diff --git a/ConfigurationControlSpecification.html b/ConfigurationControlSpecification.html
index 2e2447e..2443efa 100644
--- a/ConfigurationControlSpecification.html
+++ b/ConfigurationControlSpecification.html
@@ -49,7 +49,7 @@ a:hover {
Creation date: 20091214
Editor: Iang
-Status: 20100227 WIP
+Status: 20100407 WIP
@@ -63,54 +63,75 @@ The Configuration-Control Specification (CCS) controls and tracks those document
This document is the procedure for CCS. -This document itself is a component of the CCS. +This document itself is a component of the CCS, +see §2. + All other documentation and process specified within is derivative and is ruled by the CCS.
++CCS is formated, inspired and designed to meet the needs of +DRC-A.1. +CCS may be seen as the index to systems audit under DRC. +
+-This CCS creates a list of Primary or "root" documents. +This CCS creates a list of Primary or "root" documents known as Policies. +Primary documents may authorise other secondary documents +into the list, or "practices" outside the list.
-Primary Documents may authorise other secondary documents -under the same process (PoP). -Policy Officer manages the controlled documents list -containing numbers, locations and versions of all controlled documents. +The controlled documents list +contains numbers, locations and versions of all controlled documents. The list is part of this CCS, and is located at http://svn.cacert.org/CAcert/Policies/ControlledDocumentList.html - +Policy Officer is to manage the list. +Policy Officer is to log the changes at + +http://wiki.cacert.org/PolicyDecisions. +
-Overall responsibility for change to documents resides with the policy mailgroup, -as specified in Policy on Policy. -CAcert Inc., board maintains a veto on new policies while in DRAFT. -Fully approved documents (POLICY status) are published on the CAcert website at - -http://www.cacert.org/policy/ -in plain HTML format. +Change to the documents is as specified by +Policy on Policy (PoP).
+The following would possibly be better off in PoP (when a change cycle comes around), or a practices manual.
++Policies in effect (DRAFT and POLICY status) are to be under change control. +Fully approved documents (POLICY status) +are published on the CAcert website at + +http://www.cacert.org/policy/ +in plain HTML format, +under the same control as critical source code +under Security Policy (SP). Pre-final work (DRAFT status) and working documents (work-in-progress status) -are made available on publically-accessible version management systems +are made available on community-controlled version management systems (rooted at Subversion: http://svn.cacert.org/CAcert/Policies wiki: - -http://wiki.cacert.org/wiki/PolicyDrafts). + +http://wiki.cacert.org/PolicyDrafts). +Documents of lower status (work-in-progress or DRAFT) +must not be confusable with +documents of higher status (DRAFT or POLICY). +Copies should be eliminated where not being worked on.
Critical software is defined by Security Policy.
+See Security Policy.
@@ -190,22 +219,36 @@ and a registry of software under approved open source licences. --Logs are defined by Security Policy. -
+Root Certificates are to be listed in the CPS.
Changes to Hardware and Software are logged according to Security Policy.
+Creation and usage of Root Certificates is to be controlled by Security Policy.
See Security Policy.
+Logs are defined by Security Policy.
+ +Changes to Hardware, Software and Root Certificates are logged according to Security Policy.
+ +See Security Policy.
+