                         |
|   | BLE |                                |                         |
|   | for |                                |                         |
|   | X-C |                                |                         |
|   | ERT |                                |                         |
|   | D** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 0 | L-2 |                                |                         |
| 7 |     | The organization develops and  | 6.6.2 Security          |
| . | SYS | implements a security plan for | Management Controls     |
|   | TEM | the information system that    |                         |
|   | SE  | provides an overview of the    | The configuration of    |
|   | CUR | security requirements for the  | the FBCA or Entity CA   |
|   | ITY | system and a description of    | system as well as any   |
|   | P   | the security controls in place | modifications and       |
|   | LAN | or planned for meeting those   | upgrades shall be       |
|   |     | requirements. Designated       | documented and          |
|   |     | officials within the           | controlled. There shall |
|   |     | organization review and        | be a mechanism for      |
|   |     | approve the plan.              | detecting unauthorized  |
|   |     |                                | modification to the     |
|   |     | Enhancements:                  | FBCA or Entity CA       |
|   |     |                                | software or             |
|   |     | None.                          | configuration. A formal |
|   |     |                                | configuration           |
|   |     | Supplemental Guidance:         | management methodology  |
|   |     |                                | shall be used for       |
|   |     | NIST Special Publication       | installation and        |
|   |     | 800-18 provides guidance on    | ongoing maintenance of  |
|   |     | security planning.             | the FBCA or Entity CA   |
|   |     |                                | system. The FBCA or     |
|   |     |                                | Entity CA software,     |
|   |     |                                | when first loaded,      |
|   |     |                                | shall be verified as    |
|   |     |                                | being that supplied     |
|   |     |                                | from the vendor, with   |
|   |     |                                | no modifications, and   |
|   |     |                                | be the version intended |
|   |     |                                | for use. For the FBCA,  |
|   |     |                                | the integrity of the    |
|   |     |                                | software shall be       |
|   |     |                                | verified by the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | at least weekly (e.g.,  |
|   |     |                                | in conjunction with CRL |
|   |     |                                | publication).           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 0 | L-3 |                                |                         |
| 8 |     | The organization reviews the   | 6.6.2 Security          |
| . | SYS | security plan for the          | Management Controls     |
|   | TEM | information system             |                         |
|   | SE  | *\[Assignment:                 | The configuration of    |
|   | CUR | organization-defined           | the FBCA or Entity CA   |
|   | ITY | frequency\]* and revises the   | system as well as any   |
|   | P   | plan to address                | modifications and       |
|   | LAN | system/organizational changes  | upgrades shall be       |
|   | UPD | or problems identified during  | documented and          |
|   | ATE | plan implementation or         | controlled. There shall |
|   |     | security control assessments.  | be a mechanism for      |
|   |     |                                | detecting unauthorized  |
|   |     | Enhancements:                  | modification to the     |
|   |     |                                | FBCA or Entity CA       |
|   |     | None.                          | software or             |
|   |     |                                | configuration. A formal |
|   |     | Supplemental Guidance:         | configuration           |
|   |     |                                | management methodology  |
|   |     | Significant changes are        | shall be used for       |
|   |     | defined in advance by the      | installation and        |
|   |     | organization and identified in | ongoing maintenance of  |
|   |     | the configuration management   | the FBCA or Entity CA   |
|   |     | process.                       | system. The FBCA or     |
|   |     |                                | Entity CA software,     |
|   |     |                                | when first loaded,      |
|   |     |                                | shall be verified as    |
|   |     |                                | being that supplied     |
|   |     |                                | from the vendor, with   |
|   |     |                                | no modifications, and   |
|   |     |                                | be the version intended |
|   |     |                                | for use. For the FBCA,  |
|   |     |                                | the integrity of the    |
|   |     |                                | software shall be       |
|   |     |                                | verified by the FPKI    |
|   |     |                                | Operational Authority   |
|   |     |                                | at least weekly (e.g.,  |
|   |     |                                | in conjunction with CRL |
|   |     |                                | publication).           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 0 | L-4 |                                |                         |
| 9 |     | The organization establishes   | ### 9                   |
| . | RU  | and makes readily available to | .6.3 Subscriber Represe |
|   | LES | all information system users a | ntations and Warranties |
|   | OF  | set of rules that describes    |                         |
|   | BE  | their responsibilities and     | For Basic Assurance     |
|   | HAV | expected behavior with regard  | level, the Subscriber   |
|   | IOR | to information and information | shall be required to    |
|   |     | system usage. The organization | acknowledge his or her  |
|   |     | receives signed                | obligations respecting  |
|   |     | acknowledgement from users     | protection of the       |
|   |     | indicating that they have      | private key and use of  |
|   |     | read, understand, and agree to | the certificate before  |
|   |     | abide by the rules of          | being issued the        |
|   |     | behavior, before authorizing   | certificate             |
|   |     | access to the information      |                         |
|   |     | system and its resident        |                         |
|   |     | information.                   |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Electronic signatures are      |                         |
|   |     | acceptable for use in          |                         |
|   |     | acknowledging rules of         |                         |
|   |     | behavior. NIST Special         |                         |
|   |     | Publication 800-18 provides    |                         |
|   |     | guidance on preparing rules of |                         |
|   |     | behavior.                      |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | L-5 |                                |                         |
| 0 |     | The organization conducts a    | 9.4.1 Privacy Plan      |
| . | P   | privacy impact assessment on   |                         |
|   | RIV | the information system.        | The FPKI Operational    |
|   | ACY |                                | Authority shall conduct |
|   | IMP | Enhancements:                  | a Privacy Impact        |
|   | ACT |                                | Assessment. If deemed   |
|   | A   | None.                          | necessary, the FPKI     |
|   | SSE |                                | Operational Authority   |
|   | SSM | Supplemental Guidance:         | shall have a Privacy    |
|   | ENT |                                | Plan to protect         |
|   |     | OMB Memorandum 03-22 provides  | personally identifying  |
|   |     | guidance for implementing the  | information from        |
|   |     | privacy provisions of the      | unauthorized            |
|   |     | E-Government Act of 2002. Only | disclosure. The Federal |
|   |     | those information systems      | PKI Policy Authority    |
|   |     | identified and/or covered by   | shall approve the       |
|   |     | OMB policy are required to     | Privacy Plan.           |
|   |     | have privacy impact            |                         |
|   |     | assessments. NIST Special      | For Entity CAs, no      |
|   |     | Publication 800-53 provides    | stipulation.            |
|   |     | tailoring guidance for         |                         |
|   |     | security control baselines to  |                         |
|   |     | ensure that the employment of  |                         |
|   |     | specific security controls is  |                         |
|   |     | consistent with applicable     |                         |
|   |     | federal laws, directives,      |                         |
|   |     | policies, regulations,         |                         |
|   |     | standards, and guidance.       |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | PAR |                                |                         |
|   | TIA |                                |                         |
|   | L** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | L-6 |                                |                         |
| 1 |     | The organization ensures that  |                         |
| . | S   | appropriate planning and       |                         |
|   | ECU | coordination occur before      |                         |
|   | RIT | conducting security-related    |                         |
|   | Y-R | activities affecting the       |                         |
|   | ELA | information system in order to |                         |
|   | TED | minimize the impact on         |                         |
|   | AC  | organizational operations      |                         |
|   | TIV | (i.e., mission, functions,     |                         |
|   | ITY | image, and reputation) and\    |                         |
|   | PL  | organizational assets.         |                         |
|   | ANN |                                |                         |
|   | ING | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | Routine security-related       |                         |
|   |     | activities include, but are    |                         |
|   |     | not limited to, security       |                         |
|   |     | assessments, audits, system    |                         |
|   |     | Hardware and software          |                         |
|   |     | maintenance, security          |                         |
|   |     | certifications, and            |                         |
|   |     | testing/exercises.             |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-1 |                                |                         |
| 2 |     | The organization develops,     | 5.3.1 Personnel         |
| . | PER | disseminates, and periodically | Controls                |
|   | SON | reviews/updates: (i) a formal, |                         |
|   | NEL | documented, personnel security | \[This section of the   |
|   | SE  | policy that addresses purpose, | FBCA CP applies in its  |
|   | CUR | scope, roles,                  | entirety\]              |
|   | ITY | responsibilities, management   |                         |
|   | POL | commitment, coordination among | 5.2 Procedural Controls |
|   | ICY | organizational entities, and   |                         |
|   | AND | compliance; and (ii) formal,   | \[This section of the   |
|   | P   | documented procedures to       | FBCA CP applies in its  |
|   | ROC | facilitate the implementation  | entirety\]              |
|   | EDU | of the personnel security      |                         |
|   | RES | policy and associated          |                         |
|   |     | personnel security controls.   |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The personnel security policy  |                         |
|   |     | and procedures are consistent  |                         |
|   |     | with applicable federal laws,  |                         |
|   |     | directives, policies,          |                         |
|   |     | regulations, standards, and    |                         |
|   |     | guidance. The personnel        |                         |
|   |     | security policy can be         |                         |
|   |     | included as part of the        |                         |
|   |     | general information security   |                         |
|   |     | policy for the organization.   |                         |
|   |     | Personnel security procedures  |                         |
|   |     | can be developed for the       |                         |
|   |     | security program in general,   |                         |
|   |     | and for a particular           |                         |
|   |     | information system, when       |                         |
|   |     | required. NIST Special         |                         |
|   |     | Publication 800-12 provides    |                         |
|   |     | guidance on security policies  |                         |
|   |     | and procedures.                |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-2 |                                |                         |
| 3 |     | The organization assigns a     | 5.3.1 Personnel         |
| . | PO  | risk designation to all        | Controls                |
|   | SIT | positions and establishes      |                         |
|   | ION | screening criteria for         | All persons filling     |
|   | CA  | individuals filling those      | trusted roles shall be  |
|   | TEG | positions. The organization    | selected on the basis   |
|   | ORI | reviews and revises position   | of loyalty,             |
|   | ZAT | risk designations              | trustworthiness, and    |
|   | ION | \[*Assignment:                 | integrity. For the FBCA |
|   |     | organization-defined           | and Federal Agency      |
|   |     | frequency*\].                  | PKIs, regardless of the |
|   |     |                                | assurance level, and    |
|   |     | Enhancements:                  | for state and local     |
|   |     |                                | government PKIs         |
|   |     | None.                          | operated in the U.S. at |
|   |     |                                | High Assurance, all     |
|   |     | Supplemental Guidance:         | trusted roles are       |
|   |     |                                | required to be held by  |
|   |     | Position risk designations are | U.S. citizens. For PKIs |
|   |     | consistent with 5 CFR          | operated at Medium      |
|   |     | 731.106(a) and Office of       | Assurance and Medium    |
|   |     | Personnel Management policy    | Hardware, all trusted   |
|   |     | and guidance.                  | roles must be held by   |
|   |     |                                | citizens of the country |
|   |     |                                | where the CA is         |
|   |     |                                | located. For PKIs       |
|   |     |                                | operated at Medium-CBP  |
|   |     |                                | and Medium              |
|   |     |                                | Hardware-CBP, there is  |
|   |     |                                | no citizenship          |
|   |     |                                | requirement specified.  |
|   |     |                                |                         |
|   |     |                                | 5.3.2 Background Check  |
|   |     |                                | Procedures              |
|   |     |                                |                         |
|   |     |                                | FPKI Operational        |
|   |     |                                | Authority personnel     |
|   |     |                                | acting in trusted roles |
|   |     |                                | shall, at a minimum,    |
|   |     |                                | undergo procedures      |
|   |     |                                | necessary to be cleared |
|   |     |                                | at the TOP SECRET level |
|   |     |                                |                         |
|   |     |                                | Entity CA personnel     |
|   |     |                                | shall, at a minimum,    |
|   |     |                                | pass a background       |
|   |     |                                | investigation covering  |
|   |     |                                | the following areas:    |
|   |     |                                |                         |
|   |     |                                | -   Employment;         |
|   |     |                                |                         |
|   |     |                                | -   Education;          |
|   |     |                                |                         |
|   |     |                                | -   Place of residence; |
|   |     |                                |                         |
|   |     |                                | -   Law Enforcement;    |
|   |     |                                |     and                 |
|   |     |                                |                         |
|   |     |                                | -   References.         |
|   |     |                                |                         |
|   |     |                                | The period of           |
|   |     |                                | investigation must      |
|   |     |                                | cover at least the last |
|   |     |                                | five years for each     |
|   |     |                                | area, excepting the     |
|   |     |                                | residence check which   |
|   |     |                                | must cover at least the |
|   |     |                                | last three years.       |
|   |     |                                | Regardless of the date  |
|   |     |                                | of award, the highest   |
|   |     |                                | educational degree      |
|   |     |                                | shall be verified.      |
|   |     |                                |                         |
|   |     |                                | Adjudication of the     |
|   |     |                                | background              |
|   |     |                                | investigation shall be  |
|   |     |                                | performed by a          |
|   |     |                                | competent adjudication  |
|   |     |                                | authority using a       |
|   |     |                                | process consistent with |
|   |     |                                | Executive Order 12968   |
|   |     |                                | August 1995, or         |
|   |     |                                | equivalent.             |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-3 |                                |                         |
| 4 |     | The organization screens       | 5.3.2 Background Check  |
| . | PER | individuals requiring access   | Procedures              |
|   | SON | to organizational information  |                         |
|   | NEL | and information systems before | FPKI Operational        |
|   | SCR | authorizing access.            | Authority personnel     |
|   | EEN |                                | acting in trusted roles |
|   | ING | Enhancements:                  | shall, at a minimum,    |
|   |     |                                | undergo procedures      |
|   |     | None.                          | necessary to be cleared |
|   |     |                                | at the TOP SECRET level |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                | Entity CA personnel     |
|   |     | Screening is consistent with:  | shall, at a minimum,    |
|   |     | (i) 5 CFR 731.106(a); (ii)     | pass a background       |
|   |     | Office of Personnel Management | investigation covering  |
|   |     | policy, regulations, and       | the following areas:    |
|   |     | guidance; (iii) organizational |                         |
|   |     | policy, regulations, and       | -   Employment;         |
|   |     | guidance; (iv) FIPS 201 and    |                         |
|   |     | Special Publications 800-73    | -   Education;          |
|   |     | and 800-76; and (v) the        |                         |
|   |     | criteria established for the   | -   Place of residence; |
|   |     | risk designation of the        |                         |
|   |     | assigned position.             | -   Law Enforcement;    |
|   |     |                                |     and                 |
|   |     |                                |                         |
|   |     |                                | -   References.         |
|   |     |                                |                         |
|   |     |                                | The period of           |
|   |     |                                | investigation must      |
|   |     |                                | cover at least the last |
|   |     |                                | five years for each     |
|   |     |                                | area, excepting the     |
|   |     |                                | residence check which   |
|   |     |                                | must cover at least the |
|   |     |                                | last three years.       |
|   |     |                                | Regardless of the date  |
|   |     |                                | of award, the highest   |
|   |     |                                | educational degree      |
|   |     |                                | shall be verified.      |
|   |     |                                |                         |
|   |     |                                | Adjudication of the     |
|   |     |                                | background              |
|   |     |                                | investigation shall be  |
|   |     |                                | performed by a          |
|   |     |                                | competent adjudication  |
|   |     |                                | authority using a       |
|   |     |                                | process consistent with |
|   |     |                                | Executive Order 12968   |
|   |     |                                | August 1995, or         |
|   |     |                                | equivalent.             |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-4 |                                |                         |
| 5 |     | When employment is terminated, |                         |
| . | PER | the organization terminates    |                         |
|   | SON | information system access,     |                         |
|   | NEL | conducts exit interviews,      |                         |
|   | TE  | ensures the return of all      |                         |
|   | RMI | organizational information     |                         |
|   | NAT | system-related property (e.g., |                         |
|   | ION | keys, identification cards,    |                         |
|   |     | building passes), and ensures  |                         |
|   |     | that appropriate personnel     |                         |
|   |     | have access to official        |                         |
|   |     | records created by the         |                         |
|   |     | terminated employee that are   |                         |
|   |     | stored on organizational       |                         |
|   |     | information systems.           |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | M   |                                |                         |
|   | ISS |                                |                         |
|   | ING |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-5 |                                |                         |
| 6 |     | The organization reviews       |                         |
| . | PER | information systems/facilities |                         |
|   | SON | access authorizations when     |                         |
|   | NEL | individuals are reassigned or  |                         |
|   | TR  | transferred to other positions |                         |
|   | ANS | within the organization and    |                         |
|   | FER | initiates appropriate actions  |                         |
|   |     | (e.g., reissuing keys,         |                         |
|   |     | identification cards, building |                         |
|   |     | passes; closing old accounts   |                         |
|   |     | and establishing new accounts; |                         |
|   |     | and changing system access     |                         |
|   |     | authorizations).               |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | MIS |                                |                         |
|   | SIN |                                |                         |
|   | G** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-6 |                                |                         |
| 7 |     | The organization completes     | 3.  Subscriber          |
| . | ACC | appropriate access agreements  |     Representations and |
|   | ESS | (e.g., nondisclosure           |     Warranties          |
|   | A   | agreements, acceptable use     |                         |
|   | GRE | agreements, rules of behavior, | For Medium, Medium      |
|   | EME | conflict-of-interest           | Hardware, and High      |
|   | NTS | agreements) for individuals    | Assurance levels, a     |
|   |     | requiring access to            | Subscriber shall be     |
|   |     | organizational information and | required to sign a      |
|   |     | information systems before     | document containing the |
|   |     | authorizing access and         | requirements the        |
|   |     | reviews/updates the agreements | Subscriber shall meet   |
|   |     | \[Assignment:                  | respecting protection   |
|   |     | organization-defined           | of the private key and  |
|   |     | frequency\].                   | use of the certificate  |
|   |     |                                | before being issued the |
|   |     | Enhancements:                  | certificate. For Basic  |
|   |     |                                | Assurance level, the    |
|   |     | None.                          | Subscriber shall be     |
|   |     |                                | required to acknowledge |
|   |     | Supplemental Guidance:         | his or her obligations  |
|   |     |                                | respecting protection   |
|   |     | None.                          | of the private key and  |
|   |     |                                | use of the certificate  |
|   |     |                                | before being issued the |
|   |     |                                | certificate.            |
|   |     |                                |                         |
|   |     |                                | Subscribers of Entity   |
|   |     |                                | CAs at Basic, Medium,   |
|   |     |                                | and High Assurance      |
|   |     |                                | Levels shall agree to   |
|   |     |                                | the following:          |
|   |     |                                |                         |
|   |     |                                | -   Accurately          |
|   |     |                                |     represent           |
|   |     |                                |     themselves in all   |
|   |     |                                |     communications with |
|   |     |                                |     the PKI             |
|   |     |                                |     authorities.        |
|   |     |                                |                         |
|   |     |                                | -   Protect their       |
|   |     |                                |     private keys at all |
|   |     |                                |     times, in           |
|   |     |                                |     accordance with     |
|   |     |                                |     this policy, as     |
|   |     |                                |     stipulated in their |
|   |     |                                |     certificate         |
|   |     |                                |     acceptance          |
|   |     |                                |     agreements and      |
|   |     |                                |     local procedures.   |
|   |     |                                |                         |
|   |     |                                | -   Promptly notify the |
|   |     |                                |     appropriate CA upon |
|   |     |                                |     suspicion of loss   |
|   |     |                                |     or compromise of    |
