**FPKI Common Policy Framework**

**Certification Practice Statement**

**Evaluation Mapping Matrix**

Version 2.3 August 28, 2008

Table of Contents

[1.0 INTRODUCTION 3](#introduction)

[2.0 DETAILED ASSESSMENT 4](#detailed-assessment)

[3.0 REFERENCES 60](#references)

[4.0 CONTACT DETAILS 60](#contact-details)

# 

# 

#  

# **1.0 INTRODUCTION**

Organizations who wish to qualify for or continue operating systems that
provide managed Public Key Infrastructure (PKI) services under the
Federal PKI (FPKI) Shared Service Provider (SSP) Program must follow the
processes described in the Shared Service Provider Roadmap \[ROADMAP\]
authored by the FPKI SSP Working Group (WG).

Part of the third party compliance audit required by the \[ROADMAP\]
includes the completion of this Evaluation Mapping Matrix by documenting
the text in the SSP CPS that addresses each of the mapping tables
herein. The SSPWG reviews the completed Mapping Matrix and makes a
determination as to whether the SSP's practices meet the requirements of
the Federal PKI Common Policy Framework.

The purposes of this CPS Evaluation Mapping Matrix are to:

1)  Identify at a high-level the areas of inconsistency and/or
    similarity between the contents of the SSP CPS and the Common Policy
    \[COMMON\],

2)  Recommend appropriate changes, if required, to the SSP CPS that
    would make it more consistent with the \[COMMON\], and

3)  Ensure consistent audits by qualified third parties.

# **2.0 DETAILED ASSESSMENT**

The following four evaluation terms and their definitions, listed in
order of degree of conformity, are used to assess the SSP's CPS
alignment to the \[COMMON\] elements:

1)  **Acceptable** - The SSP CPS implements the functionality specified
    for this \[COMMON\] requirement

2)  **Not Acceptable** - The SSP CPS contains dissimilar procedural
    requirements, which provide a lower level of assurance/security than
    the \[COMMON\] requirement.

3)  **Missing** - The SSP CPS does not contain procedures that can be
    compared to the \[COMMON\] requirement in any way.

4)  **Not Applicable --** The requirement contained within \[COMMON\] is
    not transferable or applied with the SSP CPS

An auditor conducting the compliance audit for an SSP should use these
terms when conducting the detailed assessment in section *3.0 Detailed
Assessment*.

The mapping report presents a detailed breakdown of the \[COMMON\]
requirements in individual tables. The SSP's compliance auditor
evaluates each table below and assigns a rating selected from the list
in section *2.0 Assessment* above based on how well elements in the CPS
meet \[COMMON\] elements listed in the table. In addition, the auditor
must insert the language from the CPS that shows how the requirements
for a particular table are met. Comments should be inserted in the
comment block to provide additional insight about the evaluation result
(e.g., explanation of which policy elements are not met if the rating is
less than Acceptable or clarification on why a table is N/A). Auditors
should only include the pertinent text from the CPS. It is not necessary
to include entire paragraphs or subsections from the CPS unless these
contribute to the acceptability of the SSP's processes to a particular
requirement.

For ease of review, the terms "NOT ACCEPTABLE" or "MISSING" should be
highlighted in RED font when applied to a table in the document.

**NOTE**: In some places in the tables below, Common High requirements
are set out in separate tables; but where they are embedded within a
paragraph pertaining to other policies, they appear in **Bold**.

