URL improvements and naming consistancy.

git-svn-id: http://svn.cacert.org/CAcert/Policies@869 14b1bab8-4ef6-0310-b690-991c95c89dfd
pull/1/head
Teus Hagen 16 years ago
parent 02443f1f3b
commit 6ea53b7249

@ -1,490 +1,555 @@
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" <html xmlns="http://www.w3.org/1999/xhtml"><head><title>Assurance Policy</title>
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>
Assurance Policy
</title>
</head>
<body>
<h1>
Assurance Policy for CAcert Community Members
</h1>
<p>
<a href="PolicyOnPolicy.html"><img src="Images/cacert-wip.png" alt="CAcert Policy Status" height="31" width="88" style="border-style: none;" /></a><br />
Editor: iang ? <br />
Creation date: 2008-05-30<br />
Status: WIP 2008-06-19<br />
Next status: DRAFT June 2008<br />
<!-- $Id: AssurancePolicy.html 772 2008-06-02 13:46:20Z teus $ -->
</p>
</head>
<h2 >0. Preamble</h2> <body>
<h1> Assurance Policy for CAcert Community Members<br>
<p > </h1>
<p>
<a href="PolicyOnPolicy.html"><img src="Images/cacert-wip.png" alt="CAcert Policy Status" style="border-style: none;" height="31" width="88"></a><br>
Author: Ian Grigg<br>
Creation date: 2008-05-30<br>
Status: WIP 2008-05-30<br>
Next status: DRAFT June 2008<br>
<br>
</p>
<h2>0. Preamble</h2>
<p>
Definitions of terms: Definitions of terms:
</p>
<dl> <dl>
<dt><em>Assurance</em></dt> <dt><em>Assurance</em></dt>
<dd>Assurance is the process by which a Member of CAcert Community (Assurer) identifies an individual (Assuree). <dd>Assurance is the process by which a Member of CAcert
Community (Assurer) identifies an individual (Assuree).
<br> <br>
With sufficient assurances, a Member may (a) issue certificates with their Names included, (b) participate in assuring others, and (c) other related activities. With sufficient assurances, a Member may (a) issue certificates with
The strength of these activities is based on the strength of the assurance. their Names included, (b) participate in assuring others, and (c) other
</dd> related activities.
The strength of these activities is based on the strength of the
assurance. </dd>
<dt><em>Member</em></dt> <dt><em>Member</em></dt>
<dd>An individual who has agreed to the CAcert Community agreement and has created successfully a CAcert (web)account on http://www.cacert.org. <dd>An individual who has agreed to the
<dt><em>Name</em></dt> CAcert Community Agreement (CCA) and has created successfully a CAcert
<dd>A Name is the full name (first name(s), family name(s), name extensions,abreviation of name(s), etc.) of an individual. (web)account on http://www.cacert.org.
</dd> </dd>
<dt><em>Name</em></dt>
<dd>A Name is the full name (first
name(s), family name(s), name extensions,abreviation of name(s), etc.)
of an individual. The Name is technically spoken a string exactly taken
from a governemental issued photo ID. Transliteration of characters to
a character table defined by CAcert is permitted.&nbsp;</dd>
<dt><em>Secondary Distinguishing Feature</em> (DoB)</dt> <dt><em>Secondary Distinguishing Feature</em> (DoB)</dt>
<dd>A Name for an individual is discrimated from similar full names by a secondary distinguished feature, as recorded on the on-line CAcert (web) account. <dd>A Name for
an individual is discrimated from similar full names by a secondary
distinguished feature, as recorded on the on-line CAcert (web) account.
Currently this is the date of birth (DoB) of the individual. Currently this is the date of birth (DoB) of the individual.
</dd> </dd>
</dl> </dl>
<p > <p>
</p>
<h3 >The CAcert Web of Trust</h3> <h3>The CAcert Web of Trust</h3>
<p>
<p > Each assurance claims a number of Assurance Points, applied to the
Each assurance claims a number of Assurance Points, applied to the assured Member or Member prospect. assured Member or Member prospect.
By combining the assurances, and the Assurance Points, CAcert constructs a global <em>Web of Trust</em> ("WoT"). By combining the assurances, and the Assurance Points, CAcert
<p > constructs a global <em>Web of Trust</em> ("WoT"). </p>
CAcert explicitly chooses to meet its various goals by construction of a web-of-trust of all Members. <p>CAcert explicitly chooses to meet its various goals by
This is done by face-to-face meeting, identifying and sharing claims in a network. construction of a web-of-trust of all Members.
Maintaining a sufficient strength for the web-of-trust is a high-level objective of the Assurance process. This is done by face-to-face meeting, identifying and sharing claims in
<p > a network.
