cacert
/
cacert-policies
8
1
Fork 0
Code Issues 3 Pull Requests 1 Packages Projects Releases Wiki Activity

imported updated policy for australia per discussion on -policy

Browse Source 
git-svn-id: http://svn.cacert.org/CAcert/Policies@697 14b1bab8-4ef6-0310-b690-991c95c89dfd
pull/1/head
Sam Johnston 17 years ago
parent ade42f0a59
commit 678e78ca64
1 changed files with 173 additions and 122 deletions
Show Stats Download Patch File Download Diff File

295
OrganisationAssurancePolicy/OrganisationAssurance-SubPolAustralia.html
Unescape Escape View File

@ -1,123 +1,174 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<TITLE> Australian OA </TITLE>
</head>
<body>
<h1> <font color="blue">Organisation Assurance - sub-policy for Australian organisations</font></h1>
<br><br>
Author: Robert Cruikshank
<br>
Creation date: WIP 2008-02-23 V0.2
<br>
Status: <font color="red">WIP DRAFT</font> 2008-03-012
<br>
Date next status: changes expected in April 2008.
<br>
<!-- $Id$ -->
<h2>0. Preliminaries</h2>
This sub-policy describes how Organisation Assurers ("OAs") conduct assurances on Australian organisations.
It fits within the overall web-of-trust or assurance process and the Organisation Assurance Policy (OAP) of CAcert.
<br><br><br>
<h2>1. Purpose</h2>
This is a subsidiary policy to the OAP.
<ol type="a">
<li>This sub-policy is applicable for the assurance of Australian organisations only.</li>
<li>This sub-policy is an implementation of the OAP.</li>
<li>Where the Assurance Officer (AO) is referred to below, this includes their local delegate.</li>
</ol>
<h2>2. Organisation Assurers</h2>
<h2>2.1 Requirements for the Organisation Assurer</h2>
In addition to the requirements defined in the OAP, an OA must meet the following requirements for assuring Australian organisations:
<ol type="a">
<li>Knowledge of common legal forms of organisations in Australia.</li>
<li>Must pass an additional test on local knowledge, even if he/she is already an OA.</li>
<li>Should help the AO to define local requirements.</li>
</ol>
<h2>3. Process</h2>
<h2>3.1 Organisations</h2>
Acceptable organisations under this sub-policy must be:
<ol type="a">
<li>Organisations created under the rules of the Australian jurisdiction.</li>
<li>Organisations must not be revoked by a competent authority with direct oversight over the organisation.</li>
</ol>
<h2>3.2 Documents</h2>
The organisation has to provide documentary and/or physical evidence for two purposes. The first is to prove that the organisation exists as a registered entity and the second is to prove that the applicant has appropriate authority over the domain name. This policy assumes that there is a link between the entity name and the domain name evident in a 'whois' search. This link should established an association between the registered entity and the applicant. (i.e. the organisation name, the domain name/s and the applicant's name can all be linked together through these mechanisms):
<ol type="a">
<li>The primary mechanism to prove existence of the organisation is to provide the ABN or other government registration number of the business that can be used to search the appropriate online register. This can take the form of a photocopy of the certificate issued by the business registrar accompanied by a letter on business letterhead. If an online search cannot be performed for the specific registrar your business is registered with, then an official extract will be required.</li>
<li>The primary mechanism to prove authority over the domain name/s in question is for the applicant to provide an official extract from the Australian business registrar containing the name and signature of the applicant as a current company officer, either via an online interface or via physical means (organisation is asked to carry the costs).</li>
<ol>
<li>An example of this is:
<br>The applicant performs an <abbr title="Australian Securities and Investments Commission">ASIC</abbr> or <abbr title="Dune and Bradstreet">D&B</abbr> document search for a lodged document that contains the name and signature of the applicant and proves the rights of the applicant over the company name.</li>
<ol type="i">
<li>Such a document could be a "Company Check" or "Business Check" (see <ahref="http://www.dnb.com.au/express/about/about_dnbexpress_reports.asp">http://www.dnb.com.au/express/about/about_dnbexpress_reports.asp</a>).</li>
<li>This document should be made available to the OA by hyperlink to the <abbr title="Australian Securities and Investments Commission">ASIC</abbr> or <abbr title="Dune and Bradstreet">D&B</abbr> web site ensuring its authenticity or be an official extract (organisation is asked to carry the costs).</li>