+----+--------+-------------------------------------------------------+
| 1. | COMMON | Certificates issued in accordance with this CP shall  |
|    | P      | assert at least one of the following OIDs in the      |
|    | OLICY: | certificate policy extension:                         |
|    |        |                                                       |
|    | **1.2  |   ----                                                |
|    | (7.    | --------------------------- ------------------------- |
|    | 1.6)** |   id-f                                                |
|    |        | pki-common-policy           ::= {2 16 840 1 101 3 2 1 |
|    |        |                                   3 6}                |
|    |        |                                                       |
|    |        |   id-f                                                |
|    |        | pki-common-hardware         ::= {2 16 840 1 101 3 2 1 |
|    |        |                                   3 7}                |
|    |        |                                                       |
|    |        |   id-f                                                |
|    |        | pki-common-devices          ::= {2 16 840 1 101 3 2 1 |
|    |        |                                   3 8}                |
|    |        |                                                       |
|    |        |   id-f                                                |
|    |        | pki-common-authentication   ::= {2 16 840 1 101 3 2 1 |
|    |        |                                   3 13}               |
|    |        |                                                       |
|    |        |   id-f                                                |
|    |        | pki-common-High             ::= {2 16 840 1 101 3 2 1 |
|    |        |                                   3 16}               |
|    |        |                                                       |
|    |        |   id-f                                                |
|    |        | pki-common-cardAuth         ::= {2 16 840 1 101 3 2 1 |
|    |        |                                   3 17}               |
|    |        |   ----                                                |
|    |        | --------------------------- ------------------------- |
|    |        |                                                       |
|    |        | Certificates issued to CAs may contain any or all of  |
|    |        | these OIDs. Certificates issued to users, other than  |
|    |        | devices, to support digitally signed documents or key |
|    |        | management may contain either id-fpki-common-policy,  |
|    |        | id-fpki-common-hardware, or id-fpki-common-High.      |
|    |        | Subscriber certificates issued to devices under this  |
|    |        | policy shall include id-fpki-common-devices.          |
|    |        |                                                       |
|    |        | Certificates issued to users supporting               |
|    |        | authentication but not digital signature may contain  |
|    |        | id-fpki-common-authentication. Certificates issued to |
|    |        | users supporting authentication where the private key |
|    |        | can be used without user authentication may contain   |
|    |        | id-fpki-common-cardAuth.                              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | Co     |                                                       |
|    | mment: |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2. | COMMON | Certificates that assert id-fpki-common-cardAuth      |
|    | P      | shall only be used to authenticate the hardware token |
|    | OLICY: | containing the associated private key and shall not   |
|    |        | be interpreted as authenticating the presenter or     |
|    | **1    | holder of the token.                                  |
|    | .4.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 3. | COMMON | All CAs that issue certificates under this policy are |
|    | P      | obligated to post all CA certificates issued by or to |
|    | OLICY: | the CA and CRLs issued by the CA in a directory that  |
|    |        | is publicly accessible through the Lightweight        |
|    | *      | Directory Access Protocol (LDAP) and Hypertext        |
|    | *2.1** | Transport Protocol (HTTP).                            |
|    |        |                                                       |
|    | **(    |                                                       |
|    | 4.6.6, |                                                       |
|    | 4.     |                                                       |
|    | 9.9)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 4. | COMMON | To promote consistent access to certificates and      |
|    | P      | CRLs, the repository shall implement access controls  |
|    | OLICY: | to prevent unauthorized modification or deletion of   |
|    |        | information.                                          |
|    | *      |                                                       |
|    | *2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 5. | COMMON | The publicly accessible directory system shall be     |
|    | P      | designed and implemented so as to provide 99%         |
|    | OLICY: | availability overall and limit scheduled down-time to |
|    |        | 0.5% annually.                                        |
|    | **2    |                                                       |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 6. | COMMON | Where applicable, the certificate status server (CSS) |
|    | P      | shall be designed and implemented so as to provide    |
|    | OLICY: | 99% availability overall and limit scheduled          |
|    |        | down-time to 0.5% annually.                           |
|    | **2    |                                                       |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 7. | COMMON | Where certificates and CRLs are published in          |
|    | P      | directories, standards-based schemas for directory    |
|    | OLICY: | objects and attributes shall be used as specified in  |
|    |        | the *Shared Service Provider Repository Service       |
|    | **2    | Requirements* \[SSP-REP\].                            |
|    | .2.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 8. | COMMON | The CA shall protect information not intended for     |
|    | P      | public dissemination or modification. CA certificates |
|    | OLICY: | and CRLs in the repository shall be publicly          |
|    |        | available through the Internet. Access to other       |
|    | *      | information in the CA repositories shall be           |
|    | *2.4** | determined by agencies pursuant to their authorizing  |
|    |        | and controlling statutes. The CPS shall detail what   |
|    |        | information in the repository shall be exempt from    |
|    |        | automatic availability and to whom, and under which   |
|    |        | conditions, the restricted information may be made    |
|    |        | available.                                            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 9. | COMMON | For certificates issued under id-fpki-common-policy,  |
|    | P      | id-fpki-common-hardware, **id-fpki-common-High** and  |
|    | OLICY: | id-fpki-common-devices, the CA shall assign X.501     |
|    |        | distinguished names to all subscribers. *These        |
|    | *      | distinguished names may be in either of two forms: a  |
|    | *3.1.1 | geo-political name or an Internet domain component    |
|    | (7.    | name*.                                                |
|    | 1.4)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 10 | COMMON | All geo-political distinguished names assigned to     |
| .  | P      | federal employees shall be in the following directory |
|    | OLICY: | information tree:                                     |
|    |        |                                                       |
|    | **3    | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    | .1.1** |     \[ou=*agency*\], \[ou=*structural_container*\]    |
|    |        |                                                       |
|    |        | *The organizational units department and agency       |
|    |        | appear when applicable and are used to specify the    |
|    |        | federal entity that employs the subscriber.* At least |
|    |        | one of these organizational units must appear in the  |
|    |        | DN*. The additional organizational unit               |
|    |        | structural_container is permitted to support local    |
|    |        | directory requirements, such as differentiation       |
|    |        | between human subscribers and devices.* This          |
|    |        | organizational unit may not be employed to further    |
|    |        | differentiate between subcomponents within an agency. |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 11 | COMMON | The distinguished name of the federal employee        |
| .  | P      | subscriber shall take one of the three following      |
|    | OLICY: | forms:                                                |
|    |        |                                                       |
|    | **3    | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    | .1.1** |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     cn=*nickname lastname*                            |
|    |        |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    |        |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     cn=*firstname initial. lastname*                  |
|    |        |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    |        |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     cn=*firstname middlename lastname*                |
|    |        |                                                       |
|    |        | *In the first name form, nickname may be the          |
|    |        | subscriber's first name, a form of the first name,    |
|    |        | middle name, or pseudonym (e.g., Buck) by which the   |
|    |        | subscriber is generally known. A generational         |
|    |        | qualifier, such as "Sr." or "III", may be appended to |
|    |        | any of the common name forms specified above.*        |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 12 | COMMON | Distinguished names assigned to federal contractors   |
| .  | P      | and other affiliated persons shall be within the same |
|    | OLICY: | directory information tree. The distinguished name of |
|    |        | the federal contractor subscribers and affiliate      |
|    | **3    | subscribers will take one of the three following      |
|    | .1.1** | forms:                                                |
|    |        |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    |        |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     cn=*nickname lastname* (affiliate)                |
|    |        |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    |        |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     cn=*firstname initial. lastname* (affiliate)      |
|    |        |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    |        |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     cn=*firstname middlename lastname* (affiliate)    |
|    |        |                                                       |
|    |        | *For names assigned to federal contractors and other  |
|    |        | affiliated persons, generational qualifiers may be    |
|    |        | inserted between lastname and "(affiliate)".*         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 13 | COMMON | Distinguished names based on Internet domain          |
| .  | P      | component names shall be in the following directory   |
|    | OLICY: | information trees:                                    |
|    |        |                                                       |
|    | **3    | -   dc=gov, dc=*org0*, \[dc=*org1*\], ..., \[         |
|    | .1.1** |     dc=*orgN*\], \[ou=*structural_container*\]        |
|    |        |                                                       |
|    |        | -   dc=mil, dc=*org0*, \[dc=*org1*\], ..., \[         |
|    |        |     dc=*orgN*\], \[ou=*structural_container*\]        |
|    |        |                                                       |
|    |        | The default Internet domain name for the agency,      |
|    |        | \[*orgN*.\]...\[*org0*\].gov or                       |
|    |        | \[*orgN*.\]...\[*org0*\].mil, will be used to         |
|    |        | determine DNs. The first domain component of the DN   |
|    |        | will either be dc=gov or dc=mil. At a minimum, the    |
|    |        | *org0* domain component must appear in the DN. The    |
|    |        | *org1* to *orgN* domain components appear, in order,  |
|    |        | when applicable and are used to specify the federal   |
|    |        | entity that employs the subscriber.                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 14 | COMMON | The distinguished name of the federal employee        |
| .  | P      | subscriber shall take one of the three following      |
|    | OLICY: | forms when their agency's Internet domain name ends   |
|    |        | in .gov:                                              |
|    | **3    |                                                       |
|    | .1.1** | -   dc=gov, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*nickname lastname*                            |
|    |        |                                                       |
|    |        | -   dc=gov, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname initial. lastname*                  |
|    |        |                                                       |
|    |        |     -   dc=gov, dc=*org0*, \[dc=*org1*\], ...,        |
|    |        |         \[dc=*orgN*\], \[ou=*structural_container*\], |
|    |        |         cn=*firstname middlename lastname*            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 15 | COMMON | The distinguished name of the federal contractors and |
| .  | P      | affiliated subscribers shall take one of the three    |
|    | OLICY: | following forms when the agency's Internet domain     |
|    |        | name ends in .gov:                                    |
|    | **3    |                                                       |
|    | .1.1** | -   dc=gov, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*nickname lastname* (affiliate)                |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   dc=gov, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname initial. lastname* (affiliate)      |
|    |        |                                                       |
|    |        | -   dc=gov, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname middlename lastname* (affiliate)    |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 16 | COMMON | The distinguished name of the federal employee        |
| .  | P      | subscriber shall take one of the three following      |
|    | OLICY: | forms when their agency's Internet domain name ends   |
|    |        | in .mil:                                              |
|    | **3    |                                                       |
|    | .1.1** | -   dc=mil, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*nickname lastname*                            |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   dc=mil, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname initial. lastname*                  |
|    |        |                                                       |
|    |        | -   dc=mil, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname middlename lastname*                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 17 | COMMON | The distinguished name of the federal contractors and |
| .  | P      | affiliated subscribers shall take one of the three    |
|    | OLICY: | following forms when the agency's Internet domain     |
|    |        | name ends in .mil:                                    |
|    | **3    |                                                       |
|    | .1.1** | -   dc=mil, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*nickname lastname* (affiliate)                |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   dc=mil, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname initial. lastname* (affiliate)      |
|    |        |                                                       |
|    |        | -   dc=mil, dc=*org0*, \[dc=*org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     cn=*firstname middlename lastname* (affiliate)    |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 18 | COMMON | Devices that are the subject of certificates issued   |
| .  | P      | under this policy shall be assigned either a          |
|    | OLICY: | geo‑political name or an Internet domain component    |
|    |        | name. Device names shall take one of the following    |
|    | **3    | forms:                                                |
|    | .1.1** |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=department\],       |
|    |        |     \[ou=agency\], \[ou=*structural_container*\],     |
|    |        |     cn=*device name*                                  |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   dc=gov, dc=*org0*, \[*dc=org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     \[cn=*device name*\]                              |
|    |        |                                                       |
|    |        | -   dc=mil, dc=*org0*, \[*dc=org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     \[cn=*device name*\]                              |
|    |        |                                                       |
|    |        | where *device name* is a descriptive name for the     |
|    |        | device. Where a device is fully described by the      |
|    |        | Internet domain name, the common name attribute is    |
|    |        | optional.                                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 19 | COMMON | *This policy does not restrict the directory          |
| .  | P      | information tree for names of CAs and CSSs.* However, |
|    | OLICY: | CAs that issue certificates under this policy must    |
|    |        | have distinguished names. *CA and CSS distinguished   |
|    | *      | names may be either a geo-political name or an        |
|    | *3.1.1 | Internet domain component name.*                      |
|    | (7.    |                                                       |
|    | 1.4)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 20 | COMMON | CA and CSS geo-political distinguished names shall be |
| .  | P      | composed of any combination of the following          |
|    | OLICY: | attributes: country; organization; organizational     |
|    |        | unit; and common name. Internet domain component      |
|    | *      | names are composed of the following attributes:       |
|    | *3.1.1 | domain component; organizational unit; and common     |
|    | (7.    | name.                                                 |
|    | 1.4)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 21 | COMMON | *For certificates issued under                        |
| .  | P      | id-fpki-common-authentication, assignment of X.500    |
|    | OLICY: | distinguished names is mandatory.* For certificates   |
|    |        | issued under this policy by a CA operating as part of |
|    | *      | the Shared Service Provider program, distinguished    |
|    | *3.1.1 | names shall follow either the rules specified above   |
|    | (7.    | for id‑fpki-common-hardware or the rules specified    |
|    | 1.4)** | below for including a non-NULL subject DN in          |
|    |        | id-fpki-common-cardAuth. Certificates issued under    |
|    |        | id-fpki-common-authentication shall include a subject |
|    |        | alternative name. At a minimum, the subject           |
|    |        | alternative name extension shall include the          |
|    |        | pivFASC-N name type \[FIPS 201-1\]. The value for     |
|    |        | this name shall be the FASC-N \[PACS\] of the         |
|    |        | subject's PIV card.                                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 22 | COMMON | Certificates issued under id-fpki-common-cardAuth     |
| .  | P      | shall include a subject alternative name extension    |
|    | OLICY: | that includes the pivFASC-N name type. The value for  |
|    |        | this name shall be the FASC-N of the subject's PIV    |
|    | *      | card. Certificates issued under                       |
|    | *3.1.1 | id-fpki-common-cardAuth shall not include any other   |
|    | (7.    | name in the subject alternative name extension but    |
|    | 1.4)** | may include a non-NULL name in the subject field. If  |
|    |        | included, the subject distinguished name shall take   |
|    |        | one of the following forms:                           |
|    |        |                                                       |
|    |        | -   C=US, o=U.S. Government, \[ou=*department*\],     |
|    |        |     \[ou=*agency*\], \[ou=*structural_container*\],   |
|    |        |     serialNumber=*FASC-N*                             |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   dc=gov, dc=*org0*, \[*dc=org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     serialNumber=*FASC-N*                             |
|    |        |                                                       |
|    |        | -   dc=mil, dc=*org0*, \[*dc=org1*\], ...,            |
|    |        |     \[dc=*orgN*\], \[ou=*structural_container*\],     |
|    |        |     serialNumber=*FASC-N*                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 23 | COMMON | *The subscriber certificates issued pursuant to this  |
| .  | P      | CP are meaningful only if the names that appear in    |
|    | OLICY: | the certificates can be understood and used by        |
|    |        | relying parties.* Names used in the certificates must |
|    | **3    | identify in a meaningful way the subscriber to which  |
|    | .1.2** | they are assigned.                                    |
|    |        |                                                       |
|    |        | The common name in the DN must represent the          |
|    |        | subscriber in a way that is easily understandable for |
|    |        | humans. *For people, this will typically be a legal   |
|    |        | name, so the preferred common name form is*           |
|    |        |                                                       |
|    |        | -   *cn=firstname initial. lastname*                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 24 | COMMON | While the issuer name in CA certificates is not       |
| .  | P      | generally interpreted by relying parties, this CP     |
|    | OLICY: | still requires use of meaningful names by CAs issuing |
|    |        | under this policy. If included, the common name       |
|    | *      | should describe the issuer, such as:                  |
|    | *3.1.2 |                                                       |
|    | (7.    | -   cn=*AgencyX CA-3*                                 |
|    | 1.4)** |                                                       |
|    |        | The subject name in CA certificates must match the    |
|    |        | issuer name in certificates issued by the subject, as |
|    |        | required by RFC 3280.                                 |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 25 | COMMON | The CA shall not issue anonymous certificates.        |
| .  | P      | *Pseudonymous certificates may be issued by the CA to |
|    | OLICY: | support internal operations.* CA certificates issued  |
|    |        | by the CA shall not contain anonymous or pseudonymous |
|    | **3    | identities.                                           |
|    | .1.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 26 | COMMON | Name uniqueness for certificates issued by each CA    |
| .  | P      | must be enforced. Each CA and its associated RAs      |
|    | OLICY: | shall enforce name uniqueness within the X.500 name   |
|    |        | space. When other name forms are used, they too must  |
|    | **3    | be allocated such that name uniqueness is ensured for |
|    | .1.5** | certificates issued by that CA.                       |
|    |        |                                                       |
|    |        | The CPS shall identify the method for the assignment  |
|    |        | of subject names. *Directory information trees may be |
|    |        | assigned to a single CA, or shared between CAs. Where |
|    |        | multiple CAs share a single directory information     |
|    |        | tree, the FPKIPA shall review and approve the method  |
|    |        | for assignment of subject names.*                     |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 27 | COMMON | In all cases where the party named in a certificate   |
| .  | P      | generates its own keys, that party shall be required  |
|    | OLICY: | to prove possession of the private key, which         |
|    |        | corresponds to the public key in the certificate      |
|    | **3    | request. *For signature keys, this may be done by the |
|    | .2.1** | entity using its private key to sign a value supplied |
|    |        | by the CA*. *The CA shall then validate the signature |
|    |        | using the party's public key. The FPKIPA may allow    |
|    |        | other mechanisms that are at least as secure as those |
|    |        | cited here.*                                          |
|    |        |                                                       |
|    |        | In the case where key generation is performed under   |
|    |        | the CA or RA's direct control, proof of possession is |
|    |        | not required.                                         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 28 | COMMON | Requests for CA certificates shall include the CA     |
| .  | P      | name, address, and documentation of the existence of  |
|    | OLICY: | the CA. Before issuing CA certificates, an authority  |
|    |        | for the issuing CA shall verify the information, in   |
|    | **3    | addition to the authenticity of the requesting        |
|    | .2.2** | representative and the representative's authorization |
|    |        | to act in the name of the CA                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 29 | COMMON | This policy allows a certificate to be issued only to |
| .  | P      | a single entity. Certificates shall not be issued     |
|    | OLICY: | that contain a public key whose associated private    |
|    |        | key is shared                                         |
|    | **3    |                                                       |
|    | .2.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 30 | COMMON | The RA shall ensure that the applicant's identity     |
| .  | P      | information is verified. Identity shall be verified   |
|    | OLICY: | no more than 30 days before initial certificate       |
|    |        | issuance. **At id-fpki-common-High, the applicant     |
|    | **3.2  | shall appear at the RA in person**. *For all other    |
|    | .3.1** | policies, RAs may accept authentication of an         |
|    |        | applicant's identity attested to and documented by a  |
|    |        | trusted agent to support identity proofing of remote  |