|   |     |                                |     their private keys. |
|   |     |                                |     Such notification   |
|   |     |                                |     shall be made       |
|   |     |                                |     directly or         |
|   |     |                                |     indirectly through  |
|   |     |                                |     mechanisms          |
|   |     |                                |     consistent with the |
|   |     |                                |     CA's CPS.           |
|   |     |                                |                         |
|   |     |                                | Abide by all the terms, |
|   |     |                                | conditions, and         |
|   |     |                                | restrictions levied on  |
|   |     |                                | the use of their        |
|   |     |                                | private keys and        |
|   |     |                                | certificates.           |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+
| 1 | P   | Control:                       | FBCA Section:           |
| 1 | S-7 |                                |                         |
| 8 |     | The organization establishes   | 5.3.7 Independent       |
| . | TH  | personnel security             | Contractor Requirements |
|   | IRD | requirements including         |                         |
|   | -PA | security roles and             | Contractor personnel    |
|   | RTY | responsibilities, for          | employed to perform     |
|   | PER | third-party providers (e.g.,   | functions pertaining to |
|   | SON | service bureaus, contractors,  | the FBCA or an Entity   |
|   | NEL | and other organizations        | CA shall meet the       |
|   | SE  | providing information system   | personnel requirements  |
|   | CUR | development, information       | set forth in the FBCA   |
|   | ITY | technology services,           | CP or Entity CP, as     |
|   |     | outsourced applications,       | applicable.             |
|   |     | network and security           |                         |
|   |     | management) and monitors       |                         |
|   |     | provider compliance to ensure  |                         |
|   |     | adequate security.             |                         |
|   |     |                                |                         |
|   |     | Enhancements:                  |                         |
|   |     |                                |                         |
|   |     | None.                          |                         |
|   |     |                                |                         |
|   |     | Supplemental Guidance:         |                         |
|   |     |                                |                         |
|   |     | The organization explicitly    |                         |
|   |     | includes personnel security    |                         |
|   |     | requirements in                |                         |
|   |     | acquisition-related documents. |                         |
|   |     | NIST Special Publication       |                         |
|   |     | 800-35 provides guidance on    |                         |
|   |     | information technology         |                         |
|   |     | security services.             |                         |
+---+-----+--------------------------------+-------------------------+
|   | O   | Comments:                      |                         |
|   | ver |                                |                         |
|   | all |                                |                         |
|   | Mat |                                |                         |
|   | ch: |                                |                         |
|   |     |                                |                         |
|   | **  |                                |                         |
|   | COM |                                |                         |
|   | PAR |                                |                         |
|   | ABL |                                |                         |
|   | E** |                                |                         |
+---+-----+--------------------------------+-------------------------+

+---+-----+-----------------------------+---+-------------------------+
| 1 | P   | Control:                    |   | FBCA Section:           |
| 1 | S-8 |                             |   |                         |
| 9 |     | The organization employs a  |   | 5.3.6 Sanctions for     |
| . | PER | formal sanctions process    |   | Unauthorized Actions    |
|   | SON | for personnel failing to    |   |                         |
|   | NEL | comply with established     |   | The FPKI Operational    |
|   | SAN | information security        |   | Authority shall take    |
|   | CTI | policies and procedures.    |   | appropriate actions     |
|   | ONS |                             |   | where personnel have    |
|   |     | Enhancements:               |   | performed actions       |
|   |     |                             |   | involving the FBCA or   |
|   |     | None.                       |   | its repository not      |
|   |     |                             |   | authorized in this CP,  |
|   |     | Supplemental Guidance:      |   | the FBCA CPS, or other  |
|   |     |                             |   | procedures published by |
|   |     | The sanctions process is    |   | the FPKI Operational    |
|   |     | consistent with applicable  |   | Authority.              |
|   |     | federal laws, directives,   |   |                         |
|   |     | policies, regulations,      |   | For Entity CAs, no      |
|   |     | standards, and guidance.    |   | stipulation             |
|   |     | The sanctions process can   |   |                         |
|   |     | be included as part of the  |   |                         |
|   |     | general personnel policies  |   |                         |
|   |     | and procedures for the      |   |                         |
|   |     | organization.               |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | PAR |                             |   |                         |
|   | TIA |                             |   |                         |
|   | L** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | R   | Control:                    |   | FBCA Section:           |
| 2 | A-1 |                             |   |                         |
| 0 |     | The organization develops,  |   | ### 1.4.1 Approp        |
| . | R   | disseminates, and           |   | riate Certificate Uses  |
|   | ISK | periodically                |   |                         |
|   | A   | reviews/updates: (i) a      |   | The sensitivity of the  |
|   | SSE | formal, documented risk     |   | information processed   |
|   | SSM | assessment policy that      |   | or protected using      |
|   | ENT | addresses purpose, scope,   |   | certificates issued by  |
|   | POL | roles, responsibilities,    |   | FBCA or an Entity CA    |
|   | ICY | management commitment,      |   | will vary               |
|   | AND | coordination among          |   | significantly. Relying  |
|   | P   | organizational entities,    |   | Parties must evaluate   |
|   | ROC | and compliance; and (ii)    |   | the environment and the |
|   | EDU | formal, documented          |   | associated threats and  |
|   | RES | procedures to facilitate    |   | vulnerabilities and     |
|   |     | the implementation of the   |   | determine the level of  |
|   |     | risk assessment policy and  |   | risk they are willing   |
|   |     | associated risk assessment  |   | to accept based on the  |
|   |     | controls.                   |   | sensitivity or          |
|   |     |                             |   | significance of the     |
|   |     | Enhancements:               |   | information. This       |
|   |     |                             |   | evaluation is done by   |
|   |     | None.                       |   | each Relying Party for  |
|   |     |                             |   | its application and is  |
|   |     | Supplemental Guidance:      |   | not controlled by this  |
|   |     |                             |   | CP. To provide          |
|   |     | The risk assessment policy  |   | sufficient granularity, |
|   |     | and procedures are          |   | this CP specifies       |
|   |     | consistent with applicable  |   | security requirements   |
|   |     | federal laws, directives,   |   | at five increasing,     |
|   |     | policies, regulations,      |   | qualitative levels of   |
|   |     | standards, and guidance.    |   | assurance: Rudimentary, |
|   |     | The risk assessment policy  |   | Basic, Medium, Medium   |
|   |     | can be included as part of  |   | Hardware, and High.     |
|   |     | the general information     |   |                         |
|   |     | security policy for the     |   |                         |
|   |     | organization. Risk          |   |                         |
|   |     | assessment procedures can   |   |                         |
|   |     | be developed for the        |   |                         |
|   |     | security program in         |   |                         |
|   |     | general, and for a          |   |                         |
|   |     | particular information      |   |                         |
|   |     | system, when required. NIST |   |                         |
|   |     | Special Publications 800-30 |   |                         |
|   |     | provides guidance on the    |   |                         |
|   |     | assessment of risk. NIST    |   |                         |
|   |     | Special Publication 800-12  |   |                         |
|   |     | provides guidance on        |   |                         |
|   |     | security policies and       |   |                         |
|   |     | procedures.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | NOT |                             |   |                         |
|   | C   |                             |   |                         |
|   | OMP |                             |   |                         |
|   | ARA |                             |   |                         |
|   | BLE |                             |   |                         |
|   | for |                             |   |                         |
|   | X-C |                             |   |                         |
|   | ERT |                             |   |                         |
|   | D** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | R   | Control:                    |   | FBCA Section:           |
| 2 | A-2 |                             |   |                         |
| 1 |     | The organization            |   | ### 1.4.1 Approp        |
| . | SE  | categorizes the information |   | riate Certificate Uses  |
|   | CUR | system and the information  |   |                         |
|   | ITY | processed, stored, or       |   | The sensitivity of the  |
|   | CA  | transmitted by the system   |   | information processed   |
|   | TEG | in accordance with FIPS 199 |   | or protected using      |
|   | ORI | and documents the results   |   | certificates issued by  |
|   | ZAT | (including supporting       |   | FBCA or an Entity CA    |
|   | ION | rationale) in the system    |   | will vary               |
|   |     | security plan. Designated   |   | significantly. Relying  |
|   |     | senior-level officials      |   | Parties must evaluate   |
|   |     | within the organization     |   | the environment and the |
|   |     | review and approve the      |   | associated threats and  |
|   |     | security categorizations.   |   | vulnerabilities and     |
|   |     |                             |   | determine the level of  |
|   |     | Enhancements:               |   | risk they are willing   |
|   |     |                             |   | to accept based on the  |
|   |     | None.                       |   | sensitivity or          |
|   |     |                             |   | significance of the     |
|   |     | Supplemental Guidance:      |   | information. This       |
|   |     |                             |   | evaluation is done by   |
|   |     | NIST Special Publication    |   | each Relying Party for  |
|   |     | 800-60 provides guidance on |   | its application and is  |
|   |     | determining the security    |   | not controlled by this  |
|   |     | categories of the           |   | CP. To provide          |
|   |     | information types resident  |   | sufficient granularity, |
|   |     | on the information system.  |   | this CP specifies       |
|   |     | The organization conducts   |   | security requirements   |
|   |     | security categorizations as |   | at five increasing,     |
|   |     | an organization-wide        |   | qualitative levels of   |
|   |     | activity with the           |   | assurance: Rudimentary, |
|   |     | involvement of the chief    |   | Basic, Medium, Medium   |
|   |     | information officer, senior |   | Hardware, and High.     |
|   |     | agency information security |   |                         |
|   |     | officer, information system |   |                         |
|   |     | owners, and information     |   |                         |
|   |     | owners.                     |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
|   |     |                             |   |                         |
|   | **C |                             |   |                         |
|   | OMP |                             |   |                         |
|   | ARA |                             |   |                         |
|   | BLE |                             |   |                         |
|   | for |                             |   |                         |
|   | X-C |                             |   |                         |
|   | ERT |                             |   |                         |
|   | D** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | R   | Control:                    |   | FBCA Section:           |
| 2 | A-3 |                             |   |                         |
| 2 |     | The organization conducts   |   | ### 1.4.1 Approp        |
| . | R   | assessments of the risk and |   | riate Certificate Uses  |
|   | ISK | magnitude of harm that      |   |                         |
|   | A   | could result from the       |   | The sensitivity of the  |
|   | SSE | unauthorized access, use,   |   | information processed   |
|   | SSM | disclosure, disruption,     |   | or protected using      |
|   | ENT | modification, or            |   | certificates issued by  |
|   |     | destruction of information  |   | FBCA or an Entity CA    |
|   |     | and information systems     |   | will vary               |
|   |     | that support the operations |   | significantly. Relying  |
|   |     | and assets of the agency    |   | Parties must evaluate   |
|   |     | (including information and  |   | the environment and the |
|   |     | information systems         |   | associated threats and  |
|   |     | managed/operated by         |   | vulnerabilities and     |
|   |     | external parties).          |   | determine the level of  |
|   |     |                             |   | risk they are willing   |
|   |     | Enhancements:               |   | to accept based on the  |
|   |     |                             |   | sensitivity or          |
|   |     | None.                       |   | significance of the     |
|   |     |                             |   | information. This       |
|   |     | Supplemental Guidance:      |   | evaluation is done by   |
|   |     |                             |   | each Relying Party for  |
|   |     | Risk assessments take into  |   | its application and is  |
|   |     | account vulnerabilities,    |   | not controlled by this  |
|   |     | threat sources, and         |   | CP. To provide          |
|   |     | security controls planned   |   | sufficient granularity, |
|   |     | or in place to determine    |   | this CP specifies       |
|   |     | the resulting level of      |   | security requirements   |
|   |     | residual risk posed to      |   | at five increasing,     |
|   |     | organizational operations,  |   | qualitative levels of   |
|   |     | organizational assets, or   |   | assurance: Rudimentary, |
|   |     | individuals based on the    |   | Basic, Medium, Medium   |
|   |     | operation of the            |   | Hardware, and High.     |
|   |     | information system. Risk    |   |                         |
|   |     | assessments also take into  |   |                         |
|   |     | account risk posed to       |   |                         |
|   |     | organizational operations,  |   |                         |
|   |     | organizational assets, or   |   |                         |
|   |     | individuals from external   |   |                         |
|   |     | parties (e.g., service      |   |                         |
|   |     | providers, contractors      |   |                         |
|   |     | operating information       |   |                         |
|   |     | systems on behalf of the    |   |                         |
|   |     | organization, individuals   |   |                         |
|   |     | accessing organizational    |   |                         |
|   |     | information systems,        |   |                         |
|   |     | outsourcing entities). NIST |   |                         |
|   |     | Special Publication 800-30  |   |                         |
|   |     | provides guidance on        |   |                         |
|   |     | conducting risk assessments |   |                         |
|   |     | including threat,           |   |                         |
|   |     | vulnerability, and impact   |   |                         |
|   |     | assessments.                |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | MIS |                             |   |                         |
|   | SIN |                             |   |                         |
|   | G** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | R   | Control:                    |   | FBCA Section:           |
| 2 | A-4 |                             |   |                         |
| 3 |     | The organization updates    |   | ###                     |
| . | R   | the risk assessment         |   |                         |
|   | ISK | *\[Assignment:              |   | ### 1.4.1 Approp        |
|   | A   | organization-defined        |   | riate Certificate Uses  |
|   | SSE | frequency\]* or whenever    |   |                         |
|   | SSM | there are significant       |   | The sensitivity of the  |
|   | ENT | changes to the information  |   | information processed   |
|   | UPD | system, the facilities      |   | or protected using      |
|   | ATE | where the system resides,   |   | certificates issued by  |
|   |     | or other conditions that    |   | FBCA or an Entity CA    |
|   |     | may impact the security or  |   | will vary               |
|   |     | accreditation status of the |   | significantly. Relying  |
|   |     | system.                     |   | Parties must evaluate   |
|   |     |                             |   | the environment and the |
|   |     | Enhancements:               |   | associated threats and  |
|   |     |                             |   | vulnerabilities and     |
|   |     | None.                       |   | determine the level of  |
|   |     |                             |   | risk they are willing   |
|   |     | Supplemental Guidance:      |   | to accept based on the  |
|   |     |                             |   | sensitivity or          |
|   |     | The organization develops   |   | significance of the     |
|   |     | and documents specific      |   | information. This       |
|   |     | criteria for what is        |   | evaluation is done by   |
|   |     | considered significant      |   | each Relying Party for  |
|   |     | change to the information   |   | its application and is  |
|   |     | system. NIST Special        |   | not controlled by this  |
|   |     | Publication 800-30 provides |   | CP. To provide          |
|   |     | guidance on conducting risk |   | sufficient granularity, |
|   |     | assessment updates.         |   | this CP specifies       |
|   |     |                             |   | security requirements   |
|   |     |                             |   | at five increasing,     |
|   |     |                             |   | qualitative levels of   |
|   |     |                             |   | assurance: Rudimentary, |
|   |     |                             |   | Basic, Medium, Medium   |
|   |     |                             |   | Hardware, and High.     |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | MIS |                             |   |                         |
|   | SIN |                             |   |                         |
|   | G** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | R   | Control:                    |   | FBCA Section:           |
| 2 | A-5 |                             |   |                         |
| 4 |     | The organization scans for  |   | ### 5.4.8 Vu            |
| . | V   | vulnerabilities in the      |   | lnerability Assessments |
|   | ULN | information system          |   |                         |
|   | ERA | \[*Assignment:              |   | FBCA personnel shall    |
|   | BIL | organization-defined        |   | routinely assess        |
|   | ITY | frequency*\] or when        |   | whether the CA system   |
|   | SC  | significant new             |   | or its components have  |
|   | ANN | vulnerabilities affecting   |   | been attacked or        |
|   | ING | the system are identified   |   | breached.               |
|   |     | and reported.               |   |                         |
|   |     |                             |   | For Entity CAs,         |
|   |     | Enhancements:               |   | personnel shall perform |
|   |     |                             |   | routine assessments for |
|   |     | \(1\) Vulnerability         |   | evidence of malicious   |
|   |     | scanning tools include the  |   | activity.               |
|   |     | capability to readily       |   |                         |
|   |     | update the list of          |   | 5.4.2 Frequency of      |
|   |     | information system\         |   | Processing Log          |
|   |     | vulnerabilities scanned.\   |   |                         |
|   |     | (2) The organization        |   | Audit logs shall be     |
|   |     | updates the list of         |   | reviewed in accordance  |
|   |     | information system          |   | to the table below.     |
|   |     | vulnerabilities scanned     |   | Such reviews involve    |
|   |     | \[Assignment:\              |   | verifying that the log  |
|   |     | organization-defined        |   | has not been tampered   |
|   |     | frequency\] or when         |   | with, and then briefly  |
|   |     | significant new             |   | inspecting all log      |
|   |     | vulnerabilities are         |   | entries, with a more    |
|   |     | identified and reported.\   |   | thorough investigation  |
|   |     | (3) Vulnerability scanning  |   | of any alerts or        |
|   |     | procedures include means to |   | irregularities in the   |
|   |     | ensure adequate scan        |   | logs. Actions taken as  |
|   |     | coverage, both\             |   | a result of these       |
|   |     | vulnerabilities checked and |   | reviews shall be        |
|   |     | information system          |   | documented              |
|   |     | components scanned.         |   |                         |
|   |     |                             |   | 6.6.1 System            |
|   |     | Supplemental Guidance:      |   | Development Controls    |
|   |     |                             |   |                         |
|   |     | Vulnerability scanning is   |   | -   Proper care shall   |
|   |     | conducted using appropriate |   |     be taken to prevent |
|   |     | scanning tools and          |   |     malicious software  |
|   |     | techniques. The             |   |     from being loaded   |
|   |     | organization trains         |   |     onto the CA         |
|   |     | selected personnel in the   |   |     equipment. Hardware |
|   |     | use and maintenance of      |   |     and software shall  |
|   |     | vulnerability scanning      |   |     be scanned for      |
|   |     | tools and techniques.       |   |     malicious code on   |
|   |     | Vulnerability scans are     |   |     first use and       |
|   |     | scheduled and/or random in  |   |     periodically        |
|   |     | accordance with             |   |     thereafter.         |
|   |     | organizational policy and   |   |                         |
|   |     | assessment of risk. The     |   |                         |
|   |     | information obtained from   |   |                         |
|   |     | the vulnerability scanning  |   |                         |
|   |     | process is freely shared    |   |                         |
|   |     | with appropriate personnel  |   |                         |
|   |     | throughout the organization |   |                         |
|   |     | to help eliminate similar   |   |                         |
|   |     | vulnerabilities in other    |   |                         |
|   |     | information systems.        |   |                         |
|   |     | Vulnerability analysis for  |   |                         |
|   |     | custom software and         |   |                         |
|   |     | applications may require    |   |                         |
|   |     | additional, more            |   |                         |
|   |     | specialized approaches      |   |                         |
|   |     | (e.g., vulnerability        |   |                         |
|   |     | scanning tools for          |   |                         |
|   |     | applications, source code   |   |                         |
|   |     | reviews, static analysis of |   |                         |
|   |     | source code). NIST Special  |   |                         |
|   |     | Publication 800-42 provides |   |                         |
|   |     | guidance on network         |   |                         |
|   |     | security testing. NIST      |   |                         |
|   |     | Special Publication 800-40  |   |                         |
|   |     | (version 2) provides        |   |                         |
|   |     | guidance on patch and       |   |                         |
|   |     | vulnerability management.   |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 2 | A-1 |                             |   |                         |
| 5 |     | The organization develops,  |   | 6.6.1 System            |
| . | SYS | disseminates, and           |   | Development Controls    |
|   | TEM | periodically                |   |                         |
|   | AND | reviews/updates: (i) a      |   | The System Development  |
|   | SE  | formal, documented, system  |   | Controls for the FBCA   |
|   | RVI | and services acquisition    |   | and Entity CAs at the   |
|   | CES | policy that addresses       |   | Basic Assurance level   |
|   | AC  | purpose, scope, roles,      |   | and above are as        |
|   | QUI | responsibilities,           |   | follows:                |
|   | SIT | management commitment,      |   |                         |
|   | ION | coordination among          |   | -   For commercial      |
|   | POL | organizational entities,    |   |     off-the-shelf       |
|   | ICY | and compliance; and (ii)    |   |     software, the       |
|   | AND | formal, documented          |   |     software shall be   |
|   | P   | procedures to facilitate    |   |     designed and        |
|   | ROC | the implementation of the   |   |     developed under a   |
|   | EDU | system and services         |   |     formal, documented  |
|   | RES | acquisition policy and      |   |     development         |
|   |     | associated system and       |   |     methodology.        |
|   |     | services acquisition        |   |                         |
|   |     | controls.                   |   | -   For hardware and    |
|   |     |                             |   |     software developed  |
|   |     | Enhancements:               |   |     specifically for a  |
|   |     |                             |   |     particular CA, the  |
|   |     | None.                       |   |     applicant shall     |
|   |     |                             |   |     demonstrate that    |
|   |     | Supplemental Guidance:      |   |     security            |
|   |     |                             |   |     requirements were   |
|   |     | The system and services     |   |     achieved through a  |
|   |     | acquisition policy and      |   |     combination of      |
|   |     | procedures are consistent   |   |     software            |
|   |     | with applicable federal     |   |     verification &      |
|   |     | laws, directives, policies, |   |     validation,         |
|   |     | regulations, standards, and |   |     structured          |
|   |     | guidance. The system and    |   |     development         |
|   |     | services acquisition policy |   |     approach, and       |
|   |     | can be included as part of  |   |     controlled          |
|   |     | the general information     |   |     development         |
|   |     | security policy for the     |   |     environment.        |
|   |     | organization. System and    |   |                         |
|   |     | services acquisition        |   | -   Where open source   |
|   |     | procedures can be developed |   |     software has been   |
|   |     | for the security program in |   |     utilized, the       |
