POLICIES) & PIV-I H and acceptance of certificates (if applicable) B, M (ALL POLICIES) & PIV-I H Subscriber Agreements B, M (ALL POLICIES) & PIV-I H Documentation of receipt of tokens R, B, M (ALL POLICIES) & PIV-I H All certificates issued or published R, B, M (ALL POLICIES) & PIV-I H Record of CA Re-key B, M (ALL POLICIES) & PIV-I H All CRLs issued and/or published B, M (ALL POLICIES) & PIV-I H Other data or applications to verify archive contents B, M (ALL POLICIES) & PIV-I H Compliance Auditor reports B, M (ALL POLICIES) & PIV-I H Any changes to the Audit parameters, e.g., audit frequency, type of event audited B, M (ALL POLICIES) & PIV-I H Any attempt to delete or modify the Audit logs R, B, M (ALL POLICIES) & PIV-I H Whenever the CA generates a key. (Not mandatory for single session or one-time use symmetric keys) R, B, M (ALL POLICIES) & PIV-I H All access to certificate subject private keys retained within the CA for key recovery purposes R, B, M (ALL POLICIES) & PIV-I H All changes to the trusted public keys, including additions and deletions R, B, M (ALL POLICIES) & PIV-I H The export of private and secret keys (keys used for a single session or
message are excluded) B, M (ALL POLICIES) & PIV-I H The approval or rejection of a certificate status change request R, B, M (ALL POLICIES) & PIV-I H Appointment of an individual to a Trusted Role B, M (ALL POLICIES) & PIV-I H Destruction of cryptographic modules B, M (ALL POLICIES) & PIV-I H All certificate compromise notifications B, M (ALL POLICIES) & PIV-I H Remedial action taken as a result of violations of physical security R, B, M (ALL POLICIES) & PIV-I H Violations of Certificate Policy R, B, M (ALL POLICIES) & PIV-I H Violations of Certification Practice Statement An Entity is responsible to properly administer their environment. Administration requirements affect personnel, procedures and technology. Controls over access, documented processes and alternative methods to retain records are to be implemented. Table No. CP Section Requirement 7.8 5.5.3 No unauthorized user shall be permitted to write to or delete the archive. Applicant: 7.9 5.5.3 If the original media cannot retain the data for the required period, a mechanism to periodically transfer the archived data to new media shall be defined by the archive site. Alternatively, an Entity may retain data using whatever procedures have been approved by for that category of documents. Applications required to process the archive data shall also be maintained for a period determined by the Entity for the Entity CA. Applicant: 7.10 5.5.4 If a cross-certified entity chooses to back up its archive records, the CPS or a
Certificate Revocation B,M (ALL POLICIES), All certificate revocation requests Certificate Status Change Approval B,M (ALL POLICIES), The approval or rejection of a certificate status change request CA Configuration M (ALL POLICIES), Any security-relevant changes to the configuration of the CA Account Administration R,B,M (ALL POLICIES), Roles and users are added or deleted R,B,M (ALL POLICIES), The access control privileges of a user account or a role are modified Certificate Profile Management R, B,M (ALL POLICIES), All changes to the certificate profile Revocation Profile Management B,M (ALL POLICIES), All changes to the revocation profile Certificate Revocation List Profile Management B,M (ALL POLICIES), All changes to the certificate revocation list profile Miscellaneous R,B,M (ALL POLICIES), Appointment of an individual to a Trusted Role M (ALL POLICIES), Designation of personnel for multiparty control B,M (ALL POLICIES), Installation of the Operating System B,M (ALL POLICIES), Installation of the CA
M (ALL POLICIES), Installing hardware cryptographic modules M (ALL POLICIES), Removing hardware cryptographic modules B,M (ALL POLICIES), Destruction of cryptographic modules B,M (ALL POLICIES), System Startup B,M (ALL POLICIES), Logon Attempts to CA Applications B,M (ALL POLICIES), Receipt of Hardware/Software B,M (ALL POLICIES), Attempts to set passwords B,M (ALL POLICIES), Attempts to modify passwords B,M (ALL POLICIES), Backing up CA internal database B,M (ALL POLICIES), Restoring CA internal database M (ALL POLICIES), File manipulation (e.g., creation, renaming, moving) M (ALL POLICIES), Posting of any material to a repository M (ALL POLICIES), Access to CA internal database B,M (ALL POLICIES), All certificate compromise notification requests M (ALL POLICIES), Loading tokens with certificates M (ALL POLICIES), Shipment of Tokens
B,M (ALL POLICIES), Zeroizing tokens R,B,M (ALL POLICIES), Re-key of the CA Configuration changes to the CA server involving: B,M (ALL POLICIES), - Hardware B,M (ALL POLICIES), - Software B,M (ALL POLICIES), - Operating System B,M (ALL POLICIES), - Patches B,M (ALL POLICIES), - Security Profiles Physical Access / Site Security M (ALL POLICIES), Personnel Access to room housing CA M (ALL POLICIES), Access to the CA server B,M (ALL POLICIES), Known or suspected violations of physical security Anomalies B,M (ALL POLICIES), Software Error conditions B,M (ALL POLICIES), Software check integrity failures ,M (ALL POLICIES), Receipt of improper messages ,M (ALL POLICIES), Misrouted messages
B,M (ALL POLICIES), Network attacks (suspected or confirmed) R,B,M (ALL POLICIES), Equipment failure M (ALL POLICIES), Electrical power outages M (ALL POLICIES), Uninterruptible Power Supply (UPS) failure M (ALL POLICIES), Obvious and significant network service or access failures R,B,M (ALL POLICIES), Violations of Certificate Policy R,B,M (ALL POLICIES), Violations of Certification Practice Statement B,M (ALL POLICIES), Resetting Operating System clock Additional Requirements for Rudimentary Assurance: N/A Additional Requirements for Basic Assurance: Table No. CP Section Requirement 9.15 5.4.2 Audit logs shall be reviewed as required for cause. Such reviews involve verifying that the log has not been tampered with, and then briefly inspecting all log entries, with a more thorough investigation of any alerts or irregularities in the logs. Actions taken as a result of these reviews shall be documented. Applicant: Additional Applicant Information Applicant: