<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.E-MailFormatvorlage19
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Hi Ben, Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">maybe I am misunderstanding, but what is the intended meaning of „with the use of a non-persistent unidirectional mechanism”?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">As far as I know, it is a common implementation to generate CA keys and a CSR on “Issuing CA HSM”, than transport the CSR
to the Offline Root (e.g. by external USB flash drive), create and sign the CA certificate and then export the CA certificate back to the “Issuing CA HSM”.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Obviously this involves transport of data to and from the HSM and wouldn’t be unidirectional in my understanding.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Best regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Matthias<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Von:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Servercert-wg <servercert-wg-bounces@cabforum.org>
<b>Im Auftrag von </b>Ben Wilson via Servercert-wg<br>
<b>Gesendet:</b> Montag, 15. Februar 2021 19:38<br>
<b>An:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Betreff:</b> Re: [Servercert-wg] Ballot SC40v2: Security Requirements for Air-Gapped CA Systems<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">All,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I intend to end the discussion period for this ballot and move this to the voting period this week. Are there additional comments or changes that must be made?
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Also, there is a marked-up version of the Network and Certificate Systems Security Requirements for your review here in GitHub:
<a href="https://github.com/sleevi/cabforum-docs/commit/d80c8ddac79e66cf293847cffd66b113285f5407">
https://github.com/sleevi/cabforum-docs/commit/d80c8ddac79e66cf293847cffd66b113285f5407</a> .<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks, <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Ben<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Feb 8, 2021 at 10:02 AM Ben Wilson <<a href="mailto:bwilson@mozilla.com">bwilson@mozilla.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal">This is a continuation of discussion on the air-gapped CA ballot. (As noted below, this formally continues the discussion for this ballot, as of
<span style="font-size:10.0pt;font-family:"Courier New";color:black">2021-02-08 17:00 UTC.
</span>This discussion period will continue until initiation of the Voting Period (TBD) unless extended or as otherwise determined, pursuant to the CA/Browser Forum Bylaws.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I renumbered the sections -- 5.1 for logical security and 5.2 for physical security. I have not attempted yet to address the comments between Aaron and Ryan re: accessing the air-gapped CA for checking configuration. Maybe that section
needs to remain "as is" or with clarification that a desktop review of CA configuration would be satisfactory if the air-gapped CA has not been physically touched.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have also modified the definition of "Air-Gapped CA System" for discussion purposes as:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<span style="color:black">A system that is (a) kept offline or otherwise air-gapped, (b) physically and logically separated from all other CA systems, and (c) is used by a CA or Delegated Third Party to store and manage CA private keys and to sign CA certificates,
CRLs, or OCSP responses. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">"Kept offline or otherwise air-gapped" means that the CA hardware is powered off, and if powered on, is not connected to any other system at any time. Export of data (e.g. CA public keys, signed CA certificates,
CRLs, or OCSP responses) from an Air-Gapped CA System would only occur briefly and temporarily with the use of a non-persistent unidirectional mechanism, such as an external drive or a unidirectional diode or gateway.</span>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">------------------ <o:p></o:p></p>
</div>
<div>
<p style="margin:0cm;margin-bottom:.0001pt" id="gmail-m_-1802760772419929316gmail-docs-internal-guid-657dd398-7fff-68b1-37ce-05f5e7dfb5f6">
<o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">Ballot SC 40v2: Security Requirements for Air-Gapped CA Systems</span></b><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Purpose of the Ballot:</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">This ballot increases the security of Air-Gapped/Offline CA systems (“Air-Gapped CA Systems”) by clarifying the controls that CAs must implement
to protect them.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Air-Gapped CA systems are maintained in physically isolated environments, and while they can share certain exterior physical controls with online
systems, they are not connected to online systems or the Internet. Thus, they have different operational requirements and controls due to their separate risk profile. While the scope of the current Network and Certificate System Security Requirements includes
Air-Gapped CA systems, the document focuses on online systems and contains a number of requirements that are not practical to implement in an offline environment and could increase the risk to offline systems. </span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="font-size:10.0pt;font-family:"Courier New";color:black">As an example, access to offline systems frequently elevates the risk to the environment. A quarterly vulnerability scan in the offline environment is not practical, because there is an increased
risk involved with attaching a scanning device to an Air-Gapped CA system. As another example, because such systems are not connected, the provisions of subsection 1.g (ports and protocols) are not applicable.</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="font-size:10.0pt;font-family:"Courier New";color:black">This ballot develops a working definition for an “Air-Gapped CA System” to allow for a clear delineation between those system components that fall under this category of Air-Gapped/Offline
requirements and those under other requirements. In doing so, the ballot creates two sets of requirements tailored to their respective operating environments and characteristics.</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="font-size:10.0pt;font-family:"Courier New";color:black">Not only does this ballot introduce a new section 5, it also adds additional physical security requirements for air-gapped CAs by requiring video monitoring, intrusion detection, and other
intrusion prevention controls to protect Air-Gapped CA Systems against unauthorized physical access attempts. </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">These proposed subsections in a new section 5 come from the current NCSSRs as follows:</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="border:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">Description</span></b><o:p></o:p></p>
</td>
<td valign="top" style="border:solid black 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">Offline </span></b><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">Criteria #</span></b><o:p></o:p></p>
</td>
