Audit logs and audit summaries shall be backed up at least monthly. A copy of the audit log shall be sent off-site on a monthly basis. Audit Collection System The audit log collection system may or may not be external to the ACA system. Automated audit processes shall be invoked at system (or application) startup, and cease only at system (or application) shutdown. Vulnerability Assessments Archive The ACA archive records shall be sufficiently detailed as to verify that the ACA was properly operated as well as verify the validity of any certificate (including those revoked or expired) issued by the ACA. Types of Events Archived At a minimum, the following data shall be recorded for archive in accordance with each assurance level: Data to be Archived Rudimentary Basic Medium High CA accreditation X X X X Certificate Policy X X X X Certification Practice Statement X X X X Contractual obligations X X X X Other agreements concerning operations of the CA X X X X System and equipment configuration X X X X Modifications and updates to system or configuration X X X X Certificate requests X X X X Revocation requests X X X Subscriber identity authentication data X X X Documentation of receipt and acceptance of certificates X X X Subscriber agreements X X X Documentation of receipt of tokens (if applicable) X X X All certificates issued or published X X X X Rudimentary Basic Medium High Data to be Archived Record of CA re-key X X X X All CRLs issued and/or published X X X Other data or applications to verify archive contents X X X Compliance Auditor reports X X X Any changes to audit parameters, e.g., audit frequency, X X X type of events audited Any attempt to delete or modify the audit log X X X Whenever the CA generates a key (not mandatory for X X X X single-session or one-time-use symmetric keys) All access to the certificate subject private keys retained X X X X within the CA for key recovery purposes All changes to the trusted public keys, including X X X X additions and deletions
Audit logs and audit summaries shall be backed up at least monthly. A copy of the audit log shall be sent off-site on a monthly basis. Audit Collection System The audit log collection system may or may not be external to the ACA system. Automated audit processes shall be invoked at system (or application) startup, and cease only at system (or application) shutdown. Vulnerability Assessments Archive The ACA archive records shall be sufficiently detailed as to verify that the ACA was properly operated as well as verify the validity of any certificate (including those revoked or expired) issued by the ACA. Types of Events Archived At a minimum, the following data shall be recorded for archive in accordance with each assurance level: Data to be Archived Rudimentary Basic Medium High CA accreditation X X X X Certificate Policy X X X X Certification Practice Statement X X X X Contractual obligations X X X X Other agreements concerning operations of the CA X X X X System and equipment configuration X X X X Modifications and updates to system or configuration X X X X Certificate requests X X X X Revocation requests X X X Subscriber identity authentication data X X X Documentation of receipt and acceptance of certificates X X X Subscriber agreements X X X Documentation of receipt of tokens (if applicable) X X X All certificates issued or published X X X X Data to be Archived Rudimentary Basic Medium High Record of CA re-key X X X X All CRLs issued and/or published X X X Other data or applications to verify archive contents X X X Compliance Auditor reports X X X Any changes to audit parameters, e.g., audit frequency, type of events audited X X X Any attempt to delete or modify the audit log X X X Whenever the CA generates a key (not mandatory for single-session or one-time-use symmetric keys) X X X X All access to the certificate subject private keys retained within the CA for key recovery purposes X X X X All changes to the trusted public keys, including additions and deletions X X X X
update052312w9.docx