You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
222 lines
8.1 KiB
HTML
222 lines
8.1 KiB
HTML
![]()
17 years ago
|
<?xml version="1.0" encoding="utf-8"?>
|
||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
|
||
|
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
|
<head>
|
||
|
<title>
|
||
![]()
17 years ago
|
CACert Remote Assurance Policy (RAP)
|
||
![]()
17 years ago
|
</title>
|
||
|
</head>
|
||
|
<body>
|
||
|
<h1>
|
||
![]()
17 years ago
|
CACert Remote Assurance Policy (RAP)
|
||
![]()
17 years ago
|
</h1>
|
||
|
<p>
|
||
![]()
17 years ago
|
<a href="PolicyOnPolicy.html"><img src="Images/cacert-wip.png" alt="CAcert Policy Status" height="31" width="88" style="border-style: none;" /></a><br />
|
||
![]()
17 years ago
|
Author: Sam Johnston<br />
|
||
|
Creation date: 2008-04-22<br />
|
||
|
Status: WIP 2008-04-22<br />
|
||
|
Next status: DRAFT 05-2008<br />
|
||
|
<!-- $Id$ -->
|
||
|
</p>
|
||
|
<h2>
|
||
|
0. Preliminaries
|
||
|
</h2>
|
||
|
<p>
|
||
![]()
17 years ago
|
This CAcert sub-policy extends the Assurance Policy ("AP") by specifying how assurances are to be remotely conducted for members where insufficient assurer(s) are available. A Remote Assurer ("RA") shall be assigned by a board-appointed Remote Assurance Officer ("RAO") to conduct the assurance to their satisfaction using TWO Trusted Third Parties ("TTP"s).
|
||
![]()
17 years ago
|
</p>
|
||
|
<p>
|
||
![]()
17 years ago
|
Successful completion of the process shall result in the Assuree achieving the status of Assurer (eg the allocation of sufficient points to reach 100). However this status should not be considered permanent and the Assuree must seek assurance by the usual means as soon as practicable.
|
||
![]()
17 years ago
|
</p>
|
||
|
<h2>
|
||
|
1. Scope
|
||
|
</h2>
|
||
|
<p>
|
||
![]()
17 years ago
|
This sub-policy is restricted to members where insufficient local assurer(s) are available to reach Assurer status by the usual means within a 30 day period.
|
||
![]()
17 years ago
|
</p>
|
||
|
<h2>
|
||
|
2. Requirements
|
||
|
</h2>
|
||
|
<h3>
|
||
![]()
17 years ago
|
2.1 Trusted Third Party ("TTP")
|
||
![]()
17 years ago
|
</h3>
|
||
|
<p>
|
||
![]()
17 years ago
|
Each of the TWO TTPs:
|
||
![]()
17 years ago
|
</p>
|
||
|
<ol style="list-style-type: lower-alpha;">
|
||
![]()
17 years ago
|
<li>MUST be <i><strong>verifiably practicing identification procedures</strong></i>, typically one of the following:<br />
|
||
![]()
17 years ago
|
<ol style="list-style-type: lower-roman;">
|
||
|
<li>
|
||
|
<strong>Accountant</strong> licensed and/or certified by the local authority (eg CPA)
|
||
|
</li>
|
||
|
<li>
|
||
|
<strong>Bank Manager</strong> of a branch of a banking institution
|
||
|
</li>
|
||
|
<li>
|
||
|
<strong>Justice of the Peace</strong> duly and verifiably elected or appointed
|
||
|
</li>
|
||
|
<li>
|
||
|
<strong>Lawyer</strong> currently practicing and registered with the bar association or equivalent
|
||
|
</li>
|
||
|
<li>
|
||
|
<strong>Notary Public</strong> authorised to authenticate documents in their jurisdiction
|
||
|
</li>
|
||
![]()
17 years ago
|
<li>
|
||
|
<strong>Other</strong> trusted local public figure as approved by AO (limited to ONE of the TWO TTPs)
|
||
|
</li>
|
||
![]()
17 years ago
|
</ol>
|
||
|
</li>
|
||
![]()
17 years ago
|
