<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texto sin formato Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.TextosinformatoCar
{mso-style-name:"Texto sin formato Car";
mso-style-priority:99;
mso-style-link:"Texto sin formato";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText><span lang=EN-US>This is what you can read in 319 403. In yellow I highlighted something that I consider important. Hope this can helps<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>7.4.3 Multiple sites<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>7.4.3.1 When to Consider Sample Based Approach<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>Where a TSP has a number of sites, the Conformity Assessment Body may consider using a sample-based approach to multiple-site audit where the TSP security management scheme meets the following requirements:<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>a) Security for all applicable site is administered under control of the TSP’s security policy administration; and<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>b) All applicable sites are subject to the TSP’s security management review programme.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>Applicable sites for a sample based approach shall be those directly concerned with the operations of the TSP meeting the specified TSP policy requirements.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>7.4.3.2 Requirements of Sample Based Approach<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>When using a sample-based approach, the Conformity Assessment Body wishing to use a sample-based approach shall have procedures in place to ensure the following:<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>a) The initial contract review identifies, to the greatest extent possible, the difference between sites such that an adequate level of sampling is determined.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>b) A representative number of sites have been sampled by the Conformity Assessment Body, taking into account: <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>1) the results of internal audits of the central site and the other sites,<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>2) the results of management review,<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>3) variations in the size of the sites,<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>4) <span style='background:yellow;mso-highlight:yellow'>variations in the business purpose of the sites,</span><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>5) complexity of the trust service,<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>6) <span style='background:yellow;mso-highlight:yellow'>complexity of the information systems at the different sites,</span><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>7) variations in working practices,<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>8) <span style='background:yellow;mso-highlight:yellow'>variations in activities undertaken,</span><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>9) potential interaction with critical information systems or information systems processing sensitive information, <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>10) <span style='background:yellow;mso-highlight:yellow'>whether the site is operated by a sub-contractor or other external organization,</span> and<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>11) any differing regulatory requirements.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>c) The sample should be partly selective based on the above in point b) and partly non-selective and should result in a range of different sites being selected, without excluding the random element of site selection.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>d) Every site of the TSP that is subject to significant threats to assets, vulnerabilities or impacts should be included in the sampling programme.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>e) The surveillance programme should be designed in the light of the above requirements and should, within a reasonable time, cover all sites of the TSP operations unless it can be demonstrated that this does not impact on the results of the audit, and<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>f) In the case of a non-conformity being observed either at the head office or at a single site, the corrective action procedure should apply to the head office and to all sites of the TSP operations which may be impacted by the same non-conformity.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US style='background:yellow;mso-highlight:yellow'>The audit shall address the TSP's central site activities to ensure that central security administration is applied to all sites at the operational level. The audit should address all the issues outlined above.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='background:yellow;mso-highlight:yellow'>The Conformity Assessment Body shall be prepared to substantiate or justify the number of sites being subject to the audit.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US style='mso-fareast-language:ES'><o:p> </o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>Iñigo Barreira<o:p></o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>Responsable del Área técnica<o:p></o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>i-barreira@izenpe.net<o:p></o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>945067705<o:p></o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'><o:p> </o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'><o:p> </o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!<o:p></o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted lo recibe por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.<o:p></o:p></span></p><p class=MsoPlainText><span style='mso-fareast-language:ES'><o:p> </o:p></span></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><span style='mso-fareast-language:ES'>-----Mensaje original-----<br>De: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] En nombre de Gervase Markham<br>Enviado el: martes, 17 de marzo de 2015 11:44<br>Para: Jeremy Rowley; CABFPub<br>Asunto: Re: [cabfpub] Auditor question</span></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>On 10/03/15 04:36, Jeremy Rowley wrote:<o:p></o:p></p><p class=MsoPlainText>> Personally, I think the intent was that as long as each CA had an EV <o:p></o:p></p><p class=MsoPlainText>> audit covering their portion of the requirements, then you were okay <o:p></o:p></p><p class=MsoPlainText>> (since all gaps are covered). The first CAs auditor wouldn't actually <o:p></o:p></p><p class=MsoPlainText>> need to audit the second CA. Is this not the case? I'd like to amend <o:p></o:p></p><p class=MsoPlainText>> the language to clarify how the two audits interoperate.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I think this depends on whether audits are fungible. That is to say, can they be split up into pieces with no loss of fidelity? If CA A is audited for the first half of the BRs, and CA B is audited for the second half, and they collaborate together to issue certs, is the result as well-audited as if one CA were doing it?<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I don't think this is obviously the case, certainly not all the time.<o:p></o:p></p><p class=MsoPlainText>The interactions between the two CAs may or may not be audited, depending on the split, and I would suspect an auditor needs sometimes to take an overall view of the process in order to confirm that certain criteria are met.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>To put it another way: many audit criteria relate to the trees, sure, but some relate to the wood as a whole. :-)<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Perhaps Don, Inigo or Arno could comment.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Gerv<o:p></o:p></p><p class=MsoPlainText>_______________________________________________<o:p></o:p></p><p class=MsoPlainText>Public mailing list<o:p></o:p></p><p class=MsoPlainText><a href="mailto:Public@cabforum.org"><span style='color:windowtext;text-decoration:none'>Public@cabforum.org</span></a><o:p></o:p></p><p class=MsoPlainText><a href="https://cabforum.org/mailman/listinfo/public"><span style='color:windowtext;text-decoration:none'>https://cabforum.org/mailman/listinfo/public</span></a><o:p></o:p></p></div></body></html>