**FPKI CPWG Mapping Comparison Matrix**

**Federal Bridge Certification Authority (FBCA)**

**Medium Hardware Level of Assurance Requirements**

**Mapping Matrix For Cross Certification**

Version 4.1 September 2008

Table of Contents

[1.0 INTRODUCTION 3](#introduction)

[2.0 PKI SUMMARIES 3](#pki-summaries)

[3.0 ASSESSMENT 5](#assessment)

[4.0 DETAILED ASSESSMENT 6](#detailed-assessment)

[5.0 REFERENCES 16](#references)

[6.0 CONTACT DETAILS 17](#contact-details)

# 

# 

#  

# **1.0 INTRODUCTION**

The purposes of this certificate policy comparison, in relation to the
comparison study conducted with the ENTITY CP \[2\] and the FBCA CP
\[3\], are:

> 1\) To identify at a high-level the areas of inconsistency and/or
> similarity between the contents of these two Certificate Policy (CP)
> documents to cross certify at a Medium-Hardware Level of Assurance,
> and
>
> 2\) To recommend appropriate changes, if required, to the ENTITY CP
> \[2\] that would make it more consistent with the FBCA CP \[3\].

This document is organized to achieve these purposes in the following
sections:

> 1\) **PKI SUMMARIES**, which provides a high-level overview of the
> PKIs represented by the Certificate Policies being compared in this
> analysis; and
>
> 2\) **DETAILED ASSESSMENT**, which presents a detailed breakdown of
> the Medium assurance requirements in the FBCA CP, section by section,
> and categorizes the degree of similarity of the ENTITY CP to the FBCA
> CP. Comments to explain the rationale for the degree of similarity are
> also provided, where necessary. The topical and organizational
> framework used as a basis for this comparison is Request for Comments
> (RFC) 3647 the Internet X.509 Public Key Infrastructure Certificate
> Policy and Certification Practices Framework \[1\].

# **2.0 PKI SUMMARIES**

The Federal Bridge Certification Authority (FBCA) is the unifying
element to link autonomous Certification Authorities (CA's) into a
systematic overall Public Key Infrastructure (PKI). The FBCA functions
as a non-hierarchical hub allowing relying parties to create certificate
trust paths from their PKI domains back to the PKI domain of the
Certification Authority that issued the certificate, so that the levels
of assurance honored by disparate PKI's can be reconciled.

The General Services Administration (GSA), under the auspices of the
Federal Public Key Infrastructure Policy Authority (FPKIPA) operates the
FBCA. In order to promote interoperability and the appropriate use of
certificate policies, the FBCA has issued a minimum set of operational
requirements that support trust path creation and verification of
digital certificates. The FBCA will issue cross-certificates to other
autonomous Principal CA's, and then only when authorized by the FPKIPA.
Initially, autonomous CA's that operate in trust domains that meet the
requirements established by the FPKIPA will be eligible to cross-certify
with the FBCA.

The FBCA is designed to provide a mechanism for entities employing
entity-specific PKI's to interoperate efficiently. The FBCA allows
entities to create and process trust paths between specific PKI's, so
that digital certificates issued by one CA can be honored with an
appropriate level of trust \[or assurance\] by a different CA.

The FBCA acts as a non-hierarchical \"hub.\" A Principal CA receives
permission to interoperate with the FBCA under terms and conditions
described in the application for cross certification. This system will
allow every CA that cross certifies with the FBCA the possibility of
interoperating with all participating agencies using FBCA-issued cross
certificates, in an environment of trust and reliability. This is
accomplished through the use of policy mapping, which is how
certificates issued in different agency PKIs meet one another\'s
standards for authentication, integrity of data, non-repudiation, and
encryption of data. Policy mappings between the autonomous Principal CA
and the FBCA are proposed by the entity and approved by the FPKIPA, and
then placed in the certificate issued by the FBCA to the autonomous
Principal CA's.

When the Applicant is determining whether to rely on a certificate
issued by another agency or party, it is not required to use the mapping
expressed in the FBCA certificates. The Applicant, at its sole
discretion, may choose to use a separate mapping for certain
transactions or for all transactions.

The ENTITY CP operates a PKI to provide security for its electronic
information. The ENTITY CP consists of products and services that
provide and manage X.509v3 certificates for public-key cryptography. An
ENTITY CP digital certificate identifies the individual named in the
certificate requestor/holder, and binds that person to a unique
public/private key pair.

[]{.mark}

Programs that carry out or support ENTITY CP missions may require the
type of security services provided by a PKI such as authentication,
confidentiality, encryption, non-repudiation, and access control. These
services are met with an array of network security components such as
web servers, guards, firewalls, routers, and trusted database servers.
The operation of these components is supported and complemented by use
of public-key cryptography. As a system solution, the components share
the burden of the total system security. The use of public key
certificates does not add any security services in a poorly designed or
implemented system. The reliability of the public-key cryptography
portion of the security solution is a direct result of the secure and
trustworthy operation of an established PKI, including equipment,
facilities, personnel, and procedures.

The ENTITY CP Certificate Policy (CP) follows and complies with the
Internet Engineering Task Force (IETF) Request for Comment (RFC) 3647
X.509 PKI CP and Certification Practices Framework. The ENTITY CP
defines the primary obligations and operational responsibilities of all
ENTITY CP program participants, and defines the creation, management and
use of X.509 Version 3 digital certificates. The ENTITY CP defines the
applicability of assurance levels for the protection of information
based on its value or sensitivity, the risk and the consequences of
loss, disclosure or modification.