|    |        | applicants, assuming agency identity badging          |
|    |        | requirements are otherwise satisfied.*                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 31 | COMMON | At a minimum, authentication procedures for employees |
| .  | P      | must include the following steps:                     |
|    | OLICY: |                                                       |
|    |        | 1)  Verify that a request for certificate issuance to |
|    | **3.2  |     the applicant was submitted by agency management. |
|    | .3.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 32 | COMMON | At a minimum, authentication procedures for employees |
| .  | P      | must include the following steps:                     |
|    | OLICY: |                                                       |
|    |        | > 2\) Verify Applicant's employment through use of    |
|    | **3.2  | > official agency records.                            |
|    | .3.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 33 | COMMON | At a minimum, authentication procedures for employees |
| .  | P      | must include the following steps:                     |
|    | OLICY: |                                                       |
|    |        | 3)  Establish applicant's identity by in-person       |
|    | **3.2  |     proofing before the registration authority, based |
|    | .3.1** |     on either of the following processes:             |
|    |        |                                                       |
|    |        |     a.  Process #1:                                   |
|    |        |                                                       |
|    |        |         i.  The applicant presents a                  |
|    |        |             government-issued form of identification  |
|    |        |             (e.g., an Agency ID badge, a passport, or |
|    |        |             driver's license) as proof of identity,   |
|    |        |             and                                       |
|    |        |                                                       |
|    |        |         ii. The RA examines the presented credential  |
|    |        |             for biometric data that can be linked to  |
|    |        |             the applicant (e.g., a photograph on the  |
|    |        |             credential itself or a securely linked    |
|    |        |             photograph of applicant), and             |
|    |        |                                                       |
|    |        |         iii. The credential presented in              |
|    |        |              step 3) a) i) above shall be verified by |
|    |        |              the RA for currency and legitimacy       |
|    |        |              (e.g., the agency ID is verified as      |
|    |        |              valid). *Typically this is accomplished  |
|    |        |              by querying a database maintained by the |
|    |        |              organization that issued the credential, |
|    |        |              but other equivalent methods may be      |
|    |        |              used.*                                   |
|    |        |                                                       |
|    |        |     b.  Process #2:                                   |
|    |        |                                                       |
|    |        |         i.  The applicant presents a                  |
|    |        |             government-issued form of identification  |
|    |        |             (e.g., an Agency ID badge, a passport, or |
|    |        |             driver's license) as proof of identity,   |
|    |        |             and                                       |
|    |        |                                                       |
|    |        |         ii. The RA examines the presented credential  |
|    |        |             for biometric data that can be linked to  |
|    |        |             the applicant (e.g., a photograph on the  |
|    |        |             credential itself or a securely linked    |
|    |        |             photograph of applicant), and             |
|    |        |                                                       |
|    |        |         iii. The applicant presents current           |
|    |        |              corroborating information (e.g., current |
|    |        |              credit card bill or recent utility bill) |
|    |        |              to the RA. The identifying information   |
|    |        |              (e.g., name and address) on the          |
|    |        |              credential presented in step 3) b) i)    |
|    |        |              above shall be verified by the RA for    |
|    |        |              currency and legitimacy (e.g., the       |
|    |        |              agency ID is verified as valid).         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 34 | COMMON | At a minimum, authentication procedures for employees |
| .  | P      | must include the following steps:                     |
|    | OLICY: |                                                       |
|    |        | > 4\) Record and maintain a biometric of the          |
|    | **3.2  | > applicant (e.g., a photograph or fingerprint) by    |
|    | .3.1** | > the RA or CA. (Handwritten signatures and other     |
|    |        | > behavioral characteristics are not accepted as      |
|    |        | > biometrics for the purposes of this policy.) *This  |
|    |        | > establishes an audit trail for dispute resolution.* |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 35 | COMMON | For contractors and other affiliated personnel, the   |
| .  | P      | authentication procedures must include the following  |
|    | OLICY: | steps:                                                |
|    |        |                                                       |
|    | **3.2  | 1\) Verify that a request for certificate issuance to |
|    | .3.1** | the applicant was submitted by an authorized          |
|    |        | sponsoring agency employee (e.g., contracting officer |
|    |        | or contracting officer's technical representative).   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 36 | COMMON | For contractors and other affiliated personnel, the   |
| .  | P      | authentication procedures must include the following  |
|    | OLICY: | steps:                                                |
|    |        |                                                       |
|    | **3.2  | 2)  Verify sponsoring agency employee's identity and  |
|    | .3.1** |     employment through either of the following        |
|    |        |     methods:                                          |
|    |        |                                                       |
|    |        |     a.  A digital signature verified by a currently   |
|    |        |         valid employee signature certificate issued   |
|    |        |         by the CA may be accepted as proof of both    |
|    |        |         employment and identity, or                   |
|    |        |                                                       |
|    |        |     b.  Employee's identity shall be established by   |
|    |        |         in-person proofing before the registration    |
|    |        |         authority as in employee authentication above |
|    |        |         and employment validated through use of the   |
|    |        |         official agency records.                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 37 | COMMON | For contractors and other affiliated personnel, the   |
| .  | P      | authentication procedures must include the following  |
|    | OLICY: | steps:                                                |
|    |        |                                                       |
|    | **3.2  | 3)  Establish applicant's identity by in-person       |
|    | .3.1** |     proofing before the registration authority, based |
|    |        |     on either of the following processes:             |
|    |        |                                                       |
|    |        |     a.  Process #1:                                   |
|    |        |                                                       |
|    |        |         i.  The applicant presents a                  |
|    |        |             government-issued form of identification  |
|    |        |             (e.g., an Agency ID badge, a passport, or |
|    |        |             driver's license) as proof of identity,   |
|    |        |             and                                       |
|    |        |                                                       |
|    |        |         ii. The RA examines the presented credential  |
|    |        |             for biometric data that can be linked to  |
|    |        |             the applicant (e.g., a photograph on the  |
|    |        |             credential itself or a securely linked    |
|    |        |             photograph of applicant), and             |
|    |        |                                                       |
|    |        |         iii. The credential presented in              |
|    |        |              step 3) a) i) above shall be verified by |
|    |        |              the RA for currency and legitimacy       |
|    |        |              (e.g., the agency ID is verified as      |
|    |        |              valid)*. Typically this is accomplished  |
|    |        |              by querying official records maintained  |
|    |        |              by the organization that issued the      |
|    |        |              credential.*                             |
|    |        |                                                       |
|    |        |     b.  Process #2:                                   |
|    |        |                                                       |
|    |        |         i.  The applicant presents a                  |
|    |        |             government-issued form of identification  |
|    |        |             (e.g., an Agency ID badge, a passport, or |
|    |        |             driver's license) as proof of identity,   |
|    |        |             and                                       |
|    |        |                                                       |
|    |        |         ii. The RA examines the presented credential  |
|    |        |             for biometric data that can be linked to  |
|    |        |             the applicant (e.g., a photograph on the  |
|    |        |             credential itself or a securely linked    |
|    |        |             photograph of applicant), and             |
|    |        |                                                       |
|    |        |         iii. The applicant presents current           |
|    |        |              corroborating information (e.g., current |
|    |        |              credit card bill or recent utility bill) |
|    |        |              to the RA. The identifying information   |
|    |        |              (e.g., name and address) on the          |
|    |        |              credential presented in step 3) b) i)    |
|    |        |              above shall be verified by the RA for    |
|    |        |              currency and legitimacy (e.g., the       |
|    |        |              agency ID is verified as valid).         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 38 | COMMON | For contractors and other affiliated personnel, the   |
| .  | P      | authentication procedures must include the following  |
|    | OLICY: | steps:                                                |
|    |        |                                                       |
|    | **3.2  | 4\) Record and maintain a biometric of the applicant  |
|    | .3.1** | (e.g., a photograph or fingerprint) by the RA or CA.  |
|    |        | (Handwritten signatures and other behavioral          |
|    |        | characteristics are not accepted as biometrics for    |
|    |        | the purposes of this policy.) *This establishes an    |
|    |        | audit trail for dispute resolution.*                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 39 | COMMON | Additionally, the RA shall record the process that    |
| .  | P      | was followed for issuance of each certificate. The    |
|    | OLICY: | process documentation and authentication requirements |
|    |        | shall include the following:                          |
|    | **3.2  |                                                       |
|    | .3.1** | -   The identity of the person performing the         |
|    |        |     identification;                                   |
|    |        |                                                       |
|    |        | -   A signed declaration by that person that he or    |
|    |        |     she verified the identity of the Applicant as     |
|    |        |     required by the CPS using the format set forth at |
|    |        |     28 U.S.C. 1746 (declaration under penalty of      |
|    |        |     perjury);                                         |
|    |        |                                                       |
|    |        | -   Unique identifying number(s) from the ID(s) of    |
|    |        |     the applicant, or a facsimile of the ID(s);       |
|    |        |                                                       |
|    |        | -   The biometric of the applicant;                   |
|    |        |                                                       |
|    |        | -   The date and time of the verification; and        |
|    |        |                                                       |
|    |        | -   A declaration of identity signed by the applicant |
|    |        |     using a handwritten signature and performed in    |
|    |        |     the presence of the person performing the         |
|    |        |     identity authentication, using the format set     |
|    |        |     forth at 28 U.S.C. 1746 (declaration under        |
|    |        |     penalty of perjury).                              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 40 | COMMON | The following text only applies to the issuance of    |
| .  | P      | non-FIPS 201 credentials.                             |
|    | OLICY: |                                                       |
|    |        | For all certificate policies **except                 |
|    | **3.2  | id-fpki-common-High**, where it is not possible for   |
|    | .3.1** | applicants to appear in person before the RA, a       |
|    |        | trusted agent may serve as proxy for the RA. The      |
|    |        | trusted agent forwards the information collected from |
|    |        | the applicant directly to the RA in a secure manner.  |
|    |        | The requirement for recording a biometric of the      |
|    |        | applicant may be satisfied by providing               |
|    |        | passport-style photographs to the trusted agent. The  |
|    |        | trusted agent shall verify the photographs against    |
|    |        | the appearance of the applicant and the biometrics on |
|    |        | the presented credentials and securely incorporate    |
|    |        | the biometric as a component in the notarized         |
|    |        | package. *Packages secured in a tamper-evident manner |
|    |        | by the trusted agent satisfy this requirement; other  |
|    |        | secure methods are also acceptable.*                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 41 | COMMON | *Some computing and communications devices (routers,  |
| .  | P      | firewalls, servers, etc.) will be named as            |
|    | OLICY: | certificate subjects.* In such cases, the device must |
|    |        | have a human sponsor. The sponsor is responsible for  |
|    | **3.2  | providing the following registration information:     |
|    | .3.2** |                                                       |
|    |        | -   Equipment identification (e.g., serial number) or |
|    |        |     service name (e.g., DNS name)                     |
|    |        |                                                       |
|    |        | -   Equipment public keys                             |
|    |        |                                                       |
|    |        | -   Equipment authorizations and attributes (if any   |
|    |        |     are to be included in the certificate)            |
|    |        |                                                       |
|    |        | -   Contact information to enable the CA or RA to     |
|    |        |     communicate with the sponsor when required.       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 42 | COMMON | *Some computing and communications devices (routers,  |
| .  | P      | firewalls, servers, etc.) will be named as            |
|    | OLICY: | certificate subjects. In such cases, the device must  |
|    |        | have a human sponsor.*                                |
|    | **3.2  |                                                       |
|    | .3.2** | The identity of the sponsor shall be authenticated    |
|    |        | by:                                                   |
|    |        |                                                       |
|    |        | -   Verification of digitally signed messages sent    |
|    |        |     from the sponsor using a certificate issued under |
|    |        |     this policy; or                                   |
|    |        |                                                       |
|    |        | -   In-person registration by the sponsor, with the   |
|    |        |     identity of the sponsor confirmed in accordance   |
|    |        |     with the requirements of section 3.2.3.1.         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 43 | COMMON | Information that is not verified shall not be         |
| .  | P      | included in certificates.                             |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **3    |                                                       |
|    | .2.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 44 | COMMON | Before issuing CA certificates or signature           |
| .  | P      | certificates that assert organizational authority,    |
|    | OLICY: | the CA shall validate the individual's authority to   |
|    |        | act in the name of the organization.                  |
|    | **3    |                                                       |
|    | .2.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 45 | COMMON | **For re-key of certificates issued under             |
| .  | P      | id-fpki-common-High, identity may be established      |
|    | OLICY: | through use of current signature key, except that     |
|    |        | identity shall be established through an in-person    |
|    | **3    | registration process at least once every three years  |
|    | .3.1** | from the time of initial registration.**              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 46 | COMMON | For policies other than id-fpki-common-High, a        |
| .  | P      | subscriber's identity may be established through use  |
|    | OLICY: | of current signature key, except that identity shall  |
|    |        | be re-established through an in-person registration   |
|    | **3    | process at least once every nine years from the time  |
|    | .3.1** | of initial registration. CA certificate re-key shall  |
|    |        | follow the same procedures as initial certificate     |
|    |        | issuance.                                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 47 | COMMON | In the event of certificate revocation, issuance of a |
| .  | P      | new certificate shall always require that the party   |
|    | OLICY: | go through the initial registration process per       |
|    |        | section 3.2 above.                                    |
|    | **3    |                                                       |
|    | .3.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 48 | COMMON | Revocation requests must be authenticated.            |
| .  | P      |                                                       |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | *      |                                                       |
|    | *3.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 49 | COMMON | The Certificate application process must provide      |
| .  | P      | sufficient information to:                            |
|    | OLICY: |                                                       |
|    |        | -   Establish the applicant's authorization (by the   |
|    | *      |     employing or sponsoring agency) to obtain a       |
|    | *4.1** |     certificate. (per section 3.2.3)                  |
|    |        |                                                       |
|    |        | -   Establish and record identity of the applicant.   |
|    |        |     (per section 3.2.3)                               |
|    |        |                                                       |
|    |        | -   Obtain the applicant's public key and verify the  |
|    |        |     applicant's possession of the private key for     |
|    |        |     each certificate required. (per section 3.2.1)    |
|    |        |                                                       |
|    |        | -   Verify any role or authorization information      |
|    |        |     requested for inclusion in the certificate.       |
|    |        |                                                       |
|    |        | *These steps may be performed in any order that is    |
|    |        | convenient for the PKI Authorities and applicants     |
|    |        | that does not defeat security,* but all must be       |
|    |        | completed before certificate issuance.                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 50 | COMMON | An application for a CA certificate shall be          |
| .  | P      | submitted by an authorized representative of the      |
|    | OLICY: | applicant CA.                                         |
|    |        |                                                       |
|    | **4.1  |                                                       |
|    | .1.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 51 | COMMON | An application for a user (subscriber) certificate    |
| .  | P      | shall be submitted by either the applicant or a       |
|    | OLICY: | trusted agent                                         |
|    |        |                                                       |
|    | **4.1  |                                                       |
|    | .1.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 52 | COMMON | An application for a device certificate shall be      |
| .  | P      | submitted by the human sponsor of the device          |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **4.1  |                                                       |
|    | .1.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 53 | COMMON | All communications among PKI Authorities supporting   |
| .  | P      | the certificate application and issuance process      |
|    | OLICY: | shall be authenticated and protected from             |
|    |        | modification; any electronic transmission of shared   |
|    | **4    | secrets shall be protected*. Communications may be    |
|    | .1.2** | electronic or out-of-band.* Where electronic          |
|    |        | communications are used, cryptographic mechanisms     |
|    |        | commensurate with the strength of the public/private  |
|    |        | key pair shall be used. Out-of-band communications    |
|    |        | shall protect the confidentiality and integrity of    |
|    |        | the data.                                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 54 | COMMON | Information in certificate applications must be       |
| .  | P      | verified as accurate before certificates are issued.  |
|    | OLICY: | PKI Authorities shall specify procedures to verify    |
|    |        | information in certificate applications.              |
|    | *      |                                                       |
|    | *4.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 55 | COMMON | The PKI Authority must identify the components of the |
| .  | P      | PKI Authority (e.g., CA or RA) that are responsible   |
|    | OLICY: | for authenticating the subscriber's identity.         |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 56 | COMMON | Certificate applications must be processed and a      |
| .  | P      | certificate issued within 30 days of identity         |
|    | OLICY: | verification.                                         |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .2.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 57 | COMMON | Upon receiving the request, the CAs/RAs will---       |
| .  | P      |                                                       |
|    | OLICY: | -   Verify the identity of the requester.             |
|    |        |                                                       |
|    | **4    | -   Verify the authority of the requester and the     |
|    | .3.1** |     integrity of the information in the certificate   |
|    |        |     request.                                          |
|    |        |                                                       |
|    |        | -   Build and sign a certificate if all certificate   |
|    |        |     requirements have been met (in the case of an RA, |
|    |        |     have the CA sign the certificate).                |
|    |        |                                                       |
|    |        | -   Make the certificate available to the subscriber  |
|    |        |     after confirming that the subscriber has formally |
|    |        |     acknowledged their obligations as described in    |
|    |        |     section 9.6.3.                                    |
|    |        |                                                       |
|    |        | *The certificate request may already contain a        |
|    |        | certificate built by either the RA or the             |
|    |        | subscriber.* This certificate will not be signed      |
|    |        | until all verifications and modifications, if any,    |
|    |        | have been completed to the CA's satisfaction.         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 58 | COMMON | All authorization and other attribute information     |
| .  | P      | received from a prospective subscriber shall be       |
|    | OLICY: | verified before inclusion in a certificate. The       |
|    |        | responsibility for verifying prospective subscriber   |
|    | **4    | data shall be described in a CA's CPS.                |
|    | .3.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 59 | COMMON | CAs operating under this policy shall inform the      |
| .  | P      | subscriber (or other certificate subject) of the      |
|    | OLICY: | creation of a certificate and make the certificate    |
|    |        | available to the subscriber. For device certificates, |
|    | **4    | the CA shall inform the human sponsor.                |
|    | .3.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 60 | COMMON | Before a subscriber can make effective use of its     |
| .  | P      | private key, a PKI Authority shall explain to the     |
|    | OLICY: | subscriber its responsibilities as defined in section |
|    |        | 9.6.3.                                                |
|    | *      |                                                       |
