You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
219 lines
9.3 KiB
HTML
219 lines
9.3 KiB
HTML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
|
|
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>
|
|
CACert Remote Assurance Policy (RAP)
|
|
</title>
|
|
</head>
|
|
<body>
|
|
<h1>
|
|
CACert Remote Assurance Policy (RAP)
|
|
</h1>
|
|
<p>
|
|
<a href="PolicyOnPolicy.html"><img src="images/cacert-wip.png" alt="CAcert Policy Status" height="31" width="88" style="border-style: none;" /></a><br />
|
|
Author: Sam Johnston<br />
|
|
Creation date: 2008-04-22<br />
|
|
Status: WIP 2008-04-22<br />
|
|
Next status: DRAFT 05-2008<br />
|
|
<!-- $Id$ -->
|
|
</p>
|
|
<h2>
|
|
0. Preliminaries
|
|
</h2>
|
|
<p>
|
|
This sub-policy extends the Assurance Policy ("AP") by specifying how assurances are to be remotely conducted for members where insufficient appropriate assurer(s) are available. A Remote Assurer ("RA") shall be assigned by a board-appointed Remote Assurance Officer ("RAO") to conduct the assurance to the satisfaction of the RAO using two Trusted Third Parties ("TTP"s).
|
|
</p>
|
|
<p>
|
|
Successful completion of the process shall result in the Assuree achieving the status of Assurer (eg the allocation of sufficient points to reach 100). However this status should not be considered permanent and the Assuree must seek assurance by the usual means as soon as practicable.
|
|
</p>
|
|
<h2>
|
|
1. Scope
|
|
</h2>
|
|
<p>
|
|
This sub-policy is restricted to members where insufficient appropriate local assurer(s) are available to reach Assurer status by the usual means within a 30 day period.
|
|
</p>
|
|
<h2>
|
|
2. Roles
|
|
</h2>
|
|
<h3>
|
|
2.1 Trusted Third Party ("TTP")
|
|
</h3>
|
|
<p>
|
|
Each of the TWO TTPs:
|
|
</p>
|
|
<ol style="list-style-type: lower-alpha;">
|
|
<li>MUST be <i><strong>verifiably practicing identification procedures</strong></i>, typically one of the following:<br />
|
|
<ol style="list-style-type: lower-roman;">
|
|
<li>
|
|
<strong>Accountant</strong> licensed and/or certified by the local authority (eg CPA)
|
|
</li>
|
|
<li>
|
|
<strong>Bank Manager</strong> of a branch of a banking institution
|
|
</li>
|
|
<li>
|
|
<strong>Justice of the Peace</strong> duly and verifiably elected or appointed
|
|
</li>
|
|
<li>
|
|
<strong>Lawyer</strong> currently practicing and registered with the bar association or equivalent
|
|
</li>
|
|
<li>
|
|
<strong>Notary Public</strong> authorised to authenticate documents in their jurisdiction
|
|
</li>
|
|
<li>
|
|
<strong>Other</strong> trusted local public figure as approved by RA (limited to one of the two TTPs)
|
|
</li>
|
|
</ol>
|
|
<p><i> Comment (iang): according to one discussion at least, it is suggested that: the type of quals/creds that are permissable to fulfill the role of TTP must be advised by an (O)Assurer to the board for each legal region. </i></p>
|
|
</li>
|
|
<li>MUST retain the Remote Assurance Form and a copy of the identity documents for at least 60 days and respond to enquiries in a timely fashion
|
|
</li>
|
|
<li>SHOULD have experience with the Remote Assurance Program, unless none are available within a 30 day period
|
|
</li>
|
|
<li>SHOULD be recommended to the Assuree by the RA where possible so as to improve security
|
|
</li>
|
|
</ol>
|
|
<h3>
|
|
2.2 Remote Assurance Officer ("RAO")
|
|
</h3>
|
|
<p>
|
|
Officer(s) managing the Remote Assurance Program:
|
|
</p>
|
|
<ol style="list-style-type: lower-alpha;">
|
|
<li>MUST be a full Assurer with 50 points
|
|
</li>
|
|
<li>MUST be appointed by the board.
|
|
</li>
|
|
<li>MUST be approve <i>(???)</i> each Remote Assurance.
|
|
</li>
|
|
<li>MUST report regularly to the board on program status and statistics.