Maintaining a sufficient strength for the web-of-trust is a high-level
objective of the Assurance process. </p>
<h3 >Related Documentation</h3> <p></p>
<h3>Related Documentation</h3>
<p > <p>
Documentation on Assurance is split between this Assurance Policy (AP) and the <a href="/wiki/AssuranceHandbook2">Assurance Handbook</a>. Documentation on Assurance is split between this Assurance Policy (AP)
The policy is controlled by <a href="/wiki/PolicyDrafts/ConfigurationControlSpecification">Configuration Control Specification (CCS)</a> under <a class="http" href="http://www.cacert.org/policy/PolicyOnPolicy.php">Policy of Policy (PoP)</a> policy documents. and the <a target="_blank" href="http://wiki.cacert.org/wiki/AssuranceHandbook2">Assurance
Handbook</a>.
The policy is controlled by Configuration Control Specification (<a target="_blank" href="http://wiki.cacert.org/wiki/PolicyDrafts/ConfigurationControlSpecification">CCS</a>) under Policy on Policy (<a target="_blank" class="http" href="http://www.cacert.org/policy/PolicyOnPolicy.php">PoP</a>) policy documents.
<br> <br>
Because Assurance is an active area, much of the practice is handed over to the Assurance Handbook, which is not a controlled document, and can more easily respond to experience and circumstances. Because Assurance is an active area, much of the practice is handed
It is also more readable. over to the Assurance Handbook, which is not a controlled document, and
<p > can more easily respond to experience and circumstances.
See also <a class="http" href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php">Organisation Assurance Policy (OAP)</a> and <a class="http" href="http://svn.cacert.org/CAcert/policy.htm">CAcert Policy Statement (CPS)</a>. It is also more readable. </p>
<p > <p>See also Organisation Assurance Policy (<a target="_blank" class="http" href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php">OAP</a>) and CAcert Policy Statement (<a target="_blank" class="http" href="http://svn.cacert.org/CAcert/policy.htm">CPS</a>). </p>
<p></p>
<h2>1. Purpose</h2>
<h2 >1. Purpose</h2> <p>
The purpose of Assurance is to add confidence in the Assurance
<p > Statement made of a Member by the CAcert Community. </p>
The purpose of Assurance is to add confidence in the Assurance Statement made of a Member by the CAcert Community. <p></p>
<p > <h3>The Assurance Statement</h3>
<p>
<h3 >The Assurance Statement</h3>
<p >
The following claims can be made about a person who is assured: The following claims can be made about a person who is assured:
</p>
<ol type="1"> <ol type="1">
<li> The person is a bona fide Member. <li> The person is a bona fide Member.
In other words, the person is a member of the CAcert community, as defined by the CAcert Community Agreement (CCA). In other words, the person is a member of the CAcert community, as
</li> defined by the CAcert Community Agreement (CCA).
<li> The Member has a (login) (web)Account with CAcert's on-line registration and service system. </li>
</li> <li> The Member has a (login) (web)Account with CAcert's
<li> The Member can be determined from any certificate issued by the Account. on-line registration and service system. </li>
</li> <li> The Member can be determined from any certificate issued
<li> The Member is bound into CAcert's Arbitration (as defined by the CCA). by the Account. </li>
</li> <li> The Member is bound into CAcert's Arbitration (as defined
<li> Some personal details of the Member (Name(s), primary and other listed email address(es), Secondary Distinguishing Feature (e.g., DoB)) are known to CAcert. by the CCA).</li>
</li></ol> <li> Some personal details of the Member (Name(s), primary and
<p > other
The confidence level of the Assurance Statement is expressed by the Assurance Points. listed email address(es), secundary distinguished feature (eg DoB)) are
<p > known to CAcert. </li>
</ol>
<p>The confidence level of the Assurance Statement is expressed
<h3 >Relying Party Statement</h3> by the Assurance Points. </p>
<p></p>
<p > <h3>Relying Party Statement</h3>
The primary goal of the Assurance Statement is to meet the needs of the <em>Relying Party Statement</em>, which latter is found in the Certification Practice Statement (<a class="http" href="http://svn.cacert.org/CAcert/policy.htm">CPS</a>) for the express purpose of certificates. <p>
<p > The primary goal of the Assurance Statement is to meet the needs of the
When a certificate is issued, some or all of the Assurance Statement may be incorporated (e.g., name) or implied (e.g., Membership or status) into the certificate and be part of the <em>Relying Party Statement</em>. <em>Relying Party Statement</em>, which latter is found in
In short, this means that other Members of the Community may rely on the information verified by Assurance and found in the certificate. the Certification Practice Statement (<a target="_blank" class="http" href="http://svn.cacert.org/CAcert/policy.htm">CPS</a>)
<p > for the express purpose of certificates. </p>
In particular, certificates are sometimes considered to provide reliable indications of the Member's Name. <p>When a certificate is issued, some or all of the Assurance
The nature of Assurance, the number of Assurance Points, and other policies and processes should be understood as limitations on any reliance. Statement
<p > may be incorporated (e.g., name) or implied (e.g., Membership or
status) into the certificate and be part of the <em>Relying
<h2 >2. The Member</h2> Party Statement</em>.
