<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:JA;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:881675783;
mso-list-template-ids:1607778930;}
@list l1
{mso-list-id:1369645549;
mso-list-template-ids:1577718310;}
@list l1:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>For reference, the start of voting email that Bruce attached is also in the mailing list archive at <a href="https://lists.cabforum.org/pipermail/cscwg-public/2021-September/000573.html">https://lists.cabforum.org/pipermail/cscwg-public/2021-September/000573.html</a>. I’m of the same opinion as Bruce that the voting period was started correctly.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Corey<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Cscwg-public <cscwg-public-bounces@cabforum.org> <b>On Behalf Of </b>Bruce Morton via Cscwg-public<br><b>Sent:</b> Tuesday, September 28, 2021 12:00 PM<br><b>To:</b> Dimitris Zacharopoulos (HARICA) <dzacharo@harica.gr>; cscwg-public@cabforum.org<br><b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Voting Begins: Ballot CSC-11: Update to log data retention<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Hi Dimitris,<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Ian sent out the attached email for voting to begin an attached the redline within the email. I thought that this email was sufficient to start the voting period.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Bruce.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='mso-fareast-language:ZH-CN'>From:</span></b><span style='mso-fareast-language:ZH-CN'> Dimitris Zacharopoulos (HARICA) <<a href="mailto:dzacharo@harica.gr">dzacharo@harica.gr</a>> <br><b>Sent:</b> Tuesday, September 28, 2021 11:56 AM<br><b>To:</b> Bruce Morton <<a href="mailto:Bruce.Morton@entrust.com">Bruce.Morton@entrust.com</a>>; <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br><b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Voting Begins: Ballot CSC-11: Update to log data retention<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On 28/9/2021 6:53 μ.μ., Bruce Morton wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>I am asking if CSC-11 can move forward as is OR do we have to take an action to allow CSC-11 to get passed. </span><o:p></o:p></p></blockquote><p class=MsoNormal style='margin-bottom:12.0pt'><span style='mso-fareast-language:ZH-CN'><br>IMO <b>Ian must start the voting period</b> by sending the same e-mail (including the redline) and then r<b>eset the 7 days voting period</b>. We should be fine because we haven't passed the 21 days from last post of a draft. Members that already voted will have to re-vote.<br><br><br>Thanks,<br>Dimitris.<br><br><br><br><o:p></o:p></span></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='mso-fareast-language:ZH-CN'>From:</span></b><span style='mso-fareast-language:ZH-CN'> Dimitris Zacharopoulos (HARICA) <a href="mailto:dzacharo@harica.gr"><dzacharo@harica.gr></a> <br><b>Sent:</b> Tuesday, September 28, 2021 11:51 AM<br><b>To:</b> Bruce Morton <a href="mailto:Bruce.Morton@entrust.com"><Bruce.Morton@entrust.com></a>; <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br><b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Voting Begins: Ballot CSC-11: Update to log data retention</span><o:p></o:p></p></div></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'> <o:p></o:p></p><div><p class=MsoNormal>On 28/9/2021 6:46 μ.μ., Bruce Morton wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Hi Dimitris,</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Do we have any action for ballot CSC-11?</span><o:p></o:p></p></blockquote><p class=MsoNormal style='margin-bottom:12.0pt'><span style='mso-fareast-language:ZH-CN'><br>I'm not sure what you mean.<br><br>Are you asking what steps we should perform for CSC-11?<br><br><br>Dimitris.<br><br><br></span><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Bruce.</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='mso-fareast-language:ZH-CN'>From:</span></b><span style='mso-fareast-language:ZH-CN'> Cscwg-public <a href="mailto:cscwg-public-bounces@cabforum.org"><cscwg-public-bounces@cabforum.org></a> <b>On Behalf Of </b>Dimitris Zacharopoulos (HARICA) via Cscwg-public<br><b>Sent:</b> Tuesday, September 28, 2021 11:43 AM<br><b>To:</b> Bruce Morton via Cscwg-public <a href="mailto:cscwg-public@cabforum.org"><cscwg-public@cabforum.org></a><br><b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Voting Begins: Ballot CSC-11: Update to log data retention</span><o:p></o:p></p></div></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>Hi Bruce,<br><br>According to the Bylaws section 2.3 (3), it is possible for the discussion period to be more than 7 days so the <b>proposer</b> of the ballot must explicitly start the voting period which is for exactly 7 days. I don't think Ian started the voting period. <br><br><i>"Once no new version of the ballot has been posted for seven (7) calendar days, <b>the proposer may end the discussion period and start the voting period</b> by <b>reposting the final version of the ballot</b> and clearly i<b>ndicating that voting is to begin</b>, along with the start and end dates and times (including time zone) for the voting period"</i><br><br>Also, Ian's original email had a link to the wiki, which is not publicly available (thus not acceptable according to the Bylaws), but the redline that was attached met the requirements. This redline needs to be re-sent when Ian starts the voting period.<br><br>I am highlighting this for future ballots so that if there is only a pointer to a redline hosted at an external site, the link must be pointing to a public and immutable redline.<br><br>Sorry for reporting this but it's best to do this right than having challenges in the future.<br><br><br>Thanks,<br>Dimitris.