Response to Findings
No. Baseline Requirements
Ref. Criteria
1
1.1
According to WTBR, the CA shall develop,
implement, enforce, and annually update a
Certificate Policy and/or Certification PracticeStatement that describes in detail how the CA
implements the latest version of these
Requirements.

1.4

The CP/CPS provide the Application CA2complies with guidelines of the latest version ofthe"AICPA/CICA WebTrust Program for
Certification Authorities " and "CA/Browser
Forum, Baseline Requirements for the Issuanceand Management of Publicly-Trusted
Certificates ", and that these guidelines have apriority to the CP/CPS if there is any
inconsistency between these guidelines'
requirements and the CP/CPS.

Findings

Response to Findings

The CA discloses on its website its:
(snip)
its commitment to conform to thelatest version of the Baseline
Requirements for the Issuanceand Management of
Publicly-Trusted Certificatesissued by the CA/Browser
Forum.
The Certificate Authority has
controls to provide reasonableassurance that the CA CP and/or
CPS that describes how the CA
implements the latest version of
the Baseline Requirements are
updated annually.

However, there are several inconsistencies notcomplying with WTBR. These inconsistencies
are as described below.
Therefore, the CAs and LRA shall operate inaccordance with all WTBR requirements.
2

2.3.4

According to WTBR, a Subscriber Agreement
and/or Terms of Use shall contain the following
two items, an obligation to respond to the CA’s
instructions and an entitlement to revoke thecertificate.
However, the two items mentioned above are
not described in the Terms of Use.
Therefore, the CAs shall update the Terms of
Use to contain an obligation to respond to theCA’s instructions and an entitlement to revoke
the certificate.

3

2.5.2

According to WTBR, the CA shall begin
investigation of Certificate Problem Report
within 24 hours of receipt.

Subscriber Agreement and Terms "Obligations correspondingof Useto the instruction from CA"
The CA maintains controls andand "There is a right toprocedures to provide reasonable revoke the certificate in caseof illegal use" are describedassurance that the CA, prior toat the Term of service.
the issuance of a Certificate,obtains a Subscriber and/or
Terms of Use agreement inaccordance with the SSL
Baseline Requirements Section
10.3.1. That agreement contains
provisions imposing obligations
and warranties on the Application
relating to:(snip)・ responsiveness・ acknowledgement andacceptance.

The CA maintains controls to
We establish a process thatprovide reasonable assurance that we response to problem
it:reports from subscription(snip)
users can begin
The above requirement is established forbegin investigation of Certificate investigation within 24
problem reports between LRA and CA, however Problem Reports within 24 hours: hours on holidays.
as to the CA (GPKI) response to problem
reports from subscription users, investigation of
Certificate Problem Report is designed to start
within 24 hours of receipt in business days, but
not on holidays.

No. Baseline Requirements
Ref. Criteria

Findings

Response to Findings

The CA maintains controls toprovide reasonable assurance
that:(snip)
the CA requires all Validation
Specialists to pass an
examination provided by the CA
on the information verification
requirements outlined in the
Baseline Requirements.

We provide material forstudy including test anddistributes the LRA. It's
tested to all the members of
personnel of the LRA using
the material for theselearning and the test.

The CA maintains controls toprovide reasonable assurance
that:(snip)
the CA documents each
Validation Specialist possesses
the skills required by a task
before allowing the Validation
Specialist to perform that task.

We document skill required
for specific tasks for each
Validation Specialist.

The CA maintains controls toprovide reasonable assurance that
the CA internally audits each
Delegated Third Party’s
compliance with the Baseline
Requirements on an annual basis.

We include the WTBR
compliance for IA and LRA
in the scope of our internal
audit.

The CA maintains controls toprovide reasonable assurance thatthe following events arerecorded:(snip)CA and Subscriber Certificate
lifecycle management events,

We add the fields to theform in order to record theprocessing time andcommunication description
with the applicants andoperate to use this form
effectively.

