From 886211b0f935afa70645329fb00f5ece7a26bee1 Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Tue, 23 Sep 2014 23:16:56 +0200
Subject: bug 1131: Yet some more updates by the Policy Officer

---
 www/policy/OrganisationAssurancePolicy.html        | 341 +++++++--------------
 .../OrganisationAssurancePolicy_Germany.html       |  32 +-
 2 files changed, 127 insertions(+), 246 deletions(-)
diff --git a/www/policy/OrganisationAssurancePolicy.html b/www/policy/OrganisationAssurancePolicy.html
index ab4f8c7..0474953 100644
--- a/www/policy/OrganisationAssurancePolicy.html
+++ b/www/policy/OrganisationAssurancePolicy.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8" lang="en">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" lang="en">
 <title> Organisation Assurance Policy </title>
 <style type="text/css">
 <!--
@@ -31,19 +31,17 @@
 </td>
 <td align="right" valign="top">
 	<a href="https://www.cacert.org/policy/PolicyOnPolicy.php">
-<img src="images/cacert-policy.png" alt="OAP Status - POLICY" style="border-style: none;" height="31" width="88">
-</a>
-
+		<img src="images/cacert-policy.png" alt="OAP Status - POLICY" style="border-style: none;" height="31" width="88">
+	</a>
 </td>
 </tr>
 </tbody>
 </table>
 </div>
 
-
 <h1> Organisation&nbsp;Assurance&nbsp;Policy </h1>
 
-<h2 id="g0.1">Preliminaries </h2>
+<h2 id="s0"> 0. Preliminaries </h2>
 
 <p>
 This policy describes how Organisation Assurers ("OAs")
@@ -57,7 +55,7 @@ This policy is not a Controlled document, for purposes of
 Configuration Control Specification ("CCS").
 </p>
 
-<h2 id="g0.2">Purpose </h2>
+<h2 id="s1"> 1. Purpose </h2>
 
 <p>
 Organisations with assured status can issue certificates
@@ -70,24 +68,20 @@ the same as with ordinary users (natural persons)
 and as described in the CPS.
 </p>
 
-<ul>
-<li>
+<ul><li>
     The organisation named within is identified.
-  </li>
-<li>
+  </li><li>
     The organisation has been verified according
     to this policy.
-  </li>
-<li>
+  </li><li>
     The organisation is within the jurisdiction
     and can be taken to CAcert Arbitration.
-</li>
-</ul>
+</li></ul>
 
 
-<h2 id="g0.3">Roles and Structure </h2>
+<h2 id="s2"> 2. Roles and Structure </h2>
 
-<h3 id="g0.3.1">Assurance Officer </h3>
+<h3 id="s2.1"> 2.1 Assurance Officer </h3>
 
 <p>
 The Assurance Officer ("AO")
@@ -105,100 +99,68 @@ The OA is appointed by the Board.
 Where the OA is failing the Board decides.
 </p>
 
-<h3 id="g0.3.2">Organisation Assurers </h3>
+<h3 id="s2.2"> 2.2 Organisation Assurers </h3>
 
 <p>
 </p>
 
-<ol type="a">
-
-<li>
+<ol type="a"> <li>
     An OA must be an experienced Assurer
-
     <ol type="i">
-
-        <li>Have 150 assurance points.</li>
-
-        <li>Be fully trained and tested on all general Assurance processes.</li>
-
+      <li>Have 150 assurance points.</li>
+      <li>Be fully trained and tested on all general Assurance processes.</li>
     </ol>
 
-</li>
-
-<li>
+  </li><li>
     Must be trained as Organisation Assurer.
-
     <ol type="i">
-
-        <li> Global knowledge:  This policy. </li>
-
-        <li> Global knowledge:  A OA manual covers how to do the process.</li>
-
-        <li> Local knowledge:   legal forms of organisations within jurisdiction.</li>
-
-        <li> Basic governance. </li>
-
-        <li> Training may be done a variety of ways,
-            such as on-the-job, etc. </li>
-
+      <li> Global knowledge:  This policy. </li>
+      <li> Global knowledge:  A OA manual covers how to do the process.</li>
+      <li> Local knowledge:   legal forms of organisations within jurisdiction.</li>
+      <li> Basic governance. </li>
+      <li> Training may be done a variety of ways,
+           such as on-the-job, etc. </li>
     </ol>
 
