Working Groups PKIMM PKI Maturity Model (PKIMM)Categories description

Policies and documentation

Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices.

It consists of:

formal policies and practice statements for supported PKI services and use-cases
formal management of agreements between parties involved in the PKI
certificate and key management rules
roles and responsibilities in the management of the PKI
documented disclosure statements
maintenance and review of policies and documentation
code of practice for information security management, techniques and risk management

Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change.

The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties.

Category maturity levels description

Maturity level	Description
1 - Initial	There are no or limited policies and documentation.
2 - Foundational	The scope of policies is defined. Documented policies are not in the full scope and are not fully implemented and followed.
3 - Advanced	Documentation and policies are in the full scope implemented, including CP and CPS.
4 - Managed	Disclosure of information contains all relevant policies and documentation. CP and CPS are published and available. There is a documentation management in place that covers the policies and documentation.
5 - Optimized	Policies are periodically reviewed and updated according to the changes in the PKI and its environment, and organizational strategy and goals. Policies are followed and enforced, communicated and understood.

Requirements

ID	Requirement	Weight
`policy-scope`	The scope of policies is defined and documented	2
`certificate-policy`	Certificate policy is documented and published	5
`practice-statement`	Certification practice statement is documented and published	5
`disclosure-statement`	Disclosure statement is documented and published	4
`policy-review`	Policies are periodically reviewed and updated	3
`validation-requirements`	Certificate validation requirements are documented, implemented, and verified	5

Details

The scope of policies is defined and documented

Guidance

Each PKI implementation and use case is different, therefore it requires different care. The scope of policies that are applicable for the implementation should be defined and documented. When the proper description of the policies scope is provided, it helps all parties involved to understand the purpose of the policies and their applicability.

The scope can include the following:

Identification of the policies required for the implementation
Reasoning why the policies are required or not required
Structure of policies and documentation
List of policies with references, versions, etc.
Any other relevant information

Assessment

The scope of policies is defined and documented
The scope of policies is complete
Interview with the management and PKI responsible personnel to confirm the scope

References

Certificate policy is documented and published

Guidance

Certificate Policy (CP) is used to establish the controls of the issuing party and the roles and responsibilities of its entities for the specific PKI implementation and use case. It's used to provide assurance to partners and show the trustworthiness by the use of standards. It can be considered as a high level contract between the parties involved in the PKI and therefore should be published and available to all parties involved.

CPs are described in a document form where the content may differ. Multiple policies can be part of a single document for different use cases. A CP contains a set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements or level of security (for instance certificates for the purpose of: persons, domains, organizations, authenticity and confidentiality, services). To uniquely identify the purpose of the certificates the CP contains unique numbers (Object Identifier, OID) which needs to be registered.

In general a CP addresses the following items:

Types of certificates
Document name and identification
PKI participants
Certificate usage
Policy administration
Definitions
Publication and repository responsibilities
Identification and authentication
Certificate life-cycle operational requirements
Facility management and operational controls
Technical security controls
Certificate, CRL, and OCSP profiles
Compliance audit and other assessments
- Other business and legal matters

Assessment

The CP is properly documented in its full scope
The CP clearly defines the scope of the policy, such as the purpose of the security and assurance levels, the type and use of its certificates and parties involved
The legal rights and responsibilities of parties are described in the CP
CP has listed correct object identifiers for the purpose it's used for
Verify that the CP is published and available to all parties involved
Interview with the management and PKI responsible personnel to confirm the CP is accurate and followed

References

Certification practice statement is documented and published

Guidance

In addition to a CP, there is typically a Certification Practice Statement (CPS). While a CP is more at a strategic level, detailed information about how things should be carried out is part of a CPS (tactical level). The CP and CPS can be combined into a single managed document, however they are typically split for most of the PKI implementations for better orientation.

The CPS covers the same items as the CP, but includes technical detail of how the CP is implemented. All parties involved in the PKI should be aware of the CPS and follow it. The CPS is a living document that is continuously updated and changed as technologies, security, and compliance requirements change.

