[cabfpub] When is Baseline effective for audit

[Sheehy, Don (CA - Toronto)]

Hi Ben:

As all are aware, WebTrust has published baseline audit guidance and ETSI will have their guidance very soon. As all are aware, the Baseline1.0  requirements were developed with an effective date of July 1. However, Tom Albertson has mentioned a few times that that he was not regarding the requirements as effective until the audit guidance is available which it now is. Also, at the NYC meeting at least 1 CA admitted that they were not compliant on July 1.

With all that being said, can the Forum agree on the effective date at which Baseline needs to be met.  That will then set the line in the sand for the start of that audit period. We can certainly go back to July 1 - that is no problem as long as the CAs have their evidence of compliance ( if not they would of course receive a qualified Baseline audit report).

This decision is needed as there are a number of CAs whose reporting period ends over the next 3-4 months. The expectation would be that they may also need to report on Baseline, depending on what date the forum ultimately chooses.

Thanks

Don
Donald E. Sheehy, CA*CISA, CRISC, CIPP/C
Partner | Enterprise Risk
Deloitte



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20121113/2f9632c1/attachment-0003.html>