#  

# **3.0** **ASSESSMENT**

The following seven evaluation terms and their definitions, listed in
order of degree of conformity, were used to assess the ENTITY CP
alignment to the FBCA CP elements:

1)  **Exceeds** - The ENTITY CP policy provides a higher level of
    assurance/security than the FBCA CP requirement

2)  **Equivalent** - The ENTITY CP policy provides exactly the same
    assurance/security as the FBCA CP requirement.

3)  **Comparable** - The ENTITY CP contains dissimilar policy contents,
    but provides a comparable level of assurance to meet the security to
    the FBCA CP requirement.

4)  **Partial** - The ENTITY CP contains policy that is comparable, but
    it does not address the entire FBCA CP requirement.

5)  **Not Comparable** - The ENTITY CP contains dissimilar policy
    contents, which provides a lower level of assurance/security than
    the FBCA CP requirement.

6)  **Missing** - The ENTITY CP does not contain policy contents that
    can be compared to the FBCA CP requirement in any way.

7)  **N/A** -- Not Applicable to ENTITY CP or required for FBCA cross
    certification.

# **4.0 DETAILED ASSESSMENT**

This section of the report presents the mapping comparison results for
the FBCA CP and the ENTITY CP for Medium-Hardware Level of Assurance
requirements. This mapping comparison report works in conjunction with
the FPKIPA General Requirements CP Mapping Matrix report \[4\]. The
following tables contain the specific Medium-Hardware Level of Assurance
CP requirements for mapping to the FBCA CP. The mapping comparison is
characterized using the evaluation terms listed in the
[ASSESSMENT](#section-3).

The detailed mapping results provide the FBCA requirements to be mapped,
the applicable policy text from the ENTITY CP, the overall evaluation
result for each requirement element addressed by the ENTITY CP, as well
as comments that will clarify the evaluation result and suggest
recommendations for improvement of that particular section in the ENTITY
CP. By default, the evaluation results listed in the "Overall Match"
field indicates all results when multiple policy elements from the
ENTITY CP are mapped to a particular FBCA CP requirement.

NOTE: Non-shaded tables appear in the Medium mapping matrix. Tables
shaded in Yellow contain requirements that are specifically for Medium
Hardware Assurance CAs

