Check of references; Check of credit/financial records. The period of investigation must cover at least the last five years for each area, except the residence check which must cover at least the last three years. Regardless of the date of award, the highest educational degree shall be verified. Factors revealed in a background that may be considered grounds for rejecting candidates for Trusted Positions or for taking action against an existing Trusted Person may include but is not limited to the following: Misrepresentations made by the candidate or Trusted Person Highly unfavorable or unreliable personal references Certain criminal convictions Indications of a lack of financial responsibility Training Requirements All personnel performing duties with respect to the operation of the CA or RA receive comprehensive training. Training shall be conducted in the following areas: CA (or RA) security principles and mechanisms; All PKI software versions in use on the CA (or RA) system; All PKI duties they are expected to perform; Disaster recovery and business continuity procedures; and Stipulations of this policy. Retraining Frequency and Requirements All individuals responsible for PKI roles shall be made aware of changes in the CA or RA operation. Any significant change to the operations shall have a training (awareness) plan, and the execution of such plan shall be documented. Examples of such changes are CA software or hardware upgrade, changes in automated security systems, and relocation of equipment. Documentation shall be maintained identifying all personnel who received training and the level of training completed. Job Rotation Frequency and Sequence No stipulation. Sanctions for Unauthorized Actions The CA take appropriate administrative and disciplinary actions against personnel who have performed actions involving the CA or its RA that are not authorized in this CP, CPSs, or other published procedures. Independent Contractor Requirements Contractors fulfilling trusted roles are subject to all personnel requirements stipulated in this policy. PKI vendors who provide any services shall establish procedures to ensure that any subcontractors perform in accordance with this policy and the CPS. Documentation Supplied to Personnel The CA shall make available to its personnel the CP they support, the CPS, and any relevant statues, policies, or contracts. Other technical, operations, and administrative documents (e.g.: Administrator Manual, User Manual, etc.) shall be provided in order for the trusted personnel to perform their duties.
Check of references; Check of credit/financial records. The period of investigation must cover at least the last five years for each area, except the residence check which must cover at least the last three years. Regardless of the date of award, the highest educational degree shall be verified. Factors revealed in a background that may be considered grounds for rejecting candidates for Trusted Positions or for taking action against an existing Trusted Person may include but is not limited to the following: Misrepresentations made by the candidate or Trusted Person Highly unfavorable or unreliable personal references Certain criminal convictions Indications of a lack of financial responsibility Training Requirements All personnel performing duties with respect to the operation of the CA or RA receive comprehensive training. Training shall be conducted in the following areas: CA (or RA) security principles and mechanisms; All PKI software versions in use on the CA (or RA) system; All PKI duties they are expected to perform; Disaster recovery and business continuity procedures; and Stipulations of this policy. Retraining Frequency and Requirements All individuals responsible for PKI roles shall be made aware of changes in the CA or RA operation. Any significant change to the operations shall have a training (awareness) plan, and the execution of such plan shall be documented. Examples of such changes are CA software or hardware upgrade, changes in automated security systems, and relocation of equipment. Documentation shall be maintained identifying all personnel who received training and the level of training completed. Job Rotation Frequency and Sequence No stipulation. Sanctions for Unauthorized Actions The CA take appropriate administrative and disciplinary actions against personnel who have performed actions involving the CA or its RA that are not authorized in this CP, CPSs, or other published procedures. Independent Contractor Requirements Contractors fulfilling trusted roles are subject to all personnel requirements stipulated in this policy. PKI vendors who provide any services shall establish procedures to ensure that any subcontractors perform in accordance with this policy and the CPS. Documentation Supplied to Personnel The CA shall make available to its personnel the CP they support, the CPS, and any relevant statues, policies, or contracts. Other technical, operations, and administrative documents (e.g.: Administrator Manual, User Manual, etc.) shall be provided in order for the trusted personnel to perform their duties.
WP05.1%20Attachment%20to%20WP05%20DRAFT_AeroMACS%20PKI%20Certificate%20Policy.docx