</ol>
</li>
<li>Where not available, an official document will be required from the company, subject to such checks as defined by the AO.</li>
<li>An acceptable alternative may be to place a randomly generated canonical name or text entry in the DNS zone file of the domain name in question. The randomly generated text is to be created by the OA and given to the the applicant with the COAP form. This process is to be approved by the AO for each organisation.</li>
</ol>
<li>If copies of official extracts from the official register are provided, they must be officially certified.</li>
<li>The AO maintains a list of which specific documents and tests can be acceptable for certain types of organisations.</li>
<li>The OA can ask for additional documents if needed to validate required information for the assurance process.</li>
</ol>
<h2>3.3 COAP</h2>
In addition to the checks defined in the policy, the COAP form for Australian organisations requires:
<ol type="a">
<li>Signatures from organisation officials meeting the following requirements</li>
<ol type="i">
<li>as legally specified for the type of organisation</li>
<li>as specified in the official documents (i.e. the excerpt from the register)</li>
<li>as delegated within the organisation (proof of delegation needed)</li>
<li>The organisation must agree to the terms of the <strong>CAcert Community Agreement</strong> by signing the COAP and will therefore be subject to Arbitration.</li>
</ol>
</ol>
<h2>3.4 Acceptable Search Process</h2>
An Australian Organisational Assurance must be preceded with the following searches, documents and agreements:
<ol type="a">
<li>To prove the organisation in question exists an <abbr title="Australian Securities and Investments Commission">ASIC</abbr> search is to be performed using the given organisation number. This can be performed at this site <a
href="http://www.search.asic.gov.au/gns001.html">http://www.search.asic.gov.au/gns001.html</a>. A printout of this search should be made and retained.</li>
<li>This search can be extended with a <abbr title="Dune and Bradstreet">D&B</abbr> search which should also give the contact phone number for this company. This search can be performed at this site <ahref="http://www.dnb.com.au/express/default.asp">http://www.dnb.com.au/express/default.asp</a>. A copy of this search should be printed and retained. The phone number can be compared with any phone numbers provided by the applicant if any.</li>
<li>To help establish a link between the domain name and the company name a whois search is to be conducted and the registered business name compared to the ASIC search result.</li>
<li>The organisation name and number should be consistent throughout:<br>
<ol type="i">
<li>in the search documents both ASIC and whois.</li>
<li>on the COAP form.</li>
<li>and in the CAcert database.</li>
</ol></li>
</ol>
</body>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>
CACert Organisation Assurance Program sub-policy for Australia
</title>
</head>
<body>
<h1>
<font color="blue">CAcert Organisation Assurance Program sub-policy for Australia</font>
</h1>
<p>
Author(s): Robert Cruikshank, Sam Johnston<br />
Creation date: WIP 2008-03-18 V0.3<br />
Status: <font color="red">WIP DRAFT</font> 2008-03-XXX<br />
Date next status: changes expected in April 2008.<br />
<!-- $Id$ -->
</p>
<h2>
0. Preliminaries
</h2>
<p>
This CAcert sub-policy extends the Organisation Assurance Policy ("OAP") by specifying how the CAcert Organisation Assurance Program ("COAP") is to be conducted by the assigned Organisation Assurer ("OA") under the supervision of the Assurance Officer ("AO") for entities within the defined scope.
</p>
<h2>
1. Scope
</h2>
<p>
This sub-policy is applicable to:<br />
</p>
<ol type="a">
<li>Australian legal entities:<br />
<ol type="i">
<li>Sole Traders
</li>
<li>Partnerships
</li>
<li>Companies
</li>
<li>Trusts
</li>
</ol>
</li>
</ol>
<h2>
2. Requirements
</h2>
<p>
This section describes any scope specific requirements that are not otherwise defined in the OAP.
</p>
<h3>
2.1 Organisation
</h3>
<ol type="a">
<li>Sole traders operating under their own name are not required to obtain a business name registration.
</li>
<li>Applicants MUST be a valid legal entity but CAN have an arbitrary number of registered trading names.
</li>
</ol>
<h3>
2.2 Records
</h3>
<ol type="a">
<li>Digital Signatures CAN be accepted in Australia under the Electronic Transactions Act(s).
</li>
<li>Records SHOULD typically be retained for a statutory period of five years.
