<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@宋体";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:微软雅黑;
panose-1:2 11 5 3 2 2 4 2 2 4;}
@font-face
{font-family:华文隶书;
panose-1:2 1 8 0 4 1 1 1 1 1;}
@font-face
{font-family:"\@微软雅黑";
panose-1:2 11 5 3 2 2 4 2 2 4;}
@font-face
{font-family:"\@华文隶书";
panose-1:2 1 8 0 4 1 1 1 1 1;}
@font-face
{font-family:"Lucida Grande";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:宋体;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"批注框文本 Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:宋体;}
span.Char
{mso-style-name:"批注框文本 Char";
mso-style-priority:99;
mso-style-link:批注框文本;
font-family:宋体;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ZH-CN link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US>Yes, I agree.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Let me explain it specifically, there is a premise when I proposed to set a minimum and a maximum value to certificate sample size during self-audit in my last email, and that is certificates should be audited separately according to different types(or different issuance processes) rather than selecting samples randomly from the overall certificates of a CA for audit. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'>Best Regards<o:p></o:p></span></p><p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><b><span lang=EN-US style='font-size:14.0pt;font-family:"Lucida Grande";color:#1F497D'>Ruby Xiong<o:p></o:p></span></b></p><p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#1F497D'>Shanghai Electronic Certification Authority co., ltd.</span><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#595959'> </span><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#595959'><o:p></o:p></span></p><p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#1F497D'>18F, No.1717, North Sichuan Road, Shanghai, China<o:p></o:p></span></p><p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#1F497D'>Tel</span><span style='font-size:10.5pt;font-family:"微软雅黑","sans-serif";color:#1F497D'>：</span><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#1F497D'>+86-21-36393197<o:p></o:p></span></p><p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#1F497D'>Email</span><span style='font-size:10.5pt;font-family:"微软雅黑","sans-serif";color:#1F497D'>：</span><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><a href="mailto:xiongyuanyuan@sheca.com"><span style='font-family:"Lucida Grande"'>xiongyuanyuan@sheca.com</span></a></span><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#1F497D'> </span><span lang=EN-US style='font-size:10.5pt;font-family:"Lucida Grande";color:#595959'><o:p></o:p></span></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><tr style='height:1.0pt'><td width=311 colspan=2 style='width:233.5pt;border:none;border-top:dashed #BFBFBF 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:1.0pt'></td><td width=104 rowspan=2 valign=top style='width:78.35pt;border-top:dashed #BFBFBF 1.0pt;border-left:none;border-bottom:dashed #BFBFBF 1.0pt;border-right:none;padding:0cm 0cm 0cm 0cm;height:1.0pt'></td></tr><tr style='height:1.0pt'><td width=172 style='width:129.3pt;border:none;border-bottom:dashed #BFBFBF 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:1.0pt'></td><td width=139 style='width:104.2pt;border:none;border-bottom:dashed #BFBFBF 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:1.0pt'></td></tr><tr><td width=172 style='width:129.0pt;padding:0cm 0cm 0cm 0cm'></td><td width=139 style='width:104.25pt;padding:0cm 0cm 0cm 0cm'></td><td width=104 style='width:78.0pt;padding:0cm 0cm 0cm 0cm'></td></tr></table><p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt'>发件人<span lang=EN-US>:</span></span></b><span lang=EN-US style='font-size:10.0pt'> Public [mailto:public-bounces@cabforum.org] </span><b><span style='font-size:10.0pt'>代表 </span></b><span lang=EN-US style='font-size:10.0pt'>Ryan Sleevi via Public<br></span><b><span style='font-size:10.0pt'>发送时间<span lang=EN-US>:</span></span></b><span lang=EN-US style='font-size:10.0pt'> Thursday, June 8, 2017 12:04 AM<br></span><b><span style='font-size:10.0pt'>收件人<span lang=EN-US>:</span></span></b><span lang=EN-US style='font-size:10.0pt'> CA/Browser Forum Public Discussion List<br></span><b><span style='font-size:10.0pt'>抄送<span lang=EN-US>:</span></span></b><span lang=EN-US style='font-size:10.0pt'> Ryan Sleevi<br></span><b><span style='font-size:10.0pt'>主题<span lang=EN-US>:</span></span></b><span lang=EN-US style='font-size:10.0pt'> Re: [cabfpub] [EXTERNAL] </span><span style='font-size:10.0pt'>答复<span lang=EN-US>: Changing numbers of self-audited certificates<o:p></o:p></span></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-US>From the browser perspective, our target is 100% audit, particularly around technical controls. Recognizing the practical limitations of that, we've been willing to go less.<o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US>However, as a practical matter, the choice and application of the sampling, as currently practiced, does not align with the risk profile. For example, it would be entirely appropriate and reasonable to highlight that the issuance of certificates to different profiles (e.g. DV, OV, EV in one dimension, internally operated vs externally operated sub-CAs in another dimension, those using 3.2.2.4.1 vs 3.2.2.4.5, or those representing different CA brands or infrastructures) each represent a different set of activities and associated controls, and thus a more pragmatic approach to auditing would be to example sample sizes as appropriate for the populations of each of these distinct activities and controls, rather than the current approach that treats all certificate issuance as equivalent.