-</li>
-
-<li>
+  </li><li>
     Must be tested.
-
     <ol type="i">
-
-        <li> Global test:  Covers this policy and the process. </li>
-
-        <li> Local knowledge:   Subsidiary Policy to specify.</li>
-
-        <li> Tests to be created, approved, run, verified
-            by CAcert only (not outsourced). </li>
-
-        <li> Tests are conducted manually, not online/automatic. </li>
-
-        <li> Documentation to be retained. </li>
-
-        <li> Tests may include on-the-job components. </li>
-
+      <li> Global test:  Covers this policy and the process. </li>
+      <li> Local knowledge:   Subsidiary Policy to specify. </li>
+      <li> Tests to be created, approved, run, verified
+           by CAcert only (not outsourced). </li>
+      <li> Tests are conducted manually, not online/automatic. </li>
+      <li> Documentation to be retained. </li>
+      <li> Tests may include on-the-job components. </li>
     </ol>
 
-</li>
-
-<li>
+  </li><li>
     Must be approved.
-
     <ol type="i">
-
-        <li> Two supervising OAs must sign-off on new OA,
-            as trained, tested and passed.</li>
-
-        <li> AO must sign-off on a new OA,
-            as supervised, trained and tested.</li>
-
+      <li> Two supervising OAs must sign-off on new OA,
+           as trained, tested and passed.
+           </li>
+      <li> AO must sign-off on a new OA,
+           as supervised, trained and tested.
+           </li>
     </ol>
-
-</li>
-
-<li>The OA can decide when a CAcert
-    (individual) Assurer
-    has done several OA Application Advises to appoint this
-    person to OA Assurer.
-</li>
+    </li>
+	<li>The OA can decide when a CAcert
+	(individual) Assurer
+	has done several OA Application Advises to appoint this
+	person to OA Assurer.
+	</li>
 
 </ol>
 
-<h3 id="g0.3.3">Organisation Assurance Advisor ("OAA") </h3>
-
-<p>In countries/states/provinces where no OA Assurers are
+<h3 id="s2.3"> 2.3 Organisation Assurance Advisor ("OAA") </h3>
+<p>
+	In countries/states/provinces where no OA Assurers are
 	operating for an OA Application (COAP) the OA
 	can be advised by an experienced local CAcert
 	(individual) Assurer to take the decision
 	to accept the OA Application (COAP) of the organisation.
-	</p>
-
+</p>
 <p>
 	The local Assurer must have at least 150 Points,
 	should know the language, and know
@@ -206,7 +168,7 @@ Where the OA is failing the Board decides.
 </p>
 
 
-<h3 id="g0.3.4">Organisation Administrator </h3>
+<h3 id="s2.4"> 2.4 Organisation Administrator </h3>
 
 <p>
 The Administrator within each Organisation ("O-Admin")
@@ -214,48 +176,31 @@ is the one who handles the assurance requests
 and the issuing of certificates.
 </p>
 
-<ol type="a">
-<li>
+<ol type="a"> <li>
     O-Admin must be Assurer
-
     <ol type="i">
-
-        <li>Have 100 assurance points.</li>
-
-        <li>Fully trained and tested as Assurer.</li>
-
+      <li>Have 100 assurance points.</li>
+      <li>Fully trained and tested as Assurer.</li>
     </ol>
 
-</li>
-
-<li>
+  </li><li>
     Organisation is required to appoint O-Admin,
     and appoint ones as required.
-
     <ol type="i">
-
-        <li> On COAP Request Form.</li>
-
+      <li> On COAP Request Form.</li>
     </ol>
 
-</li>
-
-<li>
+  </li><li>
     O-Admin must work with an assigned OA.
-
     <ol type="i">
-
-        <li> Have contact details.</li>
-
+      <li> Have contact details.</li>
     </ol>
-
-</li>
-
 </ol>
 