</li>
<li>Reports SHOULD be submitted electronically via digitally signed email (including any attachments) by the OA to the AO.
</li>
</ol>
<h3>
2.3 Application Form
</h3>
<ol type="a">
<li>The jurisdiction MUST be specified as 'Australia' (for companies and trusts) or an Australian State or Territory (for sole traders and partnerships).
</li>
<li>Any applicable organisation identifiers (ACN/ABN/ARBN) MUST be specified where applicable (not required for sole traders operating under their own name).
</li>
</ol>
<h2>
3. Registration
</h2>
<h3>
3.1 Registries
</h3>
<ol type="a">
<li>Australian Securities and Investments Commission ("ASIC") [<a title="Australian Securities and Investments Commission" href="http://www.asic.gov.au/">http://www.asic.gov.au/</a>]<br />
<ol type="i">
<li>National Names Index [<a title="National Names Index" href="http://www.search.asic.gov.au/gns001.html">http://www.search.asic.gov.au/gns001.html</a>]<br />
</li>
</ol>
</li>
<li>Australian Taxation Office ("ATO") [<a title="Australian Taxation Office" href="http://www.ato.gov.au/">http://www.ato.gov.au/</a>]<br />
<ol type="i">
<li>Australian Business Register ("ABR") [<a title="Australian Business Register" href="http://www.abr.business.gov.au/">http://www.abr.business.gov.au/</a>]<br />
</li>
</ol>
</li>
<li>AusRegistry [<a title="AusRegistry" href="http://www.ausregistry.com.au/">http://www.ausregistry.com.au/</a>]<br />
<ol>
<li>.au ccTLD WHOIS [<a title="AusRegistry WHOIS" href="http://whois.ausregistry.net.au/">http://whois.ausregistry.net.au/</a>]<br />
</li>
</ol>
</li>
</ol>
<h3>
3.2 Agents
</h3>
<ol type="a">
<li>ASIC
<br />
<ol type="i">
<li>ASIC Information Brokers [<a title="ASIC Information Brokers" href="http://www.asic.gov.au/asic/asic.nsf/byheadline/Information+brokers?openDocument">http://www.asic.gov.au/asic/asic.nsf/byheadline/Information+brokers?openDocument</a>]
</li>
<li>ASIC Service Centers [<a title="ASIC Service Centers" href="http://www.asic.gov.au/asic/asic.nsf/byheadline/ASIC+Service+Centre+Addresses?openDocument">http://www.asic.gov.au/asic/asic.nsf/byheadline/ASIC+Service+Centre+Addresses?openDocument</a>]
</li>
</ol>
</li>
</ol>
<h3>
3.3 Identifiers
</h3>
<ol type="a">
<li>Australian Company Number ("ACN") is a unique 9 digit identifying number assigned by ASIC when a body becomes registered as a company under corporations law.
</li>
<li>Australian Registered Body Number ("ARBN") is a unique 9 digit identifying number assigned by ASIC when a body is registered with them other than as a company, for example, foreign companies and registrable Australian bodies.<br />
</li>
<li>Australian Business Number ("ABN") is a unique 11 digit identifying number issued to all entities registered in the Australian Business Register (ABR).
</li>
</ol>
<h3>
3.4 Documents
</h3>
<ol type="a">
<li>ASIC Company Extract
</li><!--> <li>Certificate of Incorporation</li>
<li>Certificate of Registration of Business Name</li>-->
</ol>
<h2>
4. Processes
</h2>
<h3>
4.1 Assurance
</h3>
<ol type="a">
<li>Each person listed in an application MUST be individually assured and referenced by a confirmed email.
</li>
<li>Sole traders operating under their own name CAN be automatically approved without further checks.
</li>
<li>All other trading names (including companies) MUST be verified against the National Names Index and/or Australian Business Register, where the status MUST be 'Registered' or 'Active' respectively.
</li>
<li>Partnership applicants MUST additionally be verified in these registers as a current individual member.
</li>
<li>Company applications MUST be made by an individual who is duly authorised to sign on behalf of the company:
<ol type="i">
<li>Officeholder applicants (directors and secretaries) MUST be verified in an "ASIC Company Extract" which is to be obtained for a fee (reclaimable from the applicant) by the OA from an ASIC Service Center or ASIC Information Broker.
</li>
<li>Any other applicant MUST prove that they are duly authorised to sign on behalf of the entity (for example via delegation and/or under replacible rules) to the satisfaction of the OA, for approval by the AO.
</li>
</ol>
</li>
</ol>
<h3>
4.2 Domain Names
</h3>
<ol type="a">
<li>.au ccTLD WHOIS contains organisation information (including identifiers where applicable) which MUST exactly match the organisation's details.
</li>
<li>Any other domain names MUST exactly match the organisation's details for the registrant (or equivalent) or be subject to technical verification measures.
</li>
</ol>
</body>
</html>

Write Preview
Loading…
Cancel
Save