1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head><title>Organisation Assurance Policy</title></head>
<body>
<table width="100%">
<tr>
<td> OAP </td>
<td> </td>
<td width="20%"> Jens </td>
</tr>
<tr>
<td> POLICY <a href="http://wiki.cacert.org/wiki/TopMinutes-20070917">m20070918.x</a> </td>
<td> </td>
<td>
$Date: 2008-01-18 22:56:31 $
<!--
to get this to work, we have to do this:
svn propset svn:keywords "Date" file.html
except it does not work through the website.
-->
</td>
</tr>
<tr>
<td> COD11 </td>
<td> </td>
<td> </td>
</tr>
<tr>
<td> </td>
<td > <b>Organisation Assurance Policy</b> </td>
<td> </td>
</tr>
</table>
<h2> <a name="0"> 0. </a> Preliminaries </h2>
<p>
This policy describes how Organisation Assurers ("OAs")
conduct Assurances on Organisations.
It fits within the overall web-of-trust
or Assurance process of Cacert.
</p>
<p>
This policy is not a Controlled document, for purposes of
Configuration Control Specification ("CCS").
</p>
<h2> <a name="1"> 1. </a> Purpose </h2>
<p>
Organisations with assured status can issue certificates
directly with their own domains within.
</p>
<p>
The purpose and statement of the certificate remains
the same as with ordinary users (natural persons)
and as described in the CPS.
</p>
<ul><li>
The organisation named within is identified.
</li><li>
The organisation has been verified according
to this policy.
</li><li>
The organisation is within the jurisdiction
and can be taken to Arbitration.
</li></ul>
<h2> <a name="2"> 2. </a> Roles and Structure </h2>
<h3> <a name="2.1"> 2.1 </a> Assurance Officer </h3>
<p>
The Assurance Officer ("AO")
manages this policy and reports to the board.
</p>
<p>
The AO manages all OAs and is responsible for process,
the CAcert Organisation Assurance Programme form ("COAP"),
OA training and testing, manuals, quality control.
In these responsibilities, other Officers will assist.
</p>
<h3> <a name="2.2"> 2.2 </a> Organisation Assurers </h3>
<p>
</p>
<ol type="a"> <li>
An OA must be an experienced Assurer
<ol type="i">
<li>Have 150 assurance points.</li>
<li>Be fully trained and tested on all general Assurance processes.</li>
</ol>
</li><li>
Must be trained as Organisation Assurer.
<ol type="i">
<li> Global knowledge: This policy. </li>
<li> Global knowledge: A OA manual covers how to do the process.</li>
<li> Local knowledge: legal forms of organisations within jurisdiction.</li>
<li> Basic governance. </li>
<li> Training may be done a variety of ways,
such as on-the-job, etc. </li>
</ol>
</li><li>
Must be tested.
<ol type="i">
<li> Global test: Covers this policy and the process. </li>
<li> Local knowledge: Subsidiary Policy to specify.</li>
<li> Tests to be created, approved, run, verified
by CAcert only (not outsourced). </li>
<li> Tests are conducted manually, not online/automatic. </li>
<li> Documentation to be retained. </li>
<li> Tests may include on-the-job components. </li>
</ol>
</li><li>
Must be approved.
<ol type="i">
<li> Two supervising OAs must sign-off on new OA,
as trained, tested and passed.
</li>
<li> AO must sign-off on a new OA,
as supervised, trained and tested.
</li>
</ol>
</ol>
<h3> <a name="2.3"> 2.3 </a> Organisation Administrator </h3>
<p>
The Administrator within each Organisation ("O-Admin")
is the one who handles the assurance requests
and the issuing of certificates.
</p>
<ol type="a"> <li>
O-Admin must be Assurer
<ol type="i">
<li>Have 100 assurance points.</li>
<li>Fully trained and tested as Assurer.</li>
</ol>
</li><li>
Organisation is required to appoint O-Admin,
and appoint ones as required.
<ol type="i">
<li> On COAP Request Form.</li>
</ol>
</li><li>
O-Admin must work with an assigned OA.
<ol type="i">
<li> Have contact details.</li>
</ol>
</ol>
<h2> <a name="3"> 3. </a> Policies </h2>
<h3> <a name="3.1"> 3.1 </a> Policy </h3>
<p>
There is one policy being this present document,
and several subsidiary policies.
</p>
<ol type="a">
<li> This policy authorises the creation of subsidiary policies. </li>
<li> This policy is international. </li>
<li> Subsidiary policies are implementations of the policy. </li>
<li> Organisations are assured under an appropriate subsidiary policy. </li>
</ol>
<h3> <a name="3.2"> 3.2 </a> Subsidiary Policies </h3>
<p>
The nature of the Subsidiary Policies ("SubPols"):
</p>
<ol type="a"><li>
SubPols are purposed to check the organisation
under the rules of the jurisdiction that creates the
organisation. This does not evidence an intention
by CAcert to
enter into the local jurisdiction, nor an intention
to impose the rules of that jurisdiction over any other
organisation.