In short, this means that other Members of the Community may rely on
<p > the information verified by Assurance and found in the certificate. </p>
<p>In particular, certificates are sometimes considered to
<h3 >Name(s)</h3> provide
reliable indications of the Member's Name.
The nature of Assurance, the number of Assurance Points, and other
<p > policies and processes should be understood as limitations on any
The general standard is that the individual name of the Member is as written on a government-issued Identity (photo) document. reliance. </p>
<p > <p></p>
<em>For more details see the <a href="/wiki/PolicyDrafts/PolicyOnNames">PolicyDrafts/PolicyOnNames</a>, where the discussion is carried on. <h2>2. The Member</h2>
This page will be copied into here when the discussion is complete.</em>
<p >
<p> <p>
The technical form of a Name is a string of characters. It should be exactly copied from a governemental-issued photo ID. Transliteration of characters to a character table defined by Assurance Officer is permitted.
</p> </p>
<h3>Name(s)</h3>
<p>
The general standard is that the individual name of the Member is as
written on a government-issued Identity (photo) document. </p>
<p><em>For more details see the <a target="_blank" href="http://wiki.cacert.org/wiki/PolicyDrafts/PolicyOnNames">Policy
Drafts Policy On Names</a>, where the discussion is carried on.
This page will be copied into here when the discussion is complete.</em>
</p>
<p></p>
<p> The technical form of a Name is a string of characters. It
should be exactly copied from a governemental-issued photo ID.
Transliteration of characters to a character table defined by Assurance
Officer is permitted.
</p>
<strong>Multiple Names</strong> <strong>Multiple Names</strong>
<br> <br>
A Member may have multiple individual Names. A Member may have multiple individual Names.
For example, married name, variations of initials of first or middle names, abbreviation of a first name, different language or country variations and transliterations of characters in a name. For example, married name, variations of initials of first or middle
names, abbreviation of a first name, different language or country
variations and transliterations of characters in a name.
Each individual Name must be assured to the applicable level. Each individual Name must be assured to the applicable level.
That is, each Name to 50 Assurance Points to be used in a certificate. That is, each Name to 50 Assurance Points to be used in a certificate.
<br> <br>
For an Assurer at least one Name must have at least to 100 Assurance Points. For an Assurer at least one Name must have at least to 100 Assurance
<p > Points.
<p></p>
<h3 >Capabilities</h3> <h3>Capabilities</h3>
<p>
<p >
A Member has the following capabilities derived from Assurance: A Member has the following capabilities derived from Assurance:
<div><table border=1 cellspacing=0 cellpadding=5><tbody> </p>
<caption align=bottom>Assurance Capability table</caption> <div>
<tr align=left> <table border="1" cellpadding="5" cellspacing="0">
<td width=10%><em>Minimum Assurance Points</em></td> <tbody>
<td width=25%><em>Capability</em></td> </tbody><caption align="bottom">Assurance
<td width=65%><em>Comment</em></td> Capability table</caption>
<tbody>
<tr align="left">
<td width="10%"><em>Minimum Assurance Points</em></td>
<td width="25%"><em>Capability</em></td>
<td width="65%"><em>Comment</em></td>
</tr> </tr>
<tr align=left valign=top> <tr align="left" valign="top">
<td align=center>0</td> <td align="center">0</td>
<td>request un-named certificates</td> <td>request un-named certificates</td>
<td>although the Member's details are recorded in the account, they are not highly assured.</td> <td>although the Member's details are recorded in the
account, they are not highly assured.</td>
</tr> </tr>
<tr align=left valign=top> <tr align="left" valign="top">
<td align=center>50</td> <td align="center">50</td>
<td>request named certificates</td> <td>request named certificates</td>
<td>the name and Assurance Statement is assured to 50 Assurance Points or more</td> <td>the name and Assurance Statement is assured to 50
Assurance Points or more</td>
</tr> </tr>
<tr align=left valign=top> <tr align="left" valign="top">
<td align=center>100</td> <td align="center">100</td>
<td>become an Assurer</td> <td>become an Assurer</td>
<td>assured to 100 Assurance Points or more, and other requirements listed below</td> <td>assured to 100 Assurance Points or more, and other
requirements listed below</td>
</tr> </tr>
</tbody></table></div> </tbody>
</table>
<p > </div>
The CAcert Policy Statement (CPS) and other policies may list other capabilities that rely on Assurance Points. <p>
<p > The CAcert Policy Statement (CPS) and other policies may list other