+------+--------------+------------------------------------------------+
| T    | **CP         | Mapping Phrase                                 |
| able | Section**    |                                                |
| No.  |              |                                                |
+======+==============+================================================+
| 1.   | FBCA:        | All certificates issued to end entities shall  |
|      |              | include a non-NULL subject DN.                 |
|      | **3.1.1**    |                                                |
|      |              | (Non-Null Subject Name, and optional Subject   |
|      |              | Alternative Name if marked non-critical.)      |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 2.   | FBCA:        | An entity certified by a State or Federal      |
|      |              | Entity as being authorized to confirm          |
|      | **3.2.3.1**  | identities may perform in-person               |
|      |              | authentication on behalf of the RA. The        |
|      |              | certified entity forwards the information      |
|      |              | collected from the applicant directly to the   |
|      |              | RA in a secure manner.                         |
|      |              |                                                |
|      |              | *Packages secured in a tamper-evident manner   |
|      |              | by the certified entity satisfy this           |
|      |              | requirement; other secure methods are also     |
|      |              | acceptable. Such authentication does not       |
|      |              | relieve the RA of its responsibility to verify |
|      |              | the presented data.*                           |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 3.   | FBCA:        | Identity shall be established by in-person     |
|      |              | proofing before the Registration Authority,    |
|      | **3.2.3.1**  | Trusted Agent or an entity certified by a      |
|      |              | State or Federal Entity as being authorized to |
|      |              | confirm identities; information provided shall |
|      |              | be verified to ensure legitimacy. Credentials  |
|      |              | required are either one Federal                |
|      |              | Government-issued Picture I.D., or two         |
|      |              | Non-Federal Government I.D.s, one of which     |
|      |              | shall be a photo I.D. (e.g., Drivers License)  |
|      |              |                                                |
|      |              | *A trust relationship between the Trusted      |
|      |              | Agent and the applicant, which is based on an  |
|      |              | in-person antecedent, may suffice as meeting   |
|      |              | the in-person identity proofing requirement.*  |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 4    | FBCA:        | For Medium and High Assurance, identity shall  |
| .  [ |              | be established no more than 30 days before     |
| ]{.m | **3.2.3.1**  | initial certificate issuance Entity CAs being  |
| ark} |              | considered for cross certification must comply |
|      |              | with this requirement.                         |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | []{.mark}                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
| 5.   | FBCA:        | Information that is not verified shall not be  |
|      |              | included in certificates.                      |
|      | **3.2.4**    |                                                |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 6.   | FBCA:        | Subscribers of Entity CAs shall identify       |
|      |              | themselves for the purpose of re-keying as     |
|      | **3.3.1**    | follows:                                       |
|      |              |                                                |
|      |              | Identity may be established through use of     |
|      |              | current signature key, except that identity    |
|      |              | shall be established through initial           |
|      |              | registration process at least once every nine  |
|      |              | years from the time of initial registration.   |
+------+--------------+------------------------------------------------+
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 7.   | FBCA:        | Subscribers shall protect their private keys   |
|      |              | from access by other parties.                  |
|      | **4.5.1**    |                                                |
+------+--------------+------------------------------------------------+
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 8.   | FBCA:        | All CAs shall publish CRLs.                    |
|      |              |                                                |
|      | **4.9**      |                                                |
+------+--------------+------------------------------------------------+
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 9.   | FBCA:        | Maximum Interval for Routine CRL Issuance is   |
|      |              | 24 hours                                       |
|      | **4.9.7**    |                                                |
|      |              | For Entity Principal CAs that are operated in  |
|      |              | an off-line manner, routine CRLs may be issued |
|      |              | less frequently than specified above if the CA |
|      |              | only issues:                                   |
|      |              |                                                |
|      |              | -   CA certificates                            |
|      |              |                                                |
|      |              | -   (optionally) CSS certificates, and         |
|      |              |                                                |
|      |              | -   (optionally) end user certificates solely  |
|      |              |     for the administration of the principal    |
|      |              |     CA.                                        |
|      |              |                                                |
|      |              | However, the interval between routine CRL      |
|      |              | issuance shall not exceed 31 days. Such CAs    |
|      |              | must meet the requirements specified in        |
|      |              | section 4.9.12 for issuing Emergency CRLs.     |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 10.  | FBCA:        | For Entity CAs, when a CA certificate is       |
|      |              | revoked or subscriber certificate is revoked   |
|      | **4.9.12**   | because of compromise, or suspected            |
|      |              | compromise, of a private key, a CRL must be    |
|      |              | issued as specified below                      |
|      |              |                                                |
|      |              | Medium (all policies) 18 hours after           |
|      |              | notification.                                  |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
| 11.  | FBCA:        | The physical security requirements pertaining  |
|      |              | to CAs that issue Basic Assurance certificates |
|      | **5.1.2.1**  | are:                                           |
|      |              |                                                |
|      |              | -   Ensure no unauthorized access to the       |
|      |              |     hardware is permitted                      |
|      |              |                                                |
|      |              | -   Ensure all removable media and paper       |
|      |              |     containing sensitive plain-text            |
|      |              |     information is stored in secure containers |
|      |              |                                                |
|      |              | In addition to those requirements, the         |
|      |              | following requirements shall apply to CAs that |
|      |              | issue Medium, Medium Hardware, or High         |
|      |              | assurance certificates:                        |
|      |              |                                                |
|      |              | -   Ensure manual or electronic monitoring for |
|      |              |     unauthorized intrusion at all times        |
|      |              |                                                |
|      |              | -   Ensure an access log is maintained and     |
|      |              |     inspected periodically                     |
|      |              |                                                |
|      |              | -   Require two person physical access control |
|      |              |     to both the cryptographic module and       |
|      |              |     computer system                            |
|      |              |                                                |
|      |              | *Practice Note: Multiparty physical access     |
|      |              | control to CA equipment can be achieved by any |
|      |              | combination of two or more trusted roles (see  |
|      |              | Section 5.2.2) as long as the tasks being      |
|      |              | conducted are segregated in accordance with    |
|      |              | the requirements and duties defined for each   |
|      |              | trusted role. As an example, an Auditor and an |
|      |              | Operator might access the site housing the CA  |
|      |              | equipment to perform a tape backup, but only   |
|      |              | the Operator may perform the tape backup.*     |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 12.  | FBCA:        | A security check of the facility housing the   |
|      |              | Entity CA equipment shall occur if the         |
|      | **5.1.2.1**  | facility is to be left unattended. At a        |
|      |              | minimum, the check shall verify the following: |
|      |              |                                                |
|      |              | -   The equipment is in a state appropriate to |
|      |              |     the current mode of operation (*e.g., that |
|      |              |     cryptographic modules are in place when    |