-<h2 id="g0.4">Policies </h2>
 
-<h3 id="g0.4.1">Policy </h3>
+<h2 id="s3"> 3. Policies </h2>
+
+<h3 id="s3.1"> 3.1 Policy </h3>
 
 <p>
 There is one policy being this present document,
@@ -263,25 +208,19 @@ and several subsidiary policies.
 </p>
 
 <ol type="a">
-
-<li>  This policy authorises the creation of subsidiary policies. </li>
-
-<li>  This policy is international. </li>
-
-<li>  Subsidiary policies are implementations of the policy. </li>
-
-<li>  Organisations are assured under an appropriate subsidiary policy. </li>
-
+  <li>  This policy authorises the creation of subsidiary policies. </li>
+  <li>  This policy is international. </li>
+  <li>  Subsidiary policies are implementations of the policy. </li>
+  <li>  Organisations are assured under an appropriate subsidiary policy. </li>
 </ol>
 
-<h3 id="g0.4.2">Subsidiary Policies </h3>
+<h3 id="s3.2"> 3.2 Subsidiary Policies </h3>
 
 <p>
 The nature of the Subsidiary Policies ("SubPols"):
 </p>
 
-<ol type="a">
-<li>
+<ol type="a"><li>
     SubPols are purposed to check the organisation
     under the rules of the jurisdiction that creates the
     organisation.  This does not evidence an intention
@@ -291,159 +230,114 @@ The nature of the Subsidiary Policies ("SubPols"):
     organisation.
     CAcert assurances are conducted under the jurisdiction
     of CAcert.
-  </li>
-<li>
+  </li><li>
     For OAs,
     SubPol specifies the <i>tests of local knowledge</i>
     including the local organisation assurance COAP forms.
-  </li>
-<li>
+  </li><li>
     For assurances,
     SubPol specifies the <i>local documentation forms</i>
     which are acceptable under this SubPol to meet the
     standard.
-  </li>
-<li>
+  </li><li>
    SubPols are subjected to the normal
    policy approval process.
-</li>
-</ol>
+</li></ol>
 
-<h3 id="g0.4.3">Freedom to Assemble </h3>
+<h3 id="s3.3"> 3.3  Freedom to Assemble </h3>
 
 <p>
 Subsidiary Policies are open, accessible and free to enter.
 </p>
 
-<ol type="a">
-<li>
+<ol type="a"><li>
     SubPols compete but are compatible.
-  </li>
-<li>
+  </li><li>
     No SubPol is a franchise.
-  </li>
-<li>
+  </li><li>
     Many will be on State or National lines,
     reflecting the legal
     tradition of organisations created
     ("incorporated") by states.
-  </li>
-<li>
+  </li><li>
     However, there is no need for strict national lines;
     it is possible to have 2 SubPols in one country, or one
     covering several countries with the same language
     (e.g., Austria with Germany, England with Wales but not Scotland).
-  </li>
-<li>
+  </li><li>
     There could also be SubPols for special
     organisations, one person organisations,
     UN agencies, churches, etc.
-  </li>
-<li>
+  </li><li>
     Where it is appropriate to use the SubPol
     in another situation (another country?), it
     can be so approved.
     (e.g., Austrian SubPol might be approved for Germany.)
     The SubPol must record this approval.
-</li>
-</ol>
+</li></ol>
 
 
-<h2 id="g0.5">Process </h2>
+<h2 id="s4"> 4.  Process </h2>
 
-<h3 id="g0.5.1">Standard of Organisation Assurance </h3>
+<h3 id="s4.1"> 4.1  Standard of Organisation Assurance </h3>
 <p>
 The essential standard of Organisation Assurance is:
 </p>
 
