From fe0b2a2af05f409fcd96d0cc31d8ebf03d8286e1 Mon Sep 17 00:00:00 2001
From: Ian Grigg
This CCS creates a list of Primary or "root" documents known as Policies. @@ -107,7 +107,7 @@ wiki.cacert.org/PolicyDecisions.
-@@ -140,27 +140,27 @@ documents of higher status (DRAFT or POLICY). Copies should be eliminated where not being worked on.
-CAcert policies are required to be owned / transferred to CAcert. See PoP 6.2.
-Critical systems are defined by Security Policy.
-See Security Policy.
-Control of Hardware is the ultimate responsibility of the Board of CAcert Inc. @@ -171,9 +171,9 @@ The ownership responsibility is delegated by agreement to Oophaga.
-Critical software is defined by Security Policy. @@ -187,11 +187,11 @@ Critical software is defined by Security Policy.
See Security Policy.
-CAcert owns its code, or requires control over open source code in use @@ -225,17 +225,17 @@ and a registry of software under approved open source licences. -
This section applies to Root and Sub-root certificates, not to End-entity (subscriber, member) certificates.
-Certificates (Root and sub-root) are to be listed in the CPS.
-Creation and handling of Certificates @@ -244,37 +244,37 @@ Usage of Certificates is controlled by Certification Practice Statement.
-See Security Policy.
-Logs are defined by Security Policy.
-Changes to Hardware, Software and Root Certificates are logged according to Security Policy.
-See Security Policy.
-Types of critical member data is defined by Assurance Policy.
-Changes and access to critical member data @@ -287,7 +287,7 @@ collection and storage of critical member data is defined by Security Policy.
-Data retention is controlled by Security Policy and CAcert Community Agreement.