|      |              |     "open", and secured when "closed"*);       |
|      |              |                                                |
|      |              | -   Any security containers are properly       |
|      |              |     secured;                                   |
|      |              |                                                |
|      |              | -   Physical security systems (e.g., door      |
|      |              |     locks, vent covers) are functioning        |
|      |              |     properly; and                              |
|      |              |                                                |
|      |              | -   The area is secured against unauthorized   |
|      |              |     access.                                    |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 13.  | FBCA:        | A person or group of persons shall be made     |
|      |              | explicitly responsible for making \[security\] |
|      | **5.1.2.1**  | checks. When a group of persons is             |
|      |              | responsible, a log identifying the person      |
|      |              | performing a check at each instance shall be   |
|      |              | maintained. If the facility is not             |
|      |              | continuously attended, the last person to      |
|      |              | depart shall initial a sign-out sheet that     |
|      |              | indicates the date and time, and asserts that  |
|      |              | all necessary physical protection mechanisms   |
|      |              | are in place and activated.                    |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 14.  | FBCA:        | Entity CAs shall have backup capability        |
|      |              | sufficient to automatically lockout input,     |
|      | **5.1.3**    | finish any pending actions, and record the     |
|      |              | state of the equipment before lack of power or |
|      |              | air conditioning causes a shutdown.            |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | Overall      | Comments:                                      |
|      | Match:       |                                                |
+------+--------------+------------------------------------------------+
| 15.  | FBCA:        | For Entity CAs, full system backups sufficient |
|      |              | to recover from system failure shall be made   |
|      | **5.1.8**    | on a periodic schedule. Backups are to be      |
|      |              | performed and stored off-site not less than    |
|      |              | once per week. At least one full backup copy   |
|      |              | shall be stored at an off-site location        |
|      |              | separate from the Entity CA equipment. Only    |
|      |              | the latest full backup need be retained. The   |
|      |              | backup shall be stored at a site with physical |
|      |              | and procedural controls commensurate to that   |
|      |              | of the operational Entity CA.                  |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 16.  | FBCA:        | Two or more persons are required per task for  |
|      |              | the following tasks:                           |
|      | **5.2.2**    |                                                |
|      |              | -   CA key generation;                         |
|      |              |                                                |
|      |              | -   CA signing key activation;                 |
|      |              |                                                |
|      |              | -   CA private key backup.                     |
|      |              |                                                |
|      |              | Where multiparty control for logical access is |
|      |              | required, at least one of the participants     |
|      |              | shall be an Administrator. All participants    |
|      |              | must serve in a trusted role as defined in     |
|      |              | Section 5.2.1. Multiparty control for logical  |
|      |              | access shall not be achieved using personnel   |
|      |              | that serve in the Auditor Trusted Role.        |
|      |              |                                                |
|      |              | Physical access to the CAs does not constitute |
|      |              | a task as defined in this section. Therefore,  |
|      |              | two-person physical access control may be      |
|      |              | attained as required in Section 5.1.2.1.       |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 17.  | FBCA:        | An individual shall identify and authenticate  |
|      |              | him/herself before being permitted to perform  |
|      | **5.2.3**    | any actions set forth for that role or         |
|      |              | identity.                                      |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     |                                                |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 18.  | FBCA:        | Individual personnel shall be specifically     |
|      |              | designated to the four roles defined in        |
|      | **5.2.4**    | Section 5.2.1 above. Individuals may only      |
|      |              | assume one of the Officer, Administrator, and  |
|      |              | Auditor roles, but any individual may assume   |
|      |              | the Operator role. The CA and RA software and  |
|      |              | hardware shall identify and authenticate its   |
|      |              | users and shall ensure that no user identity   |
|      |              | can assume both an Administrator and an        |
|      |              | Officer role, assume both the Administrator    |
|      |              | and Auditor roles, and assume both the Auditor |
|      |              | and Officer roles. No individual shall have    |
|      |              | more than one identity.                        |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 19.  | **FBCA:**    | Each person filling a trusted role must        |
|      |              | satisfy at least one of the following:         |
|      | **5.3.1**    |                                                |
|      |              | -   The person shall be a citizen of the       |
|      |              |     country where the CA is located; or        |
|      |              |                                                |
|      |              | -   For PKIs operated on behalf of             |
|      |              |     multinational governmental organizations,  |
|      |              |     the person shall be a citizen of one of    |
|      |              |     the member countries; or                   |
|      |              |                                                |
|      |              | -   For PKIs located within the European       |
|      |              |     Union, the person shall be a citizen of    |
|      |              |     one of the member States of the European   |
|      |              |     Union; or                                  |
|      |              |                                                |
|      |              | -   For PKIs other than Federal Agency PKIs,   |
|      |              |     the person shall have a security clearance |
|      |              |     equivalent to U.S. Secret or higher issued |
|      |              |     by a NATO member nation or major non-NATO  |
|      |              |     ally as defined by the International       |
|      |              |     Traffic in Arms Regulation (ITAR) -- 22    |
|      |              |     CFR 120.32; or                             |
|      |              |                                                |
|      |              | -   For RA personnel only, in addition to the  |
|      |              |     above, the person may be a citizen of the  |
|      |              |     country where the RA is located.           |
|      |              |                                                |
|      |              | .                                              |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | **Overall    | Comments: This requirement applies to Medium   |
|      | Match:**     | HW, but not to Medium HW CBP                   |
+------+--------------+------------------------------------------------+
| 20.  | FBCA:        | Audit logs shall be reviewed at least once     |
|      |              | every two months                               |
|      | **5.4.2**    |                                                |
|      |              | *Such reviews involve verifying that the log   |
|      |              | has not been tampered with, and then briefly   |
|      |              | inspecting all log entries, with a more        |
|      |              | thorough investigation of any alerts or        |
|      |              | irregularities in the logs.* Actions taken as  |
|      |              | a result of these reviews shall be documented. |
|      |              |                                                |
|      |              | A statistically significant set of security    |
|      |              | audit data generated by Entity CAs since the   |
|      |              | last review shall be examined (where the       |
|      |              | confidence intervals for each category of      |
|      |              | security audit data are determined by the      |
|      |              | security ramifications of the category and the |
|      |              | availability of tools to perform such a        |
|      |              | review), as well as a reasonable search for    |
|      |              | any evidence of malicious activity.            |
+------+--------------+------------------------------------------------+
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     |                                                |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 21.  | FBCA:        | Audit logs shall be retained onsite until      |
|      |              | reviewed                                       |
|      | **5.4.3**    |                                                |
+------+--------------+------------------------------------------------+
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     |                                                |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+

