<div dir="ltr">Kirk,<div><br></div><div>I appreciate this attempt, but this wasn't what I was requesting. Could you clarify that you're not willing to schedule the sessions as I'd requested / and/or appointing other facilitators for those discussions?</div><div><br></div><div>I specifically was requesting to present on #1, #2, #3, and #5. I believe the recordings will show that.</div><div><br></div><div>This is a critically important area for Google, and while we welcome participation, the request for the sessions, as made on the call, stands, with Google facilitating the discussion.</div><br><div class="gmail_quote"><div dir="ltr">On Sat, Sep 22, 2018 at 3:19 PM Kirk Hall via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-6990807131405490681WordSection1">
<p class="MsoNormal">On our SCWG call this week, Ryan, Wayne, and others suggested we take time in Shanghai to talk about the audit programs, their different forms of audits and reports, their terminology, and problems that browsers are encountering. Wayne
also indicated he wanted to discuss an “ideal audit life cycle” for a new trusted root from birth to death. This seems like a great topic for us.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We can also talk about how we want to interpret our current Bylaws Section 2.1 on Forum membership requirements – what type of audit reports are required, and whether we need to clarify Bylaws clarifications.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ve asked Dimitris to be the Moderator on these topics to make sure we stay on schedule and following a logical progression.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We would still have the regular auditor updates before this discussion – that’s just the place where WebTrust and ETSI can give us the most recent program news.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Here is my proposed Agenda breakdown. Comments are welcome.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">*****<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">1. Types of audits/reports under <u>WebTrust</u> and their terminology, including new CAs and new audit/report types (Jeff, Don). A summary reference table would be welcome.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">2. Types of audits/reports under <u>ETSI</u> and their terminology, including new CAs and new audit/report types (Arno, Clemens). A summary reference table would be welcome.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in">[Jeff/Don/Arno/Clemens – do you think you can also prepare a summary comparison table of the different WebTrust and ETSI audits and reports, showing which are roughly “equivalent”, which are not, and the main differences?]<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">3. Problems faced by root programs from existing WebTrust/ETSI reports and terminology, including for new CAs (Ryan, Wayne)
<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Oddball report types received<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Common issues/misunderstandings by new CAs<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Recommendations on standard terminology to be used (if any)<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Recommendation for clarification on audit requirements in
<b><u>current</u></b> BRs, root programs to eliminate misunderstandings, adopt common terminology<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">4. Ideal audit life cycle – birth to death of a new CA (Wayne – also Ryan, or Mike, or Geoff)
<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Description of ideal cycle (with timelines, multiple use cases) – not necessarily what is required today by BRs, WT/ETSI, root programs, but what browsers would like to see<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Once there is consensus on ideal life cycle, how do we get there? Via BRs or via root programs (or both)?
<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Proposals for BR amendments to reach ideal life cycle<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Do we need to better align BRs and root program rules?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">5. Forum membership rules Bylaws Sec. 2.1 (Dimitris) <u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>What does the Forum *<b>want</b>* the audit requirements to be based on different level of membership (Associate Member, Member). See
<a href="https://cabforum.org/pipermail/public/2018-April/013259.html" target="_blank">https://cabforum.org/pipermail/public/2018-April/013259.html</a>
<u></u><u></u></p>
<p class="m_-6990807131405490681MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>Potential amendments to Bylaws to clarify audit requirements for Associate Member, full Member status. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
</blockquote></div></div>