|   |     | general, and for a          |   |     applicant shall     |
|   |     | particular information      |   |     demonstrate that    |
|   |     | system, when required. NIST |   |     security            |
|   |     | Special Publication 800-12  |   |     requirements were   |
|   |     | provides guidance on        |   |     achieved through    |
|   |     | security policies and       |   |     software            |
|   |     | procedures.                 |   |     verification &      |
|   |     |                             |   |     validation and      |
|   |     |                             |   |     structured          |
|   |     |                             |   |                         |
|   |     |                             |   |  development/life-cycle |
|   |     |                             |   |     management.         |
|   |     |                             |   |                         |
|   |     |                             |   | -   Hardware and        |
|   |     |                             |   |     software procured   |
|   |     |                             |   |     to operate the CA   |
|   |     |                             |   |     shall be purchased  |
|   |     |                             |   |     and shipped in a    |
|   |     |                             |   |     fashion to reduce   |
|   |     |                             |   |     the likelihood that |
|   |     |                             |   |     any particular      |
|   |     |                             |   |     component was       |
|   |     |                             |   |     tampered with       |
|   |     |                             |   |     (e.g., by ensuring  |
|   |     |                             |   |     the equipment was   |
|   |     |                             |   |     randomly selected   |
|   |     |                             |   |     at time of          |
|   |     |                             |   |     purchase).          |
|   |     |                             |   |                         |
|   |     |                             |   | -   The CA hardware and |
|   |     |                             |   |     software shall be   |
|   |     |                             |   |     dedicated to        |
|   |     |                             |   |     performing one      |
|   |     |                             |   |     task: the CA. There |
|   |     |                             |   |     shall be no other   |
|   |     |                             |   |     applications;       |
|   |     |                             |   |     hardware devices,   |
|   |     |                             |   |     network             |
|   |     |                             |   |     connections, or     |
|   |     |                             |   |     component software  |
|   |     |                             |   |     installed which are |
|   |     |                             |   |     not part of the CA  |
|   |     |                             |   |     operation.          |
|   |     |                             |   |                         |
|   |     |                             |   | -   Proper care shall   |
|   |     |                             |   |     be taken to prevent |
|   |     |                             |   |     malicious software  |
|   |     |                             |   |     from being loaded   |
|   |     |                             |   |     onto the CA         |
|   |     |                             |   |     equipment. Hardware |
|   |     |                             |   |     and software shall  |
|   |     |                             |   |     be scanned for      |
|   |     |                             |   |     malicious code on   |
|   |     |                             |   |     first use and       |
|   |     |                             |   |     periodically        |
|   |     |                             |   |     thereafter.         |
|   |     |                             |   |                         |
|   |     |                             |   | -   Hardware and        |
|   |     |                             |   |     software updates    |
|   |     |                             |   |     shall be purchased  |
|   |     |                             |   |     or developed in the |
|   |     |                             |   |     same manner as      |
|   |     |                             |   |     original equipment, |
|   |     |                             |   |     and be installed by |
|   |     |                             |   |     trusted and trained |
|   |     |                             |   |     personnel in a      |
|   |     |                             |   |     defined manner.     |
|   |     |                             |   |                         |
|   |     |                             |   | 6.6.2 Security          |
|   |     |                             |   | Management Controls     |
|   |     |                             |   |                         |
|   |     |                             |   | The configuration of    |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system as well as any   |
|   |     |                             |   | modifications and       |
|   |     |                             |   | upgrades shall be       |
|   |     |                             |   | documented and          |
|   |     |                             |   | controlled. There shall |
|   |     |                             |   | be a mechanism for      |
|   |     |                             |   | detecting unauthorized  |
|   |     |                             |   | modification to the     |
|   |     |                             |   | FBCA or Entity CA       |
|   |     |                             |   | software or             |
|   |     |                             |   | configuration. A formal |
|   |     |                             |   | configuration           |
|   |     |                             |   | management methodology  |
|   |     |                             |   | shall be used for       |
|   |     |                             |   | installation and        |
|   |     |                             |   | ongoing maintenance of  |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system. The FBCA or     |
|   |     |                             |   | Entity CA software,     |
|   |     |                             |   | when first loaded,      |
|   |     |                             |   | shall be verified as    |
|   |     |                             |   | being that supplied     |
|   |     |                             |   | from the vendor, with   |
|   |     |                             |   | no modifications, and   |
|   |     |                             |   | be the version intended |
|   |     |                             |   | for use. For the FBCA,  |
|   |     |                             |   | the integrity of the    |
|   |     |                             |   | software shall be       |
|   |     |                             |   | verified by the FPKI    |
|   |     |                             |   | Operational Authority   |
|   |     |                             |   | at least weekly (e.g.,  |
|   |     |                             |   | in conjunction with CRL |
|   |     |                             |   | publication).           |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | N/A |                             |   |                         |
|   | for |                             |   |                         |
|   | X-C |                             |   |                         |
|   | ERT |                             |   |                         |
|   | D** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 2 | A-2 |                             |   |                         |
| 6 |     | The organization            |   | 6.6.1 System            |
| . | A   | determines, documents, and  |   | Development Controls    |
|   | LLO | allocates as part of its    |   |                         |
|   | CAT | capital planning and        |   | The System Development  |
|   | ION | investment control process  |   | Controls for the FBCA   |
|   | OF  | the resources required to   |   | and Entity CAs at the   |
|   | RES | adequately protect the      |   | Basic Assurance level   |
|   | OUR | information system.         |   | and above are as        |
|   | CES |                             |   | follows:                |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   | -   For commercial      |
|   |     | None.                       |   |     off-the-shelf       |
|   |     |                             |   |     software, the       |
|   |     | Supplemental Guidance:      |   |     software shall be   |
|   |     |                             |   |     designed and        |
|   |     | The organization includes   |   |     developed under a   |
|   |     | the determination of        |   |     formal, documented  |
|   |     | security requirements for   |   |     development         |
|   |     | the information system in   |   |     methodology.        |
|   |     | mission/business case       |   |                         |
|   |     | planning and establishes a  |   | -   For hardware and    |
|   |     | discrete line item for      |   |     software developed  |
|   |     | information system security |   |     specifically for a  |
|   |     | in the organization's       |   |     particular CA, the  |
|   |     | programming and budgeting   |   |     applicant shall     |
|   |     | documentation. NIST Special |   |     demonstrate that    |
|   |     | Publication 800-65 provides |   |     security            |
|   |     | guidance on integrating     |   |     requirements were   |
|   |     | security into the capital   |   |     achieved through a  |
|   |     | planning and investment     |   |     combination of      |
|   |     | control process.            |   |     software            |
|   |     |                             |   |     verification &      |
|   |     |                             |   |     validation,         |
|   |     |                             |   |     structured          |
|   |     |                             |   |     development         |
|   |     |                             |   |     approach, and       |
|   |     |                             |   |     controlled          |
|   |     |                             |   |     development         |
|   |     |                             |   |     environment.        |
|   |     |                             |   |                         |
|   |     |                             |   | -   Where open source   |
|   |     |                             |   |     software has been   |
|   |     |                             |   |     utilized, the       |
|   |     |                             |   |     applicant shall     |
|   |     |                             |   |     demonstrate that    |
|   |     |                             |   |     security            |
|   |     |                             |   |     requirements were   |
|   |     |                             |   |     achieved through    |
|   |     |                             |   |     software            |
|   |     |                             |   |     verification &      |
|   |     |                             |   |     validation and      |
|   |     |                             |   |     structured          |
|   |     |                             |   |                         |
|   |     |                             |   |  development/life-cycle |
|   |     |                             |   |     management.         |
|   |     |                             |   |                         |
|   |     |                             |   | -   Hardware and        |
|   |     |                             |   |     software procured   |
|   |     |                             |   |     to operate the CA   |
|   |     |                             |   |     shall be purchased  |
|   |     |                             |   |     and shipped in a    |
|   |     |                             |   |     fashion to reduce   |
|   |     |                             |   |     the likelihood that |
|   |     |                             |   |     any particular      |
|   |     |                             |   |     component was       |
|   |     |                             |   |     tampered with       |
|   |     |                             |   |     (e.g., by ensuring  |
|   |     |                             |   |     the equipment was   |
|   |     |                             |   |     randomly selected   |
|   |     |                             |   |     at time of          |
|   |     |                             |   |     purchase).          |
|   |     |                             |   |                         |
|   |     |                             |   | -   The CA hardware and |
|   |     |                             |   |     software shall be   |
|   |     |                             |   |     dedicated to        |
|   |     |                             |   |     performing one      |
|   |     |                             |   |     task: the CA. There |
|   |     |                             |   |     shall be no other   |
|   |     |                             |   |     applications;       |
|   |     |                             |   |     hardware devices,   |
|   |     |                             |   |     network             |
|   |     |                             |   |     connections, or     |
|   |     |                             |   |     component software  |
|   |     |                             |   |     installed which are |
|   |     |                             |   |     not part of the CA  |
|   |     |                             |   |     operation.          |
|   |     |                             |   |                         |
|   |     |                             |   | -   Proper care shall   |
|   |     |                             |   |     be taken to prevent |
|   |     |                             |   |     malicious software  |
|   |     |                             |   |     from being loaded   |
|   |     |                             |   |     onto the CA         |
|   |     |                             |   |     equipment. Hardware |
|   |     |                             |   |     and software shall  |
|   |     |                             |   |     be scanned for      |
|   |     |                             |   |     malicious code on   |
|   |     |                             |   |     first use and       |
|   |     |                             |   |     periodically        |
|   |     |                             |   |     thereafter.         |
|   |     |                             |   |                         |
|   |     |                             |   | -   Hardware and        |
|   |     |                             |   |     software updates    |
|   |     |                             |   |     shall be purchased  |
|   |     |                             |   |     or developed in the |
|   |     |                             |   |     same manner as      |
|   |     |                             |   |     original equipment, |
|   |     |                             |   |     and be installed by |
|   |     |                             |   |     trusted and trained |
|   |     |                             |   |     personnel in a      |
|   |     |                             |   |     defined manner.     |
|   |     |                             |   |                         |
|   |     |                             |   | 6.6.2 Security          |
|   |     |                             |   | Management Controls     |
|   |     |                             |   |                         |
|   |     |                             |   | The configuration of    |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system as well as any   |
|   |     |                             |   | modifications and       |
|   |     |                             |   | upgrades shall be       |
|   |     |                             |   | documented and          |
|   |     |                             |   | controlled. There shall |
|   |     |                             |   | be a mechanism for      |
|   |     |                             |   | detecting unauthorized  |
|   |     |                             |   | modification to the     |
|   |     |                             |   | FBCA or Entity CA       |
|   |     |                             |   | software or             |
|   |     |                             |   | configuration. A formal |
|   |     |                             |   | configuration           |
|   |     |                             |   | management methodology  |
|   |     |                             |   | shall be used for       |
|   |     |                             |   | installation and        |
|   |     |                             |   | ongoing maintenance of  |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system. The FBCA or     |
|   |     |                             |   | Entity CA software,     |
|   |     |                             |   | when first loaded,      |
|   |     |                             |   | shall be verified as    |
|   |     |                             |   | being that supplied     |
|   |     |                             |   | from the vendor, with   |
|   |     |                             |   | no modifications, and   |
|   |     |                             |   | be the version intended |
|   |     |                             |   | for use. For the FBCA,  |
|   |     |                             |   | the integrity of the    |
|   |     |                             |   | software shall be       |
|   |     |                             |   | verified by the FPKI    |
|   |     |                             |   | Operational Authority   |
|   |     |                             |   | at least weekly (e.g.,  |
|   |     |                             |   | in conjunction with CRL |
|   |     |                             |   | publication).           |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 2 | A-3 |                             |   |                         |
| 7 |     | The organization manages    |   | 6.6.1 System            |
| . | L   | the information system      |   | Development Controls    |
|   | IFE | using a system development  |   |                         |
|   | CY  | life cycle methodology that |   | \[See text in previous  |
|   | CLE | includes information        |   | tables\]                |
|   | S   | security considerations.    |   |                         |
|   | UPP |                             |   | 6.6.2 Security          |
|   | ORT | Enhancements:               |   | Management Controls     |
|   |     |                             |   |                         |
|   |     | None.                       |   | The configuration of    |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     | Supplemental Guidance:      |   | system as well as any   |
|   |     |                             |   | modifications and       |
|   |     | NIST Special Publication    |   | upgrades shall be       |
|   |     | 800-64 provides guidance on |   | documented and          |
|   |     | security considerations in  |   | controlled. There shall |
|   |     | the system development life |   | be a mechanism for      |
|   |     | cycle.                      |   | detecting unauthorized  |
|   |     |                             |   | modification to the     |
|   |     |                             |   | FBCA or Entity CA       |
|   |     |                             |   | software or             |
|   |     |                             |   | configuration. A formal |
|   |     |                             |   | configuration           |
|   |     |                             |   | management methodology  |
|   |     |                             |   | shall be used for       |
|   |     |                             |   | installation and        |
|   |     |                             |   | ongoing maintenance of  |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system. The FBCA or     |
|   |     |                             |   | Entity CA software,     |
|   |     |                             |   | when first loaded,      |
|   |     |                             |   | shall be verified as    |
|   |     |                             |   | being that supplied     |
|   |     |                             |   | from the vendor, with   |
|   |     |                             |   | no modifications, and   |
|   |     |                             |   | be the version intended |
|   |     |                             |   | for use. For the FBCA,  |
|   |     |                             |   | the integrity of the    |
|   |     |                             |   | software shall be       |
|   |     |                             |   | verified by the FPKI    |
|   |     |                             |   | Operational Authority   |
|   |     |                             |   | at least weekly (e.g.,  |
|   |     |                             |   | in conjunction with CRL |
|   |     |                             |   | publication).           |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
|   |     |                             |   |                         |
|   | **C |                             |   |                         |
|   | OMP |                             |   |                         |
|   | ARA |                             |   |                         |
|   | BLE |                             |   |                         |
|   | for |                             |   |                         |
|   | X   |                             |   |                         |
|   | -CE |                             |   |                         |
|   | RTD |                             |   |                         |
|   | En  |                             |   |                         |
|   | tit |                             |   |                         |
|   | ies |                             |   |                         |
|   | at  |                             |   |                         |
|   | Ba  |                             |   |                         |
|   | sic |                             |   |                         |
|   | and |                             |   |                         |
|   | A   |                             |   |                         |
|   | bov |                             |   |                         |
|   | e** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 2 | A-4 |                             |   |                         |
| 8 |     | The organization includes   |   |                         |
| . | ACQ | security requirements       |   |                         |
|   | UIS | and/or security             |   |                         |
|   | ITI | specifications, either      |   |                         |
|   | ONS | explicitly or by reference, |   |                         |
|   |     | in information system       |   |                         |
|   |     | acquisition contracts based |   |                         |
|   |     | on an assessment of risk.   |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | *Solicitation Documents\    |   |                         |
|   |     | *The solicitation documents |   |                         |
|   |     | (e.g., Requests for         |   |                         |
|   |     | Proposals) for information  |   |                         |
|   |     | systems and services        |   |                         |
|   |     | include, either explicitly  |   |                         |
|   |     | or by reference, security   |   |                         |
|   |     | requirements that describe: |   |                         |
|   |     | (i) required security       |   |                         |
|   |     | capabilities; (ii) required |   |                         |
|   |     | design and development      |   |                         |
|   |     | processes; (iii) required   |   |                         |
|   |     | test and evaluation         |   |                         |
|   |     | procedures; and (iv)        |   |                         |
|   |     | required documentation.     |   |                         |
|   |     | The requirements in the     |   |                         |
|   |     | solicitation documents      |   |                         |
|   |     | permit updating security    |   |                         |
|   |     | controls as new             |   |                         |
|   |     | threats/vulnerabilities are |   |                         |
|   |     | identified and as new       |   |                         |
|   |     | technologies are            |   |                         |
|   |     | implemented. NIST Special   |   |                         |
|   |     | Publication 800-53 provides |   |                         |
|   |     | guidance on recommended     |   |                         |
|   |     | security controls for       |   |                         |
|   |     | federal information systems |   |                         |
|   |     | to meet minimum security    |   |                         |
|   |     | requirements for            |   |                         |
|   |     | information systems         |   |                         |
|   |     | categorized in accordance   |   |                         |
|   |     | with FIPS 199. NIST Special |   |                         |
|   |     | Publication 800-36 provides |   |                         |
|   |     | guidance on the selection   |   |                         |
|   |     | of information security     |   |                         |
|   |     | products. NIST Special      |   |                         |
|   |     | Publication 800-35 provides |   |                         |
|   |     | guidance on information     |   |                         |
|   |     | technology security         |   |                         |
|   |     | services. NIST Special      |   |                         |
|   |     | Publication 800-64 provides |   |                         |
|   |     | guidance on security        |   |                         |
|   |     | considerations in the       |   |                         |
|   |     | system development life     |   |                         |
|   |     | cycle.\                     |   |                         |
|   |     | *Use of Tested, Evaluated,  |   |                         |
|   |     | and Validated Products\     |   |                         |
|   |     | *NIST Special Publication   |   |                         |
|   |     | 800-23 provides guidance on |   |                         |
|   |     | the acquisition and use of  |   |                         |
|   |     | tested/evaluated            |   |                         |
|   |     | information technology      |   |                         |
|   |     | products.\                  |   |                         |
|   |     | *Configuration Settings and |   |                         |
|   |     | Implementation Guidance\    |   |                         |
|   |     | *The information system     |   |                         |
|   |     | required documentation      |   |                         |
|   |     | includes security           |   |                         |
|   |     | configuration settings and  |   |                         |
|   |     | security implementation     |   |                         |
|   |     | guidance. NIST Special      |   |                         |
|   |     | Publication 800-70 provides |   |                         |
|   |     | guidance on configuration   |   |                         |
|   |     | settings for information    |   |                         |
|   |     | technology products.        |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 2 | A-5 |                             |   |                         |
| 9 | (1) | The organization ensures    |   | 5.3.3 Training          |
| . |     | that adequate documentation |   | Requirements            |
|   | IN  | for the information system  |   |                         |
|   | FOR | and its constituent         |   | All personnel           |
|   | MAT | components is available,    |   | performing duties with  |
|   | ION | protected when required,    |   | respect to the          |
|   | SYS | and distributed to          |   | operation of the FBCA   |
|   | TEM | authorized personnel.       |   | or Entity CA shall      |
|   | D   |                             |   | receive comprehensive   |
|   | OCU | Enhancements:               |   | training in all         |
|   | MEN |                             |   | operational duties they |
|   | TAT | \(1\) The organization      |   | are expected to         |
|   | ION | includes documentation, if  |   | perform, including      |
|   |     | available from the          |   | disaster recovery and   |
|   |     | vendor/manufacturer,        |   | business continuity     |
|   |     | describing\                 |   | procedures.             |
|   |     | the functional properties   |   |                         |
|   |     | of the security controls    |   | 5.3.8 Documentation     |
|   |     | employed within the         |   | Supplied to Personnel   |
|   |     | information system with\    |   |                         |
|   |     | sufficient detail to permit |   | For the FBCA and Entity |
|   |     | analysis and testing of the |   | CAs, documentation      |
|   |     | controls.\                  |   | sufficient to define    |
|   |     | (2) The organization        |   | duties and procedures   |
|   |     | includes documentation, if  |   | for each trusted role   |