+------+--------------+------------------------------------------------+
| **T  | **CP         | **Mapping Phrase**                             |
| able | Section**    |                                                |
| N    |              |                                                |
| o.** |              |                                                |
+------+--------------+------------------------------------------------+
| 22.  | FBCA:        | At a minimum, the following data shall be      |
|      |              | recorded for archive:                          |
|      | **5.5.1**    |                                                |
|      |              |   -                                            |
|      |              | ---------------------------------------------- |
|      |              |                                                |
|      |              |  **Data To Be Archived**            **Medium** |
|      |              |   -                                            |
|      |              | --------------------------------- ------------ |
|      |              |   CA accreditation (if applicable)   X         |
|      |              |                                                |
|      |              |   Certificate Policy                 X         |
|      |              |                                                |
|      |              |   Certification Practice Statement   X         |
|      |              |                                                |
|      |              |   Contractual obligations            X         |
|      |              |                                                |
|      |              |   Other agreements concerning        X         |
|      |              |   operations of the CA                         |
|      |              |                                                |
|      |              |   System and equipment configuration X         |
|      |              |                                                |
|      |              |   Modifications and updates to       X         |
|      |              |   system or configuration                      |
|      |              |                                                |
|      |              |   Certificate requests               X         |
|      |              |                                                |
|      |              |   Revocation requests                X         |
|      |              |                                                |
|      |              |   Subscriber identity Authentication X         |
|      |              |   data as per Section 3.2.3                    |
|      |              |                                                |
|      |              |   Documentation of receipt and       X         |
|      |              |   acceptance of certificates                   |
|      |              |                                                |
|      |              |   Subscriber Agreements              X         |
|      |              |                                                |
|      |              |   Documentation of receipt of tokens X         |
|      |              |                                                |
|      |              |   All certificates issued or         X         |
|      |              |   published                                    |
|      |              |                                                |
|      |              |   Record of CA Re-key                X         |
|      |              |                                                |
|      |              |   All CRLs issued and/or published   X         |
|      |              |                                                |
|      |              |   Other data or applications to      X         |
|      |              |   verify archive contents                      |
|      |              |                                                |
|      |              |   Compliance Auditor reports         X         |
|      |              |                                                |
|      |              |   Any changes to the Audit           X         |
|      |              |   parameters, e.g., audit frequency,           |
|      |              |   type of event audited                        |
|      |              |                                                |
|      |              |   Any attempt to delete or modify    X         |
|      |              |   the Audit logs                               |
|      |              |                                                |
|      |              |   Whenever the CA generates a key    X         |
|      |              |   (Not mandatory for single session            |
|      |              |   or one-time use symmetric keys)              |
|      |              |                                                |
|      |              |   All access to certificate subject  X         |
|      |              |   private keys retained within the             |
|      |              |   CA for key recovery purposes                 |
|      |              |                                                |
|      |              |   All changes to the trusted public  X         |
|      |              |   keys, including additions and                |
|      |              |   deletions                                    |
|      |              |   -                                            |
|      |              | ---------------------------------------------- |
+------+--------------+------------------------------------------------+
|      |              |   ---------------------------------- --------  |
|      |              |   The export of private and secret   X         |
|      |              |   keys (keys used for a single                 |
|      |              |   session or message are excluded)             |
|      |              |                                                |
|      |              |   The approval or rejection of a     X         |
|      |              |   certificate status change request            |
|      |              |                                                |
|      |              |   Appointment of an individual to a  X         |
|      |              |   Trusted Role                                 |
|      |              |                                                |
|      |              |   Destruction of cryptographic       X         |
|      |              |   modules                                      |
|      |              |                                                |
|      |              |   All certificate compromise         X         |
|      |              |   notifications                                |
|      |              |                                                |
|      |              |   Remedial action taken as a result  X         |
|      |              |   of violations of physical security           |
|      |              |                                                |
|      |              |   Violations of Certificate Policy   X         |
|      |              |                                                |
|      |              |   Violations of Certification        X         |
|      |              |   Practice Statement                           |
|      |              |   ---------------------------------- --------  |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 23.  | FBCA:        | The minimum retention period for archive data  |
|      |              | is 10 years & 6 months.                        |
|      | **5.5.2**    |                                                |
|      |              | *Executive branch agencies must follow either  |
|      |              | the General Records Schedule established by    |
|      |              | the National Archives and Records              |
|      |              | Administration or an agency-specific schedule  |
|      |              | as applicable. All other entities shall comply |
|      |              | with their respective records retention        |
|      |              | policies in accordance with whatever laws      |
|      |              | apply to those entities.*                      |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     |                                                |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
| 24.  | FBCA:        | For Entity CAs, the \[cryptographic\] modules  |
|      |              | shall meet or exceed Security Level 2.         |
|      | **6.1.1.1**  | Multiparty control is required for CA key pair |
|      |              | generation.                                    |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 25.  | FBCA:        | *\[At all levels\] CA key pair generation must |
|      |              | create a verifiable audit trail that the       |
|      | **6.1.1.1**  | security requirements for procedures were      |
|      |              | followed. For all levels of assurance, the     |
|      |              | documentation of the procedure must be         |
|      |              | detailed enough to show that appropriate role  |
|      |              | separation was used.*                          |
|      |              |                                                |
|      |              | \[An\] independent third party shall validate  |
|      |              | the execution of the key generation procedures |
|      |              | either by witnessing the key generation or by  |
|      |              | examining the signed and documented record of  |
|      |              | the key generation.                            |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 26.  | **FBCA:**    | Subscriber key generation shall be performed   |
|      |              | using a validated hardware cryptographic       |
|      | **6.1.1.2**  | module.                                        |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | **Overall    | Comments: This requirement applies to Medium   |
|      | Match:**     | HW, but not to Medium                          |
+------+--------------+------------------------------------------------+
| 27.  | FBCA:        | Where key pairs are generated by the           |
|      |              | Subscriber or RA, the public key and the       |
|      | **6.1.3**    | Subscriber's identity must be delivered        |
|      |              | securely to the CA for certificate issuance.   |
|      |              | The delivery mechanism shall bind the          |
|      |              | Subscriber's verified identity to the public   |
|      |              | key. If cryptography is used to achieve this   |
|      |              | binding, it must be at least as strong as the  |
|      |              | CA keys used to sign the certificate.          |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 28.  | 6.1.7        | Public keys that are bound into certificates   |