-<ol type="a">
-<li>
+<ol type="a"><li>
     the organisation exists
-</li>
-
-<li>
+  </li><li>
     the organisation name is correct and consistent:
-
     <ol type="i">
-
-        <li>in official documents specified in SubPol.</li>
-
-        <li>on COAP form.</li>
-
-        <li>in CAcert database.</li>
-
-        <li>form or type of legal entity is consistent</li>
-
+      <li>in official documents specified in SubPol.</li>
+      <li>on COAP form.</li>
+      <li>in CAcert database.</li>
+      <li>form or type of legal entity is consistent</li>
     </ol>
-
-</li>
-
-<li>
+  </li><li>
     signing rights:
     requestor can sign on behalf of the organisation.
-</li>
-
-<li>
+  </li><li>
     the organisation has agreed to the terms of the
     CAcert Community Agreement
     and is therefore subject to Arbitration.
-</li>
-
-</ol>
+</li></ol>
 
 <p>
     Acceptable documents to meet above standard
     are stated in the SubPol.
 </p>
 
-<h3 id="g0.5.2">COAP </h3>
+<h3 id="s4.2"> 4.2  COAP </h3>
 <p>
 The COAP form documents the checks and the resultant
 assurance results to meet the standard.
 Additional information to be provided on form:
 </p>
 
-<ol type="a">
-<li>
+<ol type="a"><li>
     CAcert account of O-Admin (email address?)
-</li>
-<li>
+  </li><li>
     location:
-
     <ol type="i">
-
-        <li>country (MUST).</li>
-
-        <li>city (MUST).</li>
-
-        <li>additional contact information (as required by SubPol).</li>
-
+      <li>country (MUST).</li>
+      <li>city (MUST).</li>
+      <li>additional contact information (as required by SubPol).</li>
     </ol>
-
-</li>
-
-<li>
+  </li><li>
     administrator account name(s) (1 or more)
-</li>
-
-<li>
+  </li><li>
     domain name(s)
-</li>
-
-<li>
+  </li><li>
     Agreement with
     CAcert Community Agreement.
     Statement and initials box for organisation
     and also for OA.
-</li>
-
-<li>
+  </li><li>
     Date of completion of Assurance.
     Records should be maintained for 7 years from
     this date.
-</li>
-
-</ol>
+</li></ol>
 
 <p>
 The COAP should be in English.  Where translations
@@ -452,7 +346,7 @@ and indication provided that the English is the
 ruling language (due to Arbitration requirements).
 </p>
 
-<h3 id="g0.5.3">Jurisdiction </h3>
+<h3 id="s4.3"> 4.3 Jurisdiction </h3>
 
 <p>
 Organisation Assurances are carried out by
@@ -460,60 +354,45 @@ CAcert Inc. under its Arbitration jurisdiction.
 Actions carried out by OAs are under this regime.
 </p>
 
-<ol type="a">
-
-<li>
+<ol type="a"><li>
     The organisation has agreed to the terms of the
     CAcert Community Agreement.
-</li>
-
-<li>
+  </li><li>
     The organisation, the Organisation Assurers, CAcert and
     other related parties are bound into CAcert's jurisdiction
     and dispute resolution.
-</li>
-
-<li>
+  </li><li>
     The OA is responsible for ensuring that the
     organisation reads, understands, intends and
     agrees to the
     CAcert Community Agreement.
     This OA responsibility should be recorded on COAP
     (statement and initials box).
-</li>
+</li></ol>
 
-</ol>
-
-<h2 id="g0.6">Exceptions </h2>
+<h2 id="s5"> 5. Exceptions </h2>
 
-<ol type="a">
 
-<li>
+<ol type="a"><li>
     <b> Conflicts of Interest.</b>
     An OA must not assure an organisation in which
     there is a close or direct relationship by, e.g.,
     employment, family, financial interests.
     Other conflicts of interest must be disclosed.
-</li>
-
-<li>
+  </li><li>
     <b> Trusted Third Parties.</b>
     TTPs are not generally approved to be part of
     organisation assurance,
     but may be approved by subsidiary policies according
     to local needs.
-</li>
-
-<li>
+  </li><li>
     <b>Exceptional Organisations.</b>
     (e.g., Vatican, International Space Station, United Nations)
     can be dealt with as a single-organisation
     SubPol.
     The OA creates the checks, documents them,
     and subjects them to to normal policy approval.
-</li>
-
-<li>
+  </li><li>
     <b>DBA.</b>
     Alternative names for organisations
     (DBA, "doing business as")
@@ -521,9 +400,9 @@ Actions carried out by OAs are under this regime.
     E.g., registration as DBA or holding of registered trade mark.
     This means that the anglo law tradition of unregistered DBAs
     is not accepted without further proof.
-</li>
-
+  </li>
 </ol>
 