<li>MUST retain the TTP form(s) for at least 60 days and respond to CAcert enquiries in a timely fashion
|
||
![]()
17 years ago
|
</li>
|
||
|
<li>SHOULD have experience with the CAcert TTP program, unless no experienced local TTPs are available within a 30 day period
|
||
|
</li>
|
||
![]()
17 years ago
|
<li>SHOULD be recommended to the Assuree by the RA where possible so as to improve security
|
||
|
</li>
|
||
![]()
17 years ago
|
</ol>
|
||
|
<h3>
|
||
![]()
17 years ago
|
2.2 Remote Assurer ("RA")
|
||
![]()
17 years ago
|
</h3>
|
||
|
<p>
|
||
![]()
17 years ago
|
An RA conducting assurances remotely using TTPs:
|
||
![]()
17 years ago
|
</p>
|
||
|
<ol style="list-style-type: lower-alpha;">
|
||
![]()
17 years ago
|
<li>MUST be approved by a board-appointed Remote Assurance Officer ("RAO")
|
||
![]()
17 years ago
|
</li>
|
||
![]()
17 years ago
|
<li>MUST be satisfied as to the identity and competency of the TTP in identification procedures, as though they were to be conducting the assurance themselves
|
||
![]()
17 years ago
|
</li>
|
||
![]()
17 years ago
|
<li>SHOULD be the most senior Assurer available
|
||
![]()
17 years ago
|
</li>
|
||
![]()
17 years ago
|
<li>SHOULD have experience with the TTP program, unless no experienced local Assurers are available within a 30 day period
|
||
![]()
17 years ago
|
</li>
|
||
|
<li>MAY charge a reasonable fee for the service, provided that fee is disclosed in advance
|
||
|
</li>
|
||
|
</ol>
|
||
|
<h3>
|
||
|
2.3 Assuree
|
||
|
</h3>
|
||
|
<p>
|
||
|
An assuree being assured using the CAcert TTP program:
|
||
|
</p>
|
||
|
<ol style="list-style-type: lower-alpha;">
|
||
|
<li>MUST agree to be bound the CAcert Community Agreement (CCA), including the Disupute Resolution Policy (DRP)
|
||
|
</li>
|
||
|
<li>MUST justify to the Assurer as to why it is the standard processes are not appropriate
|
||
|
</li>
|
||
|
<li>MUST provide adequate identification to satisfy the prevailing CAcert Assurance Policy and the TTP
|
||
|
</li>
|
||
|
<li>MUST cover the costs of their assurance (if any), including fees imposed by TTPs and Assurers
|
||
|
</li>
|
||
|
</ol>
|
||
|
<h2>
|
||
|
3. Processes
|
||
|
</h2>
|
||
|
<h3>
|
||
|
3.1 Assurance
|
||
|
</h3>
|
||
|
<ol style="list-style-type: lower-alpha;">
|
||
|
<li>Assuree SHALL create a CAcert account and agree to the CAcert Community Agreement (CCA)
|
||
|
</li>
|
||
|
<li>Assuree SHOULD first attempt to use the usual means for assurance
|
||
|
</li>
|
||
|
<li>Assuree SHOULD contact the most local and most (TTP) experienced Assurer available
|
||
|
</li>
|
||
|
<li>Assurer SHOULD refer Assuree to the most known, experienced and appropriate TTPs in preference to:<br />
|
||
|
<ol style="list-style-type: lower-roman;">
|
||
|
<li>unknown, inexperienced or inappropriate TTPs
|
||
|
</li>
|
||
|
<li>TTPs proposed by the Assuree
|
||
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
<li>Assuree SHALL have their identity verified by the TTP by:<br />
|
||
|
<ol style="list-style-type: lower-roman;">
|
||
|
<li>obtaining and printing two copies of the CAcert TTP form
|
||
|
</li>
|
||
|
<li>taking two copies of any identity documents to be presented to the TTP
|
||
|
</li>
|
||
|
<li>meeting with the TTP in person and furnishing <strong>at least</strong> sufficient identification to meet the requirements of the prevailing Assurance Policy
|
||
|
</li>
|
||
|
