[Cscwg-public] Notice of Review Period - Ballot CSC-11: Update to log data retention requirements

[Corey Bonnell]

Ballot page and review notice has been published to the website:
https://cabforum.org/2021/10/04/ballot-csc-11-update-to-log-data-retention-r
equirements/



From: Cscwg-public <cscwg-public-bounces at cabforum.org> On Behalf Of Bruce
Morton via Cscwg-public
Sent: Monday, October 4, 2021 9:21 AM
To: cscwg-public at cabforum.org
Subject: [Cscwg-public] Notice of Review Period - Ballot CSC-11: Update to
log data retention requirements



Notice of Review Period - Ballot CSC- 11: Update to log data retention
requirements

This Review Notice is sent pursuant to Section 4.1 of the CA/Browser Forum’
s Intellectual Property Rights Policy (v1.2).  This Review Period is for
Final Maintenance Guidelines (30 day Review Period).  A complete draft of
the Draft Guideline that is the subject of this Review Notice is attached.

Date Review Notice Sent:            October 4, 2021

Ballot for Review:                         Ballot CSC- 11: Update to log
data retention requirements

Start of Review Period:                October 4, 2021 at 13:30 UTC

End of Review Period:                 November 3, 2021 at 13:30 UTC

Please forward any Exclusion Notice relating to Essential Claims to the
Chair by email to dean.coclin at digicert.com <mailto:dean.coclin at digicert.com>
before the end of the Review Period.  See current version of CA/Browser
Forum Intellectual Property Rights Policy for details.



  _____



Purpose of this ballot:

Update the log data and retention of log data requirements in the Baseline
Requirement for the Issuance and Management of Publicly-Trusted Code Signing
Certificates v2.5. The following motion has been proposed by Ian McMillan of
Microsoft, and I am looking for endorsements from two other members of the
CSCWG.



- MOTION BEGINS -



This ballot updates the “Baseline Requirements for the Issuance and
Management of Publicly‐Trusted Code Signing Certificates“ version 2.5
according to the attached redline which includes:



*	Update section 15 “Data Records” removing references to [SSL/TLS]
Baseline Requirements for this section in totality
*	Update section 15 “Data Records” to include sub-section 15.1
“Types of Events Recorded” and describing the requirements for CAs and
Third Party Delegates while removing “Signing Services”
*	Update section 15 “Data Records” to include sub-section 15.2
“Timestamp Authority Data Records”
*	Update section 15.1 to clarify 4(f) for security event logging on
Timestamp Authority servers
*	Update section 15.1 on 4(d) for security event logging to no longer
include “hardware failures”
*	Update section 15 “Data Records” to include sub-section 15.3
“Data Retention Period for Audit Logs”
*	Update section 15.2 to no longer reference Baseline Requirements
section 5.4.3 and defined a specific retention period for CA, subscriber
certificate, Timestamp Authority, and security event data records for at
least 2 years



- MOTION ENDS -



The procedure for approval of this ballot is as follows:



Discussion (7 days)

Start Time: 2021-09-17, 19:00 Eastern Time (US)

End Time: not before 2021-09-24, 19:00 Eastern Time (US)



Vote for approval (7 days)

Start Time: 2021-09-24, 19:00 Eastern Time (US)

End Time: 2021-10-01, 19:00 Eastern Time (US)



Any email and files/attachments transmitted with it are confidential and are
intended solely for the use of the individual or entity to whom they are
addressed. If this message has been sent to you in error, you must not copy,
distribute or disclose of the information it contains. Please notify Entrust
immediately and delete the message from your system.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20211005/5a2a712a/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4990 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20211005/5a2a712a/attachment-0001.p7s>