|   |     | available from the          |   | shall be provided to    |
|   |     | vendor/manufacturer,        |   | the personnel filling   |
|   |     | describing\                 |   | that role.              |
|   |     | the design and              |   |                         |
|   |     | implementation details of   |   | 6.6.2 Security          |
|   |     | the security controls       |   | Management Controls     |
|   |     | employed within the         |   |                         |
|   |     | information\                |   | The configuration of    |
|   |     | system with sufficient      |   | the FBCA or Entity CA   |
|   |     | detail to permit analysis   |   | system as well as any   |
|   |     | and testing of the controls |   | modifications and       |
|   |     | (including functional\      |   | upgrades shall be       |
|   |     | interfaces among control    |   | documented and          |
|   |     | components).                |   | controlled. There shall |
|   |     |                             |   | be a mechanism for      |
|   |     | Supplemental Guidance:      |   | detecting unauthorized  |
|   |     |                             |   | modification to the     |
|   |     | Administrator and user      |   | FBCA or Entity CA       |
|   |     | guides include information  |   | software or             |
|   |     | on: (i) configuring,        |   | configuration. A formal |
|   |     | installing, and operating   |   | configuration           |
|   |     | the information system; and |   | management methodology  |
|   |     | (ii) effectively using the  |   | shall be used for       |
|   |     | system's security features. |   | installation and        |
|   |     |                             |   | ongoing maintenance of  |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system. The FBCA or     |
|   |     |                             |   | Entity CA software,     |
|   |     |                             |   | when first loaded,      |
|   |     |                             |   | shall be verified as    |
|   |     |                             |   | being that supplied     |
|   |     |                             |   | from the vendor, with   |
|   |     |                             |   | no modifications, and   |
|   |     |                             |   | be the version intended |
|   |     |                             |   | for use. For the FBCA,  |
|   |     |                             |   | the integrity of the    |
|   |     |                             |   | software shall be       |
|   |     |                             |   | verified by the FPKI    |
|   |     |                             |   | Operational Authority   |
|   |     |                             |   | at least weekly (e.g.,  |
|   |     |                             |   | in conjunction with CRL |
|   |     |                             |   | publication).           |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | A-6 |                             |   |                         |
| 0 |     | The organization complies   |   |                         |
| . | SO  | with software usage         |   |                         |
|   | FTW | restrictions.               |   |                         |
|   | ARE |                             |   |                         |
|   | US  | Enhancements:               |   |                         |
|   | AGE |                             |   |                         |
|   | RES | None.                       |   |                         |
|   | TRI |                             |   |                         |
|   | CTI | Supplemental Guidance:      |   |                         |
|   | ONS |                             |   |                         |
|   |     | Software and associated     |   |                         |
|   |     | documentation is used in    |   |                         |
|   |     | accordance with contract    |   |                         |
|   |     | agreements and copyright    |   |                         |
|   |     | laws. For software and      |   |                         |
|   |     | associated documentation    |   |                         |
|   |     | protected by quantity       |   |                         |
|   |     | licenses, the organization  |   |                         |
|   |     | employs tracking systems to |   |                         |
|   |     | control copying and         |   |                         |
|   |     | distribution. The           |   |                         |
|   |     | organization controls and   |   |                         |
|   |     | documents the use of        |   |                         |
|   |     | publicly accessible         |   |                         |
|   |     | peer-to-peer file sharing   |   |                         |
|   |     | technology to ensure that   |   |                         |
|   |     | this capability is not used |   |                         |
|   |     | for the unauthorized        |   |                         |
|   |     | distribution, display,      |   |                         |
|   |     | performance, or             |   |                         |
|   |     | reproduction of copyrighted |   |                         |
|   |     | work.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | A-7 |                             |   |                         |
| 1 |     | The organization enforces   |   | 6.6.2 Security          |
| . | U   | explicit rules governing    |   | Management Controls     |
|   | SER | the downloading and         |   |                         |
|   | INS | installation of software by |   | The configuration of    |
|   | TAL | users.                      |   | the FBCA or Entity CA   |
|   | LED |                             |   | system as well as any   |
|   | SO  | Enhancements:               |   | modifications and       |
|   | FTW |                             |   | upgrades shall be       |
|   | ARE | None.                       |   | documented and          |
|   |     |                             |   | controlled. There shall |
|   |     | Supplemental Guidance:      |   | be a mechanism for      |
|   |     |                             |   | detecting unauthorized  |
|   |     | If provided the necessary   |   | modification to the     |
|   |     | privileges, users have the  |   | FBCA or Entity CA       |
|   |     | ability to download and     |   | software or             |
|   |     | install software.  The      |   | configuration. A formal |
|   |     | organization identifies     |   | configuration           |
|   |     | what types of software      |   | management methodology  |
|   |     | downloads and installations |   | shall be used for       |
|   |     | are permitted (e.g.,        |   | installation and        |
|   |     | updates and security        |   | ongoing maintenance of  |
|   |     | patches to existing         |   | the FBCA or Entity CA   |
|   |     | software) and what types of |   | system. The FBCA or     |
|   |     | downloads and installations |   | Entity CA software,     |
|   |     | are prohibited (e.g.,       |   | when first loaded,      |
|   |     | software that is free only  |   | shall be verified as    |
|   |     | for personal, not           |   | being that supplied     |
|   |     | government, use). The       |   | from the vendor, with   |
|   |     | organization also restricts |   | no modifications, and   |
|   |     | the use of                  |   | be the version intended |
|   |     | install-on-demand software. |   | for use. For the FBCA,  |
|   |     |                             |   | the integrity of the    |
|   |     |                             |   | software shall be       |
|   |     |                             |   | verified by the FPKI    |
|   |     |                             |   | Operational Authority   |
|   |     |                             |   | at least weekly (e.g.,  |
|   |     |                             |   | in conjunction with CRL |
|   |     |                             |   | publication).           |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | A-8 |                             |   |                         |
| 2 |     | The organization designs    |   | 6.6.1 System            |
| . | SE  | and implements the          |   | Development Controls    |
|   | CUR | information system using    |   |                         |
|   | ITY | security engineering        |   | -   For commercial      |
|   | DES | principles.                 |   |     off-the-shelf       |
|   | IGN |                             |   |     software, the       |
|   | P   | Enhancements:               |   |     software shall be   |
|   | RIN |                             |   |     designed and        |
|   | CIP | None.                       |   |     developed under a   |
|   | LES |                             |   |     formal, documented  |
|   |     | Supplemental Guidance:      |   |     development         |
|   |     |                             |   |     methodology.        |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-27 provides guidance on |   | -   For hardware and    |
|   |     | engineering principles for  |   |     software developed  |
|   |     | information system          |   |     specifically for a  |
|   |     | security.                   |   |     particular CA, the  |
|   |     |                             |   |     applicant shall     |
|   |     |                             |   |     demonstrate that    |
|   |     |                             |   |     security            |
|   |     |                             |   |     requirements were   |
|   |     |                             |   |     achieved through a  |
|   |     |                             |   |     combination of      |
|   |     |                             |   |     software            |
|   |     |                             |   |     verification &      |
|   |     |                             |   |     validation,         |
|   |     |                             |   |     structured          |
|   |     |                             |   |     development         |
|   |     |                             |   |     approach, and       |
|   |     |                             |   |     controlled          |
|   |     |                             |   |     development         |
|   |     |                             |   |     environment.        |
|   |     |                             |   |                         |
|   |     |                             |   | -   Where open source   |
|   |     |                             |   |     software has been   |
|   |     |                             |   |     utilized, the       |
|   |     |                             |   |     applicant shall     |
|   |     |                             |   |     demonstrate that    |
|   |     |                             |   |     security            |
|   |     |                             |   |     requirements were   |
|   |     |                             |   |     achieved through    |
|   |     |                             |   |     software            |
|   |     |                             |   |     verification &      |
|   |     |                             |   |     validation and      |
|   |     |                             |   |     structured          |
|   |     |                             |   |                         |
|   |     |                             |   |  development/life-cycle |
|   |     |                             |   |     management.         |
|   |     |                             |   |                         |
|   |     |                             |   | -   Hardware and        |
|   |     |                             |   |     software procured   |
|   |     |                             |   |     to operate the CA   |
|   |     |                             |   |     shall be purchased  |
|   |     |                             |   |     and shipped in a    |
|   |     |                             |   |     fashion to reduce   |
|   |     |                             |   |     the likelihood that |
|   |     |                             |   |     any particular      |
|   |     |                             |   |     component was       |
|   |     |                             |   |     tampered with       |
|   |     |                             |   |     (e.g., by ensuring  |
|   |     |                             |   |     the equipment was   |
|   |     |                             |   |     randomly selected   |
|   |     |                             |   |     at time of          |
|   |     |                             |   |     purchase).          |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
|   |     |                             |   |                         |
|   | **C |                             |   |                         |
|   | OMP |                             |   |                         |
|   | ARA |                             |   |                         |
|   | BLE |                             |   |                         |
|   | for |                             |   |                         |
|   | X   |                             |   |                         |
|   | -CE |                             |   |                         |
|   | RTD |                             |   |                         |
|   | En  |                             |   |                         |
|   | tit |                             |   |                         |
|   | ies |                             |   |                         |
|   | at  |                             |   |                         |
|   | Ba  |                             |   |                         |
|   | sic |                             |   |                         |
|   | and |                             |   |                         |
|   | A   |                             |   |                         |
|   | bov |                             |   |                         |
|   | e** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | A-9 |                             |   |                         |
| 3 |     | The organization ensures    |   | 6.6.1 System            |
| . | O   | that third-party providers  |   | Development Controls    |
|   | UTS | of information system       |   |                         |
|   | OUR | services employ adequate    |   | -   For commercial      |
|   | CED | security controls in        |   |     off-the-shelf       |
|   | IN  | accordance with applicable  |   |     software, the       |
|   | FOR | federal laws, directives,   |   |     software shall be   |
|   | MAT | policies, regulations,      |   |     designed and        |
|   | ION | standards, guidance, and    |   |     developed under a   |
|   | SYS | established service level   |   |     formal, documented  |
|   | TEM | agreements. The             |   |     development         |
|   | SE  | organization monitors       |   |     methodology.        |
|   | RVI | security control            |   |                         |
|   | CES | compliance.                 |   | -   For hardware and    |
|   |     |                             |   |     software developed  |
|   |     | Enhancements:               |   |     specifically for a  |
|   |     |                             |   |     particular CA, the  |
|   |     | None.                       |   |     applicant shall     |
|   |     |                             |   |     demonstrate that    |
|   |     | Supplemental Guidance:      |   |     security            |
|   |     |                             |   |     requirements were   |
|   |     | Third-party providers are   |   |     achieved through a  |
|   |     | subject to the same         |   |     combination of      |
|   |     | information system security |   |     software            |
|   |     | policies and procedures of  |   |     verification &      |
|   |     | the supported organization, |   |     validation,         |
|   |     | and must conform to the     |   |     structured          |
|   |     | same security control and   |   |     development         |
|   |     | documentation requirements  |   |     approach, and       |
|   |     | as would apply to the       |   |     controlled          |
|   |     | organization's internal     |   |     development         |
|   |     | systems. Appropriate        |   |     environment.        |
|   |     | organizational officials    |   |                         |
|   |     | approve outsourcing of      |   | -   Where open source   |
|   |     | information system services |   |     software has been   |
|   |     | to third-party providers    |   |     utilized, the       |
|   |     | (e.g., service bureaus,     |   |     applicant shall     |
|   |     | contractors, and other      |   |     demonstrate that    |
|   |     | external organizations).    |   |     security            |
|   |     | The outsourced information  |   |     requirements were   |
|   |     | system services             |   |     achieved through    |
|   |     | documentation includes      |   |     software            |
|   |     | government, service         |   |     verification &      |
|   |     | provider, and end user      |   |     validation and      |
|   |     | security roles and          |   |     structured          |
|   |     | responsibilities, and any   |   |                         |
|   |     | service level agreements.   |   |  development/life-cycle |
|   |     | Service level agreements    |   |     management.         |
|   |     | define the expectations of  |   |                         |
|   |     | performance for each        |   | -   Hardware and        |
|   |     | required security control,  |   |     software procured   |
|   |     | describe measurable         |   |     to operate the CA   |
|   |     | outcomes, and identify      |   |     shall be purchased  |
|   |     | remedies and response       |   |     and shipped in a    |
|   |     | requirements for any        |   |     fashion to reduce   |
|   |     | identified instance of      |   |     the likelihood that |
|   |     | non-compliance. NIST        |   |     any particular      |
|   |     | Special Publication 800-35  |   |     component was       |
|   |     | provides guidance on        |   |     tampered with       |
|   |     | information technology      |   |     (e.g., by ensuring  |
|   |     | security services. NIST     |   |     the equipment was   |
|   |     | Special Publication 800-64  |   |     randomly selected   |
|   |     | provides guidance on the    |   |     at time of          |
|   |     | security considerations in  |   |     purchase).          |
|   |     | the system development life |   |                         |
|   |     | cycle.                      |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
|   |     |                             |   |                         |
|   | **C |                             |   |                         |
|   | OMP |                             |   |                         |
|   | ARA |                             |   |                         |
|   | BLE |                             |   |                         |
|   | for |                             |   |                         |
|   | X   |                             |   |                         |
|   | -CE |                             |   |                         |
|   | RTD |                             |   |                         |
|   | En  |                             |   |                         |
|   | tit |                             |   |                         |
|   | ies |                             |   |                         |
|   | at  |                             |   |                         |
|   | Ba  |                             |   |                         |
|   | sic |                             |   |                         |
|   | and |                             |   |                         |
|   | A   |                             |   |                         |
|   | bov |                             |   |                         |
|   | e** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SA  | Control:                    |   | FBCA Section:           |
| 3 | -10 |                             |   |                         |
| 4 |     | The information system      |   |                         |
| . | DEV | developer creates and       |   |                         |
|   | ELO | implements a configuration  |   |                         |
|   | PER | management plan that        |   |                         |
|   | C   | controls changes to the     |   |                         |
|   | ONF | system during development,  |   |                         |
|   | IGU | tracks security flaws,      |   |                         |
|   | RAT | requires authorization of   |   |                         |
|   | ION | changes, and provides       |   |                         |
|   | M   | documentation of the plan   |   |                         |
|   | ANA | and its implementation.     |   |                         |
|   | GEM |                             |   |                         |
|   | ENT | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SA  | Control:                    |   | FBCA Section:           |
| 3 | -11 |                             |   |                         |
| 5 |     | The information system      |   | 8.0 Compliance Audit    |
| . | DEV | developer creates a         |   | and Other Assessments   |
|   | ELO | security test and           |   |                         |
|   | PER | evaluation plan, implements |   | The FPKI Operational    |
|   | SE  | the plan, and documents the |   | Authority shall have a  |
|   | CUR | results. Developmental      |   | compliance audit        |
|   | ITY | security test results may   |   | mechanism in place to   |
|   | T   | be used in support of the   |   | ensure that the         |
|   | EST | security certification and  |   | requirements of this CP |
|   | ING | accreditation process for   |   | and the FBCA CPS are    |
|   |     | the delivered information   |   | being implemented and   |
|   |     | system.                     |   | enforced.               |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   | Entity CAs shall have a |
|   |     |                             |   | compliance audit        |
|   |     | None.                       |   | mechanism in place to   |
|   |     |                             |   | ensure that the         |
|   |     | Supplemental Guidance:      |   | requirements of their   |
|   |     |                             |   | CP/CPS are being        |
|   |     | Developmental security test |   | implemented and         |
|   |     | results should only be used |   | enforced.               |
|   |     | when no security relevant   |   |                         |
|   |     | modifications of the        |   | 8.5 Actions Taken as a  |
|   |     | information system have     |   | Result of Deficiency    |
|   |     | been made subsequent to     |   |                         |
|   |     | developer testing and after |   | When the compliance     |
|   |     | selective verification of   |   | auditor finds a         |
|   |     | developer test results.     |   | discrepancy between how |
|   |     |                             |   | the FBCA is designed or |
|   |     |                             |   | is being operated or    |
|   |     |                             |   | maintained, and the     |
|   |     |                             |   | requirements of this    |
|   |     |                             |   | CP, the MOAs, or the    |
|   |     |                             |   | applicable CPS, the     |
|   |     |                             |   | following actions shall |
|   |     |                             |   | be performed:           |
|   |     |                             |   |                         |
|   |     |                             |   | -   he compliance      |
|   |     |                             |   |     auditor shall       |
|   |     |                             |   |     document the        |
|   |     |                             |   |     discrepancy and     |
|   |     |                             |   |     provide a copy to   |
|   |     |                             |   |     the FPKI            |
|   |     |                             |   |     Operational         |
|   |     |                             |   |     Authority;          |
|   |     |                             |   |                         |
|   |     |                             |   | When the Entity         |
|   |     |                             |   | compliance auditor      |
|   |     |                             |   | finds a discrepancy     |
|   |     |                             |   | between how the Entity  |
|   |     |                             |   | CA is designed or is    |
|   |     |                             |   | being operated or       |
|   |     |                             |   | maintained, and the     |
|   |     |                             |   | requirements of the     |
|   |     |                             |   | Entity CP, any          |
|   |     |                             |   | applicable MOAs, or the |
|   |     |                             |   | applicable CPS, the     |
|   |     |                             |   | following actions shall |
|   |     |                             |   | be performed:           |
|   |     |                             |   |                         |
|   |     |                             |   | -   The compliance      |
|   |     |                             |   |     auditor shall       |
|   |     |                             |   |     document the        |
|   |     |                             |   |     discrepancy         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | C-1 |                             |   |                         |
| 6 |     | The organization develops,  |   | 6.7 Network Security    |
| . | SYS | disseminates, and           |   | Controls                |
|   | TEM | periodically                |   |                         |
|   | AND | reviews/updates: (i) a      |   | Network security        |
|   | CO  | formal, documented, system  |   | controls shall be       |
|   | MMU | and communications          |   | employed to protect the |
|   | NIC | protection policy that      |   | FBCA and the FBCA       |
|   | ATI | addresses purpose, scope,   |   | Internal Directory.     |
|   | ONS | roles, responsibilities,    |   | Networking equipment    |
|   | P   | management commitment,      |   | shall turn off unused   |
|   | ROT | coordination among          |   | network ports and       |
|   | ECT | organizational entities,    |   | services. Any network   |
|   | ION | and compliance; and (ii)    |   | software installed on   |
|   | POL | formal, documented          |   | the FBCA equipment      |
|   | ICY | procedures to facilitate    |   | shall be necessary to   |
|   | AND | the implementation of the   |   | the functioning of the  |
|   | P   | system and communications   |   | FBCA.                   |
|   | ROC | protection policy and       |   |                         |
|   | EDU | associated system and       |   | The FBCA Border         |
|   | RES | communications protection   |   | Directory shall be      |
|   |     | controls.                   |   | connected to the        |
|   |     |                             |   | Internet and provide    |
|   |     | Enhancements:               |   | continuous service      |
|   |     |                             |   | (except, when           |
|   |     | None.                       |   | necessary, for brief    |
|   |     |                             |   | periods of maintenance  |
|   |     | Supplemental Guidance:      |   | or backup).             |
|   |     |                             |   |                         |
|   |     | The system and              |   | Any boundary control    |
|   |     | communications protection   |   | devices used to protect |
|   |     | policy and procedures are   |   | the Border directory or |
|   |     | consistent with applicable  |   | FBCA local area network |
|   |     | federal laws, directives,   |   | shall deny all but the  |
|   |     | policies, regulations,      |   | necessary services to   |
|   |     | standards, and guidance.    |   | the PKI equipment even  |
|   |     | The system and              |   | if those services are   |
|   |     | communications protection   |   | enabled for other       |
|   |     | policy can be included as   |   | devices on the network. |
|   |     | part of the general         |   |                         |
|   |     | information security policy |   | Entity CAs and          |
|   |     | for the organization.       |   | directories shall       |
|   |     | System and communications   |   | employ appropriate      |
|   |     | protection procedures can   |   | network security        |
|   |     | be developed for the        |   | controls. Networking    |
|   |     | security program in         |   | equipment shall turn    |
|   |     | general, and for a          |   | off unused network      |
|   |     | particular information      |   | ports and services. Any |
|   |     | system, when required. NIST |   | network software        |
|   |     | Special Publication 800-12  |   | present shall be        |
|   |     | provides guidance on        |   | necessary to the        |
|   |     | security policies and       |   | functioning of the      |
|   |     | procedures.                 |   | equipment               |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | C-2 |                             |   |                         |
| 7 |     | The information system      |   | ### 6.5.1 Spe           |
| . | AP  | separates user              |   | cific Computer Security |