|    | *4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 61 | COMMON | The Federal PKI Policy Authority must be notified     |
| .  | P      | whenever a CA operating under this policy issues a CA |
|    | OLICY: | certificate.                                          |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .4.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 62 | COMMON | *Renewing a certificate means creating a new          |
| .  | P      | certificate with the same name, key, and other        |
|    | OLICY: | information as the old one, but with a new, extended  |
|    |        | validity period and a new serial number.* The old     |
|    | *      | certificate may or may not be revoked, but must not   |
|    | *4.6** | be further re-keyed, renewed, or modified.            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 63 | COMMON | Subscriber certificates issued under this policy      |
| .  | P      | shall not be renewed, except during recovery from CA  |
|    | OLICY: | key compromise (see 5.7.3). In such cases, the        |
|    |        | renewed certificate shall expire as specified in the  |
|    | **4    | original subscriber certificate.                      |
|    | .6.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 64 | COMMON | The CA shall inform the subscriber of the renewal of  |
| .  | P      | his or her certificate and the contents of the        |
|    | OLICY: | certificate                                           |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .6.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 65 | COMMON | *Re-keying a certificate consists of creating new     |
| .  | P      | certificates with a different public key (and serial  |
|    | OLICY: | number) while retaining the remaining contents of the |
|    |        | old certificate that describe the subject. The new    |
|    | *      | certificate may be assigned a different validity      |
|    | *4.7** | period, key identifiers, specify a different CRL      |
|    |        | distribution point, and/or be signed with a different |
|    |        | key.* The old certificate may or may not be revoked,  |
|    |        | but must not be further re-keyed, renewed, or         |
|    |        | modified.                                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 66 | COMMON | Requests for certification of a new public key shall  |
| .  | P      | be considered as follows:                             |
|    | OLICY: |                                                       |
|    |        | Subscribers with a currently valid certificate may    |
|    | **4    | request certification of a new public key. CAs and    |
|    | .7.2** | RAs may request certification of a new public key on  |
|    |        | behalf of a subscriber. For device certificates, the  |
|    |        | human sponsor of the device may request certification |
|    |        | of a new public key.                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 67 | COMMON | Digital signatures on subscriber re-key requests      |
| .  | P      | shall be validated before electronic re-key requests  |
|    | OLICY: | are processed. Alternatively, subscriber re-key       |
|    |        | requests may be processed using the same process used |
|    | **4    | for initial certificate issuance.                     |
|    | .7.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 68 | COMMON | *Modifying a certificate means creating a new         |
| .  | P      | certificate that has the same or a different key and  |
|    | OLICY: | a different serial number, and that differs in one or |
|    |        | more other fields from the old certificate.* The old  |
|    | *      | certificate may or may not be revoked, but must not   |
|    | *4.8** | be further re-keyed, renewed, or modified             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 69 | COMMON | *A CA may perform certificate modification for a      |
| .  | P      | subscriber whose characteristics have changed (e.g.,  |
|    | OLICY: | name change due to marriage).* The new certificate    |
|    |        | shall have a different subject public key.            |
|    | **4    |                                                       |
|    | .8.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 70 | COMMON | Requests for certification of a new public key shall  |
| .  | P      | be considered as follows:                             |
|    | OLICY: |                                                       |
|    |        | Subscribers with a currently valid certificate may    |
|    | **4    | request certificate modification. CAs and RAs may     |
|    | .8.2** | request certificate modification on behalf of a       |
|    |        | subscriber. For device certificates, the human        |
|    |        | sponsor of the device may request certificate         |
|    |        | modification.                                         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 71 | COMMON | If an individual's name changes (e.g., due to         |
| .  | P      | marriage), then proof of the name change must be      |
|    | OLICY: | provided to the RA or other designated agent in order |
|    |        | for a certificate with the new name to be issued. If  |
|    | **4    | an individual's authorizations or privileges change,  |
|    | .8.3** | the RA will verify those authorizations. If           |
|    |        | authorizations have reduced, the old certificate must |
|    |        | be revoked.                                           |
|    |        |                                                       |
|    |        | Proof of all subject information changes must be      |
|    |        | provided to the RA or other designated agent and      |
|    |        | verified before the modified certificate is issued.   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 72 | COMMON | CAs operating under this policy shall issue CRLs      |
| .  | P      | covering all unexpired certificates issued under this |
|    | OLICY: | policy except for OCSP responder certificates that    |
|    |        | include the id-pkix-ocsp-nocheck extension.           |
|    | *      |                                                       |
|    | *4.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 73 | COMMON | CAs operating under this policy shall make public a   |
| .  | P      | description of how to obtain revocation information   |
|    | OLICY: | for the certificates they publish, and an explanation |
|    |        | of the consequences of using dated revocation         |
|    | *      | information. This information shall be given to       |
|    | *4.9** | subscribers during certificate request or issuance,   |
|    |        | and shall be readily available to any potential       |
|    |        | relying party.                                        |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 74 | COMMON | Revocation requests must be authenticated. *Requests  |
| .  | P      | to revoke a certificate may be authenticated using    |
|    | OLICY: | that certificate\'s associated private key,           |
|    |        | regardless of whether or not the private key has been |
|    | *      | compromised*                                          |
|    | *4.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 75 | COMMON | Certificate suspension for CA certificates is not     |
| .  | P      | allowed by this policy. *However, the use of          |
|    | OLICY: | certificate suspension for end entity certificates is |
|    |        | allowed*.                                             |
|    | **4.9  |                                                       |
|    | (4.9   |                                                       |
|    | .13)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 76 | COMMON | A certificate shall be revoked when the binding       |
| .  | P      | between the subject and the subject's public key      |
|    | OLICY: | defined within the certificate is no longer           |
|    |        | considered valid. *Examples of circumstances that     |
|    | **4    | invalidate the binding are---*                        |
|    | .9.1** |                                                       |
|    |        | -   *Identifying information or affiliation           |
|    |        |     components of any names in the certificate        |
|    |        |     becomes invalid.*                                 |
|    |        |                                                       |
|    |        | -   *Privilege attributes asserted in the             |
|    |        |     subscriber's certificate are reduced.*            |
|    |        |                                                       |
|    |        | -   *The subscriber can be shown to have violated the |
|    |        |     stipulations of its subscriber agreement.*        |
|    |        |                                                       |
|    |        | -   *There is reason to believe the private key has   |
|    |        |     been compromised.*                                |
|    |        |                                                       |
|    |        | -   *The subscriber or other authorized party (as     |
|    |        |     defined in the CPS) asks for his/her certificate  |
|    |        |     to be revoked.*                                   |
|    |        |                                                       |
|    |        | Whenever any of the above circumstances occur, the    |
|    |        | associated certificate shall be revoked and placed on |
|    |        | the CRL. Revoked certificates shall be included on    |
|    |        | all new publications of the certificate status        |
|    |        | information until the certificates expire.            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 77 | COMMON | *Within the PKI, a CA may summarily revoke            |
| .  | P      | certificates within its domain*. A written notice and |
|    | OLICY: | brief explanation for the revocation shall            |
|    |        | subsequently be provided to the subscriber.           |
|    | **4    |                                                       |
|    | .9.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 78 | COMMON | A request to revoke a certificate shall identify the  |
| .  | P      | certificate to be revoked, explain the reason for     |
|    | OLICY: | revocation, and allow the request to be authenticated |
|    |        | (e.g., digitally or manually signed). The steps       |
|    | **4    | involved in the process of requesting a certification |
|    | .9.3** | revocation are detailed in the CPS.                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 79 | COMMON | *Where subscribers use hardware tokens, revocation is |
| .  | P      | optional if all the following conditions are met:*    |
|    | OLICY: |                                                       |
|    |        | -   *the revocation request was not for key           |
|    | **4    |     compromise;*                                      |
|    | .9.3** |                                                       |
|    |        | -   *the hardware token does not permit the user to   |
|    |        |     export the signature private key;*                |
|    |        |                                                       |
|    |        | -   *the subscriber surrendered the token to the      |
|    |        |     PKI;*                                             |
|    |        |                                                       |
|    |        | -   *the token was zeroized or destroyed promptly     |
|    |        |     upon surrender;*                                  |
|    |        |                                                       |
|    |        | -   *the token has been protected from malicious use  |
|    |        |     between surrender and zeroization or              |
|    |        |     destruction*.                                     |
|    |        |                                                       |
|    |        | In all other cases, revocation of the certificates is |
|    |        | mandatory. *Even where all the above conditions have  |
|    |        | been met, revocation of the associated certificates   |
|    |        | is recommended*                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 80 | COMMON | There is no grace period for revocation under this    |
| .  | P      | policy                                                |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .9.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 81 | COMMON | CAs will revoke certificates as quickly as practical  |
| .  | P      | upon receipt of a proper revocation request.          |
|    | OLICY: | Revocation requests shall be processed before the     |
|    |        | next CRL is published, excepting those requests       |
|    | **4    | received within two hours of CRL issuance. Revocation |
|    | .9.5** | requests received within two hours of CRL issuance    |
|    |        | shall be processed before the following CRL is        |
|    |        | published.                                            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 82 | COMMON | CRLs shall be issued periodically, even if there are  |
| .  | P      | no changes to be made, to ensure timeliness of        |
|    | OLICY: | information. .                                        |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .9.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 83 | COMMON | Certificate status information shall be published not |
| .  | P      | later than the next scheduled update.                 |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .9.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 84 | COMMON | CAs operating as part of the Shared Service Providers |
| .  | P      | program that only issue certificates to CAs and that  |
|    | OLICY: | operate off-line must issue CRLs at least once every  |
|    |        | 24 hours, and the *nextUpdate* time in the CRL may be |
|    | **4    | no later than 48 hours after issuance time (i.e., the |
|    | .9.7** | *thisUpdate* time).                                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 85 | COMMON | CAs that issue certificates to subscribers or operate |
| .  | P      | on-line must issue CRLs at least once every 18 hours, |
|    | OLICY: | and the *nextUpdate* time in the CRL may be no later  |
|    |        | than 48 hours after issuance time (i.e., the          |
|    | **4    | *thisUpdate* time).                                   |
|    | .9.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 86 | COMMON | CRLs shall be published within 4 hours of generation. |
| .  | P      | Furthermore, each CRL shall be published no later     |
|    | OLICY: | than the time specified in the *nextUpdate* field of  |
|    |        | the previously issued CRL for same scope.             |
|    | **4    |                                                       |
|    | .9.8** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 87 | COMMON | CAs shall support on-line status checking via OCSP    |
| .  | P      | \[RFC 2560\] for end entity certificates issued under |
|    | OLICY: | id-fpki-common-authentication and                     |
|    |        | id-fpki-common-cardAuth.                              |
|    | **4    |                                                       |
|    | .9.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 88 | COMMON | Where on-line status checking is supported, status    |
| .  | P      | information must be updated and available to relying  |
|    | OLICY: | parties within 18 hours of certificate revocation.    |
|    |        |                                                       |
|    | **4    |                                                       |
|    | .9.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 89 | COMMON | **Where on-line status checking is supported and a    |
| .  | P      | certificate issued under id-fpki-common-High is       |
|    | OLICY: | revoked for key compromise, the status information    |
|    |        | must be updated and available to relying parties      |
|    | **4    | within 6 hours.**                                     |
|    | .9.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 90 | COMMON | *A CA may also use other methods to publicize the     |
| .  | P      | certificates it has revoked.* Any alternative method  |
|    | OLICY: | must meet the following requirements:                 |
|    |        |                                                       |
|    | **4.   | -   The alternative method must be described in the   |
|    | 9.11** |     CA's approved CPS;                                |
|    |        |                                                       |
|    |        | -   The alternative method must provide               |
|    |        |     authentication and integrity services             |
|    |        |     commensurate with the assurance level of the      |
|    |        |     certificate being verified.                       |
|    |        |                                                       |
|    |        | -   The alternative method must meet the issuance and |
|    |        |     latency requirements for CRLs stated in sections  |
|    |        |     4.9.7 and 4.9.8.                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 91 | COMMON | When a CA certificate is revoked a CRL must be issued |
| .  | P      | within 18 hours of notification.                      |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **4.   |                                                       |
|    | 9.12** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 92 | COMMON | **When a CA certificate issued under                  |
| .  | P      | id-fpki-common-High is revoked or subscriber          |
|    | OLICY: | certificate issued under id-fpki-common-High is       |
|    |        | revoked because of compromise, or suspected           |
|    | **4.   | compromise, of a private key, a CRL must be issued    |
|    | 9.12** | within 6 hours of notification.**                     |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 93 | COMMON | CA private keys are never escrowed.                   |
| .  | P      |                                                       |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **     |                                                       |
|    | 4.12.1 |                                                       |
|    | (6.    |                                                       |
|    | 2.3)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 94 | COMMON | *Subscriber key management keys may be escrowed to    |
| .  | P      | provide key recovery.* CAs that support private key   |
|    | OLICY: | escrow for key management keys shall identify the     |
|    |        | document describing the practices in the applicable   |
|    | **4.   | CPS. Escrowed keys shall be protected at no less than |
|    | 12.1** | the level of security in which they are generated,    |
|    |        | delivered, and protected by the subscriber.           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 95 | COMMON | Under no circumstances shall a subscriber signature   |
| .  | P      | key be held in trust by a third party.                |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | **4.   |                                                       |
|    | 12.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 96 | COMMON | CAs that support session key encapsulation and        |
| .  | P      | recovery shall identify the document describing the   |
|    | OLICY: | practices in the applicable CPS.                      |
|    |        |                                                       |
|    | **4.   |                                                       |
|    | 12.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 97 | COMMON | CA equipment shall be protected from unauthorized     |
| .  | P      | access while the cryptographic module is installed    |
|    | OLICY: | and activated.                                        |
|    |        |                                                       |
|    | *      |                                                       |
|    | *5.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 98 | COMMON | The CA shall implement physical access controls to    |
| .  | P      | reduce the risk of equipment tampering even when the  |
|    | OLICY: | cryptographic module is not installed and activated.  |
|    |        |                                                       |
|    | **     |                                                       |
|    | 5.1.** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 99 | COMMON | CA cryptographic tokens shall be protected against    |
| .  | P      | theft, loss, and unauthorized use.                    |
|    | OLICY: |                                                       |
|    |        |                                                       |
|    | *      |                                                       |
|    | *5.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The location and construction of the facility housing |
| 00 | P      | the CA equipment shall be consistent with facilities  |
| .  | OLICY: | used to house high-value, sensitive information. The  |
|    |        | site location and construction, when combined with    |
|    | **5    | other physical security protection mechanisms such as |
|    | .1.1** | guards and intrusion sensors, shall provide robust    |
|    |        | protection against unauthorized access to the CA      |
|    |        | equipment and records.                                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | At a minimum, the physical access controls shall---   |
| 01 | P      |                                                       |
| .  | OLICY: | -   Ensure that no unauthorized access to the         |
|    |        |     hardware is permitted.                            |
|    | **5.1  |                                                       |
|    | .2.1** | -   Ensure that all removable media and paper         |
|    |        |     containing sensitive plain-text information is    |
|    |        |     stored in secure containers.                      |
|    |        |                                                       |
|    |        | -   Be manually or electronically monitored for       |
|    |        |     unauthorized intrusion at all times.              |
|    |        |                                                       |
|    |        | -   Ensure an access log is maintained and inspected  |
|    |        |     periodically.                                     |
|    |        |                                                       |
|    |        | -   Require two-person physical access control to     |
|    |        |     both the cryptographic module and computer        |
|    |        |     system.                                           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When not in use, removable cryptographic modules,     |
| 02 | P      | activation information used to access or enable       |
| .  | OLICY: | cryptographic modules, and CA equipment shall be      |
|    |        | placed in secure containers. Activation data shall be |
|    | **5.1  | either memorized or recorded and stored in a manner   |
|    | .2.1** | commensurate with the security afforded the           |
|    |        | cryptographic module, and shall not be stored with    |
|    |        | the cryptographic module.                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | A security check of the facility housing the CA       |
| 03 | P      | equipment shall occur if the facility is to be left   |
| .  | OLICY: | unattended. At a minimum, the check shall verify the  |
|    |        | following:                                            |
|    | **5.1  |                                                       |
|    | .2.1** | -   The equipment is in a state appropriate to the    |
|    |        |     current mode of operation (e.g., that             |
|    |        |     cryptographic modules are in place when "open,"   |
|    |        |     and secured when "closed," and for the CA, that   |
|    |        |     all equipment other than the repository is shut   |
|    |        |     down).                                            |
|    |        |                                                       |
|    |        | -   Any security containers are properly secured.     |
|    |        |                                                       |
|    |        | -   Physical security systems (e.g., door locks, vent |
|    |        |     covers) are functioning properly.                 |
|    |        |                                                       |
|    |        | -   The area is secured against unauthorized access.  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | A person or group of persons shall be made explicitly |
| 04 | P      | responsible for making such checks. When a group of   |
| .  | OLICY: | persons is responsible, a log identifying the person  |
|    |        | performing a check at each instance shall be          |
|    | **5.1  | maintained. If the facility is not continuously       |
|    | .2.1** | attended, the last person to depart shall initial a   |
|    |        | sign-out sheet that indicates the date and time and   |
|    |        | asserts that all necessary physical protection        |
|    |        | mechanisms are in place and activated.                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | RA equipment shall be protected from unauthorized     |
| 05 | P      | access while the cryptographic module is installed    |
| .  | OLICY: | and activated. The RA shall implement physical access |
|    |        | controls to reduce the risk of equipment tampering    |
|    | **5.1  | even when the cryptographic module is not installed   |
|    | .2.2** | and activated. These security mechanisms shall be     |
|    |        | commensurate with the level of threat in the RA       |
|    |        | equipment environment.                                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Physical access control requirements for CSS          |
| 06 | P      | equipment (if implemented), shall meet the CA         |
| .  | OLICY: | physical access requirements specified in 5.1.2.1     |
|    |        |                                                       |
|    | **5.1  |                                                       |
|    | .2.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall have backup capability sufficient to     |
| 07 | P      | lock out input, finish any pending actions, and       |
| .  | OLICY: | record the state of the equipment automatically       |
|    |        | before lack of power or air conditioning causes a     |
|    | **5    | shutdown.                                             |
|    | .1.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The directories (containing CA certificates and CRLs) |
| 08 | P      | shall be provided with uninterrupted power sufficient |
| .  | OLICY: | for a minimum of 6 hours operation in the absence of  |
|    |        | commercial power, to maintain availability and avoid  |
|    | **5    | denial of service.                                    |
|    | .1.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CA equipment shall be installed such that it is not   |
