<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.gmail-sha
{mso-style-name:gmail-sha;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Verdana",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Hi Ben,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">I notice there aren’t any changes to 1.c in your diff. Just wanted to check if that was a purposeful omission?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Now that your proposed wording defines Offline CA Systems as air-gapped, perhaps requirement 1.c about Root CAs being in either “offline state OR air-gapped” should
be updated to either say “offline AND air-gapped” or something similar to “Maintain Root CA Systems in a High Security Zone as an Offline CA System”?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Pavan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Netsec <netsec-bounces@cabforum.org> <b>On Behalf Of
</b>Ben Wilson via Netsec<br>
<b>Sent:</b> Monday, June 29, 2020 12:14 PM<br>
<b>To:</b> CABF Network Security List <netsec@cabforum.org><br>
<b>Subject:</b> [EXT] [cabf_netsec] SCXX: Offline CA Security Requirements<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">The Document Structure subgroup (Tim Crawford, David Kluge, and myself) met this morning and finalized the following ballot. We need a proposer and two endorsers:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:8.0pt;line-height:105%"><a href="https://secure-web.cisco.com/1xWwZd_cmeFl6Wo_6UnD9yndY-91SE2BLQMB66tkJxNbdveawFdMG_dr9LWTsW1fgDVwMiS_8LaIZXgfaqYETPEu3j6PnWGrwkWsRkIdgj_DM8YJ33XziwfwlLH3MN_Br9VDqnSD2GutwLZekzB4gEPisbmmUVHAwtA4Kvz6jBiEIvXdHsXVoS3l9ZfaQtby1FcOt1Qkl8fbZdZ5MXCLpoOCE7GzJElyWhF_c7_8uV6wR8UlGN7lpl93ubChysPb6etjUMF2ikThUPLxT7kHOs6JJPMjRhdOHt_zQJMVvnykLz5JPDe2bdo94McAJQ5hclWG7d10oiAtnM4y79R1r8w/https%3A%2F%2Fgithub.com%2Fcabforum%2Fdocuments%2Fcompare%2F095fc4f7992dbd186503a4b0ec4e643ae4ea1624...BenWilson-Mozilla%3A99ea75f4ad19c58a7f9eb2829e63fb1678a838fa">https://github.com/cabforum/documents/compare/095fc4f7992dbd186503a4b0ec4e643ae4ea1624...BenWilson-Mozilla:<span class="gmail-sha">99ea75f4ad19c58a7f9eb2829e63fb1678a838fa</span></a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ben<o:p></o:p></p>
</div>
</div>
</div>
<p><em>Confidentiality Warning:</em></p>
<p><em>Deloitte refers to a Deloitte member firm, one of its related entities, or Deloitte Touche Tohmatsu Limited (“DTTL”). Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL does not provide services to clients. Please see </em><a href="http://www.deloitte.com/about" target="_blank" rel="noopener">www.deloitte.com/about</a><em> to
learn more.</em></p>
<p><em>This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy,
copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system. Thank
You.</em></p>
<p><em>If you do not wish to receive future commercial electronic messages from Deloitte, forward this email to </em><a href="mailto:unsubscribe@deloitte.ca">unsubscribe@deloitte.ca</a></p>
<p><em>Avertissement de confidentialité:</em></p>
<p><em>Deloitte désigne un cabinet membre de Deloitte, une de ses entités liées ou Deloitte Touche Tohmatsu Limited (DTTL). Chaque cabinet membre de Deloitte constitue une entité juridique distincte et est membre de DTTL. DTTL n’offre aucun service aux clients.
Pour en apprendre davantage, voir </em><a href="http://www.deloitte.com/ca/apropos" target="_blank" rel="noopener">www.deloitte.com/ca/apropos</a><em>.</em></p>
<p><em>Ce message, ainsi que toutes ses pièces jointes, est destiné exclusivement au(x) destinataire(s) prévu(s), est confidentiel et peut contenir des renseignements privilégiés. Si vous n’êtes pas le destinataire prévu de ce message, nous vous avisons par
la présente que la modification, la retransmission, la conversion en format papier, la reproduction, la diffusion ou toute autre utilisation de ce message et de ses pièces jointes sont strictement interdites. Si vous n’êtes pas le destinataire prévu, veuillez
en aviser immédiatement l’expéditeur en répondant à ce courriel et supprimez ce message et toutes ses pièces jointes de votre système. Merci.</em></p>
<p><em>Si vous ne voulez pas recevoir d’autres messages électroniques commerciaux de Deloitte à l’avenir, veuillez envoyer ce courriel à l’adresse </em><a href="mailto:unsubscribe@deloitte.ca">unsubscribe@deloitte.ca</a></p>
</body>
</html>