<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
@font-face
{font-family:trebuchet;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:12.0pt;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Regarding the emails discussing audit criteria and related, I thought it might be helpful to provide some history as well as address some issues we face collectively. While my views are from a WebTrust point of view based on my position
as Chair of the WebTrust Task Force, the same principles would apply regardless of the type of audit.<o:p></o:p></p>
<p class="MsoNormal">I’d first like to offer a historical perspective. Please keep in mind the initial release of WebTrust for Certification Authorities Principles, Version 1.0, was released in August 2000, prior to the creation of the CABF. While the WebTrust
for Certification Authorities Principles provided a solid foundation to assist CAs and Browsers alike, the WebTrust Task Force worked lockstep with the Forum to develop customized services to specifically address its needs. Over the years, additional audit
engagements have been created as an “add on” to the WebTrust for Certification Authorities to include specific requirements for Baseline, Network Security, Extended Validation SSL, Extended Validation Code Signing, and Publicly Trusted Code Signing Certificates.
This list will continue to grow as the needs evolve for the Forum.<o:p></o:p></p>
<p class="MsoNormal">As you may know, when these customized services are created/updated by the WebTrust Task Force, we review the most recently approved requirements/changes as a starting point to establish the audit criteria. We highlight those requirements
that are not auditable and list them out in the appendix of our respective principles and criteria documents. For CABF requirements that are auditable, we craft audit criteria based on our professional standards. These documents are subject to review by
the WebTrust Task Force typically on an annual basis, or as necessary based on the severity of the new/modified CABF requirements.<o:p></o:p></p>
<p class="MsoNormal">One of the recurring and problematic issues the Task Force faces when crafting audit criteria is dealing with International law. For instance, conducting background checks is a great practice, but in some parts of the world is deemed to
violate privacy laws. In these cases, since we cannot require a CA to do something illegal, the law prevails over the underlying criteria. In this case, the CA would still get a “clean” opinion. Such potential conflicts are also addressed in the CABF
Baseline Requirements in Section 9.16.3, Severability, capturing the same spirit as the audit requirements issue.
<o:p></o:p></p>
<p class="MsoNormal">For another example, since the WebTrust audits are conducted based on specific versions of the CABF guidelines and updated from time to time, we could experience a case where CABF Requirements were changed but the audit criteria were not
yet updated. In this case, as was with the SHA-1 deprecation, a CA could be out of compliance with more updated CABF requirements, but still in compliance with the latest version of the WebTrust document. In this unusual case, even though the CA would get
a “clean opinion” for complying with the WebTrust criteria, and obviously out of compliance with the CABF requirements, the auditor would typically add an extra opinion in their report as an “Emphasis of a Matter” citing specific reference to the updated criteria
that was not met. The Browsers would then presumably take appropriate action regardless of whether or not the audit opinion was “clean” or not.
<o:p></o:p></p>
<p class="MsoNormal">The WebTrust Task Force is comprised of volunteers with an expertise in PKI. Members of the Task Force are either members of CPA Canada or the American Institute of Certified Public Accountants (AICPA), both of which govern our profession.
While the Task Force runs the program for the profession, ultimate approval of our documents rests with CPA Canada and the AICPA.<o:p></o:p></p>
<p class="MsoNormal">When first created, CPA Canada worked jointly with the AICPA, but since, has taken the primary role on the ongoing WebTrust matters, including licensing and seal issuance. With Don Sheehy’s retirement, we will now have the pleasure of
working with him representing CPA Canada, so we are definitely excited about the added resource.<o:p></o:p></p>
<p class="MsoNormal">Thanks for the opportunity to offer my comments.<o:p></o:p></p>
<p class="MsoNormal">Jeff<o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#404040">Jeff Ward, CPA, CGMA, CITP, CISA, CISSP, CEH</span></b><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#404040"><br>
National Managing Partner Third Party Attestation Services<br>
314-889-1220 (Direct) 347-1220 (Internal)<br>
314-889-1221 (Fax)</span><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><br>
</span><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#ED1A3B"><a href="mailto:jfward@bdo.com"><span style="color:#ED1A3B">jfward@bdo.com</span></a></span><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><br>
<br>
</span><b><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#404040">BDO</span></b><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><br>
</span><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#404040">101 S Hanley Rd, #800<br>
St. Louis, MO 63105 <br>
UNITED STATES<br>
314-889-1100</span><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><br>
</span><u><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#ED1A3B"><a href="http://www.bdo.com"><span style="color:#ED1A3B">www.bdo.com</span></a></span></u><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><br>
<br>
</span><i><span style="font-size:10.0pt;line-height:106%;font-family:"trebuchet",serif;color:green">Please consider the environment before printing this e-mail</span></i><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><br>
<br>
</span><span style="font-size:12.0pt;line-height:106%;font-family:"Times New Roman",serif"><img border="0" width="105" height="112" id="_x0000_i1025" src="file:///C:\Windows\Support\OutlookSignatureDesigner\Icons\BDO%20Award.png" alt="BDOC Networking Award"></span><span style="font-size:10.0pt;line-height:106%;font-family:"Trebuchet MS",sans-serif;color:#404040"><o:p></o:p></span></p>
</div>
</body>
</html>