|      |              | shall be certified for use in signing or       |
|      |              | encrypting, but not both.                      |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | Overall      | Comments: This requirement applies to Medium   |
|      | Match:       | HW, but not to Medium                          |
+------+--------------+------------------------------------------------+
| 29.  | FBCA:        | The table below summarizes the minimum         |
|      |              | requirements for cryptographic modules; higher |
|      | **6.2.1**    | levels may be used.                            |
|      |              |                                                |
|      |              |   --                                           |
|      |              | --------- ----------- ------------ ----------- |
|      |              |   Assurance   CA & CSS    Subscriber   RA      |
|      |              |   Level                                        |
|      |              |                                                |
|      |              |   Medium      Level 2     Level 2      Level 2 |
|      |              |                                                |
|      |              |  Hardware    hardware    hardware     hardware |
|      |              |   --                                           |
|      |              | --------- ----------- ------------ ----------- |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments: This requirement applies to Medium   |
|      | Ma           | HW, but not to Medium                          |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 30.  | FBCA:        | Use of the Entity CA private signing key shall |
|      |              | require action by multiple persons.            |
|      | **6.2.2**    |                                                |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     |                                                |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 31.  | FBCA:        | Subscriber private signature keys may not be   |
|      |              | backed up or copied.                           |
|      | **6.2.4.2**  |                                                |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments: This requirement applies to Medium   |
|      | Ma           | HW, but not to Medium                          |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 32.  | FBCA:        | For Entity CAs that operate at the Medium,     |
|      |              | Medium Hardware, or High level of assurance,   |
|      | **6.2.8**    | CA signing key activation requires multiparty  |
|      |              | control as specified in Section 5.2.2.         |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 33.  | FBCA:        | The System Development Controls for the Entity |
|      |              | CAs are as follows:                            |
|      | **6.6.1**    |                                                |
|      |              | -   For commercial off-the-shelf software, the |
|      |              |     software shall be designed and developed   |
|      |              |     under a formal, documented development     |
|      |              |     methodology.                               |
|      |              |                                                |
|      |              | -   For hardware and software developed        |
|      |              |     specifically for a particular CA, the      |
|      |              |     applicant shall demonstrate that security  |
|      |              |     requirements were achieved through a       |
|      |              |     combination of software verification &     |
|      |              |     validation, structured development         |
|      |              |     approach, and controlled development       |
|      |              |     environment.                               |
|      |              |                                                |
|      |              | -   Where open source software has been        |
|      |              |     utilized, the applicant shall demonstrate  |
|      |              |     that security requirements were achieved   |
|      |              |     through software verification & validation |
|      |              |     and structured development/lifecycle       |
|      |              |     management.                                |
|      |              |                                                |
|      |              | -   Hardware and software procured to operate  |
|      |              |     the CA shall be purchased and shipped in a |
|      |              |     fashion to reduce the likelihood that any  |
|      |              |     particular component was tampered with     |
|      |              |     (e.g., by ensuring the equipment was       |
|      |              |     randomly selected at time of purchase).    |
|      |              |                                                |
|      |              | -   The CA hardware and software shall be      |
|      |              |     dedicated to performing one task: the CA.  |
|      |              |     There shall be no other applications;      |
|      |              |     hardware devices, network connections, or  |
|      |              |     component software installed which are not |
|      |              |     part of the CA operation.                  |
|      |              |                                                |
|      |              | -   Proper care shall be taken to prevent      |
|      |              |     malicious software from being loaded onto  |
|      |              |     the CA equipment. Hardware and software    |
|      |              |     shall be scanned for malicious code on     |
|      |              |     first use and periodically thereafter.     |
|      |              |                                                |
|      |              | -   Hardware and software updates shall be     |
|      |              |     purchased or developed in the same manner  |
|      |              |     as original equipment, and be installed by |
|      |              |     trusted and trained personnel in a defined |
|      |              |     manner.                                    |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 34.  | FBCA:        | Certificates issued by Federal Entity CAs      |
|      |              | shall comply with the ***Federal Public Key    |
|      | **7.1.2**    | Infrastructure X.509 Certificate and CRL       |
|      |              | Extensions Profile***.                         |
+------+--------------+------------------------------------------------+
|      |              |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments: This requirement applies to Medium   |
|      | Ma           | HW, but not to Medium HW CBP                   |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 35.  | FBCA         | Entity CAs shall issue X.509 version 1 or      |
|      |              | version 2 CRLs.                                |
|      | 7.2.1        |                                                |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comment:                                       |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
| 36.  | FBCA         | The Entity Principal CAs and RAs and their     |
|      |              | subordinate CAs and RAs shall be subject to a  |
|      | 8.1          | periodic compliance audit at least once per    |
|      |              | year for High, Medium Hardware, and Medium     |
|      |              | Assurance, and at least once every two years   |
|      |              | for Basic Assurance. Where a status server is  |
|      |              | specified in certificates issued by a CA, the  |
|      |              | status server shall be subject to the same     |
|      |              | periodic compliance audit requirements as the  |
|      |              | corresponding CA. For example, if an OCSP      |
|      |              | server is specified in the authority           |
|      |              | information access extension in certificates   |
|      |              | issued by a CA, that server must be reviewed   |
|      |              | as part of that CA's compliance audit.         |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comment:                                       |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
| 37.  | FBCA         | A Subscriber shall be required to sign a       |
|      |              | document containing the requirements the       |
|      | 9.6.3        | Subscriber shall meet respecting protection of |
|      |              | the private key and use of the certificate     |
|      |              | before being issued the certificate.           |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comment:                                       |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
| 38.  | FBCA         | Subscribers of Entity CAs shall agree to the   |
|      |              | following:                                     |
|      | 9.6.3        |                                                |
|      |              | -   Accurately represent themselves in all     |
|      |              |     communications with the PKI authorities.   |
|      |              |                                                |
|      |              | -   Protect their private keys at all times,   |
|      |              |     in accordance with this policy, as         |
|      |              |     stipulated in their certificate acceptance |
|      |              |     agreements and local procedures.           |
|      |              |                                                |
|      |              | -   Promptly notify the appropriate CA upon    |
|      |              |     suspicion of loss or compromise of their   |
|      |              |     private keys. Such notification shall be   |
|      |              |     made directly or indirectly through        |
|      |              |     mechanisms consistent with the CA's CPS.   |
|      |              |                                                |
|      |              | -   Abide by all the terms, conditions, and    |
|      |              |     restrictions levied on the use of their    |
|      |              |     private keys and certificates.             |
+------+--------------+------------------------------------------------+
|      | []{.mark}    | []{.mark}                                      |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comment:                                       |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
|      |              |                                                |
|      | []{.mark}    |                                                |
+------+--------------+------------------------------------------------+