|
|
</li>
|
|
</ol>
|
|
<h3>
|
|
2.3 Remote Assurer ("RA")
|
|
</h3>
|
|
<p>
|
|
An RA conducting assurances remotely using TTPs:
|
|
</p>
|
|
<ol style="list-style-type: lower-alpha;">
|
|
<li>MUST be a full Assurer
|
|
<i> (does this mean 50 experience points?) </i>
|
|
</li>
|
|
<li>MUST be approved by a board-appointed RAO
|
|
</li>
|
|
<li>MUST be satisfied as to the identity and competency of the TTP in identification procedures, as though they were to be conducting the assurance themselves
|
|
<p><i>iang: this clause would probably meet DRC C.9.a: "When the CA uses an external registration authority (RA), each RA is positively identified by CA personnel before being authorized to verify identities of subscribers and authorizations of individuals to represent organizational subscribers (see §A.2.v)."</i></p>
|
|
</li>
|
|
<li>SHOULD be the most senior Assurer available
|
|
</li>
|
|
<li>SHOULD have experience with the TTP program, unless none are available within a 30 day period
|
|
</li>
|
|
<li>MAY charge a reasonable fee for the service, provided that fee is disclosed in advance
|
|
</li>
|
|
</ol>
|
|
<h3>
|
|
2.4 Assuree
|
|
</h3>
|
|
<p>
|
|
An Assuree (the subject of an assurance) using the Remote Assurance program:
|
|
</p>
|
|
<ol style="list-style-type: lower-alpha;">
|
|
<li>MUST agree to be bound the CAcert Community Agreement (CCA), including the Disupute Resolution Policy (DRP)
|
|
</li>
|
|
<li>MUST justify to the Assurer as to why it is the standard processes are not appropriate
|
|
</li>
|
|
<li>MUST provide adequate identification to satisfy the prevailing Assurance Policy and the TTP
|
|
</li>
|
|
<li>MUST disclose any conflicts of interest (including but not limited to relationships with Assurers)
|
|
</li>
|
|
<li>MUST cover the costs of their assurance (if any), including fees imposed by TTPs and Assurers
|
|
</li>
|
|
</ol>
|
|
<h2>
|
|
3. Processes
|
|
</h2>
|
|
<h3>
|
|
3.1 Assurance
|
|
</h3>
|
|
<ol style="list-style-type: lower-alpha;">
|
|
<li>Assuree SHALL create a CAcert account and agree to the CAcert Community Agreement (CCA)
|
|
</li>
|
|
<li>Assuree SHOULD first attempt to use the usual means for assurance
|
|
</li>
|
|
<li>Assuree MUST request allocation of an RA from the RAO
|
|
</li>
|
|
<li>RA SHOULD refer Assuree to the most known, experienced and appropriate TTPs in preference to:<br />
|
|
<ol style="list-style-type: lower-roman;">
|
|
<li>unknown, inexperienced or inappropriate TTPs
|
|
</li>
|
|
<li>TTPs proposed by the Assuree
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
<li>Assuree SHALL have their identity verified by the TTP by:<br />
|
|
<ol style="list-style-type: lower-roman;">
|
|
<li>obtaining and printing two copies of the Remote Assurance Form (for paper forms only)
|
|
</li>
|
|
<li>taking two copies of any identity documents to be presented to the TTP
|
|
</li>
|
|
<li>meeting with the TTP in person and furnishing <strong>at least</strong> sufficient identification to meet the requirements of the prevailing Assurance Policy
|
|
</li>
|
|
<li>executing the Remote Assurance Form in duplicate, in the presence of the TTP (for paper forms only)
|
|
</li>
|
|
<li>leaving a Remote Assurance Form and copies of identity documents with the TTP for at least 60 days
|
|
</li>
|
|
<li>sending a Remote Assurance Form and copies of identity documents to the Assurer by mutually agreed medium (eg post, web form or encrypted email)
|
|
<p> <i>iang: this clause <B>is similar</B> to the requirement DRC C.9.b: "RAs provide the CA with complete documentation on each verified applicant for a certificate." What is different is that the criteria requires the TTP to send the form, not the Member.</i></p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
<li>RA MUST authenticate the TTP to their satisfaction by:<br />
|
|
<ol style="list-style-type: lower-roman;">
|
|
<li>searching for their details in an appropriate, official public registry (eg government site, association registry, telephone book)
|
|
</li>
|
|
<li>contacting the TTP using these details to verify their identity
|
|
</li>
|
|
<li>verifying that the TTP is suitable in terms of meeting the requirements of this policy
|
|
</li>
|
|
<li>verifying that the meeting did indeed take place and that the Assuree was adequately identified
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
<li>RA MUST submit their reports electronically for both TTPs to the RAO within 30 days of the date of the second TTP meeting
|
|
</li>
|
|
<li>RAO MUST approve or deny the Remote Assurance within 60 days of the date of the second TTP meeting
|
|
</li>
|
|
<li>RA and RAO MUST securely destroy all copies held no less than 60 days and no more than 90 days from the date of the second TTP meeting
|
|
</li>
|
|
<li>
|
|
<i> Suggested (iang, heard in a discussion, and following AP):</i><br />
|
|
<u> For each TTP, RAO approves the allocation of 35 Assurance Points, making 70 points. </u>
|
|
</li>
|
|
<li>
|
|
<i> Suggested (iang, heard in a discussion, and following AP):</i><br />
|
|
<u> Additionally, RAO may submit to the Board for the allocation of a further 30 Assurance Points, making 100 points available. </u>
|
|
</li>
|
|
<li>Disputes requiring access to the Remote Assurance Form and copies of identity documents must be handled within 60 days of the TTP meeting (after which time disputes MAY result in the Remote Assurance being revoked)
|
|
</li>
|
|
</ol>
|
|
<h2>
|
|
4. Documentation
|
|
</h2>
|
|
<h3>
|
|
4.1 Remote Assurance Form
|
|
</h3>
|
|
<p>
|
|
The Remote Assurance Form is to be completed (in duplicate for paper forms) and:
|
|
</p>
|
|
<ol style="list-style-type: lower-alpha;">
|
|
<li>SHALL include all information required by the Assurance Policy and Remote Assurance Policy
|
|
</li>
|
|
<li>SHOULD include a concise guide for Assurees and TTPs
|
|
</li>
|
|
<li>MUST be executed by the Assuree in the presence of the TTP (for paper forms)
|
|
</li>
|
|
</ol>
|
|
</body>
|
|
</html>
|