| 09 | P      | in danger of exposure to water (e.g., on tables or    |
| .  | OLICY: | elevated floors).                                     |
|    |        |                                                       |
|    | **5    | *Potential water damage from fire prevention and      |
|    | .1.4** | protection measures (e.g., sprinkler systems) are     |
|    |        | excluded from this requirement.*                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Media shall be stored so as to protect them from      |
| 10 | P      | accidental damage (e.g., water, fire, or              |
| .  | OLICY: | electromagnetic) and unauthorized physical access.    |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .1.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Sensitive media and documentation that are no longer  |
| 11 | P      | needed for operations shall be destroyed in a secure  |
| .  | OLICY: | manner. For example, sensitive paper documentation    |
|    |        | shall be shredded, burned, or otherwise rendered      |
|    | **5    | unrecoverable.                                        |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Full system backups sufficient to recover from system |
| 12 | P      | failure shall be made on a periodic schedule, and     |
| .  | OLICY: | described in a CA's CPS. Backups are to be performed  |
|    |        | and stored off-site not less than once per week. At   |
|    | **5    | least one full backup copy shall be stored at an      |
|    | .1.8** | off-site location (separate from CA equipment). Only  |
|    |        | the latest full backup need be retained. The backup   |
|    |        | shall be stored at a site with physical and           |
|    |        | procedural controls commensurate to that of the       |
|    |        | operational CA.                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The primary trusted roles defined in this policy are  |
| 13 | P      | Administrator, Officer, Auditor, and Operator.        |
| .  | OLICY: | Individual personnel shall be specifically designated |
|    |        | to the four roles. *These four roles are employed at  |
|    | **5    | the CA, RA, and CSS locations as appropriate.*        |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The administrator role shall be responsible for:      |
| 14 | P      |                                                       |
| .  | OLICY: | -   Installation, configuration, and maintenance of   |
|    |        |     the CA and CSS (where applicable);                |
|    | **5.2  |                                                       |
|    | .1.1** | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Establishing and maintaining CA and CSS system    |
|    |        |     accounts;                                         |
|    |        |                                                       |
|    |        | -   Configuring certificate profiles or templates;    |
|    |        |                                                       |
|    |        | -   Configuring CA, RA, and CSS audit parameters;     |
|    |        |                                                       |
|    |        | -   Configuring CSS response profiles; and            |
|    |        |                                                       |
|    |        | -   Generating and backing up CA and CSS keys.        |
|    |        |                                                       |
|    |        | Administrators do not issue certificates to           |
|    |        | subscribers.                                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The officer role shall be responsible for issuing     |
| 15 | P      | certificates, that is:                                |
| .  | OLICY: |                                                       |
|    |        | -   Registering new subscribers and requesting the    |
|    | **5.2  |     issuance of certificates;                         |
|    | .1.2** |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Verifying the identity of subscribers and         |
|    |        |     accuracy of information included in certificates; |
|    |        |                                                       |
|    |        | -   Approving and executing the issuance of           |
|    |        |     certificates; and                                 |
|    |        |                                                       |
|    |        |     -   Requesting, approving and executing the       |
|    |        |         revocation of certificates.                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The auditor role shall be responsible for:            |
| 16 | P      |                                                       |
| .  | OLICY: | -   Reviewing, maintaining, and archiving audit logs; |
|    |        |     and                                               |
|    | **5.2  |                                                       |
|    | .1.3** |     -   Performing or overseeing internal compliance  |
|    |        |         audits to ensure that the CA, associated RAs, |
|    |        |         and CSS (where applicable) are operating in   |
|    |        |         accordance with its CPS.                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The operator role shall be responsible for the        |
| 17 | P      | routine operation of the CA equipment and operations  |
| .  | OLICY: | such as system backups and recovery or changing       |
|    |        | recording media.                                      |
|    | **5.2  |                                                       |
|    | .1.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Two or more persons are required for the following    |
| 18 | P      | tasks:                                                |
| .  | OLICY: |                                                       |
|    |        | -   CA key generation;                                |
|    | **5    |                                                       |
|    | .2.2** | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   CA signing key activation;                        |
|    |        |                                                       |
|    |        | -   CA private key backup.                            |
|    |        |                                                       |
|    |        | Where multiparty control is required, at least one of |
|    |        | the participants shall be an Administrator. All       |
|    |        | participants must serve in a trusted role as defined  |
|    |        | in section 5.2.1. Multiparty control shall not be     |
|    |        | achieved using personnel that serve in the Auditor    |
|    |        | trusted role                                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | An individual shall identify and authenticate         |
| 19 | P      | him/herself before being permitted to perform any     |
| .  | OLICY: | actions set forth for that role or identity.          |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .2.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Individuals may only assume one of the Officer,       |
| 20 | P      | Administrator, and Auditor roles, but any individual  |
| .  | OLICY: | may assume the Operator role.                         |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .2.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA and RA software and hardware shall identify    |
| 21 | P      | and authenticate its users and shall ensure that no   |
| .  | OLICY: | user identity can assume both the Administrator and   |
|    |        | Officer roles, assume both the Administrator and      |
|    | **5    | Auditor roles, or assume both the Auditor and Officer |
|    | .2.4** | roles. **For CAs that issue at id-fpki-common-High,   |
|    |        | the Auditor may not assume any other role.** No       |
|    |        | individual shall have more than one identity.         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | All persons filling trusted roles shall be selected   |
| 22 | P      | on the basis of loyalty, trustworthiness, and         |
| .  | OLICY: | integrity, and must be U.S. citizens. The             |
|    |        | requirements governing the qualifications, selection  |
|    | **5    | and oversight of individuals who operate, manage,     |
|    | .3.1** | oversee, and audit the CA shall be set forth in the   |
|    |        | CPS.                                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CA personnel shall, at a minimum, pass a background   |
| 23 | P      | investigation covering the following areas:           |
| .  | OLICY: |                                                       |
|    |        | -   Employment;                                       |
|    | **5    |                                                       |
|    | .3.2** | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Education;                                        |
|    |        |                                                       |
|    |        | -   Place of residence;                               |
|    |        |                                                       |
|    |        | -   Law Enforcement; and                              |
|    |        |                                                       |
|    |        | -   References.                                       |
|    |        |                                                       |
|    |        | The period of investigation must cover at least the   |
|    |        | last five years for each area, excepting the          |
|    |        | residence check which must cover at least the last    |
|    |        | three years. Regardless of the date of award, the     |
|    |        | highest educational degree shall be verified.         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Adjudication of the background investigation shall be |
| 24 | P      | performed by a competent adjudication authority using |
| .  | OLICY: | a process consistent with Executive Order 12968       |
|    |        | August 1995, or equivalent.                           |
|    | **5    |                                                       |
|    | .3.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | All personnel performing duties with respect to the   |
| 25 | P      | operation of the CA or RA shall receive comprehensive |
| .  | OLICY: | training. Training shall be conducted in the          |
|    |        | following areas:                                      |
|    | **5    |                                                       |
|    | .3.3** | -   CA (or RA) security principles and mechanisms;    |
|    |        |                                                       |
|    |        | -   All PKI software versions in use on the CA (or    |
|    |        |     RA) system;                                       |
|    |        |                                                       |
|    |        | -   All PKI duties they are expected to perform;      |
|    |        |                                                       |
|    |        | -   Disaster recovery and business continuity         |
|    |        |     procedures; and                                   |
|    |        |                                                       |
|    |        | -   Stipulations of this policy.                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | All individuals responsible for PKI roles shall be    |
| 26 | P      | made aware of changes in the CA operation. Any        |
| .  | OLICY: | significant change to the operations shall have a     |
|    |        | training (awareness) plan, and the execution of such  |
|    | **5    | plan shall be documented. *Examples of such changes   |
|    | .3.4** | are CA software or hardware upgrade, changes in       |
|    |        | automated security systems, and relocation of         |
|    |        | equipment.*                                           |
|    |        |                                                       |
|    |        | Documentation shall be maintained identifying all     |
|    |        | personnel who received training and the level of      |
|    |        | training completed.                                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall take appropriate administrative and      |
| 27 | P      | disciplinary actions against personnel who have       |
| .  | OLICY: | performed actions involving the CA or its RAs that    |
|    |        | are not authorized in this CP, CPSs, or other         |
|    | **5    | published procedures.                                 |
|    | .3.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Contractors fulfilling trusted roles are subject to   |
| 28 | P      | all personnel requirements stipulated in this policy. |
| .  | OLICY: |                                                       |
|    |        | PKI vendors who provide any services shall establish  |
|    | **5    | procedures to ensure that any subcontractors perform  |
|    | .3.7** | in accordance with this policy and the CPS.           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Documentation sufficient to define duties and         |
| 29 | P      | procedures for each role shall be provided to the     |
| .  | OLICY: | personnel filling that role.                          |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .3.8** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Audit log files shall be generated for all events     |
| 30 | P      | relating to the security of the CA. Where possible,   |
| .  | OLICY: | the security audit logs shall be automatically        |
|    |        | collected. Where this is not possible, a logbook,     |
|    | *      | paper form, or other physical mechanism shall be      |
|    | *5.4** | used. All security audit logs, both electronic and    |
|    |        | non-electronic, shall be retained and made available  |
|    |        | during compliance audits.                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | All security auditing capabilities of CA operating    |
| 31 | P      | system and CA applications shall be enabled during    |
| .  | OLICY: | installation. At a minimum, each audit record shall   |
|    |        | include the following (either recorded automatically  |
|    | **5    | or manually for each auditable event):                |
|    | .4.1** |                                                       |
|    |        | -   The type of event;                                |
|    |        |                                                       |
|    |        | -   The date and time the event occurred;             |
|    |        |                                                       |
|    |        | -   A success or failure indicator when executing the |
|    |        |     CA's signing process;                             |
|    |        |                                                       |
|    |        | -   A success or failure indicator when performing    |
|    |        |     certificate revocation; and                       |
|    |        |                                                       |
|    |        | -   The identity of the entity and/or operator that   |
|    |        |     caused the event.                                 |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | A message from any source requesting an action by the |
| 32 | P      | CA is an auditable event; the corresponding audit     |
| .  | OLICY: | record must also include message date and time,       |
|    |        | source, destination, and contents.                    |
|    | **5    |                                                       |
|    | .4.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 33 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   SECURITY AUDIT:                                   |
|    |        |                                                       |
|    |        |     -   Any changes to the Audit parameters, e.g.,    |
|    |        |         audit frequency, type of event audited        |
|    |        |                                                       |
|    |        |     -   Any attempt to delete or modify the Audit     |
|    |        |         logs                                          |
|    |        |                                                       |
|    |        |     -   Obtaining a third-party time-stamp            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 34 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   IDENTIFICATION AND AUTHENTICATION:                |
|    |        |                                                       |
|    |        |     -   Successful and unsuccessful attempts to       |
|    |        |         assume a role                                 |
|    |        |                                                       |
|    |        |     -   The value of maximum authentication attempts  |
|    |        |         is changed                                    |
|    |        |                                                       |
|    |        |     -   Maximum authentication attempts unsuccessful  |
|    |        |         authentication attempts occur during user     |
|    |        |         login                                         |
|    |        |                                                       |
|    |        |     -   An Administrator unlocks an account that has  |
|    |        |         been locked as a result of unsuccessful       |
|    |        |         authentication attempts                       |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   An Administrator changes the type of              |
|    |        |     authenticator, e.g., from password to biometrics  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 35 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   LOCAL DATA ENTRY:                                 |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   All security-relevant data that is entered in the |
|    |        |     system                                            |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   REMOTE DATA ENTRY:                                |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   All security-relevant messages that are received  |
|    |        |     by the system                                     |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   DATA EXPORT AND OUTPUT:                           |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   All successful and unsuccessful requests for      |
|    |        |     confidential and security-relevant information    |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 36 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   KEY GENERATION:                                   |
|    |        |                                                       |
|    |        |     -   Whenever the CA generates a key. (Not         |
|    |        |         mandatory for single session or one-time use  |
|    |        |         symmetric keys)                               |
|    |        |                                                       |
|    |        | -   PRIVATE KEY LOAD AND STORAGE:                     |
|    |        |                                                       |
|    |        |     -   The loading of Component private keys         |
|    |        |                                                       |
|    |        |     -   All access to certificate subject private     |
|    |        |         keys retained within the CA for key recovery  |
|    |        |         purposes                                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 37 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   TRUSTED PUBLIC KEY ENTRY, DELETION AND STORAGE:   |
|    |        |                                                       |
|    |        |     -   All changes to the trusted public keys,       |
|    |        |         including additions and deletions             |
|    |        |                                                       |
|    |        | -   SECRET KEY STORAGE:                               |
|    |        |                                                       |
|    |        |     -   The manual entry of secret keys used for      |
|    |        |         authentication                                |
|    |        |                                                       |
|    |        | -   PRIVATE AND SECRET KEY EXPORT:                    |
|    |        |                                                       |
|    |        |     -   The export of private and secret keys (keys   |
|    |        |         used for a single session or message are      |
|    |        |         excluded)                                     |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 38 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   CERTIFICATE REGISTRATION:                         |
|    |        |                                                       |
|    |        |     -   All certificate requests                      |
|    |        |                                                       |
|    |        | -   CERTIFICATE REVOCATION:                           |
|    |        |                                                       |
|    |        |     -   All certificate revocation requests           |
|    |        |                                                       |
|    |        | -   CERTIFICATE STATUS CHANGE APPROVAL:               |
|    |        |                                                       |
|    |        |     -   The approval or rejection of a certificate    |
|    |        |         status change request                         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 39 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   CA CONFIGURATION:                                 |
|    |        |                                                       |
|    |        |     -   Any security-relevant changes to the          |
|    |        |         configuration of the CA                       |
|    |        |                                                       |
|    |        | -   ACCOUNT ADMINISTRATION:                           |
|    |        |                                                       |
|    |        |     -   Roles and users are added or deleted          |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   The access control privileges of a user account   |
|    |        |     or a role are modified                            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 40 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   CERTIFICATE PROFILE MANAGEMENT:                   |
|    |        |                                                       |
|    |        |     -   All changes to the certificate profile        |
|    |        |                                                       |
|    |        | -   REVOCATION PROFILE MANAGEMENT:                    |
|    |        |                                                       |
|    |        |     -   All changes to the revocation profile         |
|    |        |                                                       |
|    |        | -   CERTIFICATE REVOCATION LIST PROFILE MANAGEMENT:   |
|    |        |                                                       |
|    |        |     -   All changes to the certificate revocation     |
|    |        |         list profile                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 41 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   MISCELLANEOUS:                                    |
|    |        |                                                       |
|    |        |     -   Appointment of an individual to a trusted     |
|    |        |         role                                          |
|    |        |                                                       |
|    |        |     -   Designation of personnel for multiparty       |
|    |        |         control                                       |
|    |        |                                                       |
|    |        |     -   Installation of the operating system          |
|    |        |                                                       |
|    |        |     -   Installation of the CA                        |
|    |        |                                                       |
|    |        |     -   Installing hardware cryptographic modules     |
|    |        |                                                       |
|    |        |     -   Removing hardware cryptographic modules       |
|    |        |                                                       |
|    |        |     -   Destruction of cryptographic modules          |
|    |        |                                                       |
|    |        |     -   System startup                                |
|    |        |                                                       |
|    |        |     -   Logon attempts to CA applications             |
|    |        |                                                       |
|    |        |     -   Receipt of hardware / software                |
|    |        |                                                       |
|    |        |     -   Attempts to set passwords                     |
|    |        |                                                       |
|    |        |     -   Attempts to modify passwords                  |
|    |        |                                                       |
|    |        |     -   Backing up CA internal database               |
|    |        |                                                       |
|    |        |     -   Restoring CA internal database                |
|    |        |                                                       |
|    |        |     -   File manipulation (e.g., creation, renaming,  |
|    |        |         moving)                                       |
|    |        |                                                       |
|    |        |     -   Posting of any material to a repository       |
|    |        |                                                       |
|    |        |     -   Access to CA internal database                |
|    |        |                                                       |
|    |        |     -   All certificate compromise notification       |
|    |        |         requests                                      |
|    |        |                                                       |
|    |        |     -   Loading tokens with certificates              |
|    |        |                                                       |
|    |        |     -   Shipment of tokens                            |
|    |        |                                                       |
|    |        |     -   Zeroizing tokens                              |
|    |        |                                                       |
|    |        |     -   Re-key of the CA                              |
|    |        |                                                       |
|    |        |     -   Configuration changes to the CA server        |
|    |        |         involving:                                    |
|    |        |                                                       |
|    |        |         -   Hardware                                  |
|    |        |                                                       |
|    |        |         -   Software                                  |