capabilities that rely on Assurance Points. </p>
<h2 >3. The Assurer</h2> <p></p>
<h2>3. The Assurer</h2>
<p > <p>
An Assurer is a Member with the following: <ul> An Assurer is a Member with the following: </p>
<li>is assured to a minimum of 100 Assurance Points, <ul>
</li> <li>is assured to a minimum of 100 Assurance Points, </li>
<li>has passed the Assurer Challenge. <li>has passed the Assurer Challenge. </li>
</li></ul> </ul>
<p > <p>
The Assurer Challenge is administered by the Education Team on behalf of the Assurance Officer. The Assurer Challenge is administered by the Education Team on behalf
<p > of the Assurance Officer. </p>
<p></p>
<h3 >The Obligations of the Assurer</h3> <h3>The Obligations of the Assurer</h3>
<p>
<p > The Assurer is obliged to: </p>
The Assurer is obliged to: <ul> <ul>
<li>Follow this Assurance Policy; <li>Follow this Assurance Policy; </li>
</li> <li>Follow any additional rules of detail laid out by the
<li>Follow any additional rules of detail laid out by the Assurance Officer; Assurance Officer; </li>
</li>
<li> <li>
<p > <p>Be guided by the <a target="_blank" href="http://wiki.cacert.org/wiki/AssuranceHandbook2">Assurance
Be guided by the <a href="/wiki/AssuranceHandbook2">Assurance Handbook</a> in their judgement; Handbook</a> in their judgement; </p>
</li> </li>
<li>Make a good faith effort at identifying and verifying Members; <li>Make a good faith effort at identifying and verifying
</li> Members; </li>
<li>Maintain the documentation on each Assurance; <li>Maintain the documentation on each Assurance; </li>
</li> <li>Deliver documentation to Arbitration, or as otherwise
<li>Deliver documentation to Arbitration, or as otherwise directed by the Arbitrator; directed by the Arbitrator;
</li> </li>
<li>Keep up-to-date with developments within the CAcert Community. <li>Keep up-to-date with developments within the CAcert
</li></ul> Community. </li>
<p > </ul>
<p>
<h2 >4. The Assurance</h2> </p>
<h2>4. The Assurance</h2>
<p > <p>
</p>
<h3 >The Assurance Process</h3> <h3>The Assurance Process</h3>
<p>
<p > The Assurer conducts the process of Assurance with each Member. </p>
The Assurer conducts the process of Assurance with each Member. <p>The process consists of:
<p > </p>
The process consists of:
<ol type="1"> <ol type="1">
<li>Voluntary agreement by both Assurer and Member or prospect Member to conduct the Assurance; <li>Voluntary agreement by both Assurer and Member or prospect
</li> Member to conduct the Assurance; </li>
<li>Personal meeting of Assurer and Member or prospect Member; <li>Personal meeting of Assurer and Member or prospect Member;
</li> </li>
<li>Recording of essential details on CAP form (below); <li>Recording of essential details on CAP form (below); </li>
</li> <li>Examination of Identity documents by Assurer and
<li>Examination of Identity documents by Assurer and verification of recorded details (Name(s) and Secondary Distinguishing Feature, e.g., DoB); verification of recorded details (Name(s) and Secondary Distinguishing
Feature, e.g., DoB);</li>
<li>Allocation of Assurance Points by Assurer; </li>
<li>Optional: supervision of reciprocal Assurance made by
Assuree (Mutual Assurance);
</li> </li>
<li>Allocation of Assurance Points by Assurer; <li>Safe keeping of the CAP forms by Assurer. </li>
</li> </ol>
<li>Optional: supervision of reciprocal Assurance made by Assuree (Mutual Assurance); <p>
</li> </p>
<li>Safe keeping of the CAP forms by Assurer. <h3>Mutual Assurance</h3>
</li></ol> <p>
<p >
<h3 >Mutual Assurance</h3>
<p >
Mutual Assurance follows the principle of reciprocity. Mutual Assurance follows the principle of reciprocity.
This means that the Assurance may be two-way, and that each member participating in the Assurance procedure should be able to show evidence of their identity to the other. This means that the Assurance may be two-way, and that each member
<p > participating in the Assurance procedure should be able to show
In the event that an Assurer is assured by a Member who is not certified as an Assurer, the Assurer supervises the Assurance procedure and process, and is responsible for the results. evidence of their identity to the other. </p>
<p > <p>In the event that an Assurer is assured by a Member who is not
Reciprocity maintains a balance between the (new) Member and the Assurer, and reduces any sense of power. certified as an Assurer, the Assurer supervises the Assurance procedure
It is also an important aid to the assurance training for future Assurers. and process, and is responsible for the results. </p>
<p > <p>Reciprocity maintains a balance between the (new) Member and
<em>Evidence of Assurer status</em> the Assurer, and reduces any sense of power.