**Table 40:**

**FBCA 5.4.1 -- Types of Events Recorded**

**Overall Match:**

**Comments:**

+---+--------------------------------------------------+--------+------+
| \ | **Auditable Event**                              |        | **FB |
| # |                                                  |        | CA** |
|   |                                                  |        |      |
|   |                                                  |        | **   |
|   |                                                  |        | Medi |
|   |                                                  |        | um** |
+===+==================================================+========+======+
|   | **SECURITY AUDIT**                               |        |      |
+---+--------------------------------------------------+--------+------+
| 1 | Any changes to the Audit parameters, e.g., audit |        | *    |
|   | frequency, type of event audited                 |        | *X** |
+---+--------------------------------------------------+--------+------+
| * | Any attempt to delete or modify the Audit logs   |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | Obtaining a third-party time-stamp               |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **IDENTIFICATION AND AUTHENTICATION**            |        |      |
+---+--------------------------------------------------+--------+------+
| * | Successful and unsuccessful attempts to assume a |        | *    |
| * | role                                             |        | *X** |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | The value of *maximum authentication attempts*   |        | *    |
| * | is changed                                       |        | *X** |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | The number of unsuccessful authentication        |        | *    |
| * | attempts exceeds the *maximum authentication     |        | *X** |
| 6 | attempts* during user login                      |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | An Administrator unlocks an account that has     |        | *    |
| * | been locked as a result of unsuccessful          |        | *X** |
| 7 | authentication attempts                          |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | An Administrator changes the type of             |        | *    |
| * | authenticator, e.g., from password to biometrics |        | *X** |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **LOCAL DATA ENTRY**                             |        |      |
+---+--------------------------------------------------+--------+------+
| * | All security-relevant data that is entered in    |        | *    |
| * | the system                                       |        | *X** |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **REMOTE DATA ENTRY**                            |        |      |
+---+--------------------------------------------------+--------+------+
| * | All security-relevant messages that are received |        | *    |
| * | by the system                                    |        | *X** |
| 1 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **DATA EXPORT AND OUTPUT**                       |        |      |
+---+--------------------------------------------------+--------+------+
| * | All successful and unsuccessful requests for     |        | *    |
| * | confidential and security-relevant information   |        | *X** |
| 1 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **KEY GENERATION**                               |        |      |
+---+--------------------------------------------------+--------+------+
| * | Whenever the Entity CA generates a key. (Not     |        | *    |
| * | mandatory for single session or one-time use     |        | *X** |
| 1 | symmetric keys)                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **PRIVATE KEY LOAD AND STORAGE**                 |        |      |
+---+--------------------------------------------------+--------+------+
| * | The loading of Component private keys            |        | *    |
| * |                                                  |        | *X** |
| 1 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | All access to certificate subject private keys   |        | *    |
| * | retained within the Entity CA for key recovery   |        | *X** |
| 1 | purposes                                         |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **TRUSTED PUBLIC KEY ENTRY, DELETION AND         |        |      |
|   | STORAGE**                                        |        |      |
+---+--------------------------------------------------+--------+------+
| 1 | All changes to the trusted public keys,          |        | *    |
| 5 | including additions and deletions                |        | *X** |
+---+--------------------------------------------------+--------+------+
|   | **SECRET KEY STORAGE**                           |        |      |
+---+--------------------------------------------------+--------+------+
| * | The manual entry of secret keys used for         |        | *    |
| * | authentication                                   |        | *X** |
| 1 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **PRIVATE AND SECRET KEY EXPORT**                |        |      |
+---+--------------------------------------------------+--------+------+
| * | The export of private and secret keys (keys used |        | *    |
| * | for a single session or message are excluded)    |        | *X** |
| 1 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE REGISTRATION**                     |        |      |
+---+--------------------------------------------------+--------+------+
| * | All certificate requests                         |        | *    |
| * |                                                  |        | *X** |
| 1 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE REVOCATION**                       |        |      |
+---+--------------------------------------------------+--------+------+
| * | All certificate revocation requests              |        | *    |
| * |                                                  |        | *X** |
| 1 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE STATUS CHANGE APPROVAL**           |        |      |
+---+--------------------------------------------------+--------+------+
| * | The approval or rejection of a certificate       |        | *    |
| * | status change request                            |        | *X** |
| 2 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **FBCA OR ENTITY CA CONFIGURATION**              |        |      |
+---+--------------------------------------------------+--------+------+
| * | Any security-relevant changes to the             |        | *    |
| * | configuration of the FBCA or Entity CA           |        | *X** |
| 2 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **ACCOUNT ADMINISTRATION**                       |        |      |
+---+--------------------------------------------------+--------+------+
| * | Roles and users are added or deleted             |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | The access control privileges of a user account  |        | *    |
| * | or a role are modified                           |        | *X** |
| 2 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE PROFILE MANAGEMENT**               |        |      |
+---+--------------------------------------------------+--------+------+
| 2 | All changes to the certificate profile           |        | *    |
| 4 |                                                  |        | *X** |
+---+--------------------------------------------------+--------+------+
|   | **REVOCATION PROFILE MANAGEMENT**                |        |      |
+---+--------------------------------------------------+--------+------+
