From e3e373f3a152ca3efa5b160249ff560bc6e7cb82 Mon Sep 17 00:00:00 2001
From: Ian Grigg
Date: Thu, 13 May 2010 02:06:56 +0000
Subject: [PATCH] fixed 2.2.1.1 after discussion on Policy group
git-svn-id: http://svn.cacert.org/CAcert/Policies@1899 14b1bab8-4ef6-0310-b690-991c95c89dfd
---
SecurityPolicy.html | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/SecurityPolicy.html b/SecurityPolicy.html
index e6d8558..b67f8f0 100644
--- a/SecurityPolicy.html
+++ b/SecurityPolicy.html
@@ -48,6 +48,7 @@ a:hover {
+- 20100513: With some consensus from policy group, changed the text in 2.2.1.1 to transfer the detailed handling of pre-purchase risks to SM.
- 20100512: Some clarifying tweaks to semantics supplied by Philipp G, added Arb as a role in 9.1.1. but not as critical role.
- 20100511: Introduced "Board" term, tightened "approval" semantics, s/wiped/erased/, slight semantic tweaks.
- 20100502: Made 7.3 blank, "refer to SM"
@@ -281,7 +282,12 @@ Machines shall be housed in secured facilities (cages and/or locked racks).
2.2.1.1 Acquisition
-
+
+Equipment for critical purposes should be acquired
+in a way to minimise pre-acquisition security risks.
+
+
+
Acquisition of new equipment that is subject to a
pre-purchase security risk must be done from a
vendor that is regularly and commercially in business.