|    |        |                                                       |
|    |        |         -   Operating system                          |
|    |        |                                                       |
|    |        |         -   Patches                                   |
|    |        |                                                       |
|    |        |         -   Security profiles                         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 42 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   PHYSICAL ACCESS / SITE SECURITY:                  |
|    |        |                                                       |
|    |        |     -   Personnel access to room housing CA           |
|    |        |                                                       |
|    |        |     -   Access to the CA server                       |
|    |        |                                                       |
|    |        |     -   Known or suspected violations of physical     |
|    |        |         security                                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA shall record the events identified in the list |
| 43 | P      | below. Where these events cannot be electronically    |
| .  | OLICY: | logged, the CA shall supplement electronic audit logs |
|    |        | with physical logs as necessary.                      |
|    | **5    |                                                       |
|    | .4.1** | -   ANOMALIES:                                        |
|    |        |                                                       |
|    |        |     -   Software error conditions                     |
|    |        |                                                       |
|    |        |     -   Software check integrity failures             |
|    |        |                                                       |
|    |        |     -   Receipt of improper messages                  |
|    |        |                                                       |
|    |        |     -   Misrouted messages                            |
|    |        |                                                       |
|    |        |     -   Network attacks (suspected or confirmed)      |
|    |        |                                                       |
|    |        |     -   Equipment failure                             |
|    |        |                                                       |
|    |        |     -   Electrical power outages                      |
|    |        |                                                       |
|    |        |     -   Uninterruptible power supply (UPS) failure    |
|    |        |                                                       |
|    |        |     -   Obvious and significant network service or    |
|    |        |         access failures                               |
|    |        |                                                       |
|    |        |     -   Violations of certificate policy              |
|    |        |                                                       |
|    |        |     -   Violations of certification practice          |
|    |        |         statement                                     |
|    |        |                                                       |
|    |        |     -   Resetting operating system clock              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | **For CAs that issue certificates under               |
| 44 | P      | id-fpki-common-High, review of the audit log shall be |
| .  | OLICY: | required at least once every month.** For CAs that do |
|    |        | not issue certificates under id-fpki-common-High,     |
|    | **5    | review of the audit log shall be required at least    |
|    | .4.2** | once every two months.                                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | \[Audit\] reviews involve verifying that the log has  |
| 45 | P      | not been tampered with and then briefly inspecting    |
| .  | OLICY: | all log entries, with a more thorough investigation   |
|    |        | of any alerts or irregularities in the logs. A        |
|    | **5    | statistically significant portion of the security     |
|    | .4.2** | audit data generated by the CA since the last review  |
|    |        | shall be examined. This amount will be described in   |
|    |        | the CPS.                                              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | All significant events shall be explained in an audit |
| 46 | P      | log summary. Actions taken as a result of these       |
| .  | OLICY: | reviews shall be documented.                          |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Audit logs shall be retained on-site for at least 2   |
| 47 | P      | months                                                |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The individual who removes audit logs from the CA     |
| 48 | P      | system shall be an official different from the        |
| .  | OLICY: | individuals who, in combination, command the CA       |
|    |        | signature key.                                        |
|    | **5    |                                                       |
|    | .4.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The security audit data shall not be open for reading |
| 49 | P      | or modification by any human, or by any automated     |
| .  | OLICY: | process, other than those that perform security audit |
|    |        | processing.                                           |
|    | **5    |                                                       |
|    | .4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CA system configuration and procedures must be        |
| 50 | P      | implemented together to ensure that only authorized   |
| .  | OLICY: | people archive or delete security audit data.         |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Procedures must be implemented to protect archived    |
| 51 | P      | data from deletion or destruction before the end of   |
| .  | OLICY: | the security audit data retention period (note that   |
|    |        | deletion requires modification access).               |
|    | **5    |                                                       |
|    | .4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Security audit data shall be moved to a safe, secure  |
| 52 | P      | storage location separate from the CA equipment.      |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Audit logs and audit summaries shall be backed up at  |
| 53 | P      | least monthly.                                        |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | A copy of the audit log shall be sent off-site on a   |
| 54 | P      | monthly basis.                                        |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | *The audit log collection system may or may not be    |
| 55 | P      | external to the CA system*. Automated audit processes |
| .  | OLICY: | shall be invoked at system or application startup,    |
|    |        | and cease only at system or application shutdown.     |
|    | **5    |                                                       |
|    | .4.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Audit collection systems shall be configured such     |
| 56 | P      | that security audit data is protected against loss    |
| .  | OLICY: | (e.g., overwriting or overflow of automated log       |
|    |        | files).                                               |
|    | **5    |                                                       |
|    | .4.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Should it become apparent that an automated audit     |
| 57 | P      | system has failed, and the integrity of the system or |
| .  | OLICY: | confidentiality of the information protected by the   |
|    |        | system is at risk, operations shall be suspended      |
|    | **5    | until the problem has been remedied.                  |
|    | .4.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The CA will perform routine self-assessments of       |
| 58 | P      | security controls.                                    |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .4.8** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CA archive records shall be sufficiently detailed to  |
| 59 | P      | determine the proper operation of the CA and the      |
| .  | OLICY: | validity of any certificate (including those revoked  |
|    |        | or expired) issued by the CA.                         |
|    | **5    |                                                       |
|    | .5.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | At a minimum, the following data shall be recorded    |
| 60 | P      | for archive:                                          |
| .  | OLICY: |                                                       |
|    |        | -   CA accreditation (if applicable)                  |
|    | **5    |                                                       |
|    | .5.1** | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Certificate policy                                |
|    |        |                                                       |
|    |        | -   Certification practice statement                  |
|    |        |                                                       |
|    |        | -   Contractual obligations                           |
|    |        |                                                       |
|    |        | -   and other agreements concerning operations of the |
|    |        |     CA                                                |
|    |        |                                                       |
|    |        | -   System and equipment configuration                |
|    |        |                                                       |
|    |        | -   Modifications and updates to system or            |
|    |        |     configuration                                     |
|    |        |                                                       |
|    |        | -   Certificate requests                              |
|    |        |                                                       |
|    |        | -   All certificates issued and/or published          |
|    |        |                                                       |
|    |        | -   Record of re-key                                  |
|    |        |                                                       |
|    |        | -   Security audit data (in accordance with section   |
|    |        |     5.4.1)                                            |
|    |        |                                                       |
|    |        | -   Revocation requests                               |
|    |        |                                                       |
|    |        | -   Subscriber identity authentication data as per    |
|    |        |     section 3.2.3                                     |
|    |        |                                                       |
|    |        | -   Documentation of receipt and acceptance of        |
|    |        |     certificates (if applicable)                      |
|    |        |                                                       |
|    |        | -   Subscriber agreements                             |
|    |        |                                                       |
|    |        | -   Documentation of receipt of tokens                |
|    |        |                                                       |
|    |        | -   All CRLs issued and/or published                  |
|    |        |                                                       |
|    |        | -   Other data or applications to verify archive      |
|    |        |     contents                                          |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Documentation required by compliance auditors     |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | **For CAs that issue certificates under               |
| 61 | P      | id-fpki-common-High, archive records must be kept for |
| .  | OLICY: | a minimum of 20 years and 6 months without any loss   |
|    |        | of data.**                                            |
|    | **5    |                                                       |
|    | .5.2** | For CAs that do not issue certificates under          |
|    |        | id-fpki-common-High, archive records must be kept for |
|    |        | a minimum of 10 years and 6 months without any loss   |
|    |        | of data.                                              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | No unauthorized user shall be permitted to write to,  |
| 62 | P      | modify, or delete the archive.                        |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .5.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The contents of the archive shall not be released     |
| 63 | P      | except in accordance with sections 9.3 and 9.4.       |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .5.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Archive media shall be stored in a safe, secure       |
| 64 | P      | storage facility separate from the CA.                |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .5.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | If the original media cannot retain the data for the  |
| 65 | P      | required period, a mechanism to periodically transfer |
| .  | OLICY: | the archived data to new media shall be defined by    |
|    |        | the archive site.                                     |
|    | **5    |                                                       |
|    | .5.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | *Alternatively, a CA operating under this policy may  |
| 66 | P      | retain data using whatever procedures have been       |
| .  | OLICY: | approved by NARA for that category of documents.*     |
|    |        | Applications required to process the archive data     |
|    | **5    | shall be maintained for a period that equals or       |
|    | .5.3** | exceeds the archive requirements for the data.        |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CA archive records shall be automatically             |
| 67 | P      | time-stamped as they are created. The CPS shall       |
| .  | OLICY: | describe how system clocks used for time-stamping are |
|    |        | maintained in synchrony with an authoritative time    |
|    | **5    | standard.                                             |
|    | .5.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Procedures, detailing how to create, verify, package, |
| 68 | P      | transmit, and store the CA archive information, shall |
| .  | OLICY: | be published in the CPS.                              |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .5.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | *To minimize risk from compromise of a CA's private   |
| 69 | P      | signing key, that key may be changed often.* From     |
| .  | OLICY: | that time on, only the new key will be used to sign   |
|    |        | CA and subscriber certificates. If the old private    |
|    | *      | key is used to sign OCSP responder certificates or    |
|    | *5.6** | CRLs that cover certificates signed with that key,    |
|    |        | the old key must be retained and protected.           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When a CA updates its private signature key and thus  |
| 70 | P      | generates a new public key, the CA shall notify all   |
| .  | OLICY: | CAs, RAs, and subscribers that rely on the CA's       |
|    |        | certificate that it has been changed.                 |
|    | *      |                                                       |
|    | *5.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When a CA that distributes self-signed certificates   |
| 71 | P      | updates its private signature key, the CA shall       |
| .  | OLICY: | generate key rollover certificates, where the new     |
|    |        | public key is signed by the old private key, and vice |
|    | *      | versa. *This permits acceptance of newly issued       |
|    | *5.6** | certificates and CRLs without distribution of the new |
|    |        | self-signed certificate to current users. Key         |
|    |        | rollover certificates are optional for CAs that do    |
|    |        | not distribute self-signed certificates.*             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The Federal PKI Policy Authority shall be notified if |
| 72 | P      | any CAs operating under this policy experience the    |
| .  | OLICY: | following:                                            |
|    |        |                                                       |
|    | **5    | -   suspected or detected compromise of the CA        |
|    | .7.1** |     systems;                                          |
|    |        |                                                       |
|    |        | -   suspected or detected compromise of a certificate |
|    |        |     status server (CSS) if (1) the CSS certificate    |
|    |        |     has a lifetime of more than 72 hours and (2) the  |
|    |        |     CSS certificate cannot be revoked (e.g., an OCSP  |
|    |        |     responder certificate with the                    |
|    |        |     id-pkix-ocsp-nocheck extension);                  |
|    |        |                                                       |
|    |        | -   physical or electronic penetration of CA systems; |
|    |        |                                                       |
|    |        | -   successful denial of service attacks on CA        |
|    |        |     components; or                                    |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   any incident preventing the CA from issuing a CRL |
|    |        |     within 48 hours of the issuance of the previous   |
|    |        |     CRL.                                              |
|    |        |                                                       |
|    |        | The CA's Operational Authority shall reestablish      |
|    |        | operational capabilities as quickly as possible in    |
|    |        | accordance with procedures set forth in the CA\'s     |
|    |        | CPS.                                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When computing resources, software, and/or data are   |
| 73 | P      | corrupted, CAs operating under this policy shall      |
| .  | OLICY: | respond as follows:                                   |
|    |        |                                                       |
|    | **5    | -   Before returning to operation, ensure that the    |
|    | .7.2** |     system's integrity has been restored.             |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   If the CA signature keys are not destroyed**,**   |
|    |        |     CA operation shall be reestablished, giving       |
|    |        |     priority to the ability to generate certificate   |
|    |        |     status information within the CRL issuance        |
|    |        |     schedule specified in section 4.9.7.              |
|    |        |                                                       |
|    |        | -   If the CA signature keys are destroyed**,** CA    |
|    |        |     operation shall be reestablished as quickly as    |
|    |        |     possible, giving priority to the generation of a  |
|    |        |     new CA key pair.                                  |
|    |        |                                                       |
|    |        | The Agency PMA shall be notified as soon as possible. |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | In the event of a CA private key compromise, the      |
| 74 | P      | following operations must be performed.               |
| .  | OLICY: |                                                       |
|    |        | -   The FPKIPA shall be immediately informed, as well |
|    | **5    |     as any superior or cross-certified CAs and any    |
|    | .7.3** |     entities known to be distributing the CA          |
|    |        |     certificate (e.g., in a root store).              |
|    |        |                                                       |
|    |        | -   The CA must generate new keys in accordance with  |
|    |        |     section 6.1.1.1.                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | In the event of a CA private key compromise, . . . if |
| 75 | P      | the CA distributed the private key in a Trusted       |
| .  | OLICY: | Certificate, the CA shall perform the following       |
|    |        | operations:                                           |
|    | **5    |                                                       |
|    | .7.3** | -   Generate a new Trusted Certificate.               |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Securely distribute the new Trusted Certificate   |
|    |        |     as specified in section 6.1.4.                    |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   Initiate procedures to notify subscribers of the  |
|    |        |     compromise.                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CAs operating under this policy shall have recovery   |
| 76 | P      | procedures in place to reconstitute the CA within 72  |
| .  | OLICY: | hours of failure.                                     |
|    |        |                                                       |
|    | **5    |                                                       |
|    | .7.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | In the case of a disaster whereby the CA installation |
| 77 | P      | is physically damaged and all copies of the CA        |
| .  | OLICY: | signature key are destroyed as a result, the FPKIPA   |
|    |        | shall be notified at the earliest feasible time.      |
|    | **5    |                                                       |
|    | .7.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When a CA operating under this policy terminates      |
| 78 | P      | operations before all certificates have expired, the  |
| .  | OLICY: | CA signing keys shall be surrendered to the Federal   |
|    |        | PKI Policy Authority. Prior to CA termination, the CA |
|    | *      | shall provide archived data to an archive facility as |
|    | *5.8** | specified in the CPS. As soon as possible, the CA     |
|    |        | will advise all other organizations to which it has   |
|    |        | issued certificates of its termination, using an      |
|    |        | agreed-upon method of communication specified in the  |
|    |        | CPS.                                                  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Cryptographic keying material used by CAs to sign     |
| 79 | P      | certificates, CRLs or status information shall be     |
| .  | OLICY: | generated in FIPS 140 validated cryptographic         |
|    |        | modules. **For CAs that issue certificates under      |
|    | **6.1  | id-fpki-common-High, the module(s) shall meet or      |
|    | .1.1** | exceed FIPS 140 Level 3**. For CAs that do not issue  |
|    |        | certificates under id-fpki-common-High, the module(s) |
|    |        | shall meet or exceed FIPS 140 Level 2.                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CA key pair generation must create a verifiable audit |
| 80 | P      | trail that the security requirements for procedures   |
| .  | OLICY: | were followed. The documentation of the procedure     |
|    |        | must be detailed enough to show that appropriate role |
|    | **6.1  | separation was used. An independent third party shall |
|    | .1.1** | validate the execution of the key generation          |
|    |        | procedures either by witnessing the key generation or |
|    |        | by examining the signed and documented record of the  |
|    |        | key generation.                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Validated software or hardware cryptographic modules  |
| 81 | P      | shall be used to generate all subscriber key pairs,   |
| .  | OLICY: | as well as pseudo-random numbers and parameters used  |
|    |        | in key pair generation. .                             |
|    | **6.1  |                                                       |
|    | .1.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | For the id‑fpki-common-hardware**,                    |
| 82 | P      | id-fpki-common-High,** id-fpki-common-authentication, |
| .  | OLICY: | and id-fpki-common-cardauth policies, subscriber key  |
|    |        | pairs shall be generated in FIPS 140 Level 2 hardware |
|    | **6.1  | cryptographic modules.                                |
|    | .1.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Any pseudo-random numbers used for key generation     |
| 83 | P      | material shall be generated by a FIPS-approved        |
| .  | OLICY: | method*. Symmetric keys may be generated by means of  |
|    |        | either software or hardware mechanisms*               |
|    | **6.1  |                                                       |
|    | .1.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Cryptographic keying material used by CSSes to sign   |
| 84 | P      | status information shall be generated in FIPS 140     |
| .  | OLICY: | validated cryptographic modules**. For CSSes that     |
|    |        | provide status under id-fpki-common-High, the         |
|    | **6.1  | module(s) shall meet or exceed FIPS 140 Level 3.**    |
|    | .1.3** | For CSSes that do not provide status under            |
|    |        | id-fpki-common-High, the module(s) shall meet or      |
|    |        | exceed FIPS 140 Level 2.                              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When CAs or RAs generate keys on behalf of the        |
| 85 | P      | subscriber, then the private key must be delivered    |
| .  | OLICY: | securely to the subscriber. *Private keys may be      |
|    |        | delivered electronically or may be delivered on a     |
|    | **6    | hardware cryptographic module.* In all cases, the     |
|    | .1.2** | following requirements must be met:                   |
|    |        |                                                       |
|    |        | -   Anyone who generates a private signing key for a  |
|    |        |     subscriber shall not retain any copy of the key   |
|    |        |     after delivery of the private key to the          |
|    |        |     subscriber.                                       |
|    |        |                                                       |
|    |        | -   The private key(s) must be protected from         |
|    |        |     activation, compromise, or modification during    |
|    |        |     the delivery process.                             |
|    |        |                                                       |
|    |        | -   The subscriber shall acknowledge receipt of the   |
|    |        |     private key(s).                                   |
|    |        |                                                       |
|    |        | -   Delivery shall be accomplished in a way that      |
|    |        |     ensures that the correct tokens and activation    |
|    |        |     data are provided to the correct subscribers.     |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   For hardware modules, accountability for the      |