It is also an important aid to the assurance training for future
Assurers. </p>
<p><em>Evidence of Assurer status</em>
<br> <br>
On the question of providing evidence that one is an Assurer, <a class="http" href="http://svn.cacert.org/CAcert/policy.htm#p3.2">CAcert Policy Statement (CPS) says</a>: <em>The level at which each Member is Assured is public data. The number of Assurance Points for each Member is not published.</em>. On the question of providing evidence that one is an Assurer, CAcert
<p > Policy Statement (<a target="_blank" class="http" href="http://svn.cacert.org/CAcert/policy.htm#p3.2">CPS</a>)
says:<em> The level at which each Member is Assured is public
data. The number of Assurance Points for each Member is not published.</em>.
<h3 >Assurance Points</h3> </p>
<p></p>
<p > <h3>Assurance Points</h3>
The Assurance applies Assurance Points to each Member which measure the increase of confidence in the Statement (above). <p>
The Assurance applies Assurance Points to each Member which measure the
increase of confidence in the Statement (above).
Assurance Points should not be interpreted for any other purpose. Assurance Points should not be interpreted for any other purpose.
Note that, even though they are sometimes referred to as <em>Web-of-Trust</em> (Assurance) Points, or <em>Trust</em> Points, the meaning of the word 'trust' is not well defined. Note that, even though they are sometimes referred to as <em>Web-of-Trust</em>
<p > (Assurance) Points, or <em>Trust</em> Points, the meaning
<em>Assurance Points Allocation.</em> of the word 'trust' is not well defined. </p>
<br>An Assurer can allocate a number of Assurance Points to the Member according to the Assurer's experience (Experience Point system, see below). <p><em>Assurance Points Allocation.</em>
The allocation of the maximum means that the Assurer is 100% confident in the information presented: <br>
An Assurer can allocate a number of Assurance Points to the Member
according to the Assurer's experience (Experience Point system, see
below).
The allocation of the maximum means that the Assurer is 100% confident
in the information presented:
</p>
<ul> <ul>
<li>Detail on form, system, documents, person in accordance; <li>Detail on form, system, documents, person in accordance; </li>
</li> <li>Sufficient quality identity documents have been checked; </li>
<li>Sufficient quality identity documents have been checked;
</li>
<li>Assurer's familiarity with identity documents; <li>Assurer's familiarity with identity documents;
</li> </li>
<li>The Assurance Statement is confirmed. <li>The Assurance Statement is confirmed. </li>
</li></ul> </ul>
<p > <p>Any lesser confidence should result in less Assurance Points
Any lesser confidence should result in less Assurance Points for a Name. If the Assurer has no confidence in the information presented, then <em>zero </em> Assurance Points may be allocated by the Assurer. for a Name. If the Assurer has no confidence in the information
For example, this may happen if the identity documents are totally unfamiliar to the Assurer. presented, then <em>zero </em> Assurance Points may be
The number of Assurance Points from <em>zero</em> to <em>maximum </em> is guided by the Assurance Handbook and the judgement of the Assurer. allocated by the Assurer.&nbsp;For example, this may happen if the
<p > identity documents are totally unfamiliar to the Assurer.
Multiple Names should be allocated separately in a single Assurance. The number of Assurance Points from <em>zero</em> to <em>maximum
That is, the Assurer may allocate the maximum to one Name, half that amount to another Name, and zero to a third Name. </em> is guided by the Assurance Handbook and the judgement of
<p > the Assurer. </p>
A (new) Member who is not an Assurer may award an Assurer in a reciprocal process a maximum of 2 Assurance Points, according to his judgement. <p>Multiple Names should be allocated separately in a single
The Assurer should strive to have the Member allocate according to the Member's judgement, and stay on the cautious side; a (new) Member new to the assurance process should allocate <em>zero</em> Assurance Points until they get some confidence in what is happening. Assurance.
<p > That is, the Assurer may allocate the maximum to one Name, half that
No Assurance process can give more than 50 Assurance Points per Name. amount to another Name, and zero to a third Name. </p>
This means that to reach 50 Assurance Points (certificate with a Name), a Member must have been assured at least once. <p>A (new) Member who is not an Assurer may award an Assurer in a
To reach 100 Assurance Points, at least one Name of the Member must have been assured at least twice. reciprocal process a maximum of 2 Assurance Points, according to his
<p > judgement.
The Assurer should strive to have the Member allocate according to the
<h3 >Experience Points</h3> Member's judgement, and stay on the cautious side; a (new) Member new
to the assurance process should allocate <em>zero</em>
<p > Assurance Points until they get some confidence in what is happening. </p>
The maximum number of Assurance Points that may be awarded by an Assurer is determined by the Experience Points of the Assurer. <p>No Assurance process can give more than 50 Assurance Points
<div><table border=1 cellspacing=0 width=15%> per Name.
