<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Open Sans";}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:JA;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Notice of Review Period - Ballot CSC-10 - WebTrust CSBR v2.0 Audit Criteria</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">This Review Notice is sent pursuant to Section 4.1 of the CA/Browser Forum’s Intellectual Property Rights Policy
(v1.2). This Review Period is for Final Maintenance Guidelines (30 day Review Period). A complete draft of the Draft Guideline that is the subject of this Review Notice is attached.</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;text-indent:.5in;background:white">
<span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Date Review Notice Sent: August 13, 2021</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;text-indent:.5in;background:white">
<span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Ballot for Review: Ballot CSC-10 - WebTrust CSBR v2.0 Audit Criteria</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;text-indent:.5in;background:white">
<span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Start of Review Period: August 13, 2021 at 14:00 UTC</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;text-indent:.5in;background:white">
<span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">End of Review Period: September 12, 2021 at 14:00 UTC</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Please forward any Exclusion Notice relating to Essential Claims to the Chair by email to
<a href="mailto:dean.coclin@digicert.com">dean.coclin@digicert.com</a> before the end of the Review Period. See current version of CA/Browser Forum Intellectual Property Rights Policy for details.</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Ballot CSC-10 - WebTrust CSBR v2.0 Audit Criteria</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">— MOTION BEGINS —</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Delete the following text from Section 17.1:</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">1. “WebTrust for CAs v2.0 or newer” AND “WebTrust for Certification Authorities – Publicly Trusted Code Signing Certificates
v1.0.1 or newer”; or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">2. “WebTrust for CAs v2.0 or newer” AND “WebTrust for Certification Authorities – Extended Validation Code Signing
v1.4.1 or newer”; or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">3. ETSI EN 319 411-1, which includes normative references to ETSI EN 319 401 (the latest version of the referenced
ETSI documents should be applied); or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">4. If a Government CA is required by its Certificate Policy to use a different internal audit scheme, it MAY use
such scheme provided that the audit either (a) encompasses all requirements of one of the above schemes or (b) consists of comparable criteria that are available for public review.</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Insert the following text to Section 17.1:</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">1. For Audit Periods starting before 1 November 2020, “WebTrust for CAs v2.0 or newer” AND “WebTrust for Certification
Authorities – Publicly Trusted Code Signing Certificates v1.0.1 or newer”; or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">2. For Audit Periods starting before 1 November 2020, “WebTrust for CAs v2.0 or newer” AND “WebTrust for Certification
Authorities – Extended Validation Code Signing v1.4.1 or newer”; or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">3. “WebTrust for CAs v2.0 or newer” AND “WebTrust for Certification Authorities – Code Signing Baseline Requirements
v2.0 or newer”; or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">4. ETSI EN 319 411-1, which includes normative references to ETSI EN 319 401 (the latest version of the referenced
ETSI documents should be applied); or</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">5. If a Government CA is required by its Certificate Policy to use a different internal audit scheme, it MAY use
such scheme provided that the audit either (a) encompasses all requirements of one of the above schemes or (b) consists of comparable criteria that are available for public review.</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">— MOTION ENDS —</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">Bruce Morton</span><span style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span lang="PT-BR" style="font-size:10.5pt;font-family:"Open Sans",sans-serif;color:black">CA/Browser Forum CSCWG Vice Chair</span><span lang="PT-BR" style="font-size:10.5pt;font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
</div>
</body>
</html>