Therefore, CAs shall establish a process that the
CA (GPKI) response to problem reports fromsubscription users can begin investigation
within 24 hours on holidays.
4

2.6.2

According to WTBR, the LRA shall require all
Validation Specialists to pass an examination
provided by the LRA on the information
verification requirements.
However, the LRA only requires all Validation
Specialists to participate in a training (basic
education, security training, privacy dataprotection, requirements of verification), but
passing an examination after training is not
required.
Therefore, the LRA shall document andimplement a policy to have all Validation
Specialists passing an examination provided by
the CA after participating the training.

5

2.6.2

According to WTBR, the CA shall document
each Validation Specialist possesses the skills
required by a task before allowing the
Validation Specialist to perform that task.
However, the LRA has not a rule to document
skills required for a specific task for each
Validation Specialist before he/she performs thetask.
Therefore, the LRA shall document skill
required for specific tasks for each Validation
Specialist.

6

2.6.6

According to WTBR, the CA shall internallyaudit each Delegated Third Party’s compliancewith WTBR on an annual basis.
However, the CAs do not perform the WTBR
compliance audit for neither IA nor LRA,
whereas they perform the internal audits for
WebTrust and their CP/CPS.
Therefore, the CAs shall include the WTBR
compliance for IA and LRA in the scope of theirinternal audit.

7

2.7.2

According to WTBR, the CA and each
Delegated Third Party shall record details of theactions taken to process a certificate request,
including(1)Time of processing a certificate request(2)Communications with the applicant.

No. Baseline Requirements
Ref. Criteria
There is no field to record the processing timeand communication description with theapplicants on the form ruled by the LRAinternal operation procedures, although the form
has the date field.
In addition, although their internal operation
procedures require that the Validation Specialist
should record the results of verification on thisform, they do not use it, but use a different
form.
The LRA shall add the fields to this form inorder to record the processing time andcommunication description with the applicantsand operate to use this form effectively.

8

2.7.3

According to WTBR, the CA shall retain any
audit logs generated after the effective date forat least seven years.
However, the policy has documented that
firewall log is retained at three years.

Findings

Response to Findings

including:・Certificate Requests, renewal
and re-key requests, andrevocation
・ all verification activities
stipulated in the Baseline
Requirements and the CA’s
Certification PracticeStatement
・ date, time, phone number used,persons spoken to, and end
results of verification telephone
calls
・acceptance and rejection ofcertificate requests
・ issuance of Certificates・ generation of Certificate
Revocation Lists (CRLs) and
OCSP entries.
The CA has a policy andmaintains controls to provide
reasonable assurance that audit
logs generated after the effective
date of the Baseline
Requirements are retained for atleast seven years.

We update the rule to retain
firewall log at least sevenyears.

Therefore, the CAs shall update the rule toretain firewall log at least seven years.
9

2.8.1

According to WTBR, the CA shall ensure that
the Subordinate CA meets all applicableBaseline Requirements.
However, the subordinate CA (APCA2 (Sub))has not been audited in accordance with theserequirements.
Therefore, the APCA2 (Sub) in addition to the
APCA2 (Root) shall be taken the WTBR audit.

10

2.8.3

According to WTBR, the CA shall monitor
adherence to its CP/CPS and WTBR and strictly
control its service quality by performing self
audits on at least a quarterly basis against arandomly selected sample of certificate.

The CA maintains controls to
We are taken the WTBR
provide reasonable assurance that audit to APCA2 (Root) andthe following requirements are
APCA2 (Sub).
followed for Subordinate CAs:
(snip)
for a Subordinate CA that is nottechnically constrained:
・the CA verifies that Subordinate
CAs that are not technicallyconstrained are audited inaccordance with SSL Baseline
Requirements 17.1.

The CA maintains controls toprovide reasonable assurancethat:・it performs ongoing
self-assessments on at least aquarterly basis against a
However, as to the sample based self audits
randomly selected sample of at
including LRA, performed by the CAs, there areleast three percent (3%) of theno rules to audit whether the RA procedures
Certificates issued during thewere performed in compliance with WTBR.
period commencing
And also, the CAs did not retain sufficient
immediately after the previous
evidence of these audits.
self-assessment samples was
taken.

We document the audit
procedures to monitor LRA
process in compliance with
WTBR, and retain sufficient
audit evidence.