|   | PLI | functionality (including    |   |  Technical Requirements |
|   | CAT | user interface services)    |   |                         |
|   | ION | from information system     |   | For the FBCA, the       |
|   | PAR | management functionality.   |   | computer security       |
|   | TIT |                             |   | functions listed below  |
|   | ION | Enhancements:               |   | are required. These     |
|   | ING |                             |   | functions may be        |
|   |     | None.                       |   | provided by the         |
|   |     |                             |   | operating system, or    |
|   |     | Supplemental Guidance:      |   | through a combination   |
|   |     |                             |   | of operating system,    |
|   |     | The information system      |   | software, and physical  |
|   |     | physically or logically     |   | safeguards. The FBCA    |
|   |     | separates user interface    |   | and its ancillary parts |
|   |     | services (e.g., public web  |   | shall include the       |
|   |     | pages) from information     |   | following               |
|   |     | storage and management      |   | functionality:          |
|   |     | services (e.g., database    |   |                         |
|   |     | management). Separation may |   | -   Require             |
|   |     | be accomplished through the |   |     authenticated       |
|   |     | use of different computers, |   |     logins              |
|   |     | different central           |   |                         |
|   |     | processing units, different |   | -   Provide             |
|   |     | instances of the operating  |   |     Discretionary       |
|   |     | system, different network   |   |     Access Control      |
|   |     | addresses, combinations of  |   |                         |
|   |     | these methods, or other     |   | -   Provide a security  |
|   |     | methods as appropriate.     |   |     audit capability    |
|   |     |                             |   |                         |
|   |     |                             |   | -   Restrict access     |
|   |     |                             |   |     control to FBCA     |
|   |     |                             |   |     services and PKI    |
|   |     |                             |   |     roles               |
|   |     |                             |   |                         |
|   |     |                             |   | -   Enforce separation  |
|   |     |                             |   |     of duties for PKI   |
|   |     |                             |   |     roles               |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require             |
|   |     |                             |   |     identification and  |
|   |     |                             |   |     authentication of   |
|   |     |                             |   |     PKI roles and       |
|   |     |                             |   |     associated          |
|   |     |                             |   |     identities          |
|   |     |                             |   |                         |
|   |     |                             |   | -   Prohibit object     |
|   |     |                             |   |     re-use or require   |
|   |     |                             |   |     separation for FBCA |
|   |     |                             |   |     random access       |
|   |     |                             |   |     memory              |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require use of      |
|   |     |                             |   |     cryptography for    |
|   |     |                             |   |     session             |
|   |     |                             |   |     communication and   |
|   |     |                             |   |     database security   |
|   |     |                             |   |                         |
|   |     |                             |   | -   Archive FBCA        |
|   |     |                             |   |     history and audit   |
|   |     |                             |   |     data                |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require self-test   |
|   |     |                             |   |     security related    |
|   |     |                             |   |     FBCA services       |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require a trusted   |
|   |     |                             |   |     path for            |
|   |     |                             |   |     identification of   |
|   |     |                             |   |     PKI roles and       |
|   |     |                             |   |     associated          |
|   |     |                             |   |     identities          |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require a recovery  |
|   |     |                             |   |     mechanisms for keys |
|   |     |                             |   |     and the FBCA system |
|   |     |                             |   |                         |
|   |     |                             |   | -   Enforce domain      |
|   |     |                             |   |     integrity           |
|   |     |                             |   |     boundaries for      |
|   |     |                             |   |     security critical   |
|   |     |                             |   |     processes           |
|   |     |                             |   |                         |
|   |     |                             |   | For Entity CAs, the     |
|   |     |                             |   | computer security       |
|   |     |                             |   | functions listed below  |
|   |     |                             |   | are required. These     |
|   |     |                             |   | functions may be        |
|   |     |                             |   | provided by the         |
|   |     |                             |   | operating system, or    |
|   |     |                             |   | through a combination   |
|   |     |                             |   | of operating system,    |
|   |     |                             |   | software, and physical  |
|   |     |                             |   | safeguards. The Entity  |
|   |     |                             |   | CA and its ancillary    |
|   |     |                             |   | parts shall include the |
|   |     |                             |   | following               |
|   |     |                             |   | functionality:          |
|   |     |                             |   |                         |
|   |     |                             |   | -   authenticate the    |
|   |     |                             |   |     identity of users   |
|   |     |                             |   |     before permitting   |
|   |     |                             |   |     access to the       |
|   |     |                             |   |     system or           |
|   |     |                             |   |     applications;       |
|   |     |                             |   |                         |
|   |     |                             |   | -   manage privileges   |
|   |     |                             |   |     of users to limit   |
|   |     |                             |   |     users to their      |
|   |     |                             |   |     assigned roles;     |
|   |     |                             |   |                         |
|   |     |                             |   | -   generate and        |
|   |     |                             |   |     archive audit       |
|   |     |                             |   |     records for all     |
|   |     |                             |   |     transactions; (see  |
|   |     |                             |   |     Section 5.4)        |
|   |     |                             |   |                         |
|   |     |                             |   | -   enforce domain      |
|   |     |                             |   |     integrity           |
|   |     |                             |   |     boundaries for      |
|   |     |                             |   |     security critical   |
|   |     |                             |   |     processes; and      |
|   |     |                             |   |     support recovery    |
|   |     |                             |   |     from key or system  |
|   |     |                             |   |     failure             |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | C-3 |                             |   |                         |
| 8 |     | The information system      |   |                         |
| . | SE  | isolates security functions |   |                         |
|   | CUR | from non-security           |   |                         |
|   | ITY | functions.                  |   |                         |
|   | FU  |                             |   |                         |
|   | NCT | Enhancements:               |   |                         |
|   | ION |                             |   |                         |
|   | ISO | \(1\) The information       |   |                         |
|   | LAT | system employs underlying   |   |                         |
|   | ION | hardware separation         |   |                         |
|   |     | mechanisms to facilitate    |   |                         |
|   |     | security\                   |   |                         |
|   |     | function isolation.\        |   |                         |
|   |     | (2) The information system  |   |                         |
|   |     | further divides the         |   |                         |
|   |     | security functions with the |   |                         |
|   |     | functions enforcing access\ |   |                         |
|   |     | and information flow        |   |                         |
|   |     | control isolated and        |   |                         |
|   |     | protected from both         |   |                         |
|   |     | nonsecurity functions and   |   |                         |
|   |     | from\                       |   |                         |
|   |     | other security functions.\  |   |                         |
|   |     | (3) The information system  |   |                         |
|   |     | minimizes the amount of     |   |                         |
|   |     | nonsecurity functions       |   |                         |
|   |     | included within the\        |   |                         |
|   |     | isolation boundary          |   |                         |
|   |     | containing security         |   |                         |
|   |     | functions.\                 |   |                         |
|   |     | (4) The information system  |   |                         |
|   |     | security maintains its      |   |                         |
|   |     | security functions in       |   |                         |
|   |     | largely independent         |   |                         |
|   |     | modules\                    |   |                         |
|   |     | that avoid unnecessary      |   |                         |
|   |     | interactions between        |   |                         |
|   |     | modules.\                   |   |                         |
|   |     | (5) The information system  |   |                         |
|   |     | security maintains its      |   |                         |
|   |     | security functions in a     |   |                         |
|   |     | layered structure           |   |                         |
|   |     | minimizing\                 |   |                         |
|   |     | interactions between layers |   |                         |
|   |     | of the design.              |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The information system      |   |                         |
|   |     | isolates security functions |   |                         |
|   |     | from non-security functions |   |                         |
|   |     | by means of partitions,     |   |                         |
|   |     | domains, etc., including    |   |                         |
|   |     | control of access to and    |   |                         |
|   |     | integrity of, the hardware, |   |                         |
|   |     | software, and firmware that |   |                         |
|   |     | perform those security      |   |                         |
|   |     | functions. The information  |   |                         |
|   |     | system maintains a separate |   |                         |
|   |     | execution domain (e.g.,     |   |                         |
|   |     | address space) for each     |   |                         |
|   |     | executing process.          |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 3 | C-4 |                             |   |                         |
| 9 |     | The information system      |   | ### 6.5.1 Spe           |
| . | IN  | prevents unauthorized and   |   | cific Computer Security |
|   | FOR | unintended information      |   |  Technical Requirements |
|   | MAT | transfer via shared system  |   |                         |
|   | ION | resources.                  |   | For the FBCA, the       |
|   | RE  |                             |   | computer security       |
|   | MNA | Enhancements:               |   | functions listed below  |
|   | NTS |                             |   | are required. These     |
|   |     | None.                       |   | functions may be        |
|   |     |                             |   | provided by the         |
|   |     | Supplemental Guidance:      |   | operating system, or    |
|   |     |                             |   | through a combination   |
|   |     | Control of information      |   | of operating system,    |
|   |     | system remnants, sometimes  |   | software, and physical  |
|   |     | referred to as object       |   | safeguards. The FBCA    |
|   |     | reuse, prevents             |   | and its ancillary parts |
|   |     | information, including      |   | shall include the       |
|   |     | encrypted representations   |   | following               |
|   |     | of information, produced by |   | functionality:          |
|   |     | the actions of a prior      |   |                         |
|   |     | user/role (or the actions   |   | -   Require             |
|   |     | of a process acting on      |   |     authenticated       |
|   |     | behalf of a prior           |   |     logins              |
|   |     | user/role) from being       |   |                         |
|   |     | available to any current    |   | -   Provide             |
|   |     | user/role (or current       |   |     Discretionary       |
|   |     | process) that obtains       |   |     Access Control      |
|   |     | access to a shared system   |   |                         |
|   |     | resource (e.g., registers,  |   | -   Provide a security  |
|   |     | main memory, secondary      |   |     audit capability    |
|   |     | storage) after that         |   |                         |
|   |     | resource has been released  |   | -   Restrict access     |
|   |     | back to the information     |   |     control to FBCA     |
|   |     | system.                     |   |     services and PKI    |
|   |     |                             |   |     roles               |
|   |     |                             |   |                         |
|   |     |                             |   | -   Enforce separation  |
|   |     |                             |   |     of duties for PKI   |
|   |     |                             |   |     roles               |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require             |
|   |     |                             |   |     identification and  |
|   |     |                             |   |     authentication of   |
|   |     |                             |   |     PKI roles and       |
|   |     |                             |   |     associated          |
|   |     |                             |   |     identities          |
|   |     |                             |   |                         |
|   |     |                             |   | -   Prohibit object     |
|   |     |                             |   |     re-use or require   |
|   |     |                             |   |     separation for FBCA |
|   |     |                             |   |     random access       |
|   |     |                             |   |     memory              |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require use of      |
|   |     |                             |   |     cryptography for    |
|   |     |                             |   |     session             |
|   |     |                             |   |     communication and   |
|   |     |                             |   |     database security   |
|   |     |                             |   |                         |
|   |     |                             |   | -   Archive FBCA        |
|   |     |                             |   |     history and audit   |
|   |     |                             |   |     data                |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require self-test   |
|   |     |                             |   |     security related    |
|   |     |                             |   |     FBCA services       |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require a trusted   |
|   |     |                             |   |     path for            |
|   |     |                             |   |     identification of   |
|   |     |                             |   |     PKI roles and       |
|   |     |                             |   |     associated          |
|   |     |                             |   |     identities          |
|   |     |                             |   |                         |
|   |     |                             |   | -   Require a recovery  |
|   |     |                             |   |     mechanisms for keys |
|   |     |                             |   |     and the FBCA system |
|   |     |                             |   |                         |
|   |     |                             |   | -   Enforce domain      |
|   |     |                             |   |     integrity           |
|   |     |                             |   |     boundaries for      |
|   |     |                             |   |     security critical   |
|   |     |                             |   |     processes           |
|   |     |                             |   |                         |
|   |     |                             |   | For Entity CAs, the     |
|   |     |                             |   | computer security       |
|   |     |                             |   | functions listed below  |
|   |     |                             |   | are required. These     |
|   |     |                             |   | functions may be        |
|   |     |                             |   | provided by the         |
|   |     |                             |   | operating system, or    |
|   |     |                             |   | through a combination   |
|   |     |                             |   | of operating system,    |
|   |     |                             |   | software, and physical  |
|   |     |                             |   | safeguards. The Entity  |
|   |     |                             |   | CA and its ancillary    |
|   |     |                             |   | parts shall include the |
|   |     |                             |   | following               |
|   |     |                             |   | functionality:          |
|   |     |                             |   |                         |
|   |     |                             |   | -   authenticate the    |
|   |     |                             |   |     identity of users   |
|   |     |                             |   |     before permitting   |
|   |     |                             |   |     access to the       |
|   |     |                             |   |     system or           |
|   |     |                             |   |     applications;       |
|   |     |                             |   |                         |
|   |     |                             |   | -   manage privileges   |
|   |     |                             |   |     of users to limit   |
|   |     |                             |   |     users to their      |
|   |     |                             |   |     assigned roles;     |
|   |     |                             |   |                         |
|   |     |                             |   | -   generate and        |
|   |     |                             |   |     archive audit       |
|   |     |                             |   |     records for all     |
|   |     |                             |   |     transactions; (see  |
|   |     |                             |   |     Section 5.4)        |
|   |     |                             |   |                         |
|   |     |                             |   | -   enforce domain      |
|   |     |                             |   |     integrity           |
|   |     |                             |   |     boundaries for      |
|   |     |                             |   |     security critical   |
|   |     |                             |   |     processes; and      |
|   |     |                             |   |     support recovery    |
|   |     |                             |   |     from key or system  |
|   |     |                             |   |     failure             |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 4 | C-5 |                             |   |                         |
| 0 |     | The information system      |   |                         |
| . | DEN | protects against or limits  |   |                         |
|   | IAL | the effects of the          |   |                         |
|   | OF  | following types of denial   |   |                         |
|   | S   | of service attacks:         |   |                         |
|   | ERV | \[*Assignment:              |   |                         |
|   | ICE | organization-defined list   |   |                         |
|   | P   | of types of denial of       |   |                         |
|   | ROT | service attacks or          |   |                         |
|   | ECT | reference to source for     |   |                         |
|   | ION | current list*\].            |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | \(1\) The information       |   |                         |
|   |     | system restricts the        |   |                         |
|   |     | ability of users to launch  |   |                         |
|   |     | denial of service attacks   |   |                         |
|   |     | against\                    |   |                         |
|   |     | other information systems   |   |                         |
|   |     | or networks.\               |   |                         |
|   |     | (2) The information system  |   |                         |
|   |     | manages excess capacity,    |   |                         |
|   |     | bandwidth, or other         |   |                         |
|   |     | redundancy to limit the\    |   |                         |
|   |     | effects of information      |   |                         |
|   |     | flooding types of denial of |   |                         |
|   |     | service attacks.            |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | A variety of technologies   |   |                         |
|   |     | exist to limit, or in some  |   |                         |
|   |     | cases, eliminate the        |   |                         |
|   |     | effects of denial of        |   |                         |
|   |     | service attacks. For        |   |                         |
|   |     | example, network perimeter  |   |                         |
|   |     | devices can filter certain  |   |                         |
|   |     | types of packets to protect |   |                         |
|   |     | devices on an               |   |                         |
|   |     | organization's internal     |   |                         |
|   |     | network from being directly |   |                         |
|   |     | affected by denial of       |   |                         |
|   |     | service attacks.            |   |                         |
|   |     | Information systems that    |   |                         |
|   |     | are publicly accessible can |   |                         |
|   |     | be protected by employing   |   |                         |
|   |     | increased capacity and      |   |                         |
|   |     | bandwidth combined with     |   |                         |
|   |     | service redundancy.         |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 4 | C-6 |                             |   |                         |
| 1 |     | The information system      |   |                         |
| . | RE  | limits the use of resources |   |                         |
|   | SOU | by priority.                |   |                         |
|   | RCE |                             |   |                         |
|   | PR  | Enhancements:               |   |                         |
|   | IOR |                             |   |                         |
|   | ITY | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | Priority protection ensures |   |                         |
|   |     | that a lower-priority       |   |                         |
|   |     | process is not able to      |   |                         |
|   |     | interfere with the          |   |                         |
|   |     | information system          |   |                         |
|   |     | servicing any               |   |                         |
|   |     | higher-priority process.    |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 4 | C-7 |                             |   |                         |
| 2 | (1) | The information system      |   | 6.7 Network Security    |
| . |     | monitors and controls       |   | Controls                |
|   | BO  | communications at the       |   |                         |
|   | UND | external boundary of the    |   | Network security        |
|   | ARY | information system and at   |   | controls shall be       |
|   | P   | key internal boundaries     |   | employed to protect the |
|   | ROT | within the system.          |   | FBCA and the FBCA       |
|   | ECT |                             |   | Internal Directory.     |
|   | ION | Enhancements:               |   | Networking equipment    |
|   |     |                             |   | shall turn off unused   |
|   |     | \(1\) The organization      |   | network ports and       |
|   |     | physically allocates        |   | services. Any network   |
|   |     | publicly accessible         |   | software installed on   |
|   |     | information system          |   | the FBCA equipment      |
|   |     | components (e.g., public    |   | shall be necessary to   |
|   |     | web servers) to separate    |   | the functioning of the  |
|   |     | subnetworks with separate,  |   | FBCA.                   |
|   |     | physical network            |   |                         |
|   |     | interfaces. The             |   | The FBCA Border         |
|   |     | organization prevents       |   | Directory shall be      |
|   |     | public access into the      |   | connected to the        |
|   |     | organization's internal     |   | Internet and provide    |
|   |     | networks except as          |   | continuous service      |
|   |     | appropriately mediated.     |   | (except, when           |
|   |     |                             |   | necessary, for brief    |
|   |     | Supplemental Guidance:      |   | periods of maintenance  |
|   |     |                             |   | or backup).             |
|   |     | Any connections to the      |   |                         |
|   |     | Internet, or other external |   | Any boundary control    |
|   |     | networks or information     |   | devices used to protect |
|   |     | systems, occur through      |   | the Border directory or |
|   |     | devices known as controlled |   | FBCA local area network |
|   |     | interfaces (e.g., proxies,  |   | shall deny all but the  |
|   |     | gateways, routers,          |   | necessary services to   |
|   |     | firewalls, encrypted        |   | the PKI equipment even  |
|   |     | tunnels). The operational   |   | if those services are   |
|   |     | failure of the boundary     |   | enabled for other       |
|   |     | protection mechanisms does  |   | devices on the network. |
|   |     | not result in any           |   |                         |
|   |     | unauthorized release of     |   | Entity CAs and          |
|   |     | information outside of the  |   | directories shall       |
|   |     | information system boundary |   | employ appropriate      |
|   |     | or any unauthorized         |   | network security        |
|   |     | communication through the   |   | controls. Networking    |
|   |     | information system          |   | equipment shall turn    |
|   |     | boundary. Information       |   | off unused network      |
|   |     | system boundary protections |   | ports and services. Any |
|   |     | at any designated alternate |   | network software        |
|   |     | processing sites provide    |   | present shall be        |
|   |     | the same levels of          |   | necessary to the        |
|   |     | protection as that of the   |   | functioning of the      |
|   |     | primary site.               |   | equipment.              |
|   |     |                             |   |                         |
|   |     |                             |   | 5.1.2.1 Physical Access |
|   |     |                             |   | for CA Equipment        |
|   |     |                             |   |                         |
