Home Similarity Diff BR Diff CS Diff EVG Diff SMIME Diff TLS

Home Show similarity Differences BR (in/out) Differences CS (in/out) Differences EVG (in/out) Differences SMIME (in/out) Differences TLS (in/out)

BR

CS

EVG

SMIME

TLS

BR

### 5.7.1 Incident and compromise handling procedures CA organizations shall have an Incident Response Plan and a Disaster Recovery Plan. The CA SHALL document a business continuity and disaster recovery procedures designed to notify and reasonably protect Application Software Suppliers, Subscribers, and Relying Parties in the event of a disaster, security compromise, or business failure. The CA is not required to publicly disclose its business continuity plans but SHALL make its business continuity plan and security plans available to the CA's auditors upon request. The CA SHALL annually test, review, and update these procedures. The business continuity plan MUST include: 1. The conditions for activating the plan, 2. Emergency procedures, 3. Fallback procedures, 4. Resumption procedures, 5. A maintenance schedule for the plan; 6. Awareness and education requirements; 7. The responsibilities of the individuals; 8. Recovery time objective (RTO); 9. Regular testing of contingency plans. 10. The CA's plan to maintain or restore the CA's business operations in a timely manner following interruption to or failure of critical business processes 11. A requirement to store critical cryptographic materials (i.e., secure cryptographic device and activation materials) at an alternate location; 12. What constitutes an acceptable system outage and recovery time 13. How frequently backup copies of essential business information and software are taken; 14. The distance of recovery facilities to the CA's main site; and 15. Procedures for securing its facility to the extent possible during the period of time following a disaster and prior to restoring a secure environment either at the original or a remote site.

EVG

### 5.7.1 Incident and compromise handling procedures

SMIME

### 5.7.1 Incident and compromise handling procedures CA operators SHALL have an Incident Response Plan and a Disaster Recovery Plan. The CA SHALL document a business continuity and disaster recovery procedures designed to notify and reasonably protect Application Software Suppliers, Subscribers, and Relying Parties in the event of a disaster, security compromise, or business failure. The CA is not required to publicly disclose its business continuity plans but SHALL make its business continuity plan and security plans available to the CA's auditors upon request. The CA SHALL annually test, review, and update these procedures. The business continuity plan SHALL include: 1. The conditions for activating the plan; 2. Emergency procedures; 3. Fallback procedures; 4. Resumption procedures; 5. A maintenance schedule for the plan; 6. Awareness and education requirements; 7. The responsibilities of the individuals; 8. Recovery time objective (RTO); 9. Regular testing of contingency plans; 10. The CA's plan to maintain or restore the CA's business operations in a timely manner following interruption to or failure of critical business processes; 11. A requirement to store critical cryptographic materials (i.e., secure cryptographic device and activation materials) at an alternate location; 12. What constitutes an acceptable system outage and recovery time; 13. How frequently backup copies of essential business information and software are taken; 14. The distance of recovery facilities to the CA's main site; and 15. Procedures for securing its facility to the extent possible during the period of time following a disaster and prior to restoring a secure environment either at the original or a remote site.