CAcert assurances are conducted under the jurisdiction
of CAcert.
</li><li>
For OAs,
SubPol specifies the <i>tests of local knowledge</i>
including the local organisational forms.
</li><li>
For assurances,
SubPol specifies the <i>local documentation forms</i>
which are acceptable under this SubPol to meet the
standard.
</li><li>
SubPols are subjected to the normal
policy approval process.
</li></ol>
<h3> <a name=""> </a> 3.3 Freedom to Assemble </h3>
<p>
Subsidiary Policies are open, accessible and free to enter.
</p>
<ol type="a"><li>
SubPols compete but are compatible.
</li><li>
No SubPol is a franchise.
</li><li>
Many will be on State or National lines,
reflecting the legal
tradition of organisations created
("incorporated") by states.
</li><li>
However, there is no need for strict national lines;
it is possible to have 2 SubPols in one country, or one
covering several countries with the same language
(e.g., Austria with Germany, England with Wales but not Scotland).
</li><li>
There could also be SubPols for special
organisations, one person organisations,
UN agencies, churches, etc.
</li><li>
Where it is appropriate to use the SubPol
in another situation (another country?), it
can be so approved.
(e.g., Austrian SubPol might be approved for Germany.)
The SubPol must record this approval.
</li></ol>
<h2> <a name="4"> 4. </a> Process </h2>
<h3> <a name="4.1"> 4.1 </a> Standard of Organisation Assurance </h3>
<p>
The essential standard of Organisation Assurance is:
</p>
<ol type="a"><li>
the organisation exists
</li><li>
the organisation name is correct and consistent:
<ol type="i">
<li>in official documents specified in SubPol.</li>
<li>on COAP form.</li>
<li>in CAcert database.</li>
<li>form or type of legal entity is consistent</li>
</ol>
</li><li>
signing rights:
requestor can sign on behalf of the organisation.
</li><li>
the organisation has agreed to the terms of the
Registered User Agreement,
and is therefore subject to Arbitration.
</li></ol>
<p>
Acceptable documents to meet above standard
are stated in the SubPol.
</p>
<h3> <a name="4.2"> 4.2 </a> COAP </h3>
<p>
The COAP form documents the checks and the resultant
assurance results to meet the standard.
Additional information to be provided on form:
</p>
<ol type="a"><li>
CAcert account of O-Admin (email address?)
</li><li>
location:
<ol type="i">
<li>country (MUST).</li>
<li>city (MUST).</li>
<li>additional contact information (as required by SubPol).</li>
</ol>
</li><li>
administrator account names (1 or more)
</li><li>
domain name(s)
</li><li>
Agreement with registered user agreement.
Statement and initials box for organsation
and also for OA.
</li><li>
Date of completion of Assurance.
Records should be maintained for 7 years from
this date.
</li></ol>
<p>
The COAP should be in English. Where translations
are provided, they should be matched to the English,
and indication provided that the English is the
ruling language (due to Arbitration requirements).
</p>
<h3> <a name="4.3"> 4.3 </a> Jurisdiction </h3>
<p>
Organisation Assurances are carried out by
CAcert Inc under its Arbitration jurisdiction.
Actions carried out by OAs are under this regime.
</p>
<ol type="a"><li>
The organisation has agreed to the terms of the
Registered User Agreement,
</li><li>
The organisation, the Organisation Assurers, CAcert and
other related parties are bound into CAcert's jurisdiction
and dispute resolution.
</li><li>
The OA is responsible for ensuring that the
organisation reads, understands, intends and
agrees to the registered user agreement.
This OA responsibility should be recorded on COAP
(statement and initials box).
</li></ol>
<h2> <a name="5"> 5. </a> Exceptions </h2>
<ol type="a"><li>
<b> Conflicts of Interest.</b>
An OA must not assure an organisation in which
there is a close or direct relationship by, e.g.,
employment, family, financial interests.
Other conflicts of interest must be disclosed.
</li><li>
<b> Trusted Third Parties.</b>
TTPs are not generally approved to be part of
organisation assurance,
but may be approved by subsidiary policies according
to local needs.
</li><li>
<b>Exceptional Organisations.</b>
(e.g., Vatican, International Space Station, United Nations)
can be dealt with as a single-organisation
SubPol.
The OA creates the checks, documents them,
and subjects them to to normal policy approval.
</li><li>
<b>DBA.</b>
Alternative names for organisations
(DBA, "doing business as")
can be added as long as they are proven independently.
E.g., registration as DBA or holding of registered trade mark.
This means that the anglo law tradition of unregistered DBAs
is not accepted without further proof.
</li></ol>
|