<o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US>By taking a more meaningful examination of the practice - one in which every activity that exercises distinct controls is a distinct risk profile - it might be possible to reduce the sample size on an individual basis. Of course, in order to have reliable assurances of the meaningfulness of those samples, we would also need to see increased documentation in CA's CP/CPS (to highlight the activities) and in the audit reports (to detail the controls examined for each 'issuance pipeline')<o:p></o:p></span></p></div></div><div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-US>On Wed, Jun 7, 2017 at 11:55 AM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Hi, Ruby - thanks for the information.<br><br>If I recall correctly, we first required a 3% self-audit of certificates when the EV Guidelines were developed about ten years ago, but I can't remember the rationale, or why there was no maximum number of self-audits included. Does anyone else remember?<o:p></o:p></span></p><div><div><p class=MsoNormal><span lang=EN-US><br>-----Original Message-----<br>From: Public [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of xiongyuanyuan via Public<br>Sent: Wednesday, June 7, 2017 3:40 AM<br>To: 'CA/Browser Forum Public Discussion List' <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>Cc: xiongyuanyuan <<a href="mailto:xiongyuanyuan@sheca.com">xiongyuanyuan@sheca.com</a>><br>Subject: [EXTERNAL][cabfpub] </span>答复<span lang=EN-US>: Changing numbers of self-audited certificates<br><br>Yes.<br>From the point of audit risk control, set a minimum value is more reasonable. According to the presentation in AICPA Audit Sampling Guide(screenshot attached), when a control happens less frequently, we can decide the sample size by the frequency of the control. So in my opinion, when CA performs self-audit to certificates that have a small volume, it is acceptable to take this guide as reference. From this table, we can see that a minimum value of 5 to certificate sample size is appropriate and is able to control audit risk.<br><br>Besides, I think we should also set a maximum value to certificate sample size.<br>This is because when CA performs self-audit to certificates that have a very large volume, 3% of the total population will still be a lot to audit, and this would result in large audit cost for the CA.<br>When we look at AICPA Audit Sampling Guide and AU 350 of PCAOB, for those testing samples with high risk, the TER</span>（<span lang=EN-US>tolerable exception rate</span>）<span lang=EN-US>should be low as possible, a maximum value of 60(certificates) to sample size(assume all the 60 testing samples are effective) will promise a lower TER as 5% which is much lower than a TER as12%-15% (which is operated by some audit firms for those testing samples with normal risk).<br><br>Base on this, I suggest we also set a maximum value of 60 to certificate sample size, which ensures audit efficiency as well as controls audit cost and audit risk.<br><br>Best Regards,<br>Ruby Xiong<br>Shanghai Electronic Certification Authority co., ltd.<br>18F, No.1717, North Sichuan Road, Shanghai, China<br>Tel</span>：<span lang=EN-US>+86-21-36393197<br>Email</span>：<span lang=EN-US><a href="mailto:xiongyuanyuan@sheca.com">xiongyuanyuan@sheca.com</a><br><br><br>-----</span>邮件原件<span lang=EN-US>-----<br></span>发件人<span lang=EN-US>: Public [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] </span>代表<span lang=EN-US> Gervase Markham via Public<br></span>发送时间<span lang=EN-US>: Tuesday, June 6, 2017 6:47 PM<br></span>收件人<span lang=EN-US>: CABFPub<br></span>抄送<span lang=EN-US>: Gervase Markham<br></span>主题<span lang=EN-US>: [cabfpub] Changing numbers of self-audited certificates<br><br>Currently, the BRs define, in section 8.7, the parameters for self-audits and audits of certificates below a TCSC. At the moment, the number of certs randomly chosen to be audited is defined as "the greater of one certificate or at least three percent of the Certificates issued".<br><br>I think that auditing just a single certificate (which is currently OK up until 33 are issued) makes it too easy to overlook problems when volumes are small. I propose instead a 5-certificate minimum, or 3%, whichever is larger. In other words:<br><br>Issued Audited<br>0 0<br>1 1<br>.....<br>5 5<br>6 5<br>.....<br>166 5<br>167 6<br>.....<br><br>We could just change the "one" to a "five" if people thought it was obvious that if you've issued less than five, you just audit all of them. Or we could expand the text a bit to explicitly describe that.<br><br>I would be interested in feedback on the impact of this change. It's been proposed for the Mozilla policy but as it's a BR stipulation I thought we should try here first.<br><br>Gerv<br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br><br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></span></p></div></div></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div></div></body></html>