|   |     |                             |   | In addition to those    |
|   |     |                             |   | requirements, the       |
|   |     |                             |   | following requirements  |
|   |     |                             |   | shall apply to CAs that |
|   |     |                             |   | issue Medium, Medium    |
|   |     |                             |   | Hardware, or High       |
|   |     |                             |   | assurance certificates: |
|   |     |                             |   |                         |
|   |     |                             |   | -   Ensure manual or    |
|   |     |                             |   |     electronic          |
|   |     |                             |   |     monitoring for      |
|   |     |                             |   |     unauthorized        |
|   |     |                             |   |     intrusion at all    |
|   |     |                             |   |     times               |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 4 | C-8 |                             |   |                         |
| 3 |     | The information system      |   |                         |
| . | TRA | protects the integrity of   |   |                         |
|   | NSM | transmitted information.    |   |                         |
|   | ISS |                             |   |                         |
|   | ION | Enhancements:               |   |                         |
|   | INT |                             |   |                         |
|   | EGR | \(1\) The organization      |   |                         |
|   | ITY | employs cryptographic       |   |                         |
|   |     | mechanisms to ensure        |   |                         |
|   |     | recognition of changes to\  |   |                         |
|   |     | information during          |   |                         |
|   |     | transmission unless         |   |                         |
|   |     | otherwise protected by      |   |                         |
|   |     | alternative physical        |   |                         |
|   |     | measures (e.g.,\            |   |                         |
|   |     | protective distribution     |   |                         |
|   |     | systems).                   |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The FIPS 199 security       |   |                         |
|   |     | category (for integrity) of |   |                         |
|   |     | the information being       |   |                         |
|   |     | transmitted should guide    |   |                         |
|   |     | the decision on the use of  |   |                         |
|   |     | cryptographic mechanisms.   |   |                         |
|   |     | NSTISSI No. 7003 contains   |   |                         |
|   |     | guidance on the use of      |   |                         |
|   |     | Protective Distribution     |   |                         |
|   |     | Systems. NIST Special       |   |                         |
|   |     | Publication 800-52 provides |   |                         |
|   |     | guidance on protecting      |   |                         |
|   |     | transmission integrity      |   |                         |
|   |     | using Transport Layer       |   |                         |
|   |     | Security (TLS). NIST        |   |                         |
|   |     | Special Publication 800-77  |   |                         |
|   |     | provides guidance on        |   |                         |
|   |     | protecting transmission     |   |                         |
|   |     | integrity using IPsec.      |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 4 | C-9 |                             |   |                         |
| 4 |     | The information system      |   |                         |
| . | TRA | protects the                |   |                         |
|   | NSM | confidentiality of          |   |                         |
|   | ISS | transmitted information.    |   |                         |
|   | ION |                             |   |                         |
|   | CON | Enhancements:               |   |                         |
|   | FID |                             |   |                         |
|   | ENT | \(1\) The organization      |   |                         |
|   | IAL | employs cryptographic       |   |                         |
|   | ITY | mechanisms to prevent       |   |                         |
|   |     | unauthorized disclosure of\ |   |                         |
|   |     | information during          |   |                         |
|   |     | transmission unless         |   |                         |
|   |     | otherwise protected by      |   |                         |
|   |     | alternative physical        |   |                         |
|   |     | measures (e.g.,\            |   |                         |
|   |     | protective distribution     |   |                         |
|   |     | systems).                   |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The FIPS 199 security       |   |                         |
|   |     | category (for               |   |                         |
|   |     | confidentiality) of the     |   |                         |
|   |     | information being           |   |                         |
|   |     | transmitted should guide    |   |                         |
|   |     | the decision on the use of  |   |                         |
|   |     | cryptographic mechanisms.   |   |                         |
|   |     | NSTISSI No. 7003 contains   |   |                         |
|   |     | guidance on the use of      |   |                         |
|   |     | Protective Distribution     |   |                         |
|   |     | Systems. NIST Special       |   |                         |
|   |     | Publication 800-52 provides |   |                         |
|   |     | guidance on protecting      |   |                         |
|   |     | transmission integrity      |   |                         |
|   |     | using Transport Layer       |   |                         |
|   |     | Security\                   |   |                         |
|   |     | (TLS). NIST Special         |   |                         |
|   |     | Publication 800-77 provides |   |                         |
|   |     | guidance on protecting      |   |                         |
|   |     | transmission integrity      |   |                         |
|   |     | using IPsec.                |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 4 | -10 |                             |   |                         |
| 5 |     | The information system      |   |                         |
| . | N   | terminates a network        |   |                         |
|   | ETW | connection at the end of a  |   |                         |
|   | ORK | session or after            |   |                         |
|   | D   | \[*Assignment:              |   |                         |
|   | ISC | organization-defined time   |   |                         |
|   | ONN | period*\] of inactivity.    |   |                         |
|   | ECT |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | MIS |                             |   |                         |
|   | SIN |                             |   |                         |
|   | G** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 4 | -11 |                             |   |                         |
| 6 |     | The information system      |   |                         |
| . | T   | establishes a trusted       |   |                         |
|   | RUS | communications path between |   |                         |
|   | TED | the user and the security   |   |                         |
|   | P   | functionality of the        |   |                         |
|   | ATH | system.                     |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 4 | -12 |                             |   |                         |
| 7 |     | The information system      |   | 6.1.1.1 CA Key Pair     |
| . | C   | employs automated           |   | Generation              |
|   | RYP | mechanisms with supporting  |   |                         |
|   | TOG | procedures or manual        |   | Cryptographic keying    |
|   | RAP | procedures for              |   | material used to sign   |
|   | HIC | cryptographic key           |   | certificates, CRLs or   |
|   | KEY | establishment and key       |   | status information by   |
|   | E   | management.                 |   | the FBCA shall be       |
|   | STA |                             |   | generated in FIPS 140   |
|   | BLI | Enhancements:               |   | validated cryptographic |
|   | SHM |                             |   | modules. Cryptographic  |
|   | ENT | None.                       |   | keying material used to |
|   | AND |                             |   | sign certificates, CRLs |
|   | M   | Supplemental Guidance:      |   | or status information   |
|   | ANA |                             |   | by Entity CAs shall be  |
|   | GEM | NIST Special Publication    |   | generated in FIPS 140   |
|   | ENT | 800-56 provides guidance on |   | validated cryptographic |
|   |     | cryptographic key           |   | modules or modules      |
|   |     | establishment. NIST Special |   | validated under         |
|   |     | Publication 800-57 provides |   | equivalent              |
|   |     | guidance on cryptographic   |   | international           |
|   |     | key management.             |   | standards.              |
|   |     |                             |   |                         |
|   |     | .                           |   | For the FBCA, the       |
|   |     |                             |   | modules shall meet or   |
|   |     |                             |   | exceed Security Level   |
|   |     |                             |   | 3. For Entity CAs, the  |
|   |     |                             |   | modules shall meet or   |
|   |     |                             |   | exceed Security Level 1 |
|   |     |                             |   | (for Rudimentary),      |
|   |     |                             |   | Security Level 2 (for   |
|   |     |                             |   | Basic, Medium, or       |
|   |     |                             |   | Medium Hardware), or    |
|   |     |                             |   | Security Level 3 (for   |
|   |     |                             |   | High). Multiparty       |
|   |     |                             |   | control is required for |
|   |     |                             |   | CA key pair generation  |
|   |     |                             |   | for the FBCA and for    |
|   |     |                             |   | Entity CAs operating at |
|   |     |                             |   | the Medium, Medium      |
|   |     |                             |   | Hardware, or High       |
|   |     |                             |   | levels of assurance, as |
|   |     |                             |   | specified in Section    |
|   |     |                             |   | 5.2.2.                  |
|   |     |                             |   |                         |
|   |     |                             |   | CA key pair generation  |
|   |     |                             |   | must create a           |
|   |     |                             |   | verifiable audit trail  |
|   |     |                             |   | that the security       |
|   |     |                             |   | requirements for        |
|   |     |                             |   | procedures were         |
|   |     |                             |   | followed. For all       |
|   |     |                             |   | levels of assurance,    |
|   |     |                             |   | the documentation of    |
|   |     |                             |   | the procedure must be   |
|   |     |                             |   | detailed enough to show |
|   |     |                             |   | that appropriate role   |
|   |     |                             |   | separation was used.    |
|   |     |                             |   |                         |
|   |     |                             |   | 6.1.1.2 Subscriber Key  |
|   |     |                             |   | Pair Generation         |
|   |     |                             |   |                         |
|   |     |                             |   | Key generation shall be |
|   |     |                             |   | performed using a FIPS  |
|   |     |                             |   | approved method or      |
|   |     |                             |   | equivalent              |
|   |     |                             |   | international standard. |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 4 | -13 |                             |   |                         |
| 8 |     | When cryptography is        |   | 6.1.1.1 CA Key Pair     |
| . | USE | employed within the         |   | Generation              |
|   | OF  | information system, the     |   |                         |
|   | VAL | cryptography complies with  |   | Cryptographic keying    |
|   | IDA | applicable federal laws,    |   | material used to sign   |
|   | TED | directives, policies,       |   | certificates, CRLs or   |
|   | CRY | regulations, standards, and |   | status information by   |
|   | PTO | guidance, including FIPS    |   | the FBCA shall be       |
|   | GRA | 140-2 which requires the    |   | generated in FIPS 140   |
|   | PHY | system to perform all       |   | validated cryptographic |
|   |     | cryptographic operations    |   | modules. Cryptographic  |
|   |     | (including key generation)  |   | keying material used to |
|   |     | using FIPS 140-2 validated  |   | sign certificates, CRLs |
|   |     | cryptographic modules       |   | or status information   |
|   |     | operating in approved modes |   | by Entity CAs shall be  |
|   |     | of operation.               |   | generated in FIPS 140   |
|   |     |                             |   | validated cryptographic |
|   |     | Enhancements:               |   | modules or modules      |
|   |     |                             |   | validated under         |
|   |     | None.                       |   | equivalent              |
|   |     |                             |   | international           |
|   |     | Supplemental Guidance:      |   | standards.              |
|   |     |                             |   |                         |
|   |     | NIST Special Publication    |   | For the FBCA, the       |
|   |     | 800-56 provides guidance on |   | modules shall meet or   |
|   |     | cryptographic key           |   | exceed Security Level   |
|   |     | establishment. NIST Special |   | 3. For Entity CAs, the  |
|   |     | Publication 800-57 provides |   | modules shall meet or   |
|   |     | guidance on cryptographic   |   | exceed Security Level 1 |
|   |     | key management.             |   | (for Rudimentary),      |
|   |     |                             |   | Security Level 2 (for   |
|   |     |                             |   | Basic, Medium, or       |
|   |     |                             |   | Medium Hardware), or    |
|   |     |                             |   | Security Level 3 (for   |
|   |     |                             |   | High). Multiparty       |
|   |     |                             |   | control is required for |
|   |     |                             |   | CA key pair generation  |
|   |     |                             |   | for the FBCA and for    |
|   |     |                             |   | Entity CAs operating at |
|   |     |                             |   | the Medium, Medium      |
|   |     |                             |   | Hardware, or High       |
|   |     |                             |   | levels of assurance, as |
|   |     |                             |   | specified in Section    |
|   |     |                             |   | 5.2.2.                  |
|   |     |                             |   |                         |
|   |     |                             |   | CA key pair generation  |
|   |     |                             |   | must create a           |
|   |     |                             |   | verifiable audit trail  |
|   |     |                             |   | that the security       |
|   |     |                             |   | requirements for        |
|   |     |                             |   | procedures were         |
|   |     |                             |   | followed. For all       |
|   |     |                             |   | levels of assurance,    |
|   |     |                             |   | the documentation of    |
|   |     |                             |   | the procedure must be   |
|   |     |                             |   | detailed enough to show |
|   |     |                             |   | that appropriate role   |
|   |     |                             |   | separation was used.    |
|   |     |                             |   |                         |
|   |     |                             |   | 6.1.1.2 Subscriber Key  |
|   |     |                             |   | Pair Generation         |
|   |     |                             |   |                         |
|   |     |                             |   | Key generation shall be |
|   |     |                             |   | performed using a FIPS  |
|   |     |                             |   | approved method or      |
|   |     |                             |   | equivalent              |
|   |     |                             |   | international standard. |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 4 | -14 |                             |   |                         |
| 9 |     | For publicly available      |   | 6.7 Network Security    |
| . | PUB | systems, the information    |   | Controls                |
|   | LIC | system protects the         |   |                         |
|   | ACC | integrity of the            |   | Network security        |
|   | ESS | information and             |   | controls shall be       |
|   | PR  | applications.               |   | employed to protect the |
|   | OTE |                             |   | FBCA and the FBCA       |
|   | CTI | Enhancements:               |   | Internal Directory.     |
|   | ONS |                             |   | Networking equipment    |
|   |     | None.                       |   | shall turn off unused   |
|   |     |                             |   | network ports and       |
|   |     | Supplemental Guidance:      |   | services. Any network   |
|   |     |                             |   | software installed on   |
|   |     | None.                       |   | the FBCA equipment      |
|   |     |                             |   | shall be necessary to   |
|   |     |                             |   | the functioning of the  |
|   |     |                             |   | FBCA.                   |
|   |     |                             |   |                         |
|   |     |                             |   | The FBCA Border         |
|   |     |                             |   | Directory shall be      |
|   |     |                             |   | connected to the        |
|   |     |                             |   | Internet and provide    |
|   |     |                             |   | continuous service      |
|   |     |                             |   | (except, when           |
|   |     |                             |   | necessary, for brief    |
|   |     |                             |   | periods of maintenance  |
|   |     |                             |   | or backup).             |
|   |     |                             |   |                         |
|   |     |                             |   | Any boundary control    |
|   |     |                             |   | devices used to protect |
|   |     |                             |   | the Border directory or |
|   |     |                             |   | FBCA local area network |
|   |     |                             |   | shall deny all but the  |
|   |     |                             |   | necessary services to   |
|   |     |                             |   | the PKI equipment even  |
|   |     |                             |   | if those services are   |
|   |     |                             |   | enabled for other       |
|   |     |                             |   | devices on the network. |
|   |     |                             |   |                         |
|   |     |                             |   | Entity CAs and          |
|   |     |                             |   | directories shall       |
|   |     |                             |   | employ appropriate      |
|   |     |                             |   | network security        |
|   |     |                             |   | controls. Networking    |
|   |     |                             |   | equipment shall turn    |
|   |     |                             |   | off unused network      |
|   |     |                             |   | ports and services. Any |
|   |     |                             |   | network software        |
|   |     |                             |   | present shall be        |
|   |     |                             |   | necessary to the        |
|   |     |                             |   | functioning of the      |
|   |     |                             |   | equipment.              |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -15 |                             |   |                         |
| 0 |     | The information system      |   | 6.6.1 System            |
| . | C   | prohibits remote activation |   | Development Controls    |
|   | OLL | of collaborative computing  |   |                         |
|   | ABO | mechanisms (e.g., video and |   | -   The CA hardware and |
|   | RAT | audio conferencing) and     |   |     software shall be   |
|   | IVE | provides an explicit        |   |     dedicated to        |
|   | COM | indication of use to the    |   |     performing one      |
|   | PUT | local users (e.g., use of   |   |     task: the CA. There |
|   | ING | camera or microphone).      |   |     shall be no other   |
|   |     |                             |   |     applications;       |
|   |     | Enhancements:               |   |     hardware devices,   |
|   |     |                             |   |     network             |
|   |     | \(1\) The information       |   |     connections, or     |
|   |     | system provides physical    |   |     component software  |
|   |     | disconnect of camera and    |   |     installed which are |
|   |     | microphone in a manner      |   |     not part of the CA  |
|   |     | that\                       |   |     operation.          |
|   |     | supports ease of use.       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -16 |                             |   |                         |
| 1 |     | The information system      |   |                         |
| . | TRA | reliably associates         |   |                         |
|   | NSM | security parameters (e.g.,  |   |                         |
|   | ISS | security labels and         |   |                         |
|   | ION | markings) with information  |   |                         |
|   | OF  | exchanged between           |   |                         |
|   | SE  | information systems.        |   |                         |
|   | CUR |                             |   |                         |
|   | ITY | Enhancements:               |   |                         |
|   | P   |                             |   |                         |
|   | ARA | None.                       |   |                         |
|   | MET |                             |   |                         |
|   | ERS | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | Security parameters may be  |   |                         |
|   |     | explicitly or implicitly    |   |                         |
|   |     | associated with the         |   |                         |
|   |     | information contained       |   |                         |
|   |     | within the information      |   |                         |
|   |     | system.                     |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -17 |                             |   |                         |
| 2 |     | The organization develops   |   |                         |
| . | PUB | and implements a            |   |                         |
|   | LIC | certificate policy and      |   |                         |
|   | KEY | certification practice      |   |                         |
|   | IN  | statement for the issuance  |   |                         |
|   | FRA | of public key certificates  |   |                         |
|   | STR | used in the information     |   |                         |
|   | UCT | system.                     |   |                         |
|   | URE |                             |   |                         |
|   | CER | Enhancements:               |   |                         |
|   | TIF |                             |   |                         |
|   | ICA | None.                       |   |                         |
|   | TES |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | Registration to receive a   |   |                         |
|   |     | public key certificate      |   |                         |
|   |     | includes authorization by a |   |                         |
|   |     | supervisor or a responsible |   |                         |
|   |     | official, and is done by a  |   |                         |
|   |     | secure process that         |   |                         |
|   |     | verifies the identity of    |   |                         |
|   |     | the certificate holder and  |   |                         |
|   |     | ensures that the            |   |                         |
|   |     | certificate is issued to    |   |                         |
|   |     | the intended party. NIST    |   |                         |
|   |     | Special Publication 800-32  |   |                         |
|   |     | provides guidance on public |   |                         |
|   |     | key technology. NIST        |   |                         |
|   |     | Special Publication 800-63  |   |                         |
|   |     | provides guidance on remote |   |                         |
|   |     | electronic authentication.  |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **C |                             |   |                         |
|   | OMP |                             |   |                         |
|   | ARA |                             |   |                         |
|   | BLE |                             |   |                         |
|   | !!! |                             |   |                         |
|   | !** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -18 |                             |   |                         |
| 3 |     | The organization: (i)       |   |                         |
| . | MOB | establishes usage           |   |                         |
|   | ILE | restrictions and            |   |                         |
|   | C   | implementation guidance for |   |                         |
|   | ODE | mobile code technologies    |   |                         |
|   |     | based on the potential to   |   |                         |
|   |     | cause damage to the         |   |                         |
|   |     | information system if used  |   |                         |
|   |     | maliciously; and (ii)       |   |                         |
|   |     | documents, monitors, and    |   |                         |
|   |     | controls the use of mobile  |   |                         |
|   |     | code within the information |   |                         |
|   |     | system. Appropriate         |   |                         |
|   |     | organizational officials    |   |                         |
|   |     | authorize the use of mobile |   |                         |
|   |     | code.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | Mobile code technologies    |   |                         |
|   |     | include, for example, Java, |   |                         |
|   |     | JavaScript, ActiveX, PDF,   |   |                         |
|   |     | Postscript, Shockwave       |   |                         |
|   |     | movies, Flash animations,   |   |                         |
|   |     | and VBScript. Usage         |   |                         |
|   |     | restrictions and            |   |                         |
|   |     | implementation guidance     |   |                         |
|   |     | apply to both the selection |   |                         |
|   |     | and use of mobile code      |   |                         |
|   |     | installed on organizational |   |                         |
|   |     | servers and mobile code     |   |                         |
|   |     | downloaded and executed on  |   |                         |
|   |     | individual workstations.    |   |                         |
|   |     | Control procedures prevent  |   |                         |
|   |     | the development,            |   |                         |
|   |     | acquisition, or             |   |                         |
|   |     | introduction of             |   |                         |
|   |     | unacceptable mobile code    |   |                         |
|   |     | within the information      |   |                         |
|   |     | system. NIST Special        |   |                         |
|   |     | Publication 800-28 provides |   |                         |
|   |     | guidance on active content  |   |                         |
|   |     | and mobile code. Additional |   |                         |
|   |     | information on risk-based   |   |                         |
|   |     | approaches for the          |   |                         |
