[cabfpub] Ballot 170 - Amend Section 5.1 of Baseline Requirements

[Ryan Sleevi]

Google abstains.

On Wed, Jun 15, 2016 at 12:17 PM, Ben Wilson <ben.wilson at digicert.com>
wrote:

> Voting ends tomorrow, and quorum is 10.  I’d strongly urge support of this
> ballot, as indicated by my other posts.
>
>
>
> *From:* Ben Wilson
> *Sent:* Wednesday, June 15, 2016 9:11 AM
> *To:* Ben Wilson <ben.wilson at digicert.com>; CABFPub <public at cabforum.org>
> *Subject:* RE: [cabfpub] Ballot 170 - Amend Section 5.1 of Baseline
> Requirements
>
>
>
> Digicert votes “Yes”
>
>
>
> *From:* public-bounces at cabforum.org [mailto:public-bounces at cabforum.org
> <public-bounces at cabforum.org>] *On Behalf Of *Ben Wilson
> *Sent:* Thursday, June 2, 2016 2:04 PM
> *To:* CABFPub <public at cabforum.org>
> *Subject:* [cabfpub] Ballot 170 - Amend Section 5.1 of Baseline
> Requirements
>
>
>
> *Ballot 170 - Amend Section 5.1 of Baseline Requirements*
>
> The Policy Review Working Group has reviewed Section 5.1 of the Baseline
> Requirements and, as a result, suggests that certain changes be made.
> Therefore, the following motion has been proposed by Ben Wilson of DigiCert
> and endorsed by Robin Alden of Comodo and Li-Chun CHEN of Chunghwa Telecom:
>
> -- MOTION BEGINS --
>
> In Section 5.1.1 Site location and construction add:
>
> The location and construction of the facilities housing the CA and RA
> equipment SHALL be consistent with facilities used to house high-value,
> sensitive information. The site location and construction, when combined
> with other physical security protection mechanisms such as guards, high
> security locks, and intrusion sensors, SHALL provide robust protection
> against unauthorized access to the CA equipment and records.
>
> In Section 5.1.2 Physical access add:
>
> CAs SHALL maintain controls to provide reasonable assurance that: physical
> access to CA facilities and equipment is limited to authorized individuals,
> protected through restricted security perimeters, and is operated under
> multiple person (at least dual custody) control; CA facilities and
> equipment are protected from environmental hazards; loss, damage or
> compromise of assets and interruption to business activities are prevented;
> and compromise of information and information processing facilities is
> prevented.
>
> In Section 5.1.3 Power and air conditioning add:
>
> The CA SHALL have backup power capability sufficient to lock out input,
> finish any pending actions, and record the state of the equipment
> automatically before lack of power or air conditioning causes a shutdown.
> The backup power capabilities SHALL support the availability requirements
> of Section 4.10.2.
>
> In Section 5.1.4 Water exposures add:
>
> CA equipment SHALL be installed such that it is not in danger of exposure
> to water (e.g., on tables or elevated floors). Potential water damage from
> fire prevention and protection measures (e.g., sprinkler systems) SHOULD be
> minimized.
>
> In Section 5.1.5 Fire prevention and protection add:
>
> The CA SHALL comply with local commercial building codes for fire
> prevention and protection.
>
> In Section 5.1.6 Media storage add:
>
> Media SHALL be stored so as to protect it from accidental damage (water,
> fire, electromagnetic) and unauthorized physical access. Media not required
> for daily operation or not required by policy to remain with the CA or RA
> that contains security audit, archive, or backup information SHALL be
> stored securely in a location separate from the CA or RA equipment.
>
> Media containing private key material SHALL be handled, packaged, and
> stored in a manner compliant with the requirements for the sensitivity
> level of the information it protects or to which it provides access.
> Storage protection of CA and RA private key material SHALL be consistent
> with stipulations in Section 5.1.2.
>
> In Section 5.1.7 Waste disposal add:
>
> Sensitive media and documentation that are no longer needed for operations
> SHALL be destroyed in a secure manner. For example, sensitive paper
> documentation shall be shredded, burned, or otherwise rendered
> unrecoverable.
>
> In Section 5.1.8 Off-site backup add:
>
> The purpose of an off-site backup is to recover from system failure
> resulting from damage to the equipment or similar causes. For components of
> the Certificate System operated in an online fashion, any backup necessary
> to recover from system failure SHALL be made at least once per week or so
> that no changes made prior to the last week might be lost. Root CA Systems
> and other components operated in an offline fashion SHALL be backed up
> prior to taking them offline. Only the latest backup needs to be retained.
> The backup SHALL be stored at a separate site with physical and procedural
> controls sufficient to protect the confidentiality, integrity, and
> availability of the information backed up.
>
> -- MOTION ENDS --
>
> The review period for this ballot shall commence at 2200 UTC on 2 June
> 2016, and will close at 2200 UTC on 9 June 2016. Unless the motion is
> withdrawn during the review period, the voting period will start
> immediately thereafter and will close at 2200 UTC on 16 June 2016. Votes
> must be cast by posting an on-list reply to this thread.
>
> A vote in favor of the motion must indicate a clear 'yes' in the response.
> A vote against must indicate a clear 'no' in the response. A vote to
> abstain must indicate a clear 'abstain' in the response. Unclear responses
> will not be counted. The latest vote received from any representative of a
> voting member before the close of the voting period will be counted. Voting
> members are listed here: https://cabforum.org/members/
>
> In order for the motion to be adopted, two thirds or more of the votes
> cast by members in the CA category and greater than 50% of the votes cast
> by members in the browser category must be in favor. Quorum is currently
> ten (10) members– at least ten members must participate in the ballot,
> either by voting in favor, voting against, or abstaining.
>
>
>
> _______________________________________________
> Public mailing list
> Public at cabforum.org
> https://cabforum.org/mailman/listinfo/public
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/public/attachments/20160615/e5b51ac5/attachment.html