<td valign="top" style="border:solid black 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">General </span></b><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">Criteria #</span></b><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1 Logical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Configuration review</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.1</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">1h</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Appointing individuals to trusted roles</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.2</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2a</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Grant access to Air-Gapped CAs</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.3</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">1i</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Document responsibilities of Trusted roles</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.4</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2b</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Segregation of duties </span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.5</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2d</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Require least privileged access for Trusted Roles</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.6</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2e</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">All access tracked to individual account</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.7</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2f</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Password requirements</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.8</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2gi</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Review logical access</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.9</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2j</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Implement multi-factor access</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.10</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2m</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Monitor Air-Gapped CA systems</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.11</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3b</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Review logging integrity </span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.12</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3e</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Monitor archive and retention of logs</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.1.13</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3f</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2 Physical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Grant physical access</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.1</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">1i</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Multi-person physical access </span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.2</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">1j</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Review physical access</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.3</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2j</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Video monitoring</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.4</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3a</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Physical access monitoring</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.5</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3a</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Review accounts with physical access</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.6</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">2j</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Monitor retention of physical access of records</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.7</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3f</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Review integrity of physical access logs</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">5.2.8</span><o:p></o:p></p>
</td>
<td valign="top" style="border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">3e</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">This motion is made by Ben Wilson of Mozilla and endorsed by David Kluge of Google Trust Services and Neil Dunbar of TrustCor.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">--- Motion Begins ---</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">That the CA/Browser Forum Server Certificate Working Group adopt the following requirements as amendments to the Network and Certificate System
Security Requirements.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="color:black">Replace 1.c. with "Maintain Root CA Systems in a High Security Zone and as Air-Gapped CA Systems, in accordance with Section 5;"</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="color:black">Add definition of "Air-Gapped CA System" as "A system that is (a) kept offline or otherwise air-gapped, (b) physically and logically separated from all other CA systems, and (c) is used by a CA or Delegated Third Party to store and
manage CA private keys and to sign CA certificates, CRLs, or OCSP responses. ‘Kept offline or otherwise air-gapped’ means that the CA hardware is powered off, and if powered on, is not connected to any other system at any time. Export of data (e.g. CA public
keys, signed CA certificates, CRLs, or OCSP responses) from an Air-Gapped CA System would only occur briefly and temporarily with the use of a non-persistent unidirectional mechanism, such as an external drive or unidirectional diode or gateway."</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="color:black">Revise the definition of Security Support System to read:</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="color:black">A system used to provide physical and logical security support functions, which MAY include authentication, network boundary control, audit logging, audit log reduction and analysis, vulnerability scanning, and intrusion detection
(physical intrusion detection, Host-based intrusion detection, Network-based intrusion detection).</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;margin-bottom:.0001pt">