|    |        |     location and state of the module must be          |
|    |        |     maintained until the subscriber accepts           |
|    |        |     possession of it.                                 |
|    |        |                                                       |
|    |        | -   For electronic delivery of private keys, the key  |
|    |        |     material shall be encrypted using a cryptographic |
|    |        |     algorithm and key size at least as strong as the  |
|    |        |     private key. Activation data shall be delivered   |
|    |        |     using a separate secure channel.                  |
|    |        |                                                       |
|    |        | The CA must maintain a record of the subscriber       |
|    |        | acknowledgment of receipt of the token.               |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Where key pairs are generated by the subscriber or    |
| 86 | P      | RA, the public key and the subscriber's identity must |
| .  | OLICY: | be delivered securely to the CA for certificate       |
|    |        | issuance. The delivery mechanism shall bind the       |
|    | **6    | subscriber's verified identity to the public key. If  |
|    | .1.3** | cryptography is used to achieve this binding, it must |
|    |        | be at least as strong as the CA keys used to sign the |
|    |        | certificate.                                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | When a CA updates its signature key pair, the CA      |
| 87 | P      | shall distribute the new public key in a secure       |
| .  | OLICY: | fashion.                                              |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Self-signed certificates shall be conveyed to relying |
| 88 | P      | parties in a secure fashion to preclude substitution  |
| .  | OLICY: | attacks.                                              |
|    |        |                                                       |
|    | **6    | *Acceptable methods for self-signed certificate       |
|    | .1.4** | delivery are:*                                        |
|    |        |                                                       |
|    |        | -   *Loading a self-signed certificate onto tokens    |
|    |        |     delivered to relying parties via secure           |
|    |        |     mechanisms; such as*                              |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   *The Trusted Certificate is loaded onto the token |
|    |        |     during the subscriber's appearance at the RA.*    |
|    |        |                                                       |
|    |        | -   *The Trusted Certificate is loaded onto the token |
|    |        |     when the RA generates the subscriber's key pair   |
|    |        |     and loads the private key onto the token, which   |
|    |        |     is then delivered to the subscriber in accordance |
|    |        |     with section 6.1.2.*                              |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   *Secure distribution of self-signed certificates  |
|    |        |     through secure out-of-band mechanisms;*           |
|    |        |                                                       |
|    |        | -   *Comparison of the hash of the self-signed        |
|    |        |     certificate against a hash value made available   |
|    |        |     via authenticated out-of-band sources (note that  |
|    |        |     hashes posted in-band along with the certificate  |
|    |        |     are not acceptable as an authentication           |
|    |        |     mechanism); and*                                  |
|    |        |                                                       |
|    |        | ```{=html}                                            |
|    |        | <!-- -->                                              |
|    |        | ```                                                   |
|    |        | -   *Loading certificates from web sites secured with |
|    |        |     a currently valid certificate of equal or greater |
|    |        |     assurance level than the certificate being        |
|    |        |     downloaded*.                                      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Certificates issued under this policy shall contain   |
| 89 | P      | RSA or elliptic curve public keys.                    |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Trusted Certificates shall contain subject public     |
| 90 | P      | keys of at least 2048 bits for RSA or 256 bits for    |
| .  | OLICY: | elliptic curve, and be signed with the corresponding  |
|    |        | private key.                                          |
|    | **6    |                                                       |
|    | .1.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CAs that generate certificates and CRLs under this    |
| 91 | P      | policy shall use signature keys of at least 1024 bits |
| .  | OLICY: | for RSA and 256 bits for elliptic curve algorithms.   |
|    |        | Certificates that expire on or after December 31,     |
|    | **6    | 2010 shall be generated with at least 2048 bit keys   |
|    | .1.5** | for RSA and at least 256 bit keys for elliptic curve  |
|    |        | algorithms.                                           |
|    |        |                                                       |
|    |        | Practice Note: Where certificates are issued to       |
|    |        | satisfy FIPS 201 requirements, CAs shall use          |
|    |        | signature keys of at least 2048 bits for RSA and 256  |
|    |        | bits for elliptic curve algorithms to sign            |
|    |        | certificates issued on or after January 1, 2008. CAs  |
|    |        | may continue to use 1024 bit RSA keys to sign CRLs    |
|    |        | that only cover certificates that were signed using   |
|    |        | 1024 bit RSA keys. CAs may also use 1024 bit RSA keys |
|    |        | to sign OCSP responder certificates that expire       |
|    |        | before December 31, 2010.                             |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | CAs that generate certificates and CRLs under this    |
| 92 | P      | policy shall use the SHA-1, SHA‑256, or SHA-384 hash  |
| .  | OLICY: | algorithm when generating digital signatures. RSA     |
|    |        | signatures on certificates and CRLs that are issued   |
|    | **6    | after December 31, 2010 shall be generated using      |
|    | .1.5** | SHA‑256. ECDSA signatures on certificates and CRLs    |
|    |        | that expire on or after December 31, 2010 shall be    |
|    |        | generated using SHA-256 or SHA-384, as appropriate    |
|    |        | for the key length.                                   |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Where implemented, CSSs shall sign responses using    |
| 93 | P      | the same signature algorithm, key size, and hash      |
| .  | OLICY: | algorithm used by the CA to sign CRLs.                |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | End entity certificates issued under                  |
| 94 | P      | id-fpki-common-devices that expire before December    |
| .  | OLICY: | 31, 2010 shall contain RSA public keys that are at    |
|    |        | least 1024 bits in length or elliptic curve keys that |
|    | **6    | are at least 256 bits. End entity certificates issued |
|    | .1.5** | under id-fpki-common-devices that expire on or after  |
|    |        | December 31, 2010 shall contain RSA public keys that  |
|    |        | are at least 2048 bits or elliptic curve keys that    |
|    |        | are at least 256 bits.                                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | [End entity certificates issued under                 |
| 95 | P      | id-fpki-common-authentication or                      |
| .  | OLICY: | id-fpki-common-cardAuth that expire before January 1, |
|    |        | 2014 shall contain RSA public keys that are 1024 or   |
|    | **6    | 2048 bits in length or elliptic curve keys that are   |
|    | .1.5** | 256 bits. End entity certificates issued under        |
|    |        | id-fpki-common-authentication or                      |
|    |        | id-fpki-common-cardAuth that expire on or after       |
|    |        | January 1, 2014 shall contain RSA public keys that    |
|    |        | are 2048 bits in length or elliptic curve keys that   |
|    |        | are 256 bits.]{.underline}                            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | End entity certificates issued under                  |
| 96 | P      | id-fpki-common-policy, id-fpki-common-hardware, and   |
| .  | OLICY: | **id‑fpki-common-High** that expire before December   |
|    |        | 31, 2008 shall contain RSA public keys that are at    |
|    | **6    | least 1024 bits in length or elliptic curve keys that |
|    | .1.5** | are at least 256 bits. End entity certificates issued |
|    |        | under id-fpki-common-policy, id-fpki-common-hardware, |
|    |        | and **id-fpki-common-High** that expire on or after   |
|    |        | December 31, 2008 shall contain RSA public keys that  |
|    |        | are at least 2048 bits or elliptic curve keys that    |
|    |        | are at least 256 bits.                                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Use of TLS or another protocol providing similar      |
| 97 | P      | security to accomplish any of the requirements of     |
| .  | OLICY: | this CP shall require (1) triple-DES or AES for the   |
|    |        | symmetric key through December 31, 2010 and AES for   |
|    | **6    | the symmetric key after December 31, 2010 and (2) at  |
|    | .1.5** | least 1024 bit RSA or 163 bit elliptic curve keys     |
|    |        | through December 31, 2008 and at least 2048 bit RSA   |
|    |        | or 224 bit elliptic curve keys after December 31,     |
|    |        | 2008.                                                 |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | The use of a specific key is constrained by the key   |
| 98 | P      | usage extension in the X.509 certificate. All         |
| .  | OLICY: | certificates shall include a critical key usage       |
|    |        | extension.                                            |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 1  | COMMON | Public keys that are bound into subscriber user       |
| 99 | P      | certificates shall be used only for signing or        |
| .  | OLICY: | encrypting, but not both.                             |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | User certificates that assert                         |
| 00 | P      | id-fpki-common-authentication or                      |
| .  | OLICY: | id-fpki-common-cardAuth shall only assert the         |
|    |        | *digitalSignature* bit.                               |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Other user certificates to be used for digital        |
| 01 | P      | signatures shall assert both the *digitalSignature*   |
| .  | OLICY: | and *nonRepudiation* bits.                            |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | User certificates that contain RSA public keys that   |
| 02 | P      | are to be used for key transport shall assert the     |
| .  | OLICY: | *keyEncipherment* bit.                                |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | User certificates that contain elliptic curve public  |
| 03 | P      | keys that are to be used for key agreement shall      |
| .  | OLICY: | assert the *keyAgreement* bit.                        |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Public keys that are bound into CA certificates shall |
| 04 | P      | be used only for signing certificates and status      |
| .  | OLICY: | information (e.g., CRLs).                             |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA certificates whose subject public key is to be     |
| 05 | P      | used to verify other certificates shall assert the    |
| .  | OLICY: | *keyCertSign* bit.                                    |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA certificates whose subject public key is to be     |
| 06 | P      | used to verify CRLs shall assert the *cRLSign* bit.   |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA certificates whose subject public key is to be     |
| 07 | P      | used to verify Online Certificate Status Protocol     |
| .  | OLICY: | (OCSP) responses shall assert the *digitalSignature*  |
|    |        | and/or *nonRepudiation* bits.                         |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Device certificates to be used for digital signatures |
| 08 | P      | \[including authentication\] shall assert the         |
| .  | OLICY: | *digitalSignature* bit.                               |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Device certificates that contain RSA public keys that |
| 09 | P      | are to be used for key transport shall assert the     |
| .  | OLICY: | *keyEncipherment* bit.                                |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Device certificates that contain elliptic curve       |
| 10 | P      | public keys that are to be used for key agreement     |
| .  | OLICY: | shall assert the *keyAgreement* bit.                  |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Device certificates to be used for both digital       |
| 11 | P      | signatures and key management shall assert the        |
| .  | OLICY: | *digitalSignature* bit and either the                 |
|    |        | *keyEncipherment* (for RSA) or *keyAgreement* (for    |
|    | **6    | elliptic curve) bit.                                  |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Device certificates shall not assert the              |
| 12 | P      | *nonRepudiation* bit.                                 |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The *dataEncipherment*, *encipherOnly*, and           |
| 13 | P      | *decipherOnly* bits shall not be asserted in          |
| .  | OLICY: | certificates issued under this policy.                |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .1.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | **CAs that issue certificates under                   |
| 14 | P      | id-fpki-common-High shall use a FIPS 140 Level 3 or   |
| .  | OLICY: | higher validated hardware cryptographic module.** CAs |
|    |        | that do not issue certificates under                  |
|    | **6    | id-fpki-common-High shall use a FIPS 140 Level 2 or   |
|    | .2.1** | higher validated hardware cryptographic module.       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | RAs shall use a FIPS 140 Level 2 or higher validated  |
| 15 | P      | hardware cryptographic module.                        |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Subscribers shall use a FIPS 140 Level 1 or higher    |
| 16 | P      | validated cryptographic module for all cryptographic  |
| .  | OLICY: | operations.                                           |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Subscribers issued certificates under the hardware    |
| 17 | P      | users policy (id-fpki-common-hardware), one of the    |
| .  | OLICY: | authentication policies                               |
|    |        | (id-fpki-common-authentication or                     |
|    | **6    | id-fpki-common-cardAuth), or **common High policy     |
|    | .2.1** | (id-fpki-common-High)** shall use a FIPS 140 Level 2  |
|    |        | or higher validated hardware cryptographic module for |
|    |        | all private key operations.                           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | **CSSes that provide status information for           |
| 18 | P      | certificates issued under id-fpki-common-High shall   |
| .  | OLICY: | use a FIPS 140 Level 3 or higher validated hardware   |
|    |        | cryptographic module.** CSSes that do not provide     |
|    | **6    | status information for certificates issued under      |
|    | .2.1** | id-fpki-common-High shall use a FIPS 140 Level 2 or   |
|    |        | higher validated hardware cryptographic module.       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | A single person shall not be permitted to activate or |
| 19 | P      | access any cryptographic module that contains the     |
| .  | OLICY: | complete CA private signing key. CA signature keys    |
|    |        | may be backed up only under two-person control.       |
|    | **6    | Access to CA signing keys backed up for disaster      |
|    | .2.2** | recovery shall be under at least two-person control.  |
|    |        | The names of the parties used for two-person control  |
|    |        | shall be maintained on a list that shall be made      |
|    |        | available for inspection during compliance audits.    |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The CA private signature keys shall be backed up      |
| 20 | P      | under the same multiperson control as the original    |
| .  | OLICY: | signature key. At least one copy of the private       |
|    |        | signature key shall be stored off-site. All copies of |
|    | **6.2  | the CA private signature key shall be accounted for   |
|    | .4.1** | and protected in the same manner as the original.     |
|    |        | Backup procedures shall be included in the CA's CPS.  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Subscriber private signature keys whose corresponding |
| 21 | P      | public key is contained in a certificate asserting    |
| .  | OLICY: | the id-fpki-common-authentication,                    |
|    |        | id-fpki-common-cardAuth, or **id-fpki-common-High**   |
|    | **6.2  | policy shall not be backed up or copied.              |
|    | .4.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Subscriber private signature keys whose corresponding |
| 22 | P      | public key is contained in a certificate that does    |
| .  | OLICY: | not assert id-fpki-common-authentication,             |
|    |        | id-fpki-common-cardAuth, or **id-fpki-common-High**   |
|    | **6.2  | may be backed up or copied, but must be held in the   |
|    | .4.2** | subscriber's control. Backed up subscriber private    |
|    |        | signature keys shall not be stored in plaintext form  |
|    |        | outside the cryptographic module. Storage must ensure |
|    |        | security controls consistent with the protection      |
|    |        | provided by the subscriber's cryptographic module.    |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Backed up subscriber private key management keys      |
| 23 | P      | shall not be stored in plaintext form outside the     |
| .  | OLICY: | cryptographic module. Storage must ensure security    |
|    |        | controls consistent with the protection provided by   |
|    | **6.2  | the subscriber's cryptographic module.                |
|    | .4.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | *CSS private keys may be backed up*. If backed up,    |
| 24 | P      | all copies shall be accounted for and protected in    |
| .  | OLICY: | the same manner as the original.                      |
|    |        |                                                       |
|    | **6.2  |                                                       |
|    | .4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA private signature keys and subscriber private      |
| 25 | P      | signatures keys shall not be archived.                |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .2.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CAs that retain subscriber private encryption keys    |
| 26 | P      | for business continuity purposes shall archive such   |
| .  | OLICY: | subscriber private keys, in accordance with section   |
|    |        | 5.5.                                                  |
|    | **6    |                                                       |
|    | .2.5** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA private keys may be exported from the              |
| 27 | P      | cryptographic module only to perform CA key backup    |
| .  | OLICY: | procedures as described in section 6.2.4.1. At no     |
|    |        | time shall the CA private key exist in plaintext      |
|    | **6    | outside the cryptographic module.                     |
|    | .2.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | All other keys \[except CA private keys\] shall be    |
| 28 | P      | generated by and in a cryptographic module. In the    |
| .  | OLICY: | event that a private key is to be transported from    |
|    |        | one cryptographic module to another, the private key  |
|    | **6    | must be encrypted during transport; private keys must |
|    | .2.6** | never exist in plaintext form outside the             |
|    |        | cryptographic module boundary.                        |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Private or symmetric keys used to encrypt other       |
| 29 | P      | private keys for transport must be protected from     |
| .  | OLICY: | disclosure.                                           |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .2.6** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | For certificates issued under                         |
| 30 | P      | id-fpki-common-authentication, id-fpki-common-policy, |
| .  | OLICY: | id-fpki-common-hardware**, id-fpki-common-High**, and |
|    |        | id-fpki-common-devices, the subscriber must be        |
|    | **6    | authenticated to the cryptographic token before the   |
|    | .2.8** | activation of the associated private key(s).          |
|    |        | *Acceptable means of authentication include but are   |
|    |        | not limited to passphrases, PINs or biometrics.*      |
|    |        | Entry of activation data shall be protected from      |
|    |        | disclosure (i.e., the data should not be displayed    |
|    |        | while it is entered).                                 |
|    |        |                                                       |
|    |        | *For certificates issued under                        |
|    |        | id-fpki-common-cardAuth, subscriber authentication is |
|    |        | not required to use the associated private key.*      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Cryptographic modules that have been activated shall  |
| 31 | P      | not be available to unauthorized access.              |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .2.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | After use, the cryptographic module shall be          |
| 32 | P      | deactivated, e.g., via a manual logout procedure or   |
| .  | OLICY: | automatically after a period of inactivity as defined |
|    |        | in the applicable CPS.                                |
|    | **6    |                                                       |
|    | .2.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA cryptographic modules shall be removed and stored  |
| 33 | P      | in a secure container when not in use.                |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .2.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Individuals in trusted roles shall destroy CA, RA,    |
| 34 | P      | and CSS (e.g., OCSP server) private signature keys    |
| .  | OLICY: | when they are no longer needed. Subscribers shall     |
|    |        | either surrender their cryptographic module to CA/RA  |
|    | **6.   | personnel for destruction or destroy their private    |
|    | 2.10** | signature keys, when they are no longer needed or     |
|    |        | when the certificates to which they correspond expire |
|    |        | or are revoked.                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The public key is archived as part of the certificate |
| 35 | P      | archival                                              |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .3.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | For all other CAs operating under this policy, the    |
| 36 | P      | usage period for a CA key pair is a maximum of ten    |
| .  | OLICY: | years. The CA private key may be used to sign         |
|    |        | certificates for at most four years, but may be used  |
|    | **6    | to sign CRLs and OCSP responder certificates for the  |
|    | .3.2** | entire usage period. All certificates signed by a     |
|    |        | specific CA key pair must expire before the end of    |
|    |        | that key pair's usage period                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Subscriber public keys in certificates that assert    |
| 37 | P      | the id-PIV-content-signing OID in the extended key    |
| .  | OLICY: | usage extension have a maximum usage period of eight  |
|    |        | years. The private keys corresponding to the public   |
|    | **6    | keys in these certificates have a maximum usage       |
|    | .3.2** | period of three years.                                |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | For OCSP responders operating under this policy and   |
| 38 | P      | all other subscriber public keys, the maximum usage   |
| .  | OLICY: | period is three years. Subscriber signature private   |
|    |        | keys have the same usage period as their              |
|    | **6    | corresponding public key. *The usage period for       |
|    | .3.2** | subscriber key management private keys is not         |
|    |        | restricted.*                                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | *CA activation data may be user-selected (by each of  |
| 39 | P      | the multiple parties holding that activation data).*  |
| .  | OLICY: | If the activation data must be transmitted, it shall  |
|    |        | be via an appropriately protected channel, and        |
|    | **6    | distinct in time and place from the associated        |
|    | .4.1** | cryptographic module.                                 |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | *RA and subscriber activation data may be             |
| 40 | P      | user-selected*. The strength of the activation data   |
| .  | OLICY: | shall meet or exceed the requirements for             |
|    |        | authentication mechanisms stipulated for Level 2 in   |
|    | **6    | FIPS 140‑2. If the activation data must be            |
|    | .4.1** | transmitted, it shall be via an appropriately         |
|    |        | protected channel, and distinct in time and place     |
|    |        | from the associated cryptographic module              |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Data used to unlock private keys shall be protected   |
| 41 | P      | from disclosure by a combination of cryptographic and |
| .  | OLICY: | physical access control mechanisms. Activation data   |
|    |        | shall be:                                             |
|    | **6    |                                                       |
|    | .4.2** | -   memorized;                                        |
|    |        |                                                       |
|    |        | -   biometric in nature; or                           |
|    |        |                                                       |
|    |        | -   recorded and secured at the level of assurance    |
|    |        |     associated with the activation of the             |
|    |        |     cryptographic module, and shall not be stored     |
