From 98640e55f8236a55cddfa2ec54800e7a50834a24 Mon Sep 17 00:00:00 2001
From: Ian Grigg
CCS is formated, inspired and designed to meet the needs of
-
David Ross Criteria -
Certificate Authority Review Checklist
-- section A.1
-(
-
-DRC-A.1
-).
+- section A.1 (DRC-A.1)
CCS may be seen as the index to systems audit under DRC.
This CCS creates a
-list
-Controlled Document List (CDL)
+Controlled Document List (CDL)
of Primary or "root" documents known as Policies.
Primary documents may authorise other secondary documents
into the CDL, or "practices" outside the list.
@@ -110,57 +104,22 @@ into the CDL, or "practices" outside the list.
The Controlled Document List
-contains numbers, locations and
-versions
-status
+contains numbers, locations and status
of all controlled documents.
The list is part of this CCS.
-The list is part of this CCS, and is located at
-
-svn.cacert.org/CAcert/Policies/ControlledDocumentList.html.
-Policy Officer is to manage the list.
-Policy Officer is to log the changes at
-
-wiki.cacert.org/PolicyDecisions.
-
Change to the documents
- is as specified by
+is as specified by
Policy on Policy (PoP).
-Policy Officer is to manage the CDL.
- The following is now found in a WIP set of changes to PoP.
-Policies in effect (DRAFT and POLICY status) are to be under change control.
-Fully approved documents (POLICY status)
-are published on the CAcert website at
-
-www.cacert.org/policy/
-in plain HTML format,
-under the same control as critical source code
-under Security Policy (SP).
-Pre-final work (DRAFT status) and working documents (work-in-progress status)
-are made available on community-controlled version management systems
-(rooted at Subversion:
-
-svn.cacert.org/CAcert/Policies
-wiki:
-
-wiki.cacert.org/PolicyDrafts).
-Documents of lower status (work-in-progress or DRAFT)
-must not be confusable with
-documents of higher status (DRAFT or POLICY).
-Copies should be eliminated where not being worked on.
+Policy Officer is to manage the
+CDL.
+
Security Policy places executive responsibility for Hardware with the Board of CAcert Inc.
Access is delegated to Access Engineers (SP 2) and Systems Administrators (SP 3).
Legal ownership may be delegated by agreement to other organisations (SP 9.4).
-Control of Hardware is the ultimate responsibility of the Board of CAcert Inc.
-The responsibility for acts with hardware is delegated
-to Access Engineers and Systems Administrators as per
-Security Policy.
-The ownership responsibility is delegated by agreement to Oophaga.
-
Creation Date : 20091214
Editor: Iang
- Status: 20100426 WIP
+ Status: DRAFT p20100426
-
@@ -82,14 +82,9 @@ is derivative and is ruled by the CCS.
+
2.2 Change
2.3 Control
@@ -185,21 +144,12 @@ Critical systems are defined by Security Policy.
3.3 Control
- 4 Software
4.1 Controlled Software List
@@ -208,13 +158,18 @@ The ownership responsibility is delegated by agreement to Oophaga.
Critical software is defined by Security Policy.
Data retention is controlled by Security Policy and CAcert Community Agreement.
-
-
+Data retention is controlled by Security Policy and CAcert Community Agreement.
+