<li>executing the CAcert TTP form in dupicate, in the presence of the TTP
|
||
|
</li>
|
||
|
<li>leaving one TTP form and copies of identity documents with the TTP for at least 60 days
|
||
|
</li>
|
||
|
<li>sending one TTP form and copies of identity documents to the Assurer by mutually agreed medium (eg post or encrypted email)
|
||
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
<li>Assurer MUST authenticate the TTP to their satisfaction by:<br />
|
||
|
<ol style="list-style-type: lower-roman;">
|
||
|
<li>searching for their details in an appropriate, official public registry (eg government site, association registry)
|
||
|
</li>
|
||
|
<li>contacting the TTP using these details to verify their identity
|
||
|
</li>
|
||
|
<li>verifying that the TTP is suitable in terms of meeting the requirements of this policy
|
||
|
</li>
|
||
|
<li>verifying that the meeting did indeed take place and that the Assuree was adequately identified
|
||
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
<li>Assurer MUST submit their reports for BOTH TTPs to the AO within 30 days of the date of each TTP meeting
|
||
|
</li>
|
||
|
<li>Assurer MUST securely destroy all copies held no less than 60 days and no more than 90 days from the date of the TTP meeting
|
||
|
</li>
|
||
|
<li>Disputes requiring access to the TTP form and copies of identity documents must be handled within 60 days of the TTP meeting (after which time the TTP MAY be revoked)
|
||
|
</li>
|
||
|
</ol>
|
||
![]()
17 years ago
|
<h2>
|
||
|
3. Documentation
|
||
|
</h2>
|
||
|
<h3>
|
||
|
3.1 Remote Assurance Form
|
||
|
</h3>
|
||
|
<p>
|
||
|
The Remote Assurance Form is to be completed (in duplicate for paper forms) and:
|
||
|
</p>
|
||
|
<ol style="list-style-type: lower-alpha;">
|
||
|
<li>SHALL include all information required by the Assurance Policy
|
||
|
</li>
|
||
|
<li>SHOULD include a concise guide for Assurees and TTPs
|
||
|
</li>
|
||
|
</ol>
|
||
![]()
17 years ago
|
<h2>
|
||
|
4. Exclusions
|
||
|
</h2>
|
||
|
<p>
|
||
|
The following exclusions (with reasoning) apply to the TTP program:
|
||
|
</p>
|
||
|
<ol style="list-style-type: lower-alpha;">
|
||
|
<li>
|
||
|
<strong>Countries:</strong><br />
|
||
|
<ol style="list-style-type: lower-roman;">
|
||
|
<li>None
|
||
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
<li>
|
||
|
<strong>Trusted Third Parties:</strong><br />
|
||
|
<ol style="list-style-type: lower-roman;">
|
||
![]()
17 years ago
|
<li>Unqualified TTPs (due to insufficient qualifications)
|
||
![]()
17 years ago
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
<li>
|
||
![]()
17 years ago
|
<strong>Remote Assurers:</strong><br />
|
||
![]()
17 years ago
|
<ol style="list-style-type: lower-roman;">
|
||
![]()
17 years ago
|
<li>Assurers under age of majority (due to inadequate experience/liability)
|
||
![]()
17 years ago
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
<li>
|
||
|
<strong>Assurees:</strong><br />
|
||
|
<ol style="list-style-type: lower-roman;">
|
||
|
<li>Existing CAcert Assurers (due to lack of demonstrable need)
|
||
|
</li>
|
||
|
</ol>
|
||
|
</li>
|
||
|
</ol>
|
||
|
<p>
|
||
![]()
17 years ago
|
<a href="http://validator.w3.org/check?uri=referer"><img src="Images/valid-xhtml11-blue" alt="Valid XHTML 1.1" height="31" width="88" style="border-style: none;" /></a>
|
||
![]()
17 years ago
|
</p>
|
||
|
</body>
|
||
|
</html>
|