Responsibilities in relation to the AUSkey Standard Certificate 4.1 There is no definition of in the ‘person’ The Certificate Holder and the Business must not: policy. We have received legal advice stating disclose the password for the AUSkey Standard Certificate to that extends to and includes any other person ‘person’ computers, systems and software. store the AUSkey Standard Certificate in a keystore to which any other person has access otherwise allow, grant, permit or enable any person other than the Certificate Holder to use the AUSkey Standard Certificate. 4.2 There is no definition of ‘compromised’ in the policy. The Certificate Holder and the Business must promptly advise We have received policy advice from the ABR CA if: AGIMO (who accredit the AUSkey the Certificate Holder is no longer authorised to use the AUSkey system) that any transfer of an AUSkey Standard Certificate on the Business' behalf off the computer that it was generated it becomes aware of any unauthorised use of the AUSkey on, onto another computer via the Standard Certificate internet (ie uploading to any form of cloud storage), constitutes a breach of the security of the AUSkey Standard Certificate or its password the terms and conditions. has been compromised. Responsibilities in relation to the AUSkey Device Certificate 4.1.1 Who can submit an application for a Device Certificate? Device custodians must hold pre-existing Standard AUSkeys for the An application for an AUSkey Device Certificate (to be held for a business, thus typically aren’t the Cloud Business Entity): provider. can only be made by an Administrator for that same Business  The Device Custodian creates the Entity, and password, which cannot be disclosed to any other (as per previous ‘person’ can only be made online through the AUSkey Manager, and  slide), and ensures the Device AUSkey is must nominate an individual who holds a valid AUSkey Standard  only used on the intended device, Certificate (for that same Business Entity) as the Device presumably requiring physical access to Custodian to be associated with that Device Certificate. installed sites, or some other form of assurance.
Responsibilities in relation to the AUSkey Standard Certificate 4.1 The Certificate Holder and the Business must not: disclose the password for the AUSkey Standard Certificate to any other person store the AUSkey Standard Certificate in a keystore to which any other person has access otherwise allow, grant, permit or enable any person other than the Certificate Holder to use the AUSkey Standard Certificate. There is no definition of ‘person’ in the policy. We have received legal advice stating that ‘person’ extends to and includes computers, systems and software. 4.2 The Certificate Holder and the Business must promptly advise the ABR CA if: the Certificate Holder is no longer authorised to use the AUSkey Standard Certificate on the Business' behalf it becomes aware of any unauthorised use of the AUSkey Standard Certificate the security of the AUSkey Standard Certificate or its password has been compromised. There is no definition of ‘compromised’ in the policy. We have received policy advice from AGIMO (who accredit the AUSkey system) that any transfer of an AUSkey off the computer that it was generated on, onto another computer via the internet (ie uploading to any form of cloud storage), constitutes a breach of the terms and conditions. Responsibilities in relation to the AUSkey Device Certificate 4.1.1 Who can submit an application for a Device Certificate? An application for an AUSkey Device Certificate (to be held for a Business Entity):  can only be made by an Administrator for that same Business Entity, and  can only be made online through the AUSkey Manager, and  must nominate an individual who holds a valid AUSkey Standard Certificate (for that same Business Entity) as the Device Custodian to be associated with that Device Certificate. Device custodians must hold pre-existing Standard AUSkeys for the business, thus typically aren’t the Cloud provider. The Device Custodian creates the password, which cannot be disclosed to any other ‘person’ (as per previous slide), and ensures the Device AUSkey is only used on the intended device, presumably requiring physical access to installed sites, or some other form of assurance.