| * | All changes to the revocation profile            |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **CERTIFICATE REVOCATION LIST PROFILE            |        |      |
|   | MANAGEMENT**                                     |        |      |
+---+--------------------------------------------------+--------+------+
| * | All changes to the certificate revocation list   |        | *    |
| * | profile                                          |        | *X** |
| 2 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | **MISCELLANEOUS**                                |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Appointment of an individual to a Trusted Role* |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Designation of personnel for multiparty         |        | *    |
| * | control*                                         |        | *X** |
| 2 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Installation of the Operating System*           |        | *    |
| * |                                                  |        | *X** |
| 2 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Installation of the FBCA or Entity CA*          |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Installing hardware cryptographic modules*      |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Removing hardware cryptographic modules*        |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Destruction of cryptographic modules*           |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *System Startup*                                 |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Logon Attempts to FBCA or Entity CA Apps*       |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Receipt of Hardware / Software*                 |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Attempts to set passwords*                      |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Attempts to modify passwords*                   |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Backing up FBCA or Entity CA internal database* |        | *    |
| * |                                                  |        | *X** |
| 3 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Restoring FBCA or Agency CA internal database*  |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *File manipulation (e.g., creation, renaming,    |        | *    |
| * | moving)*                                         |        | *X** |
| 4 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Posting of any material to a repository*        |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Access to FBCA or Entity CA internal database*  |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *All certificate compromise notification         |        | *    |
| * | requests*                                        |        | *X** |
| 4 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Loading tokens with certificates*               |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Shipment of Tokens*                             |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Zeroizing tokens*                               |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Rekey of the FBCA or Entity CA*                 |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | *Configuration changes to the CA server          |        |      |
|   | involving:*                                      |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Hardware*                                       |        | *    |
| * |                                                  |        | *X** |
| 4 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Software*                                       |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| 5 | *Operating System*                               |        | *    |
| 1 |                                                  |        | *X** |
+---+--------------------------------------------------+--------+------+
| * | *Patches*                                        |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Security Profiles*                              |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | ***PHYSICAL ACCESS / SITE SECURITY***            |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Personnel Access to room housing FBCA or Entity |        | *    |
| * | CA*                                              |        | *X** |
| 5 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Access to the FBCA or Entity CA server*         |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Known or suspected violations of physical       |        | *    |
| * | security*                                        |        | *X** |
| 5 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
|   | ***ANOMALIES***                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Software Error conditions*                      |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Software check integrity failures*              |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Receipt of improper messages*                   |        | *    |
| * |                                                  |        | *X** |
| 5 |                                                  |        |      |
| 9 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Misrouted messages*                             |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 0 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Network attacks (suspected or confirmed)*       |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 1 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Equipment failure*                              |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 2 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Electrical power outages*                       |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 3 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Uninterruptible Power Supply (UPS) failure*     |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 4 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Obvious and significant network service or      |        | *    |
| * | access failures*                                 |        | *X** |
| 6 |                                                  |        |      |
| 5 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Violations of Certificate Policy*               |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 6 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Violations of Certification Practice Statement* |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 7 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+
| * | *Resetting Operating System clock*               |        | *    |
| * |                                                  |        | *X** |
| 6 |                                                  |        |      |
| 8 |                                                  |        |      |
| * |                                                  |        |      |
| * |                                                  |        |      |
+---+--------------------------------------------------+--------+------+

# 

# **5.0 REFERENCES**

\[1\] Request for Comments (RFC): 3647; Internet X.509 Public Key
Infrastructure Certificate Policy and Certification Practices Framework.

\[2\] X.509 Certificate Policy for the Entity CA XX, Version XX, dated
XX

\[3\] X.509 Certificate Policy For The Federal Bridge Certification
Authority (FBCA), <http://www.cio.gov/fpkipa/FBCA_CP_RFC3647.pdf>

\[4\] CPWG General Requirements CP Mapping Matrix for the Entity CA XX
dated XX

# **6.0 CONTACT DETAILS**

Comments about this document may be sent to the following people:

Brant Petrick 202-208-4673 brant.petrick@gsa.gov