No. Baseline Requirements
Ref. Criteria
Therefore, the CAs shall document the audit
procedures to monitor their RA process incompliance with WTBR, and retain sufficient
audit evidence.
11

3.9

Findings

Response to Findings

According to WTBR, the CA shall provide all
personnel performing information verification
duties with skills-training.

The CA maintains controls to
We document the rule thatprovide reasonable assurance that we establish the unified
personnel and employment
training plan in the internal
practices enhance and support the operation procedures, andHowever, the CA internal operation procedures trustworthiness of the CA’s
we make education forrequire that the members' training should be
operations.
everyone LRA
determined by the LRA controller, and that eachadministrator and LRA
LRA member should study the knowledge andpersonnel.
techniques needed at starting the LRA work.
Therefore, they do not have a unified education
standard and do not have any curriculum fortraining the all LRA personnel including LRA
controllers.

Therefore, the CAs shall document the rule thatthey establish the unified training plan in theinternal operation procedures, and the LRA
shall implement those processes covering thecontroller and all other personnel in LRA.
12

4.1

According to WTBR, each CA or DelegatedThird Party shall change authentication keys
and passwords for any privileged accounts orservice account on a Certificate System
whenever a person's authorization toadministrative access is changed or revoked.

The CA maintains controls to
We document andprovide reasonable assurance
implement the rule ofthat:
authentication key change(snip)of IC authentication card,
Authentication keys andnot only password change,
passwords for any privileged
when a personnel in LRA is
account or service account on a
replaced or terminated.
However, the CAs and LRA’s internal operation Certificate System is changed,
procedures require that the LRA personnel have when a person’s authorization toto change the password only but do not have to administratively access thatchange the authentication key when a personnel account on the Certificate System
is changed or revoked;
is replaced or terminated.
Therefore, the CAs and LRA shall document
and implement the rule of authentication key
change of IC authentication card, not only
password change, when a personnel is replacedor terminated.

13

4.1

4.2

According to WTBR 4.1, each CA or DelegatedThird Party shall implement multi-factor
authentication to each component of theCertificate System.
According to WTBR 4.2, the CAs shall
implement multi-factor authentication foradministrator access to Issuing Systems andCertificate Management Systems.
The CAs implement multi-factor authentication
to Issuing Systems by password and IC card.
However, for some administrator accounts on

The CA maintains controls toprovide reasonable assurance
that:(snip)
Multi-factor authentication is
implemented to each componentof the Certificate System that
supports it;
The CA maintains controls toprovide reasonable assurance
that:(snip)
Enforce multi-factor

We implement multi-factor
authentication for someadministrator accounts on
Certificate Management
Systems.

No. Baseline Requirements
Ref. Criteria
Certificate Management Systems the CAs do
not implement the logical multi-factor
authentication, whereas they implement thephysical facility access control and the logicalpassword authentication.

Findings

Response to Findings

authentication foradministrator access to
Issuing Systems andCertificate Management Systems;

Therefore, the CAs shall implement multi-factor
authentication for these accounts to Certificate
Management Systems.
14

4.2

According to WTBR, each CA or DelegatedThird Party shall review all system accounts atleast every 90 days.
However, the review of all operator user
accounts is performed every 6 months for theCAs.
Therefore, the CAs shall update the rule toperform the accounts review every 90 days.

15

4.2

According to WTBR, each CA or DelegatedThird Party shall implement a process that
disables all privileged access of an individual to
Certificate Systems within 24 hours upon
termination of the individual’s employment orcontracting relationship with the CA or
Delegated Third Party.
However, the CAs disable privileged access of
the individual’s employment or contracting
relationship by deleting the physical access of
their facilities.

The CA maintains controls toprovide reasonable assurance
that:(snip)
Review all system accounts atleast every 90 days anddeactivate any accounts that are
no longer necessary for
operations;

The CA maintains controls toprovide reasonable assurance
that:(snip)Disable all privileged access ofan individual to Certificate
Systems within 24 hours upon
termination of the individual’s
employment or contracting
relationship with the CA or
Delegated Third Party;

We update the rule toperform the accounts review
every 90 days from every 6month.

We document the rule andimplement to delete not
only the physical access,but also the logical access,e.g. the administrator's
password change, within 24
hours upon termination of
the individual’s
employment or contracting
relationship with them.