<br><br><br><o:p></o:p></p><div><p class=MsoNormal>On 27/9/2021 3:11 μ.μ., Bruce Morton via Cscwg-public wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Entrust votes Yes to ballot CSC-11.</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'>Bruce.</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='mso-fareast-language:ZH-CN'>From:</span></b><span style='mso-fareast-language:ZH-CN'> Cscwg-public <a href="mailto:cscwg-public-bounces@cabforum.org"><cscwg-public-bounces@cabforum.org></a> <b>On Behalf Of </b>Ian McMillan via Cscwg-public<br><b>Sent:</b> Friday, September 24, 2021 7:01 PM<br><b>To:</b> <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br><b>Subject:</b> [EXTERNAL] [Cscwg-public] Voting Begins: Ballot CSC-11: Update to log data retention</span><o:p></o:p></p></div></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:SimSun;mso-fareast-language:ZH-CN'>WARNING: This email originated outside of Entrust.<br>DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.</span><o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:SimSun;mso-fareast-language:ZH-CN'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><b><a href="https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fwiki.cabforum.org*2Fcscwg*2Fcsc_11_-_update_to_log_data_retention_requirements__*3B!!FJ-Y8qCqXTj2!OxtP9iVwcvkR2NB3D6_-cStNUlZ0jiRsvQI7kzZGF3vX8NFDtimB6Te0-iBFuXDSLg0*24*26data*3D04*7C01*7Cianmcm*40microsoft.com*7Ce3bd2ae0dce4468183c108d9737ae5b0*7C72f988bf86f141af91ab2d7cd011db47*7C0*7C0*7C637667794999582131*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DBJidr4YnWniggGmazUxO4cTwAuX0iHteFREqsQRzkoE*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!FJ-Y8qCqXTj2!NWv1K7HGvAxUABiMxdfaCMe3GpkaaPtdGr0fmyfxRX1KGs0uZ0T8Jv4ZKzUoZrd49aU*24&data=04*7C01*7Cianmcm*40microsoft.com*7C01e89b1c05da47fcdfba08d97a2f1984*7C72f988bf86f141af91ab2d7cd011db47*7C0*7C0*7C637675165228324176*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=dKwimRLyToP*2FcULHIYvxeB*2FMitrVOoTRe5ql7h4qZrA*3D&reserved=0__;JSUlJSUlJSUlJSoqKioqKioqKioqJSUqKioqKioqKioqKiolJSolJSUlJSUlJSUlJSUlJSUlJSUl!!FJ-Y8qCqXTj2!ITKna9KcfXc7HkRFu1gX_Sx3mUCs01wd3i8d3YDOWczknOMX4XiG3L1IFtkcvO3ZVyU$">Ballot CSC-11: Update to log data retention requirements</a></b><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Purpose of this ballot: <o:p></o:p></p><p class=MsoNormal>Update the log data and retention of log data requirements in the Baseline Requirement for the Issuance and Management of Publicly-Trusted Code Signing Certificates v2.5. The following motion has been proposed by Ian McMillan of Microsoft, and endorsed by Dimitris Zacharopoulos (HARICA) and Bruce Morton (Entrust).<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>— MOTION BEGINS — <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>This ballot updates the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates“ version 2.5 according to the attached redline which includes:<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15 “Data Records” removing references to [SSL/TLS] Baseline Requirements for this section in totality<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15 “Data Records” to include sub-section 15.1 “Types of Events Recorded” and describing the requirements for CAs and Third Party Delegates while removing “Signing Services”<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15 “Data Records” to include sub-section 15.2 “Timestamp Authority Data Records”<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15.1 to clarify 4(f) for security event logging on Timestamp Authority servers<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15.1 on 4(d) for security event logging to no longer include “hardware failures”<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15 “Data Records” to include sub-section 15.3 “Data Retention Period for Audit Logs”<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3'>Update section 15.2 to no longer reference Baseline Requirements section 5.4.3 and defined a specific retention period for CA, subscriber certificate, Timestamp Authority, and security event data records for at least 2 years<o:p></o:p></li></ol><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>— MOTION ENDS —<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>The procedure for approval of this ballot is as follows:<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Discussion (7 days) <o:p></o:p></p><p class=MsoNormal>Start Time: 2021-09-17, 19:00 Eastern Time (US) <o:p></o:p></p><p class=MsoNormal>End Time: not before 2021-09-24, 19:00 Eastern Time (US)<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Vote for approval (7 days) <o:p></o:p></p><p class=MsoNormal>Start Time: 2021-09-24, 19:00 Eastern Time (US) <o:p></o:p></p><p class=MsoNormal>End Time: 2021-10-01, 19:00 Eastern Time (US)<o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><i><span style='mso-fareast-language:ZH-CN'>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</span></i><span style='mso-fareast-language:ZH-CN'> <br><br><br></span><o:p></o:p></p><pre>_______________________________________________<o:p></o:p></pre><pre>Cscwg-public mailing list<o:p></o:p></pre><pre><a href="mailto:Cscwg-public@cabforum.org">Cscwg-public@cabforum.org</a><o:p></o:p></pre><pre><a href="https://urldefense.com/v3/__https:/lists.cabforum.org/mailman/listinfo/cscwg-public__;!!FJ-Y8qCqXTj2!PJmg5skWxQbnhRAgajjQ2jhsymvbkQayvI80P2QLBU1xLlSBDwpb9DloE__N3wRs_JM$">https://lists.cabforum.org/mailman/listinfo/cscwg-public</a><o:p></o:p></pre></blockquote><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p></blockquote><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'> </span><o:p></o:p></p></blockquote><p class=MsoNormal><span style='mso-fareast-language:ZH-CN'><o:p> </o:p></span></p></div></body></html>