<caption align=bottom>Assurance Points table</caption> This means that to reach 50 Assurance Points (certificate with a Name),
a Member must have been assured at least once.
To reach 100 Assurance Points, at least one Name of the Member must
have been assured at least twice. </p>
<p></p>
<h3>Experience Points</h3>
<p>
The maximum number of Assurance Points that may be awarded by an
Assurer is determined by the Experience Points of the Assurer.
</p>
<div>
<table border="1" cellspacing="0" width="15%">
<caption align="bottom">Assurance Points table</caption>
<tbody>
<tr> <tr>
<td><em>Assurer's Experience Points</em></td> <td><em>Allocatable Assurance Points</em></td> <td><em>Assurer's Experience Points</em></td>
<td><em>Allocatable Assurance Points</em></td>
</tr> </tr>
<tr align=center> <tr align="center">
<td>0</td> <td>10</td> <td>0</td>
<td>10</td>
</tr> </tr>
<tr align=center> <tr align="center">
<td>10</td> <td>15</td> <td>10</td>
<td>15</td>
</tr> </tr>
<tr align=center> <tr align="center">
<td>20</td> <td>20</td> <td>20</td>
<td>20</td>
</tr> </tr>
<tr align=center> <tr align="center">
<td>30</td> <td> 25</td> <td>30</td>
<td> 25</td>
</tr> </tr>
<tr align=center> <tr align="center">
<td>40</td> <td>30</td> <td>40</td>
<td>30</td>
</tr> </tr>
<tr align=center> <tr align="center">
<td>>=50</td> <td>35</td> <td>&gt;=50</td>
<td>35</td>
</tr> </tr>
</table></div> </tbody>
<p > </table>
An Assurer is given a maximum of 2 Experience Points for every completed Assurance. </div>
On reaching Assurer status, the Experience Points start at zero.
<p> <p>
Less Experience Points (1) may be given for mass Assurance events, where each Assurance is quicker. An Assurer is given a maximum of 2 Experience Points for every
completed Assurance.
On reaching Assurer status, the Experience Points start at zero.
</p>
<p>Less Experience Points (1) may be given for mass Assurance
events, where each Assurance is quicker.
</p>
<p>Additional Experience Points may be granted temporarily or
permanently
to an Assurer by CAcert Inc's Board, on recommendation from the
Assurance Officer. </p>
<p>Experience Points are not to be confused with Assurance
Points. </p>
<p><em>Comment: this part still needs to be agreed.</em>
</p>
<p></p>
<h3>CAcert Assurance Programme (CAP) form</h3>
<p> <p>
Additional Experience Points may be granted temporarily or permanently to an Assurer by CAcert Inc's Board, on recommendation from the Assurance Officer. The CAcert Assurance Programme (CAP) form requests the following
<p > details of each Member or prospect Member:
Experience Points are not to be confused with Assurance Points. </p>
<p >
<em>Comment: this part still needs to be agreed.</em>
<p >
<h3 >CAcert Assurance Programme (CAP) form</h3>
<p >
The CAcert Assurance Programme (CAP) form requests the following details of each Member or prospect Member:
<ul> <ul>
<li>Name(s), as recorded in the on-line account; <li>Name(s), as recorded in the on-line account;
</li> </li>
<li>Primary email address, as recorded in the on-line account; <li>Primary email address, as recorded in the on-line account; </li>
</li> <li>Secondary Distinguishing Feature, as recorded in the
<li>Secondary Distinguishing Feature, as recorded in the on-line account (normally, date of birth); on-line account (normally, date of birth);
</li>
<li>Statement of agreement with the CAcert Community Agreement (CCA);
</li>
<li>Permission to the Assurer to conduct the Assurance (required for privacy reasons);
</li> </li>
<li>Statement of agreement with the CAcert Community Agreement
(CCA); </li>
<li>Permission to the Assurer to conduct the Assurance
(required for privacy reasons); </li>
<li>Date and signature of the Assuree. <li>Date and signature of the Assuree.
</li></ul> </li>
</ul>
The CAP form requests the following details of the Assurer: The CAP form requests the following details of the Assurer:
<ul> <ul>
<li>At least one Name as recorded in the on-line account of the Assurer; <li>At least one Name as recorded in the on-line account of the
Assurer;
</li> </li>
<li>Assurance Points for each Name in the identity document(s); <li>Assurance Points for each Name in the identity document(s);
</li> </li>
<li>Statement of Assurance; <li>Statement of Assurance;</li>
</li> <li>Optional: If the Assurance is reciprocal, then the
<li> Assurer's email address and Secondary Distinguishing Feature are
Optional: If the Assurance is reciprocal, then the Assurer's email address and Secondary Distinguishing Feature are required as well. required as well.