|   |     | implementation of mobile    |   |                         |
|   |     | code technologies can be    |   |                         |
|   |     | found at:                   |   |                         |
|   |     | http://ia                   |   |                         |
|   |     | se.disa.mil/mcp/index.html. |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -19 |                             |   |                         |
| 4 |     | The organization: (i)       |   |                         |
| . | VO  | establishes usage           |   |                         |
|   | ICE | restrictions and            |   |                         |
|   | O   | implementation guidance for |   |                         |
|   | VER | Voice Over Internet         |   |                         |
|   | IN  | Protocol (VOIP)             |   |                         |
|   | TER | technologies based on the   |   |                         |
|   | NET | potential to cause damage   |   |                         |
|   | PR  | to the information system   |   |                         |
|   | OTO | if used maliciously; and    |   |                         |
|   | COL | (ii) documents, monitors,   |   |                         |
|   |     | and controls the use of     |   |                         |
|   |     | VOIP within the information |   |                         |
|   |     | system. Appropriate         |   |                         |
|   |     | organizational officials    |   |                         |
|   |     | authorize the use of VOIP.  |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-58 provides guidance on |   |                         |
|   |     | security considerations for |   |                         |
|   |     | VOIP technologies employed  |   |                         |
|   |     | in information systems.     |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -20 |                             |   |                         |
| 5 |     | The information system      |   |                         |
| . | SEC | (i.e., authoritative domain |   |                         |
|   | URE | name servers) that provides |   |                         |
|   | N   | the name lookup service for |   |                         |
|   | AME | accessing organizational    |   |                         |
|   | LOO | information resources to    |   |                         |
|   | KUP | entities across the         |   |                         |
|   | S   | Internet provides artifacts |   |                         |
|   | ERV | for data origin             |   |                         |
|   | ICE | authentication and data     |   |                         |
|   | (A  | integrity to enable users   |   |                         |
|   | UTH | to obtain message           |   |                         |
|   | ORI | authentication and message  |   |                         |
|   | TAT | integrity assurances for    |   |                         |
|   | IVE | the information received    |   |                         |
|   | S   | during\                     |   |                         |
|   | OUR | network-based transactions. |   |                         |
|   | CE) |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | \(1\) The information       |   |                         |
|   |     | system verifies the         |   |                         |
|   |     | authenticity of the         |   |                         |
|   |     | artifacts for data origin   |   |                         |
|   |     | authentication and\         |   |                         |
|   |     | data integrity (i.e.,       |   |                         |
|   |     | public key) of any          |   |                         |
|   |     | subsidiary (child) zone in  |   |                         |
|   |     | the name space in instances |   |                         |
|   |     | where\                      |   |                         |
|   |     | the subsidiary (child) zone |   |                         |
|   |     | possesses this capability   |   |                         |
|   |     | (i.e., provides these       |   |                         |
|   |     | artifacts).                 |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-81 provides guidance on |   |                         |
|   |     | secure domain name system   |   |                         |
|   |     | deployment.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    |   | FBCA Section:           |
| 5 | -21 |                             |   |                         |
| 6 |     | The information system      |   |                         |
| . | SEC | (i.e., authoritative domain |   |                         |
|   | URE | name servers) that provides |   |                         |
|   | N   | the name lookup service for |   |                         |
|   | AME | accessing information       |   |                         |
|   | LOO | resources to entities       |   |                         |
|   | KUP | within the organization     |   |                         |
|   | S   | provides mechanisms for     |   |                         |
|   | ERV | data origin authentication  |   |                         |
|   | ICE | and data integrity          |   |                         |
|   | (RE | verification and performs   |   |                         |
|   | SOL | these services when         |   |                         |
|   | UTI | requested by client         |   |                         |
|   | ON) | systems.                    |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | \(1\) The information       |   |                         |
|   |     | system performs data origin |   |                         |
|   |     | authentication and data     |   |                         |
|   |     | integrity verification for  |   |                         |
|   |     | all\                        |   |                         |
|   |     | information received        |   |                         |
|   |     | whether or not client       |   |                         |
|   |     | systems issue such          |   |                         |
|   |     | requests.                   |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-81 provides guidance on |   |                         |
|   |     | secure domain name system   |   |                         |
|   |     | deployment.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC  | Control:                    | F |                         |
| 5 | -22 |                             | B |                         |
| 7 |     |                             | C |                         |
| . |     |                             | A |                         |
|   |     |                             | S |                         |
|   |     |                             | e |                         |
|   |     |                             | c |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | o |                         |
|   |     |                             | n |                         |
|   |     |                             | : |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SC- | Control                     | F |                         |
| 5 | 23: |                             | B |                         |
| 8 |     |                             | C |                         |
| . | Aut |                             | A |                         |
|   | hen |                             | S |                         |
|   | tic |                             | e |                         |
|   | ity |                             | c |                         |
|   | of  |                             | t |                         |
|   | S   |                             | i |                         |
|   | ess |                             | o |                         |
|   | ion |                             | n |                         |
|   |     |                             |   |                         |
|   |     |                             | S |                         |
|   |     |                             | e |                         |
|   |     |                             | c |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | o |                         |
|   |     |                             | n |                         |
|   |     |                             | 4 |                         |
|   |     |                             | . |                         |
|   |     |                             | 1 |                         |
|   |     |                             | . |                         |
|   |     |                             | 2 |                         |
|   |     |                             | : |                         |
|   |     |                             | F |                         |
|   |     |                             | o |                         |
|   |     |                             | r |                         |
|   |     |                             | E |                         |
|   |     |                             | n |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | t |                         |
|   |     |                             | y |                         |
|   |     |                             | C |                         |
|   |     |                             | A |                         |
|   |     |                             | s |                         |
|   |     |                             | , |                         |
|   |     |                             | a |                         |
|   |     |                             | l |                         |
|   |     |                             | l |                         |
|   |     |                             | c |                         |
|   |     |                             | o |                         |
|   |     |                             | m |                         |
|   |     |                             | m |                         |
|   |     |                             | u |                         |
|   |     |                             | n |                         |
|   |     |                             | i |                         |
|   |     |                             | c |                         |
|   |     |                             | a |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | o |                         |
|   |     |                             | n |                         |
|   |     |                             | s |                         |
|   |     |                             | a |                         |
|   |     |                             | m |                         |
|   |     |                             | o |                         |
|   |     |                             | n |                         |
|   |     |                             | g |                         |
|   |     |                             | P |                         |
|   |     |                             | K |                         |
|   |     |                             | I |                         |
|   |     |                             | a |                         |
|   |     |                             | u |                         |
|   |     |                             | t |                         |
|   |     |                             | h |                         |
|   |     |                             | o |                         |
|   |     |                             | r |                         |
|   |     |                             | i |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | e |                         |
|   |     |                             | s |                         |
|   |     |                             | s |                         |
|   |     |                             | u |                         |
|   |     |                             | p |                         |
|   |     |                             | p |                         |
|   |     |                             | o |                         |
|   |     |                             | r |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | n |                         |
|   |     |                             | g |                         |
|   |     |                             | t |                         |
|   |     |                             | h |                         |
|   |     |                             | e |                         |
|   |     |                             | c |                         |
|   |     |                             | e |                         |
|   |     |                             | r |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | f |                         |
|   |     |                             | i |                         |
|   |     |                             | c |                         |
|   |     |                             | a |                         |
|   |     |                             | t |                         |
|   |     |                             | e |                         |
|   |     |                             | a |                         |
|   |     |                             | p |                         |
|   |     |                             | p |                         |
|   |     |                             | l |                         |
|   |     |                             | i |                         |
|   |     |                             | c |                         |
|   |     |                             | a |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | o |                         |
|   |     |                             | n |                         |
|   |     |                             | a |                         |
|   |     |                             | n |                         |
|   |     |                             | d |                         |
|   |     |                             | i |                         |
|   |     |                             | s |                         |
|   |     |                             | s |                         |
|   |     |                             | u |                         |
|   |     |                             | a |                         |
|   |     |                             | n |                         |
|   |     |                             | c |                         |
|   |     |                             | e |                         |
|   |     |                             | p |                         |
|   |     |                             | r |                         |
|   |     |                             | o |                         |
|   |     |                             | c |                         |
|   |     |                             | e |                         |
|   |     |                             | s |                         |
|   |     |                             | s |                         |
|   |     |                             | s |                         |
|   |     |                             | h |                         |
|   |     |                             | a |                         |
|   |     |                             | l |                         |
|   |     |                             | l |                         |
|   |     |                             | b |                         |
|   |     |                             | e |                         |
|   |     |                             | a |                         |
|   |     |                             | u |                         |
|   |     |                             | t |                         |
|   |     |                             | h |                         |
|   |     |                             | e |                         |
|   |     |                             | n |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | c |                         |
|   |     |                             | a |                         |
|   |     |                             | t |                         |
|   |     |                             | e |                         |
|   |     |                             | d |                         |
|   |     |                             | a |                         |
|   |     |                             | n |                         |
|   |     |                             | d |                         |
|   |     |                             | p |                         |
|   |     |                             | r |                         |
|   |     |                             | o |                         |
|   |     |                             | t |                         |
|   |     |                             | e |                         |
|   |     |                             | c |                         |
|   |     |                             | t |                         |
|   |     |                             | e |                         |
|   |     |                             | d |                         |
|   |     |                             | f |                         |
|   |     |                             | r |                         |
|   |     |                             | o |                         |
|   |     |                             | m |                         |
|   |     |                             | m |                         |
|   |     |                             | o |                         |
|   |     |                             | d |                         |
|   |     |                             | i |                         |
|   |     |                             | f |                         |
|   |     |                             | i |                         |
|   |     |                             | c |                         |
|   |     |                             | a |                         |
|   |     |                             | t |                         |
|   |     |                             | i |                         |
|   |     |                             | o |                         |
|   |     |                             | n |                         |
|   |     |                             | . |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 5 | I-1 |                             |   |                         |
| 9 |     | The organization develops,  |   | Applicable sections     |
| . | SYS | disseminates, and           |   | include:                |
|   | TEM | periodically                |   |                         |
|   | AND | reviews/updates: (i) a      |   | ###                     |
|   | IN  | formal, documented, system  |   |  5.3 Personnel Controls |
|   | FOR | and information integrity   |   |                         |
|   | MAT | policy that addresses       |   | ###                     |
|   | ION | purpose, scope, roles,      |   |                         |
|   | INT | responsibilities,           |   | ### 6.5 Com             |
|   | EGR | management commitment,      |   | puter Security Controls |
|   | ITY | coordination among          |   |                         |
|   | POL | organizational entities,    |   | ###                     |
|   | ICY | and compliance; and (ii)    |   |                         |
|   | AND | formal, documented          |   | ### 6.6 Life-           |
|   | P   | procedures to facilitate    |   | cycle Security Controls |
|   | ROC | the implementation of the   |   |                         |
|   | EDU | system and information      |   | ###                     |
|   | RES | integrity policy and        |   |                         |
|   |     | associated system and       |   | ### 6.7 Ne              |
|   |     | information integrity       |   | twork Security Controls |
|   |     | controls.                   |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The system and information  |   |                         |
|   |     | integrity policy and        |   |                         |
|   |     | procedures are consistent   |   |                         |
|   |     | with applicable federal     |   |                         |
|   |     | laws, directives, policies, |   |                         |
|   |     | regulations, standards, and |   |                         |
|   |     | guidance. The system and    |   |                         |
|   |     | information integrity       |   |                         |
|   |     | policy can be included as   |   |                         |
|   |     | part of the general         |   |                         |
|   |     | information security policy |   |                         |
|   |     | for the organization.       |   |                         |
|   |     | System and information      |   |                         |
|   |     | integrity procedures can be |   |                         |
|   |     | developed for the security  |   |                         |
|   |     | program in general, and for |   |                         |
|   |     | a particular information    |   |                         |
|   |     | system, when required. NIST |   |                         |
|   |     | Special Publication 800-12  |   |                         |
|   |     | provides guidance on        |   |                         |
|   |     | security policies and       |   |                         |
|   |     | procedures.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-2 |                             |   |                         |
| 0 |     | The organization            |   |                         |
| . | F   | identifies, reports, and    |   |                         |
|   | LAW | corrects information system |   |                         |
|   | RE  | flaws.                      |   |                         |
|   | MED |                             |   |                         |
|   | IAT | Enhancements:               |   |                         |
|   | ION |                             |   |                         |
|   |     | \(1\) The organization      |   |                         |
|   |     | centrally manages the flaw  |   |                         |
|   |     | remediation process and     |   |                         |
|   |     | installs updates\           |   |                         |
|   |     | automatically without       |   |                         |
|   |     | individual user             |   |                         |
|   |     | intervention.\              |   |                         |
|   |     | (2) The organization        |   |                         |
|   |     | employs automated           |   |                         |
|   |     | mechanisms to periodically  |   |                         |
|   |     | and upon command determine\ |   |                         |
|   |     | the state of information    |   |                         |
|   |     | system components with      |   |                         |
|   |     | regard to flaw remediation. |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The organization identifies |   |                         |
|   |     | information systems         |   |                         |
|   |     | containing software         |   |                         |
|   |     | affected by recently        |   |                         |
|   |     | announced software flaws    |   |                         |
|   |     | (and potential              |   |                         |
|   |     | vulnerabilities resulting   |   |                         |
|   |     | from those flaws).          |   |                         |
|   |     | Proprietary software can be |   |                         |
|   |     | found in either             |   |                         |
|   |     | commercial/government       |   |                         |
|   |     | off-the-shelf information   |   |                         |
|   |     | technology component        |   |                         |
|   |     | products or in              |   |                         |
|   |     | custom-developed            |   |                         |
|   |     | applications. The           |   |                         |
|   |     | organization (or the        |   |                         |
|   |     | software developer/vendor   |   |                         |
|   |     | in the case of software     |   |                         |
|   |     | developed and maintained by |   |                         |
|   |     | a vendor/contractor)        |   |                         |
|   |     | promptly installs newly     |   |                         |
|   |     | released security relevant  |   |                         |
|   |     | patches, service packs, and |   |                         |
|   |     | hot fixes, and tests        |   |                         |
|   |     | patches, service packs, and |   |                         |
|   |     | hot fixes for effectiveness |   |                         |
|   |     | and potential side effects  |   |                         |
|   |     | on the organization's       |   |                         |
|   |     | information systems before  |   |                         |
|   |     | installation. Flaws         |   |                         |
|   |     | discovered during security  |   |                         |
|   |     | assessments, continuous     |   |                         |
|   |     | monitoring (See security    |   |                         |
|   |     | controls ca-2, ca-4, or     |   |                         |
|   |     | ca-7), or incident response |   |                         |
|   |     | activities (See security    |   |                         |
|   |     | control ir-4) should also   |   |                         |
|   |     | be addressed expeditiously. |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-40 (Version 2) provides |   |                         |
|   |     | guidance on security patch  |   |                         |
|   |     | installation and patch      |   |                         |
|   |     | management.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-3 |                             |   |                         |
| 1 | (1) | The information system      |   | 6.6.1 System            |
| . |     | implements malicious code   |   | Development Controls    |
|   | MAL | protection that includes a  |   |                         |
|   | ICI | capability for automatic    |   | -   Proper care shall   |
|   | OUS | updates.                    |   |     be taken to prevent |
|   | C   |                             |   |     malicious software  |
|   | ODE | Enhancements:               |   |     from being loaded   |
|   | P   |                             |   |     onto the CA         |
|   | ROT | \(1\) The organization      |   |     equipment. Hardware |
|   | ECT | centrally manages virus     |   |     and software shall  |
|   | ION | malicious code protection   |   |     be scanned for      |
|   |     | mechanisms.\                |   |     malicious code on   |
|   |     | (2) The information system  |   |     first use and       |
|   |     | automatically updates virus |   |     periodically        |
|   |     | malicious code protection   |   |     thereafter.         |
|   |     | mechanisms.                 |   |                         |
|   |     |                             |   | 5.1.2.1 Physical Access |
|   |     | Supplemental Guidance:      |   | for CA Equipment        |
|   |     |                             |   |                         |
|   |     | The organization employs    |   | In addition to those    |
|   |     | malicious code protection   |   | requirements, the       |
|   |     | mechanisms at critical      |   | following requirements  |
|   |     | information system entry    |   | shall apply to CAs that |
|   |     | and exit points (e.g.,      |   | issue Medium, Medium    |
|   |     | firewalls, electronic mail  |   | Hardware, or High       |
|   |     | servers, web servers, proxy |   | assurance certificates: |
|   |     | servers, remote-access      |   |                         |
|   |     | servers) and at             |   | -   Ensure manual or    |
|   |     | workstations, servers, or   |   |     electronic          |
|   |     | mobile computing devices on |   |     monitoring for      |
|   |     | the network. The            |   |     unauthorized        |
|   |     | organization uses the       |   |     intrusion at all    |
|   |     | malicious code protection   |   |     times               |
|   |     | mechanisms to detect and    |   |                         |
|   |     | eradicate malicious code    |   |                         |
|   |     | (e.g., viruses, worms,      |   |                         |
|   |     | Trojan horses) transported: |   |                         |
|   |     | (i) by electronic mail,     |   |                         |
|   |     | electronic mail             |   |                         |
|   |     | attachments, Internet       |   |                         |
|   |     | accesses, removable media   |   |                         |
|   |     | (e.g., diskettes or compact |   |                         |
|   |     | disks), or other common     |   |                         |
|   |     | means; or (ii) by           |   |                         |
|   |     | exploiting information      |   |                         |
|   |     | system vulnerabilities. The |   |                         |
|   |     | organization updates virus  |   |                         |
|   |     | protection mechanisms       |   |                         |
|   |     | (including the latest virus |   |                         |
|   |     | definitions) whenever new   |   |                         |
|   |     | releases are available in   |   |                         |
|   |     | accordance with             |   |                         |
