<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Segoe Pro";
panose-1:2 11 5 2 4 5 4 2 2 3;}
@font-face
{font-family:"Segoe Pro Display";
panose-1:2 11 5 2 4 5 4 2 2 3;}
@font-face
{font-family:"Segoe Pro Light";
panose-1:2 11 3 2 4 5 4 2 2 3;}
@font-face
{font-family:wf_segoe-ui_normal;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma",sans-serif;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Segoe UI",sans-serif;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Segoe Pro",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
p.Textodeglobo, li.Textodeglobo, div.Textodeglobo
{mso-style-name:"Texto de globo";
mso-style-link:"Texto de globo Car";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.TextodegloboCar
{mso-style-name:"Texto de globo Car";
mso-style-priority:99;
mso-style-link:"Texto de globo";
font-family:"Tahoma",sans-serif;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Segoe Pro",sans-serif;
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal-compose;
font-family:"Segoe Pro",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:353501534;
mso-list-type:hybrid;
mso-list-template-ids:1576027450 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">Thank you, Inigo.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">I think the problem is that, under ETSI, it’s difficult to discern what an “equivalent national scheme” is. This sets up the scenario in which an auditor is employed by an organization
that is recognized somehow by the government, but is not affiliated with an ETSI member organization (<a href="http://www.european-accreditation.org/home">http://www.european-accreditation.org/home</a> ). Microsoft does not know whether or not this auditor
is qualified or not. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">For example,
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">Company A is a commercial CA that operates in Israel<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">Auditor Jones works for AuditCo, which is based in Israel<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">AuditCo is certified by some governmental agency as a qualified auditor<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">AuditCo is not an ETSI Member or Associate Member<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">Auditor Jones audits Company A using the ETSI 102042 standard, and Company A sends the auditor’s attestation letter to Microsoft as evidence that Company A complied
with the Program’s requirements. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">In this scenario, how does Microsoft know that Auditor Jones conducted a proper audit without expending significant resources to determine whether and according to what standard
AuditCo and Auditor Jones was certified? <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">Microsoft believes that it would be simpler if the requirements were that the Auditor must work for a company that is affiliated with an ETSI-approved member organization. If
Company A needs an auditor and there is no qualified auditor in Israel, the company can use an auditor from a member organization via the cross-border conformity rules.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D">Unless I am fundamentally misunderstanding the rules, the above is something that Microsoft is presently struggling with, and we’d like to try to make the rules easier to understand
for potential partners and ourselves. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif"><o:p> </o:p></span></p>
<table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="623" colspan="4" valign="top" style="width:467.5pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><b><span style="font-family:"Segoe Pro Display",sans-serif">Jody Cloutier<o:p></o:p></span></b></p>
<p class="MsoNormal"><i><span style="font-size:9.0pt;font-family:"Segoe Pro Light",sans-serif">Senior Security Program Manager<o:p></o:p></span></i></p>
<p class="MsoNormal"><a href="http://aka.ms/rootcert"><b><span style="font-size:9.0pt;font-family:"Segoe Pro Light",sans-serif">Microsoft Trusted Root Certificate Program</span></b></a><b><span style="font-size:9.0pt;font-family:"Segoe Pro Light",sans-serif"><o:p></o:p></span></b></p>
</td>
</tr>
<tr>
<td width="156" valign="top" style="width:116.85pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><a href="mailto:jody.cloutier@microsoft.com"><span style="font-size:8.0pt;font-family:"Segoe Pro",sans-serif">jody.cloutier@microsoft.com</span></a><span style="font-size:8.0pt;font-family:"Segoe Pro",sans-serif;color:#0072BC;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</td>
<td width="156" valign="top" style="width:116.9pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Segoe Pro",sans-serif;color:#0072BC;border:none windowtext 1.0pt;padding:0in">425.443.8922<o:p></o:p></span></p>
</td>
<td width="156" valign="top" style="width:116.85pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:wf_segoe-ui_normal;color:#0072BC;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</td>
<td width="156" valign="top" style="width:116.9pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:wf_segoe-ui_normal;color:#0072BC;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</td>