</li> </li>
<li>Date, location of Assurance and signature of Assurer. <li>Date, location of Assurance and signature of Assurer.
</li></ul>
<p >
The CAP forms are to be kept at least for 7 years by the Assurer.
<p >
<h2 >5. The Assurance Officer</h2>
<p >
The Commitee (Board) of CAcert Inc. appoints an Assurance Officer with the following responsibilities:
<ul>
<li>Reporting to the Board and advising on all matters to do with Assurance;
</li>
<li>Training and testing of Assurers, in association with the Education Team;
</li> </li>
</ul>
<p>
The CAP forms are to be kept at least for 7 years by the Assurer. </p>
<p></p>
<h2>5. The Assurance Officer</h2>
<p>
The Commitee (Board) of CAcert Inc. appoints an Assurance Officer with
the following responsibilities:
</p>
<ul>
<li>Reporting to the Board and advising on all matters to do
with Assurance; </li>
<li>Training and testing of Assurers, in association with the
Education Team; </li>
<li> <li>
Updating this Assurance Policy, under the process established by <a class="https" href="https://www.cacert.org/policy/PolicyOnPolicy.php">Policy on Policy</a>; Updating this Assurance Policy, under the process established by Policy on Policy (<a target="_blank" class="https" href="https://www.cacert.org/policy/PolicyOnPolicy.php">PoP</a>);
</li> </li>
<li> <li>
Management of all Subsidiary Policies (see below) for Assurances, under <a class="https" href="https://www.cacert.org/policy/PolicyOnPolicy.php">Policy on Policy</a>; Management of all Subsidiary Policies (see below) for Assurances, under Policy on Policy (
<a target="_blank" class="https" href="https://www.cacert.org/policy/PolicyOnPolicy.php">PoP</a>);
</li> </li>
<li>Managing and creating rules of detail or procedure where inappropriate for policies; <li>Managing and creating rules of detail or procedure where
inappropriate for policies;
</li> </li>
<li>Incorporating rulings from Arbitration into policies, procedures or guidelines; <li>Incorporating rulings from Arbitration into policies,
procedures or guidelines;
</li> </li>
<li>Assisting the Arbitrator in any requests; <li>Assisting the Arbitrator in any requests;
</li> </li>
<li>Managing the Assurer Handbook; <li>Managing the Assurer Handbook; </li>
</li> <li>Maintaining a sufficient strength in the Assurance process
<li>Maintaining a sufficient strength in the Assurance process (web-of-trust) to meet the agreed needs of the Community. (web-of-trust) to meet the agreed needs of the Community. </li>
</li></ul> </ul>
<p > <p>
</p>
<h2 >6. Subsidiary Policies</h2> <h2>6. Subsidiary Policies</h2>
<p>
<p > The Assurance Officer manages various exceptions and additional
The Assurance Officer manages various exceptions and additional processes. processes.
Each must be covered by an approved Subsidiary Policy (refer to Policy on Policy =&gt; COD1). Each must be covered by an approved Subsidiary Policy (refer to Policy
Subsidiary Policies specify any additional tests of knowledge required and variations to process and documentation, within the general standard stated here. on Policy =&gt; COD1).
<p > Subsidiary Policies specify any additional tests of knowledge required
Examples of expected subsidiary policies are these: and variations to process and documentation, within the general
standard stated here. </p>
<p>Examples of expected subsidiary policies are these:
</p>
<ul> <ul>
<li> <li>
<em>Remote Assurer Check;</em> <em>Remote Assurer Check;</em> </li>
</li>
<li> <li>
<em>Super Assurer Policy;</em> <em>Super Assurer Policy;</em> </li>
</li>
<li> <li>
<em> Junior Assurer Policy;</em> <em> Junior Assurer Policy;</em> </li>
</li>
<li> <li>
<em> Code Signing Policy;</em> <em> Code Signing Policy;</em> </li>
<li> <em>Organisation Assurance Policy and sub-policies
per country or region.</em>
</li> </li>
<li> </ul>
<em>Organisation Assurance Policy and sub-policies per country or region.</em> <p>
</li></ul> </p>
<p > <h3>Standard</h3>
<p>
Each Subsidiary Policy must augment and improve the general standards
<h3 >Standard</h3> in this Assurance Policy.
It is the responsibility of each Subsidiary Policy to describe how it
<p > maintains and improves the specific and overall goals.
Each Subsidiary Policy must augment and improve the general standards in this Assurance Policy. It must describe exceptions and potential areas of risk. </p>
It is the responsibility of each Subsidiary Policy to describe how it maintains and improves the specific and overall goals. <p></p>
It must describe exceptions and potential areas of risk. <h3>High Risk Applications</h3>
<p > <p>
In addition to the Assurance or Experience Points ratings set here in
<h3 >High Risk Applications</h3> and in other policies, Assurance Officer or policies can designate
certain applications as high risk.
