From 5cf6d32d9c10f1e6c65b36d7e4080ed886b26561 Mon Sep 17 00:00:00 2001
From: Ian Grigg <iang@cacert.org>
Date: Fri, 13 Mar 2009 15:07:21 +0000
Subject: [PATCH] extra alignments found from Security Manual, lost heading,
 moved some text

git-svn-id: http://svn.cacert.org/CAcert/Policies@1219 14b1bab8-4ef6-0310-b690-991c95c89dfd
---
 SecurityPolicy.html | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/SecurityPolicy.html b/SecurityPolicy.html
index 0e248b1..2ef4e87 100644
--- a/SecurityPolicy.html
+++ b/SecurityPolicy.html
@@ -1133,18 +1133,15 @@ All conflicts of interest should be examined.
 <h4> <a name="9.1.6"> 9.1.6. </a> Security</h4>
 
 <p>
-It is the responsibility of all individuals to observe and report on security issues.
+It is the responsibility of all individuals to
+observe and report on security issues.
 All of CAcert observes all where possible.
 It is the responsibility of each individual to resolve it satisfactorily,
 or to ensure that it is reported fully.
 </p>
 
 <p>
-Only information subject to a specific and documented exception
-may be kept secret or confidential.
-The exception itself must not be secret or confidential.
-All secrets and confidentials are reviewable under Arbitration,
-and may be reversed.
+See &sect;9.5.
 </p>
 
 <h4> <a name="9.1.7"> 9.1.7. </a> Termination of staff</h4>
@@ -1173,7 +1170,7 @@ to coordinate technical testing and training,
 especially of new team members.
 </p>
 
-<h3> <a name="9.2"> 9.2. </a> Key generation/transfer</h3>
+<h3> <a name="9.2"> 9.2. </a> Root Key Management</h3>
 
 <h4> <a name="9.2.1"> 9.2.1. </a> Root Key generation</h4>
 
@@ -1202,13 +1199,15 @@ Subroots may be escrowed by either Board or Systems Administration Team.
 Recovery must only be conducted under Arbitrator authority.
 </p>
 
+<h4> <a name="9.2.4"> 9.2.4. </a> Revocation </h4>
 
 <h3> <a name="9.3"> 9.3. </a> Legal</h3>
 
 <h4> <a name="9.3.1"> 9.3.1. </a> Responsibility</h4>
 
 <p>
-The board is responsible for the CA at the executive level.
+The board is responsible to the Community to manage
+the CA at the executive level.
 </p>
 
 <h4> <a name="9.3.2"> 9.3.2. </a> Response to external (legal) inquiry</h4>
@@ -1287,6 +1286,9 @@ In concrete terms,
 only under a defined exception under policy,
 or under the oversight of the Arbitrator,
 may confidentiality or secrecy be maintained.
+The exception itself must not be secret or confidential.
+All secrets and confidentials are reviewable under Arbitration,
+and may be reversed.
 All should strive to reduce or remove any such
 restriction.
 </p>