</tr>
<tr>
<td width="623" colspan="4" valign="top" style="width:467.5pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:"Segoe Pro Light",sans-serif;color:#5B9BD5">O</span></u></b><span style="font-size:10.0pt;font-family:"Segoe Pro Light",sans-serif">perating
<b><u><span style="color:#ED7D31">S</span></u></b>ystems <b><u><span style="color:red">G</span></u></b>roup</span><i><span style="font-size:9.0pt;font-family:"Segoe Pro Light",sans-serif">
</span></i><b><u><span style="font-size:9.0pt;font-family:"Segoe Pro Light",sans-serif">G</span></u></b><span style="font-size:9.0pt;font-family:"Segoe Pro Light",sans-serif">lobal
<b><u>R</u></b>isk and <b><u>C</u></b>ompliance</span><span style="font-size:4.0pt;font-family:wf_segoe-ui_normal;color:#0072BC;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="623" colspan="4" valign="top" style="width:467.5pt;border:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><a href="http://microsoft.com/"><span style="font-size:8.0pt;font-family:wf_segoe-ui_normal;color:#0072BC;border:none windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="122" height="26" id="Picture_x0020_3" src="cid:image002.png@01D04546.C0499760" alt="https://brandtools.microsoft.com/Style%20Library/BT/Images/MicrosoftMasterLogo.png"></span></a><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-family:"Segoe Pro",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> i-barreira@izenpe.net [mailto:i-barreira@izenpe.net]
<br>
<b>Sent:</b> Tuesday, February 10, 2015 3:09 AM<br>
<b>To:</b> Jody Cloutier; public@cabforum.org<br>
<b>Subject:</b> RE: [cabfpub] Baseline requirements for codesigning - Feb 4 2015.doc<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Hi Jody,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Regarding your comment on ETSI audits, I have to say that the ETSI audits shall be performed by accredited auditors as mentioned in Annex E of the current ETSI TS 102 042. ETSI audits performed by not accredited
auditors shall be considered invalid. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Microsoft is accepting ETSI audits since the very beginning in its root program requirements indicating this requirement. ETSI is providing a list of accredited auditors as mere information because has to be
maintained by every NAB (National Accreditation Body).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">It´s true that this has to be improved regarding the new regulation 910/2014 and the new ENs and will take some time, but at the moment, it´s clearly stated that the audits shall be performed by accredited auditors.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Don´t hesitate in contacting me for any additional information or help. Sometimes I´ve received some emails from Tom or Kelvin asking for the qualification of some audits, so, as say, you can contact me regarding
this issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:9.75pt"><b><span lang="ES-TRAD" style="font-size:8.5pt;font-family:"Tahoma",sans-serif;color:black">Iñigo Barreira</span></b><span lang="ES-TRAD" style="font-size:8.5pt;font-family:"Tahoma",sans-serif;color:black"><br>
Responsable del Área técnica<br>
<a href="mailto:i-barreira@izenpe.net"><span style="color:blue">i-barreira@izenpe.net</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ES-TRAD" style="font-size:8.5pt;font-family:"Tahoma",sans-serif;color:black">945067705</span><span lang="ES-TRAD" style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ES-TRAD" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ES" style="color:#1F497D"><img border="0" width="585" height="111" id="_x0000_i1025" src="cid:image001.png@01D0453A.FD0223E0" alt="Descripción: cid:image001.png@01CE3152.B4804EB0"></span><span lang="ES-TRAD" style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:9.75pt"><span lang="ES" style="font-size:7.5pt;font-family:"Tahoma",sans-serif;color:#888888;mso-fareast-language:ES-TRAD">ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea.
Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!</span><span lang="ES" style="color:#888888;mso-fareast-language:ES-TRAD"><br>
</span><span lang="ES" style="font-size:7.5pt;font-family:"Tahoma",sans-serif;color:#888888;mso-fareast-language:ES-TRAD">ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted
lo recibe por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.</span><span lang="ES" style="font-size:12.0pt;color:navy;mso-fareast-language:ES-TRAD"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="ES" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="ES" style="font-size:10.0pt;font-family:"Tahoma",sans-serif">De:</span></b><span lang="ES" style="font-size:10.0pt;font-family:"Tahoma",sans-serif">
<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>En nombre de </b>Jody Cloutier<br>
<b>Enviado el:</b> lunes, 09 de febrero de 2015 18:55<br>
<b>Para:</b> CABFPub (<a href="mailto:public@cabforum.org">public@cabforum.org</a>)<br>
<b>Asunto:</b> [cabfpub] Baseline requirements for codesigning - Feb 4 2015.doc<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="ES"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Segoe Pro",sans-serif">Microsoft comments on Section 17.
<o:p></o:p></span></p>
</div>
</body>
</html>