<span style="color:black">Add a new Section 5 -</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<b><span style="font-size:18.0pt;color:black">5. GENERAL PROTECTIONS FOR AIR-GAPPED CA SYSTEMS</span></b><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">This Section 5 separates requirements for Air-Gapped CA Systems into two categories--logical security and physical security.</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<b><span style="color:black">5.1 Logical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">Certification Authorities and Delegated Third Parties SHALL implement the following controls to ensure the logical security of Air-Gapped CA Systems:</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">1. Review configurations of Air-Gapped CA Systems at least on an annual basis;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">2. Follow a documented procedure for appointing individuals to those Trusted Roles that are authorized to operate Air-Gapped CA Systems;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">3. Grant logical access to Air-Gapped CA Systems only to persons acting in Trusted Roles and implement controls so that all logical access to Air-Gapped CA Systems can be traced back to an accountable individual;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">4. Document the responsibilities assigned to Trusted Roles based on the security principle of multi-person control and the security-related concerns of the functions to be performed;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">5. Ensure that an individual in a Trusted Role acts only within the scope of such role when performing administrative tasks assigned to that role;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">6. Require employees and contractors to observe the principle of "least privilege" when accessing, or when configuring access privileges on, Air-Gapped CA Systems;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">7. Require that all access to systems and offline key material can be traced back to an individual in a Trusted Role (through a combination of recordkeeping, use of logical and physical credentials, authentication factors, video recording,
etc.);</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">8. If an authentication control used by a Trusted Role is a username and password, then, where technically feasible require that passwords have at least twelve (12) characters;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">9. Review logical access control lists at least annually and deactivate any accounts that are no longer necessary for operations;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">10. Enforce Multi-Factor Authentication OR multi-party authentication for administrator access to Air-Gapped CA Systems;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">11. Identify those Air-Gapped CA Systems capable of monitoring and logging system activity and enable those systems to continuously monitor and log system activity. Back up logs to an external system each time the system is used or
on a quarterly basis, whichever is less frequent;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">12. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, check the integrity of the logical access logging processes and ensure that logging and log-integrity functions are effective;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">13. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, monitor the archival and retention of logical access logs to ensure that logs are retained for the appropriate amount of time in accordance
with the disclosed business practices and applicable legislation.</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<b><span style="color:black">5.2 Physical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">Certification Authorities and Delegated Third Parties SHALL implement the following controls to ensure the physical security of Air-Gapped CA Systems:</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">1. Grant physical access to Air-Gapped CA Systems only to persons acting in Trusted Roles and implement controls so that all physical access to Air-Gapped CA Systems can be traced back to an accountable individual;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">2. Ensure that only personnel assigned to Trusted Roles have physical access to Air-Gapped CA Systems and multi-person access controls are enforced at all times;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">3. Implement a process that removes physical access of an individual to all Air-Gapped CA Systems within twenty-four (24) hours upon termination of the individual’s employment or contracting relationship with the CA or Delegated Third
Party;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">4. Implement video monitoring, intrusion detection, and intrusion prevention controls to protect Air-Gapped CA Systems against unauthorized physical access attempts;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">5. Implement a Security Support System that monitors, detects, and alerts personnel to any physical access to Air-Gapped CA Systems;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">6. Implement a process that prevents physical access of an individual to an Air-Gapped CA within twenty-four (24) hours of removal from the relevant authorized Trusted Role, and review lists of holders of physical keys and combinations
to doors and safes as well as logical accounts tied to physical access controls at least every three (3) months, and;</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">7. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, monitor the archival and retention of the physical access logs to ensure that logs are retained for the appropriate amount of time in
accordance with the disclosed business practices and applicable legislation.</span><o:p></o:p></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm">
<span style="color:black">8. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, check the integrity of the physical access logging processes and ensure that logging and log-integrity functions are effective.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">--- Motion Ends ---</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Discussion Period - </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">This ballot proposes a Final Maintenance Guideline.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">The procedure for approval of this ballot is as follows:</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Discussion (7+ days)</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Start Time: 2021-02-08 17:00 UTC</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">End Time: TBD (not before 2021-02-09 17:00 UTC</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Vote for approval (7 days)</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Start Time: TBD</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">End Time: TBD</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<pre><font face="arial,helvetica,sans-serif" size="1">
<strong>______________________________________________________________________________________________________________________</strong>
<strong>Sitz der Gesellschaft/Headquarter:</strong> TÜV Informationstechnik GmbH * Langemarckstr. 20 * 45141 Essen, Germany
<strong>Registergericht/Register Court:</strong> Amtsgericht/Local Court Essen * HRB 11687 * USt.-IdNr./VAT No.: DE 176132277 * Steuer-Nr./Tax No.: 111/57062251
<strong>Geschäftsführung/Management Board:</strong> Dirk Kretzschmar
</font></pre>
<br>
<pre><font face="arial,helvetica,sans-serif" size="3" color="#000000"><b>TÜV NORD GROUP</b></font>
<font face="arial,helvetica,sans-serif" size="1" color="#000000">Expertise for your Success
</font></pre>
<pre><font face="arial,helvetica,sans-serif" size="1" color="#000000"><b>Please visit our website: <a href="http://www.tuv-nord.com">www.tuv-nord.com</a>
Besuchen Sie unseren Internetauftritt: <a href="http://www.tuev-nord.de">www.tuev-nord.de</a></b></font></pre>
</body>
</html>