The CA has to provide easy access to its policy under which the certificates were issued, to the certificates it has issued, and to the CRLs. A CA has to agree with the superior CA on the procedures it will undertake to fulfill the requirements stated in the superior CA's policy. These procedures have to be published in a way they are easy accessible. A CA has to perform daily backups and store these information in at least one off site location. Alternatively backups may be performed each time the CA has accessed its database.
Backups have to be physically secured.
5 Certificate Issuance Policy Certificates bind the identity of an user or a CA and their public key in a secure manner. Therefore certificates are the most import mean of trust and they have to be issued very carefully. Any CA or enduser who wishs to participate in the European certification infrastructure of ICE-TEL will be certified under the policy set in this document and additional policies possibly defined by PCAs or subordinate CAs. To certify a CA or an enduser they have to be notified about the policy. The CA or the enduser in turn has to sign an agreement that he accepts and follows this policy.