|    |        |     with the cryptographic module.                    |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | For CAs operating under this policy, the computer     |
| 42 | P      | security functions listed below are required. *These  |
| .  | OLICY: | functions may be provided by the operating system, or |
|    |        | through a combination of operating system, software,  |
|    | **\*\  | and physical safeguards.* The CA and its ancillary    |
|    | *\*\*6 | parts shall include the following functionality:      |
|    | .5.1** |                                                       |
|    |        | -   authenticate the identity of users before         |
|    |        |     permitting access to the system or applications;  |
|    |        |                                                       |
|    |        | -   manage privileges of users to limit users to      |
|    |        |     their assigned roles;                             |
|    |        |                                                       |
|    |        | -   generate and archive audit records for all        |
|    |        |     transactions; (see section 5.4)                   |
|    |        |                                                       |
|    |        | -   enforce domain integrity boundaries for security  |
|    |        |     critical processes; and                           |
|    |        |                                                       |
|    |        | -   support recovery from key or system failure.      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | For certificate status servers operating under this   |
| 43 | P      | policy, the computer security functions listed below  |
| .  | OLICY: | are required:                                         |
|    |        |                                                       |
|    | **6    | -   authenticate the identity of users before         |
|    | .5.1** |     permitting access to the system or applications;  |
|    |        |                                                       |
|    |        | -   manage privileges of users to limit users to      |
|    |        |     their assigned roles;                             |
|    |        |                                                       |
|    |        | -   enforce domain integrity boundaries for security  |
|    |        |     critical processes; and                           |
|    |        |                                                       |
|    |        | -   support recovery from key or system failure.      |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | > The CA shall use software that has been designed    |
| 44 | P      | > and developed under a formal, documented            |
| .  | OLICY: | > development methodology.                            |
|    |        |                                                       |
|    | **6    |                                                       |
|    | .6.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | > Hardware and software procured to operate the CA    |
| 45 | P      | > shall be purchased in a fashion to reduce the       |
| .  | OLICY: | > likelihood that any particular component was        |
|    |        | > tampered with *(e.g., by ensuring the vendor cannot |
|    | **6    | > identify the PKI component that will be installed   |
|    | .6.1** | > on a particular device)*.                           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | > Hardware and software developed specifically for    |
| 46 | P      | > the CA shall be developed in a controlled           |
| .  | OLICY: | > environment, and the development process shall be   |
|    |        | > defined and documented. *This requirement does not  |
|    | **6    | > apply to commercial off-the-shelf hardware or       |
|    | .6.1** | > software.*                                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | > The CA hardware and software shall be dedicated to  |
| 47 | P      | > performing one task: the CA. There shall be no      |
| .  | OLICY: | > other applications, hardware devices, network       |
|    |        | > connections, or component software installed that   |
|    | **6    | > are not parts of the CA operation. *Where the CA    |
|    | .6.1** | > operation supports multiple CAs, the hardware       |
|    |        | > platform may support multiple CAs*.                 |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | > Proper care shall be taken to prevent malicious     |
| 48 | P      | > software from being loaded onto the CA equipment.   |
| .  | OLICY: | > All applications required to perform the operation  |
|    |        | > of the CA shall be obtained from documented         |
|    | **6    | > sources. RA hardware and software shall be scanned  |
|    | .6.1** | > for malicious code on first use and periodically    |
|    |        | > thereafter.                                         |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Hardware and software updates shall be purchased or   |
| 49 | P      | developed in the same manner as original equipment,   |
| .  | OLICY: | and shall be installed by trusted and trained         |
|    |        | personnel in a defined manner.                        |
|    | **6    |                                                       |
|    | .6.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The configuration of the CA system, in addition to    |
| 50 | P      | any modifications and upgrades, shall be documented   |
| .  | OLICY: | and controlled. There shall be a mechanism for        |
|    |        | detecting unauthorized modification to the \[CA\]     |
|    | **6    | software or configuration. The CA software, when      |
|    | .6.2** | first loaded, shall be verified as being that         |
|    |        | supplied from the vendor, with no modifications, and  |
|    |        | be the version intended for use. The CA shall         |
|    |        | periodically verify the integrity of the software as  |
|    |        | specified in the CPS.                                 |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | A network guard, firewall, or filtering router must   |
| 51 | P      | protect network access to CA equipment. The network   |
| .  | OLICY: | guard, firewall, or filtering router shall limit      |
|    |        | services allowed to and from the CA equipment to      |
|    | *      | those required to perform CA functions.               |
|    | *6.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Protection of CA equipment shall be provided against  |
| 52 | P      | known network attacks. All unused network ports and   |
| .  | OLICY: | services shall be turned off. Any network software    |
|    |        | present on the CA equipment shall be necessary to the |
|    | *      | functioning of the CA application.                    |
|    | *6.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Any boundary control devices used to protect the      |
| 53 | P      | network on which PKI equipment is hosted shall deny   |
| .  | OLICY: | all but the necessary services to the PKI equipment.  |
|    |        |                                                       |
|    | *      |                                                       |
|    | *6.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Directories and certificate status servers shall      |
| 54 | P      | employ appropriate network security controls.         |
| .  | OLICY: | Networking equipment shall turn off unused network    |
|    |        | ports and services. Any network software present      |
|    | *      | shall be necessary to the functioning of the          |
|    | *6.7** | equipment.                                            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Asserted times shall be accurate to within three      |
| 55 | P      | minutes. Electronic or manual procedures may be used  |
| .  | OLICY: | to maintain system time.                              |
|    |        |                                                       |
|    | *      |                                                       |
|    | *6.8** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates issued by a CA under this policy shall   |
| 56 | P      | conform to the X.509 Certificate and Certificate      |
| .  | OLICY: | Revocation List (CRL) Extensions Profile for the      |
|    |        | Shared Service Providers (SSP) Program \[CCP-PROF\].  |
|    | *      |                                                       |
|    | *7.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The CA shall issue X.509 v3 certificates (populate    |
| 57 | P      | version field with integer "2").                      |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .1.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates issued under this CP shall use the       |
| 58 | P      | following OIDs for signatures:                        |
| .  | OLICY: |                                                       |
|    |        |   -----                                               |
|    | **7    | -------------------- -------------------------------- |
|    | .1.3** |   sha                                                 |
|    |        | -1WithRSAEncryption    {iso(1) member-body(2) us(840) |
|    |        |                                                       |
|    |        |                      rsadsi(113549) pkcs(1) pkcs‑1(1) |
|    |        |                             5}                        |
|    |        |                                                       |
|    |        |   sha                                                 |
|    |        | 256WithRSAEncryption   {iso(1) member-body(2) us(840) |
|    |        |                                                       |
|    |        |                      rsadsi(113549) pkcs(1) pkcs‑1(1) |
|    |        |                             11}                       |
|    |        |                                                       |
|    |        |   RSA with PSS padding      id-RSASSA-PSS ::= {iso(1) |
|    |        |                             member-body(2) us(840)    |
|    |        |                                                       |
|    |        |                      rsadsi(113549) pkcs(1) pkcs-1(1) |
|    |        |                             10}                       |
|    |        |                                                       |
|    |        |   ecd                                                 |
|    |        | sa-with-Sha256         {iso(1) member-body(2) us(840) |
|    |        |                                                       |
|    |        |                       ansi-X9-62(10045) signatures(4) |
|    |        |                             ecdsa-with-SHA2(3) 2}     |
|    |        |                                                       |
|    |        |   ecd                                                 |
|    |        | sa-with-Sha384         {iso(1) member-body(2) us(840) |
|    |        |                                                       |
|    |        |                       ansi-X9-62(10045) signatures(4) |
|    |        |                             ecdsa-with-SHA2(3) 3}     |
|    |        |   -----                                               |
|    |        | -------------------- -------------------------------- |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates issued under this CP must use the        |
| 59 | P      | SHA-256 hash algorithm when generating RSASSA-PSS     |
| .  | OLICY: | signatures. The following OID shall be used to        |
|    |        | specify the hash in an RSASSA-PSS digital signature:  |
|    | **7    |                                                       |
|    | .1.3** |   --------- ----------------------------------------  |
|    |        |   SHA-256   id-sha256 ::= {joint-iso-itu-t(2)         |
|    |        |             country(16) us(840) organization(1)       |
|    |        |             gov(101) csor(3) nistalgorithm(4)         |
|    |        |             hashalgs(2) 1}                            |
|    |        |                                                       |
|    |        |   --------- ----------------------------------------  |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates issued under this CP shall use the       |
| 60 | P      | following OIDs to identify the algorithm associated   |
| .  | OLICY: | with the subject key:                                 |
|    |        |                                                       |
|    | **7    |   -                                                   |
|    | .1.3** | --------------- ------------------------------------- |
|    |        |   rsaEncryption    {iso(1) member-body(2) us(840)     |
|    |        |                                                       |
|    |        |                   rsadsi(113549) pkcs(1) pkcs-1(1) 1} |
|    |        |                                                       |
|    |        |   id-ecPublicKey   {iso(1) member-body(2) us(840)     |
|    |        |                                                       |
|    |        |                 ansi-X9-62(10045) id-publicKeyType(2) |
|    |        |                    1}                                 |
|    |        |   -                                                   |
|    |        | --------------- ------------------------------------- |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Where the certificate contains an elliptic curve      |
| 61 | P      | public key, the parameters shall be specified as one  |
| .  | OLICY: | of the following named curves:                        |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .1.3** |  ------------ --------------------------------------- |
|    |        |   ansip256r1   {iso(1) member-body(2) us(840) 10045   |
|    |        |                curves(3) prime(1) 7}                  |
|    |        |                                                       |
|    |        |   ansip384r1   { iso(1) identified-organization(3)    |
|    |        |                certicom(132) curve(0) 34 }            |
|    |        |                                                       |
|    |        |  ------------ --------------------------------------- |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates issued under this CP shall not contain   |
| 62 | P      | policy qualifiers.                                    |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .1.8** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates issued under this policy shall not       |
| 63 | P      | contain a critical certificate policies extension.    |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .1.9** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CRLs issued by a CA under this policy shall conform   |
| 64 | P      | to the CRL profile specified in \[CCP-PROF\].         |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | *      |                                                       |
|    | *7.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The CAs shall issue X.509 Version two (2) CRLs        |
| 65 | P      |                                                       |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .2.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificate status servers (CSSs) operated under this |
| 66 | P      | policy shall sign responses using algorithms          |
| .  | OLICY: | designated for CRL signing.                           |
|    |        |                                                       |
|    | *      |                                                       |
|    | *7.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CSSs shall be able to process SHA-1 hashes when       |
| 67 | P      | included in the CertID field and the keyHash in the   |
| .  | OLICY: | responderID field.                                    |
|    |        |                                                       |
|    | *      |                                                       |
|    | *7.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CSSs operated under this policy shall use OCSP        |
| 68 | P      | version 1                                             |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .3.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Critical OCSP extensions shall not be used            |
| 69 | P      |                                                       |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | **7    |                                                       |
|    | .3.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CAs operating under this policy shall have a          |
| 70 | P      | compliance audit mechanism in place to ensure that    |
| .  | OLICY: | the requirements of their CPS are being implemented   |
|    |        | and enforced.                                         |
|    | **8**  |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CAs and RAs operating under this policy shall be      |
| 71 | P      | subject to a periodic compliance audit at least once  |
| .  | OLICY: | per year.                                             |
|    |        |                                                       |
|    | *      |                                                       |
|    | *8.1** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The auditor must demonstrate competence in the field  |
| 72 | P      | of compliance audits, and must be thoroughly familiar |
| .  | OLICY: | with the CA's CPS and this CP. The compliance auditor |
|    |        | must perform such compliance audits as a regular      |
|    | *      | ongoing business activity. In addition to the         |
|    | *8.2** | previous requirements, the auditor must be a          |
|    |        | certified information system auditor (CISA) or IT     |
|    |        | security specialist, and a PKI subject matter         |
|    |        | specialist who can offer input regarding acceptable   |
|    |        | risks, mitigation strategies, and industry best       |
|    |        | practices.                                            |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The compliance auditor either shall be a private firm |
| 73 | P      | that is independent from the entities (CA and RAs)    |
| .  | OLICY: | being audited, or it shall be sufficiently            |
|    |        | organizationally separated from those entities to     |
|    | *      | provide an unbiased, independent evaluation.          |
|    | *8.3** |                                                       |
|    |        | *To insure independence and objectivity, the          |
|    |        | compliance auditor may not have served the entity in  |
|    |        | developing or maintaining the entity's CA Facility or |
|    |        | certificate practices statement.*                     |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The purpose of a compliance audit shall be to verify  |
| 74 | P      | that a CA and its recognized RAs comply with all the  |
| .  | OLICY: | requirements of the current versions of this CP and   |
|    |        | the CA's CPS. All aspects of the CA/RA operation      |
|    | *      | shall be subject to compliance audit inspections.     |
|    | *8.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | When the compliance auditor finds a discrepancy       |
| 75 | P      | between the requirements of this CP or the            |
| .  | OLICY: | stipulations in the CPS and the design, operation, or |
|    |        | maintenance of the PKI Authorities, the following     |
|    | *      | actions shall be performed:                           |
|    | *8.5** |                                                       |
|    |        | -   The compliance auditor shall note the             |
|    |        |     discrepancy;                                      |
|    |        |                                                       |
|    |        | -   The compliance auditor shall notify the parties   |
|    |        |     identified in section 8.6 of the discrepancy; and |
|    |        |                                                       |
|    |        | -   The party responsible for correcting the          |
|    |        |     discrepancy will propose a remedy, including      |
|    |        |     expected time for completion, to the FPKIPA and   |
|    |        |     appropriate Agency PMA.                           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | An Audit Compliance Report shall be provided to the   |
| 76 | P      | entity responsible for CA operations. The Audit       |
| .  | OLICY: | Compliance Report and identification of corrective    |
|    |        | measures shall be provided to both the FPKIPA and     |
|    | *      | (where applicable) the Agency PMA within 30 days of   |
|    | *8.6** | completion. A special compliance audit may be         |
|    |        | required to confirm the implementation and            |
|    |        | effectiveness of the remedy.                          |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | *Section 2 of this policy requires that CA            |
| 77 | P      | certificates be publicly available.* CAs operating    |
| .  | OLICY: | under this policy must not charge additional fees for |
|    |        | access to this information.                           |
|    | **9    |                                                       |
|    | .1.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CAs operating under this policy must not charge       |
| 78 | P      | additional fees for access to CRLs and OCSP status    |
| .  | OLICY: | information.                                          |
|    |        |                                                       |
|    | **9    |                                                       |
|    | .1.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CA information not requiring protection shall be made |
| 79 | P      | publicly available. Public access to organizational   |
| .  | OLICY: | information shall be determined by the respective     |
|    |        | organization.                                         |
|    | *      |                                                       |
|    | *9.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Federal entities acquiring services under this policy |
| 80 | P      | shall protect all subscriber personally identifying   |
| .  | OLICY: | information from unauthorized disclosure.             |
|    |        |                                                       |
|    | **9    |                                                       |
|    | .4.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | The contents of the archives maintained by CAs        |
| 81 | P      | operating under this policy shall not be released     |
| .  | OLICY: | except as required by law.                            |
|    |        |                                                       |
|    | **9    |                                                       |
|    | .4.2** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Certificates that contain the FASC-N in the subject   |
| 82 | P      | alternative name extension, such as PIV               |
| .  | OLICY: | Authentication Certificates, shall not be distributed |
|    |        | via public repositories (e.g., via LDAP or HTTP).     |
|    | **9    |                                                       |
|    | .4.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | Sensitive information must be stored securely, and    |
| 83 | P      | may be released only in accordance with other         |
| .  | OLICY: | stipulations in section 9.4.                          |
|    |        |                                                       |
|    | **9    |                                                       |
|    | .4.4** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | An RA that performs registration functions as         |
| 84 | P      | described in this policy shall comply with the        |
| .  | OLICY: | stipulations of this policy, and comply with a CPS    |
|    |        | approved by the FPKIPA for use with this policy. An   |
|    | *      | RA who is found to have acted in a manner             |
|    | *9.6.2 | inconsistent with these obligations is subject to     |
|    | (5.    | revocation of RA responsibilities.                    |
|    | 3.6)** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | An RA supporting this policy shall conform to the     |
| 85 | P      | stipulations of this document, including---           |
| .  | OLICY: |                                                       |
|    |        | -   Maintaining its operations in conformance to the  |
|    | **9    |     stipulations of the approved CPS.                 |
|    | .6.2** |                                                       |
|    |        | -   Including only valid and appropriate information  |
|    |        |     in certificate requests, and maintaining evidence |
|    |        |     that due diligence was exercised in validating    |
|    |        |     the information contained in the certificate.     |
|    |        |                                                       |
|    |        | -   Ensuring that obligations are imposed on          |
|    |        |     subscribers in accordance with section 9.6.3, and |
|    |        |     that subscribers are informed of the consequences |
|    |        |     of not complying with those obligations           |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | A subscriber (or human sponsor for device             |
| 86 | P      | certificates) shall be required to sign a document    |
| .  | OLICY: | containing the requirements the subscriber shall meet |
|    |        | respecting protection of the private key and use of   |
|    | **9    | the certificate before being issued the certificate.  |
|    | .6.3** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+
| 2  | COMMON | CAs operating under this policy may not disclaim any  |
| 87 | P      | responsibilities described in this CP.                |
| .  | OLICY: |                                                       |
|    |        |                                                       |
|    | *      |                                                       |
|    | *9.7** |                                                       |
+----+--------+-------------------------------------------------------+
|    | CPS:   |                                                       |
+----+--------+-------------------------------------------------------+
|    | C      |                                                       |
|    | omment |                                                       |
+----+--------+-------------------------------------------------------+
|    | O      |                                                       |
|    | verall |                                                       |
|    | Match  |                                                       |
+----+--------+-------------------------------------------------------+

# **3.0 REFERENCES**

\[COMMON\] X.509 Certificate Policy For The US Federal PKI Common Policy
Framework, <http://www.cio.gov/fpkipa/documents/CommonPolicy.pdf>

\[ROADMAP\] Shared Service Provider Roadmap: Navigating the Process to
Acceptance, <http://www.cio.gov/fpkipa/documents/SSProadmap.pdf>

# **4.0 CONTACT DETAILS**

Comments about this document may be sent to the following people:

Judith Spencer 202-208-6576 <judith.spencer@gsa.gov>

Brant Petrick 202-208-4673 <brant.petrick@gsa.gov>