Therefore, the CAs shall document the rule andimplement to delete not only the physicalaccess, but also the logical access, e.g. theadministrator's password change, within 24
hours upon termination of the individual’s
employment or contracting relationship with
them.
16

4.2

According to WTBR, each CA or DelegatedThird Party shall implement the controls torequire that passwords have at least twelve (12)characters for accounts that are not publicly
accessible (accessible only within Secure Zones
or High Security Zones).
However, for some user accounts, the internal
operation procedures require at least 8
characters and 8 characters are actually
implemented.
Therefore, the CAs shall update the rule andimplement to have at least 12 characters for all
accounts.

The CA maintains controls toprovide reasonable assurance
that:(snip)
Trusted Role using an username
and password to authenticate
shall configure accounts toinclude but not be limited to・Passwords have at least
twelve (12) characters foraccounts not publicly
accessible (accessible only
within Secure Zones or High
Security Zones);
・Configure passwords for

We update the rule andimplement to have at least
12 characters for user
account for these systems.

No. Baseline Requirements
Ref. Criteria

Findings

Response to Findings

accounts that are accessible
from outside a Secure Zone orHigh Security Zone to have atleast eight (8) characters, bechanged at least every 90 days,
use a combination of at least
numeric and alphabetic
characters, and not be one of
the user’s previous four
passwords; and implement
account lockout for failed
access attempts; OR・Implement a documented
password management andaccount lockout policy that the
CA has determined provide atleast the same amount ofprotection against password
guessing as the foregoing
controls.
17

4.2

According to WTBR, each CA or DelegatedThird Party shall require that each individual ina Trusted Role use a unique credential createdby or assigned to that person for authentication
to Certificate Systems.
However, the users of a LRA system can spoof
the others because of improper control of their
IC authentication cards and passwords.

The CA maintains controls toprovide reasonable assurance
that:(snip)
Trusted Role use a uniquecredential created by or assigned
to that person for authentication
to Certificate Systems;

We have already done the
Guidance for Reform that
LRA perform proper
management of IC
authentication cards andpasswords.

Therefore, the LRA shall perform proper
management of IC authentication cards andpasswords.
18

4.4

According to WTBR, the CA and DelegatedThird Party shall document a vulnerability
correction process including identification,
review, response, and remediation ofvulnerabilities.
The CAs collect vulnerability information on adaily basis and also perform the vulnerability
identification, review, response, andremediation against the vulnerability scan andpenetration test results.
However, the CA does not have any
documentation of policies for these activities.

19

4.4

Therefore, the CAs shall document the rule thatvulnerability correction process and improve theprocess to include the penetration test results.
According to WTBR, the CA and DelegatedThird Parties shall perform a Vulnerability Scan
based on the following:・Target system
All related Certificate Systems

The CA maintains controls to
We document the rule thatprovide reasonable assurance
vulnerability correction
that:process and improve the(snip)
process to include the
A formal documented
penetration test results.
vulnerability correction process isfollowed and includes
identification, review, response,
and remediation ofvulnerabilities;

The CA maintains controls toprovide reasonable assurance
that:(snip)
Perform a Vulnerability Scan on

We document andimplement the vulnerability
scan policy based on
WTBR.

No. Baseline Requirements
Ref. Criteria
・Target IP Address
Public and private IP addresses
・Frequency
Within one week of receiving a request fromthe CA/Browser Forum,
After any system or network changes that the
CA determines are significant, andAt least once per quarter, on public andprivate IP addresses identified by the CA or
Delegated Third Party as the CA’s or DelegatedThird Party’s Certificate Systems.
However, per inspection of the scan report, thefrequency of the scan is annual, and targeted
servers and IP addresses are limited.

Findings

Response to Findings

public and private IP addresses
identified by the CA or DelegatedThird Party as the CA’s orDelegated Third Party’s
Certificate Systems based on thefollowing:・Within one week of receiving arequest from the CA/Browser
Forum,
・After any system or networkchanges that the CA determines
are significant, and・At least once per quarter;

Therefore, the CAs shall document andimplement the vulnerability scan policy basedon WTBR including their target systems, target
IP addresses and frequency.
20

4.4

According to WTBR, the CA and DelegatedThird Party shall undergo a Penetration Test on
the CA’s and each Delegated Third Party’s
Certificate Systems on at least an annual basis
and after infrastructure or application upgradesor modifications that the CA determines are
significant.
However, per inspection of the report, they
perform these tests as a part of the vulnerability
scan on an annual basis, these tests are
insufficient against the Penetration Test
requirements in WTBR.