+
 </body>
 </html>
diff --git a/www/policy/OrganisationAssurancePolicy_Germany.html b/www/policy/OrganisationAssurancePolicy_Germany.html
index fea4187..da69e80 100644
--- a/www/policy/OrganisationAssurancePolicy_Germany.html
+++ b/www/policy/OrganisationAssurancePolicy_Germany.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8" lang="en">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" lang="en">
 <title>CACert Organisation Assurance Program sub-policy for Germany</title>
 <style type="text/css">
 <!--
@@ -33,15 +33,15 @@
 </td>
 <td align="right" valign="top">
 	<a href="https://www.cacert.org/policy/PolicyOnPolicy.php">
-<img src="images/cacert-policy.png" alt="OAP DE Status - POLICY" style="border-style: none;" height="31" width="88">
-</a>
-    </td>
- </tr>
+		<img src="images/cacert-policy.png" alt="OAP DE Status - POLICY" style="border-style: none;" height="31" width="88">
+	</a>
+</td>
+</tr>
 </tbody>
 </table>
 </div>
 
-<h2 id="g0.1">Preliminaries</h2>
+<h2 id="g0.1">0. Preliminaries</h2>
 This sub-policy describes how Organisation Assurers ("OAs") conduct assurances on German organisations.
 It fits within the overall web-of-trust or assurance process and the Organisation Assurance Policy (OAP) of CAcert.
 <br>
@@ -50,7 +50,7 @@ It fits within the overall web-of-trust or assurance process and the Organisatio
 
 <br>
 
-<h2 id="g0.2">Purpose</h2>
+<h2 id="g0.2">1. Purpose</h2>
 This is a subsidiary policy to the OAP.
 <br>
 
@@ -66,10 +66,11 @@ c.  In the below, where the Assurance Officer (AO) is referred to, this includes
 
 <br>
 
-<h2 id="g0.3">Organisation Assurers</h2>
+<h2 id="g0.3">2. Organisation Assurers</h2>
 
-<h2 id="g0.4">Requirements for the Organisation Assurer</h2>
-In addition to the requirements defined in the OAP, an OA must meet the following requirements for assuring German organisations:
+<h2 id="g0.4">3. Requirements for the Organisation Assurer</h2>
+In addition to the requirements defined in the OAP, an OA must meet the
+following requirements for assuring German organisations:
 <br>
 a. Knowledge on common legal forms of organisations in Germany.
 <br>
@@ -82,9 +83,9 @@ c. Should help the AO to define local requirements.
 
 <br>
 
-<h2 id="g0.5">Process</h2>
+<h2 id="g0.5">4. Process</h2>
 
-<h2 id="g0.6">Organisations</h2>
+<h2 id="g0.6">5. Organisations</h2>
 Acceptable organisations under this sub-policy must be:
 <br>
 
@@ -96,10 +97,11 @@ b. Organisations must not be revoked by a competent authority with direct oversi
 
 <br>
 
-<h2 id="g0.7">Documents</h2>
+<h2 id="g0.7">6. Documents</h2>
 The organisation has to provide documents to prove the essential standard of Organisation Assurance as defined in the policy:
 <br>
-a. The primary mechanism to prove existence is to get an official extract from the official register, either via an online interface
+a. The primary mechanism to prove existence is to get an official
+extract from the official register, either via an online interface
 or via physical means (organisation is asked to carry the costs)
 <br>
 b. Where not available, an official document will be required from the company, subject to such checks as defined by the AO.
@@ -116,7 +118,7 @@ f. The OA can ask for additional documents if needed to validate required inform
 
 <br>
 
-<h2 id="g0.8">COAP</h2>
+<h2 id="g0.8">7. COAP</h2>
 <p>
 In addition to the checks defined in the policy, the COAP form for German organisations requires:
 <br>
-- 
cgit v1.2.1