|   |     | organizational              |   |                         |
|   |     | configuration management    |   |                         |
|   |     | policy and procedures.      |   |                         |
|   |     | Consideration is given to   |   |                         |
|   |     | using malicious code        |   |                         |
|   |     | protection software         |   |                         |
|   |     | products from multiple      |   |                         |
|   |     | vendors (e.g., using one    |   |                         |
|   |     | vendor for boundary devices |   |                         |
|   |     | and servers and another     |   |                         |
|   |     | vendor for workstations).   |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-83 provides guidance on |   |                         |
|   |     | implementing malicious code |   |                         |
|   |     | protection.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-4 |                             |   |                         |
| 2 | (4) | The organization employs    |   | 5.1.2.1 Physical Access |
| . |     | tools and techniques to     |   | for CA Equipment        |
|   | IN  | monitor events on the       |   |                         |
|   | FOR | information system, detect  |   | In addition to those    |
|   | MAT | attacks, and provide        |   | requirements, the       |
|   | ION | identification of           |   | following requirements  |
|   | SYS | unauthorized use of the     |   | shall apply to CAs that |
|   | TEM | system.                     |   | issue Medium, Medium    |
|   | M   |                             |   | Hardware, or High       |
|   | ONI | Enhancements:               |   | assurance certificates: |
|   | TOR |                             |   |                         |
|   | ING | \(1\) The organization      |   | -   Ensure manual or    |
|   | TO  | networks individual         |   |     electronic          |
|   | OLS | intrusion detection tools   |   |     monitoring for      |
|   | AND | into a systemwide           |   |     unauthorized        |
|   | T   | intrusion\                  |   |     intrusion at all    |
|   | ECH | detection system using      |   |     times               |
|   | NIQ | common protocols.\          |   |                         |
|   | UES | (2) The organization        |   | 6.6.2 Security          |
|   |     | employs automated tools to  |   | Management Controls     |
|   |     | support near-real-time      |   |                         |
|   |     | analysis of events in       |   | The configuration of    |
|   |     | support\                    |   | the FBCA or Entity CA   |
|   |     | of detecting system-level   |   | system as well as any   |
|   |     | attacks.\                   |   | modifications and       |
|   |     | (3) The organization        |   | upgrades shall be       |
|   |     | employs automated tools to  |   | documented and          |
|   |     | integrate intrusion         |   | controlled. There shall |
|   |     | detection tools into        |   | be a mechanism for      |
|   |     | access\                     |   | detecting unauthorized  |
|   |     | control and flow control    |   | modification to the     |
|   |     | mechanisms for rapid        |   | FBCA or Entity CA       |
|   |     | response to attacks by      |   | software or             |
|   |     | enabling reconfiguration    |   | configuration. A formal |
|   |     | of\                         |   | configuration           |
|   |     | these mechanisms in support |   | management methodology  |
|   |     | of attack isolation and     |   | shall be used for       |
|   |     | elimination.\               |   | installation and        |
|   |     | (4) The information system  |   | ongoing maintenance of  |
|   |     | monitors inbound and        |   | the FBCA or Entity CA   |
|   |     | outbound communications for |   | system. The FBCA or     |
|   |     | unusual or\                 |   | Entity CA software,     |
|   |     | unauthorized activities     |   | when first loaded,      |
|   |     | indicating the presence of  |   | shall be verified as    |
|   |     | malware (e.g., malicious    |   | being that supplied     |
|   |     | code, spyware, adware).     |   | from the vendor, with   |
|   |     |                             |   | no modifications, and   |
|   |     | Supplemental Guidance:      |   | be the version intended |
|   |     |                             |   | for use. For the FBCA,  |
|   |     | Information system          |   | the integrity of the    |
|   |     | monitoring capability can   |   | software shall be       |
|   |     | be achieved through a       |   | verified by the FPKI    |
|   |     | variety of tools and        |   | Operational Authority   |
|   |     | techniques (e.g., intrusion |   | at least weekly (e.g.,  |
|   |     | detection systems,          |   | in conjunction with CRL |
|   |     | intrusion prevention        |   | publication).           |
|   |     | systems, malicious code     |   |                         |
|   |     | protection software, log    |   | 5.4.8 Vulnerability     |
|   |     | monitoring software,        |   | Assessments             |
|   |     | network monitoring          |   |                         |
|   |     | software, network forensic  |   | FBCA personnel shall    |
|   |     | analysis tools). Monitoring |   | routinely assess        |
|   |     | devices can be              |   | whether the CA system   |
|   |     | strategically deployed      |   | or its components have  |
|   |     | within the information      |   | been attacked or        |
|   |     | system (e.g., at selected   |   | breached.               |
|   |     | perimeter locations, near   |   |                         |
|   |     | server farms supporting     |   | For Entity CAs,         |
|   |     | critical applications) to   |   | personnel shall perform |
|   |     | collect essential           |   | routine assessments for |
|   |     | information. Monitoring     |   | evidence of malicious   |
|   |     | devices can also be         |   | activity                |
|   |     | deployed at ad hoc          |   |                         |
|   |     | locations within the system |   |                         |
|   |     | to track specific           |   |                         |
|   |     | transactions (See related   |   |                         |
|   |     | security control AC-8 for   |   |                         |
|   |     | system use notification).   |   |                         |
|   |     | Additionally, these devices |   |                         |
|   |     | can be used to track the    |   |                         |
|   |     | impact of security changes  |   |                         |
|   |     | to the information system.  |   |                         |
|   |     | The granularity of the      |   |                         |
|   |     | information collected can   |   |                         |
|   |     | be determined by the        |   |                         |
|   |     | organization based upon its |   |                         |
|   |     | monitoring objectives and   |   |                         |
|   |     | the capability of the       |   |                         |
|   |     | information system to       |   |                         |
|   |     | support such activities.    |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-83 provides guidance on |   |                         |
|   |     | detecting malware-based     |   |                         |
|   |     | attacks through malicious   |   |                         |
|   |     | code protection software.   |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-61 provides guidance on |   |                         |
|   |     | detecting attacks through   |   |                         |
|   |     | various types of security   |   |                         |
|   |     | technologies.               |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-5 |                             |   |                         |
| 3 |     | The organization receives   |   |                         |
| . | SE  | information system security |   |                         |
|   | CUR | alerts/advisories on a      |   |                         |
|   | ITY | regular basis, issues       |   |                         |
|   | ALE | alerts/advisories to        |   |                         |
|   | RTS | appropriate personnel, and  |   |                         |
|   | AND | takes appropriate actions   |   |                         |
|   | A   | in response.                |   |                         |
|   | DVI |                             |   |                         |
|   | SOR | Enhancements:               |   |                         |
|   | IES |                             |   |                         |
|   |     | \(1\) The organization      |   |                         |
|   |     | employs automated           |   |                         |
|   |     | mechanisms to make security |   |                         |
|   |     | alert and advisory          |   |                         |
|   |     | information\                |   |                         |
|   |     | available throughout the    |   |                         |
|   |     | organization as needed.     |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The organization documents  |   |                         |
|   |     | the types of actions to be  |   |                         |
|   |     | taken in response to        |   |                         |
|   |     | security alerts/advisories. |   |                         |
|   |     | The organization also       |   |                         |
|   |     | maintains contact with      |   |                         |
|   |     | special interest groups\    |   |                         |
|   |     | (e.g., information security |   |                         |
|   |     | forums) that: (i)           |   |                         |
|   |     | facilitate sharing of       |   |                         |
|   |     | security-related            |   |                         |
|   |     | information (e.g., threats, |   |                         |
|   |     | vulnerabilities, and latest |   |                         |
|   |     | security technologies);     |   |                         |
|   |     | (ii) provide access to      |   |                         |
|   |     | advice from security        |   |                         |
|   |     | professionals; and (iii)    |   |                         |
|   |     | improve knowledge of        |   |                         |
|   |     | security best practices.    |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-40 provides guidance on |   |                         |
|   |     | monitoring and distributing |   |                         |
|   |     | security alerts and         |   |                         |
|   |     | advisories.                 |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-6 |                             |   |                         |
| 4 |     | The information system      |   |                         |
| . | SE  | verifies, to the extent     |   |                         |
|   | CUR | feasible, the correct       |   |                         |
|   | ITY | operation of security       |   |                         |
|   | F   | functions \[*Selection (one |   |                         |
|   | UNC | or more): upon system       |   |                         |
|   | TIO | startup and restart, upon   |   |                         |
|   | NAL | command by user with        |   |                         |
|   | ITY | appropriate privilege,      |   |                         |
|   | VER | periodically every*         |   |                         |
|   | IFI | \[*Assignment:              |   |                         |
|   | CAT | organization-defined        |   |                         |
|   | ION | time-period*\]\] and        |   |                         |
|   |     | \[*Selection (one or more): |   |                         |
|   |     | notifies system             |   |                         |
|   |     | administrator, shuts the    |   |                         |
|   |     | system down, restarts the   |   |                         |
|   |     | system*\] when anomalies    |   |                         |
|   |     | are discovered.             |   |                         |
|   |     |                             |   |                         |
|   |     | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | \(1\) The organization      |   |                         |
|   |     | employs automated           |   |                         |
|   |     | mechanisms to provide       |   |                         |
|   |     | notification of failed      |   |                         |
|   |     | security tests.\            |   |                         |
|   |     | (2) The organization        |   |                         |
|   |     | employs automated           |   |                         |
|   |     | mechanisms to support       |   |                         |
|   |     | management of distributed   |   |                         |
|   |     | security\                   |   |                         |
|   |     | testing.                    |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-7 |                             |   |                         |
| 5 |     | The information system      |   |                         |
| . | SO  | detects and protects        |   |                         |
|   | FTW | against unauthorized        |   |                         |
|   | ARE | changes to software and     |   |                         |
|   | AND | information.                |   |                         |
|   | IN  |                             |   |                         |
|   | FOR | Enhancements:               |   |                         |
|   | MAT |                             |   |                         |
|   | ION | None.                       |   |                         |
|   | INT |                             |   |                         |
|   | EGR | Supplemental Guidance:      |   |                         |
|   | ITY |                             |   |                         |
|   |     | The organization employs    |   |                         |
|   |     | integrity verification      |   |                         |
|   |     | applications on the         |   |                         |
|   |     | information system to look  |   |                         |
|   |     | for evidence of information |   |                         |
|   |     | tampering, errors, and      |   |                         |
|   |     | omissions. The organization |   |                         |
|   |     | employs good software       |   |                         |
|   |     | engineering practices with  |   |                         |
|   |     | regard to commercial        |   |                         |
|   |     | off-the-shelf integrity     |   |                         |
|   |     | mechanisms (e.g., parity    |   |                         |
|   |     | checks, cyclical redundancy |   |                         |
|   |     | checks, cryptographic       |   |                         |
|   |     | hashes) and uses tools to   |   |                         |
|   |     | automatically monitor the   |   |                         |
|   |     | integrity of the            |   |                         |
|   |     | information system and the  |   |                         |
|   |     | applications it hosts.      |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-8 |                             |   |                         |
| 6 |     | The information system      |   |                         |
| . | S   | implements spam protection. |   |                         |
|   | PAM |                             |   |                         |
|   | P   | Enhancements:               |   |                         |
|   | ROT |                             |   |                         |
|   | ECT | \(1\) The organization      |   |                         |
|   | ION | centrally manages spam and  |   |                         |
|   |     | spyware protection          |   |                         |
|   |     | mechanisms.\                |   |                         |
|   |     | (2) The information system  |   |                         |
|   |     | automatically updates spam  |   |                         |
|   |     | and spyware protection      |   |                         |
|   |     | mechanisms.                 |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | The organization employs    |   |                         |
|   |     | spam protection mechanisms  |   |                         |
|   |     | at critical information     |   |                         |
|   |     | system entry points (e.g.,  |   |                         |
|   |     | firewalls, electronic mail  |   |                         |
|   |     | servers, remote-access      |   |                         |
|   |     | servers) and at             |   |                         |
|   |     | workstations, servers, or   |   |                         |
|   |     | mobile computing devices on |   |                         |
|   |     | the network. The            |   |                         |
|   |     | organization uses the spam  |   |                         |
|   |     | protection mechanisms to    |   |                         |
|   |     | detect and take appropriate |   |                         |
|   |     | action on unsolicited       |   |                         |
|   |     | messages transported by     |   |                         |
|   |     | electronic mail, electronic |   |                         |
|   |     | mail attachments, Internet  |   |                         |
|   |     | accesses, or other common   |   |                         |
|   |     | means. Consideration is     |   |                         |
|   |     | given to using spam         |   |                         |
|   |     | protection software         |   |                         |
|   |     | products from multiple      |   |                         |
|   |     | vendors (e.g., using one    |   |                         |
|   |     | vendor for boundary devices |   |                         |
|   |     | and servers and another     |   |                         |
|   |     | vendor for workstations).   |   |                         |
|   |     | NIST Special Publication    |   |                         |
|   |     | 800-45 provides guidance on |   |                         |
|   |     | electronic mail security.   |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | *   |                             |   |                         |
|   | *N/ |                             |   |                         |
|   | A** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | S   | Control:                    |   | FBCA Section:           |
| 6 | I-9 |                             |   |                         |
| 7 |     | The organization restricts  |   | 5.1.2.1 Physical Access |
| . | IN  | the information input to    |   | for CA Equipment        |
|   | FOR | the information system to   |   |                         |
|   | MAT | authorized personnel only.  |   | The physical security   |
|   | ION |                             |   | requirements pertaining |
|   | IN  | Enhancements:               |   | to CAs that issue Basic |
|   | PUT |                             |   | Assurance certificates  |
|   | RES | None.                       |   | are:                    |
|   | TRI |                             |   |                         |
|   | CTI | Supplemental Guidance:      |   | -   Ensure no           |
|   | ONS |                             |   |     unauthorized access |
|   |     | Restrictions on personnel   |   |     to the hardware is  |
|   |     | authorized to input         |   |     permitted           |
|   |     | information to the          |   |                         |
|   |     | information system may      |   | 5.2.3 Identification    |
|   |     | extend beyond the typical   |   | and Authentication for  |
|   |     | access controls employed by |   | Each Role               |
|   |     | the system and include      |   |                         |
|   |     | limitations based on        |   | At all assurance levels |
|   |     | specific                    |   | other than Rudimentary, |
|   |     | operational/project         |   | an individual shall     |
|   |     | responsibilities.           |   | identify and            |
|   |     |                             |   | authenticate            |
|   |     |                             |   | him/herself before      |
|   |     |                             |   | being permitted to      |
|   |     |                             |   | perform any actions set |
|   |     |                             |   | forth above for that    |
|   |     |                             |   | role or identity        |
|   |     |                             |   |                         |
|   |     |                             |   | 6.6.2 Security          |
|   |     |                             |   | Management Controls     |
|   |     |                             |   |                         |
|   |     |                             |   | The configuration of    |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system as well as any   |
|   |     |                             |   | modifications and       |
|   |     |                             |   | upgrades shall be       |
|   |     |                             |   | documented and          |
|   |     |                             |   | controlled. There shall |
|   |     |                             |   | be a mechanism for      |
|   |     |                             |   | detecting unauthorized  |
|   |     |                             |   | modification to the     |
|   |     |                             |   | FBCA or Entity CA       |
|   |     |                             |   | software or             |
|   |     |                             |   | configuration. A formal |
|   |     |                             |   | configuration           |
|   |     |                             |   | management methodology  |
|   |     |                             |   | shall be used for       |
|   |     |                             |   | installation and        |
|   |     |                             |   | ongoing maintenance of  |
|   |     |                             |   | the FBCA or Entity CA   |
|   |     |                             |   | system. The FBCA or     |
|   |     |                             |   | Entity CA software,     |
|   |     |                             |   | when first loaded,      |
|   |     |                             |   | shall be verified as    |
|   |     |                             |   | being that supplied     |
|   |     |                             |   | from the vendor, with   |
|   |     |                             |   | no modifications, and   |
|   |     |                             |   | be the version intended |
|   |     |                             |   | for use. For the FBCA,  |
|   |     |                             |   | the integrity of the    |
|   |     |                             |   | software shall be       |
|   |     |                             |   | verified by the FPKI    |
|   |     |                             |   | Operational Authority   |
|   |     |                             |   | at least weekly (e.g.,  |
|   |     |                             |   | in conjunction with CRL |
|   |     |                             |   | publication).           |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SI  | Control:                    |   | FBCA Section:           |
| 6 | -10 |                             |   |                         |
| 8 |     | The information system      |   | 4.2 Certificate         |
| . | IN  | checks information for      |   | Application Processing  |
|   | FOR | accuracy, completeness,     |   |                         |
|   | MAT | validity, and authenticity. |   | Information in          |
|   | ION |                             |   | certificate             |
|   | ACC | Enhancements:               |   | applications must be    |
|   | URA |                             |   | verified as accurate    |
|   | CY, | None.                       |   | before certificates are |
|   | C   |                             |   | issued. Entity CPs      |
|   | OMP | Supplemental Guidance:      |   | shall specify           |
|   | LET |                             |   | procedures to verify    |
|   | ENE | Checks for accuracy,        |   | information in          |
|   | SS, | completeness, validity, and |   | certificate             |
|   | VAL | authenticity of information |   | applications.           |
|   | IDI | should be accomplished as   |   |                         |
|   | TY, | close to the point of       |   | 5.5.7 Procedures to     |
|   | AND | origin as possible. Rules   |   | Obtain & Verify Archive |
|   | AUT | for checking the valid      |   | Information             |
|   | HEN | syntax of information       |   |                         |
|   | TIC | system inputs (e.g.,        |   | Procedures detailing    |
|   | ITY | character set, length,      |   | how to create, verify,  |
|   |     | numerical range, acceptable |   | package, transmit, and  |
|   |     | values) are in place to     |   | store archive           |
|   |     | ensure that inputs match    |   | information shall be    |
|   |     | specified definitions for   |   | published in the        |
|   |     | format and content. Inputs  |   | applicable CP or CPS.   |
|   |     | passed to interpreters      |   |                         |
|   |     | should be prescreened to    |   |                         |
|   |     | ensure the content is not   |   |                         |
|   |     | unintentionally interpreted |   |                         |
|   |     | as commands. The extent to  |   |                         |
|   |     | which the information       |   |                         |
|   |     | system is able to check the |   |                         |
|   |     | accuracy, completeness,     |   |                         |
|   |     | validity, and authenticity  |   |                         |
|   |     | of information should be    |   |                         |
|   |     | guided by organizational    |   |                         |
|   |     | policy and operational      |   |                         |
|   |     | requirements.               |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SI  | Control:                    |   | FBCA Section:           |
| 6 | -11 |                             |   |                         |
| 9 |     | The information system      |   |                         |
| . | ER  | identifies and handles      |   |                         |
|   | ROR | error conditions in an      |   |                         |
|   | HA  | expeditious manner.         |   |                         |
|   | NDL |                             |   |                         |
|   | ING | Enhancements:               |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
|   |     |                             |   |                         |
|   |     | Supplemental Guidance:      |   |                         |
|   |     |                             |   |                         |
|   |     | None.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | COM |                             |   |                         |
|   | PAR |                             |   |                         |
|   | ABL |                             |   |                         |
|   | E** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+
| 1 | SI  | Control:                    |   | FBCA Section:           |
| 7 | -12 |                             |   |                         |
| 0 |     | The organization handles    |   | Applicable Sections     |
| . | IN  | and retains output from the |   | Include:                |
|   | FOR | information system in       |   |                         |
|   | MAT | accordance with             |   | 5.4 Audit Logging       |
|   | ION | organizational policy and   |   | Procedures              |
|   | OUT | operational requirements.   |   |                         |
|   | PUT |                             |   | 5.5 Records Archive     |
|   | HA  | Enhancements:               |   |                         |
|   | NDL |                             |   |                         |
|   | ING | None.                       |   |                         |
|   | AND |                             |   |                         |
|   | RET | Supplemental Guidance:      |   |                         |
|   | ENT |                             |   |                         |
|   | ION | None.                       |   |                         |
+---+-----+-----------------------------+---+-------------------------+
|   | O   | Comments:                   |   |                         |
|   | ver |                             |   |                         |
|   | all |                             |   |                         |
|   | Mat |                             |   |                         |
|   | ch: |                             |   |                         |
|   |     |                             |   |                         |
|   | **  |                             |   |                         |
|   | EXC |                             |   |                         |
|   | EED |                             |   |                         |
|   | S** |                             |   |                         |
+---+-----+-----------------------------+---+-------------------------+