The CA maintains controls toprovide reasonable assurance
that:(snip)
Perform a Penetration Test on the
CA’s and each Delegated Third
Party’s Certificate Systems on atleast an annual basis and after
infrastructure or application
upgrades or modifications that
the CA determines are
significant;We document the rule andimplement to undergo
Penetration Test thosecontents are in conformity
with WTBR.

The CA maintains controls toprovide reasonable assurance
that:(snip)
Document that Vulnerability
Scan and Penetration Test was
performed by a person or entitywith the skills, tools, proficiency,
code of ethics, and independence
necessary to provide a reliable
Vulnerability Scan or Penetration
Test;

We document andimplement the rule ofrecording the required items
in Vulnerability Scan andPenetration Test reports.

Therefore, the CAs shall document the rule andimplement to undergo Penetration Test of which
contents are in conformity with WTBR.
21

4.4

According to WTBR, the CA and DelegatedThird Party shall record evidence that each
Vulnerability Scan and Penetration Test was
performed by a person or entity (or collective
group thereof) with the skills, tools, proficiency,
code of ethics, and independence necessary toprovide a reliable Vulnerability Scan or
Penetration Test.
However, per inspection of the report ofVulnerability Scan and Penetration Test, there
were not any records of the above items
required by WTBR.
Therefore, the CAs shall document andimplement the rule of recording the above items
in Vulnerability Scan and Penetration Test
reports.

No. Baseline Requirements
Ref. Criteria
22

4.4

According to WTBR, the CA and DelegatedThird Parties shall perform one of thefollowing (i) – (iii) within 96 hours of discovery
of a Critical Vulnerability not previously
addressed by the CA’s vulnerability correction
process:

Findings

Response to Findings

The CA maintains controls to
We update and implement
provide reasonable assurance
the rules of vulnerability
that:
correction process based on(snip)
WTBR.
Perform one of the following
within 96 hours of discovery of a
Critical Vulnerability notpreviously addressed by the CA’s(i) Remediate the Critical Vulnerability;(ii) If remediation of the Critical Vulnerability
vulnerability correction process:within 96 hours is not possible, create and・Remediate the Criticalimplement a plan to mitigate the Critical
Vulnerability;
Vulnerability, giving priority to the following: ・If remediation of the(1) Vulnerabilities with high CVSS
Critical Vulnerability within 96
scores, starting with thehours is not possible, create
vulnerabilities the CA determines are theand implement a plan tomost critical; andmitigate the Critical(2) Systems that lack sufficient compensating
Vulnerability, giving priority tocontrols that, if the vulnerability were left
the following:
unmitigated, would allow external
・Vulnerabilities with highsystem control, code execution,
CVSS scores, starting
privilege escalation, or systemwith the vulnerabilities thecompromise; or
CA determines are the most(iii) Document the factual basis for the CA’s
critical (such as those with adetermination that the vulnerability does not
CVSS score of 10.0); andrequire remediation because of one of the・Systems that lack sufficient
following:compensating controls that, if(a) The CA disagrees with the NVD rating;the vulnerability were left(b) The identification is a false positive;
unmitigated, would allow(c) The exploit of the vulnerability isexternal system control,
prevented by compensating controls or ancode execution, privilege
absence of threats;
escalation, or system(d) Other similar reasons.
compromise; orDocument the factual basis for
The CA’s internal operation procedures
the CA’s determination that the
document a correction process based on
vulnerability does not requiremateriality and priority of correction.
remediation because of one of the
However, there are some gaps between thefollowing:
actual correction process and WTBR, such as no ・The CA disagrees with the NVD
rules of the correction process within 96 hours.
rating;・The identification is a false
Therefore, the CAs shall update and implement
positive;the rules of vulnerability correction process
・The exploit of the vulnerability
based on WTBR.
is prevented by compensating
controls or an absence of
threats; orOther similar reasons.