<p > If so, additional measures may be added to the Assurance process that
In addition to the Assurance or Experience Points ratings set here in and in other policies, Assurance Officer or policies can designate certain applications as high risk. specifically address the risks.
If so, additional measures may be added to the Assurance process that specifically address the risks.
These may include: These may include:
</p>
<dl> <dl>
<dt>Additional information</dt> <dt>Additional information</dt>
<dd>Additional information can be required in process of assurance: <dd>Additional information can be required in process of
<ul> assurance:
<li>Unique numbers of identity documents; <ul>
</li> <li>Unique numbers of identity documents; </li>
<li>Photocopy of identity documents; <li>Photocopy of identity documents; </li>
</li> <li>Photo of User; </li>
<li>Photo of User; <li>Address of User. </li>
</li> </ul>
<li>Address of User. </dd>
</li></ul> </dl>
</dd></dl> <p>
<p >
Additional Information is to be kept by Assurer, attached to CAP form. Additional Information is to be kept by Assurer, attached to CAP form.
Assurance Points allocation by this assurance is unchanged. Assurance Points allocation by this assurance is unchanged.
User's CAcert (web)account should be annotated to record type of additional information: User's CAcert (web)account should be annotated to record type of
additional information:
</p>
<ul> <ul>
<li>Arbitration: <li>Arbitration:
<ul> <ul>
<li>Member to participate in Arbitration. <li>Member to participate in Arbitration. This confirms
This confirms their acceptance of the forum as well as trains in the process and import. their acceptance of the forum as well as trains in the process and
</li> import. </li>
<li>Member to file Arbitration to present case. <li>Member to file Arbitration to present case. This allows
This allows Arbitrator as final authority. Arbitrator as final authority. </li>
</li></ul> </ul>
</li> </li>
<li class="gap">Additional training; <li class="gap">Additional training;
</li> </li>
<li class="gap">Member to be Assurer (>= 100 Assurance Points and passed Assurer Challenge); <li class="gap">Member to be Assurer (&gt;= 100
</li> Assurance Points and passed Assurer Challenge); </li>
<li class="gap">Member agrees to additional specific agreement(s); <li class="gap">Member agrees to additional specific
</li> agreement(s); </li>
<li class="gap">Additional checking/auditing of systems data by CAcert support administrators; <li class="gap">Additional checking/auditing of systems
</li></ul> data by CAcert support administrators; </li>
<p > </ul>
Applications that might attract additonal measures include code-signing certificates and administration roles. <p>
<p > Applications that might attract additonal measures include code-signing
certificates and administration roles. </p>
<h2 >Privacy</h2> <p></p>
<h2>Privacy</h2>
<p > <p>
CAcert is a "privacy" organisation, and takes the privacy of its Members seriously. CAcert is a "privacy" organisation, and takes the privacy of its
The process maintains the security and privacy of both parties. Members seriously.
<p > The process maintains the security and privacy of both parties. </p>
Information is collected primarily to make claims within the certificates requested by users and to contact the Members. <p>Information is collected primarily to make claims within the
certificates requested by users and to contact the Members.
<br> <br>
It is used secondarily for training, testing, administration and other internal purposes. It is used secondarily for training, testing, administration and other
<p > internal purposes. </p>
The Member's information can be accessed under these circumstances: <ul> <p>The Member's information can be accessed under these
circumstances: </p>
<ul>
<li> <li>
Under Arbitrator ruling, in a duly filed dispute (<a class="http" href="http://www.cacert.org/policy/DisputeResolutionPolicy.html">Dispute Resolution Policy</a> =&gt; COD7) Under Arbitrator ruling, in a duly filed dispute (<a target="_blank" class="http" href="http://www.cacert.org/policy/DisputeResolutionPolicy.html">Dispute
</li> Resolution Policy</a> =&gt; COD7) </li>
<li>An Assurer in the process of an Assurance, as permitted on the CAP form. <li>An Assurer in the process of an Assurance, as permitted on
</li> the CAP form. </li>
<li>CAcert support administration and CAcert systems administration when operating under the authority of Arbitrator or under CAcert policy. <li>CAcert support administration and CAcert systems
</li></ul> administration
<p > when operating under the authority of Arbitrator or under CAcert
<a href="http://validator.w3.org/check?uri=referer"><img src="../Images/valid-xhtml11-blue" alt="Valid XHTML 1.1" height="31" width="88" style="border-style: none;" /></a> policy. </li>
</p> </ul>
</body> <p> <a href="http://validator.w3.org/check?uri=referer"><img src="../Images/valid-xhtml11-blue" alt="Valid XHTML 1.1" style="border-style: none;" height="31" width="88"></a>
</html> </p>
</body></html>
Loading…
Cancel
Save