Assessment

The CPS is properly documented in its full scope
CPS is published and available to all parties involved
Interview with the management and PKI responsible personnel to confirm the CPS is accurate and followed
Confirm that the information in the CPS is consistent with the information in the CP

References

Disclosure statement is documented and published

Guidance

The disclosure statement (DS) is a document that describes the PKI and its services. It refers to a document that discloses the relevant information about the CA and its services to the relying parties.

It typically includes information like:

CA's identity, legal status, and contact information
Certificate types, verification procedures and compliance with standards
Reliance limits
Obligations of the CA and the relying parties
Warranty and liability limitations
Agreement, CP and CPS
Privacy policy
Refund policy and claims
Information on audit and compliance

The purpose of a DS is to provide transparency to relying parties, allowing them to assess the trustworthiness and reliability of the CA before relying on its certificates.

Assessment

The DS is properly documented in its full scope
DS is published and available to all parties involved
Interview with the management and PKI responsible personnel to confirm the DS is accurate
Confirm that the information in the DS is consistent with the information in the CP and CPS

References

ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates; Part 1: General requirements

Policies are periodically reviewed and updated

Guidance

Policies are living documents that are continuously updated and changed as technologies, security, and compliance requirements change. The policies should be reviewed and updated periodically. The frequency of review should be determined by the organization. Good practice is to review policies at least annually or when there are significant changes in the PKI or its environment.

Assessment

The policies are reviewed and updated periodically
Check the last review date of the policies
Implementation of review process
Validation of documentation and reviews
Interview with the management and PKI responsible personnel to confirm the policies are reviewed and updated periodically

References

Certificate validation requirements are documented, implemented, and verified

Guidance

Trust decisions are only as strong as the rules used to make them. A component that consumes certificates makes a security decision every time it accepts one, and that decision is governed by the validation requirements applied to it, whether or not those requirements have been written down.

The applicable requirements may already exist in a certificate policy, a certification practice statement, a relying party agreement, a security standard, or an operational procedure. A separate document is not expected. What is expected is that the requirements are identified, that they are implemented in the components that consume certificates, and that the implementation is verified.

The requirements should cover:

certification path construction and path validation, and the trust anchors accepted for each use case
the enforcement of name constraints, key usage, and extended key usage
the certificate policy identifiers that are required or rejected
the verification that the certificate identifies the subject the consuming component expects
the treatment of certificate validity, including rejection of expired or not yet valid certificates
the revocation mechanisms that are used, the status freshness that is acceptable, and the behavior when the status cannot be determined

A valid certification path does not by itself establish that a certificate is the right one to accept. A correctly issued certificate for a different subject may pass path validation, because the identity the consuming component expects is not something the path itself expresses.

A trust anchor is trusted input to path validation rather than a certificate validated within the path. Trust in an anchor is therefore withdrawn by removing, replacing, disabling, or constraining it in the components that hold it, not by revocation.

A confirmed revoked status is not a decision to be taken; the certificate is rejected. The deliberate decision applies to the outcomes that leave the status undetermined, such as an unknown status, a stale or malformed response, an unreachable responder, or the absence of any usable status source. Validity and revocation are evaluated at the validation time that applies to the use case, which for long-term signature validation may be the time of signing rather than the present.

Approved algorithms and parameters are governed under the cryptography category. This requirement applies to the certificate-consuming components within the assessed PKI environment and its use cases.

Assessment

Documented validation requirements for the certificate-consuming components in scope, whether held in a dedicated document or in existing policies, agreements, standards, or procedures
The documented requirements cover each use case and each class of certificate-consuming component in scope
Evidence that the deployed trust stores and validation settings match the documented requirements
Functional evidence that a certificate is rejected when the path, the subject identity, the intended purpose, or the validity does not meet the documented requirements
Documented behavior when revocation status cannot be determined, with justification
Documented and approved deviations from the requirements