All, Based on the comments received, I am inclined to clarify the proposed language under Issues #154 and #187 with reference to a CA's Bugzilla compliance bugs rather than "incidents". The existing language in section 2.4 of the MRSP already requires the CA to promptly file an Incident Report in Bugzilla for all incidents.
My proposal for Issue #154 is to add a final sentence to MRSP section 2.4 which would say, "If being audited according to the WebTrust criteria, the CA’s Management Assertion letter MUST include a complete list of the CA's Bugzilla compliance bugs that were unresolved at any time during the audit period." Under Issue #187, I propose that new item 11 in MRSP section 3.1.4 (required publicly-available audit documentation) would read: "11. a complete list of the CA’s Bugzilla compliance bugs that were unresolved at any time during the audit period." Regarding guidance on excluding bugs that are flagged as "Invalid" or "Duplicate" - I propose that we add a section to https://wiki.mozilla.org/CA/BR_Audit_Guidance and hyperlink to it from the words "CA's Bugzilla compliance bugs". The guidance would say that invalid or duplicate bugs do not need to be included in the list. Also, in response to Jeff's comment, if a bug is in an unresolved status spanning two audit periods, I think it should still appear in both management assertions and audit reports because one of the primary rationales for these requirements is to ensure that auditors are aware of the CA's compliance status. Thoughts? Thanks, Ben On Fri, Nov 6, 2020 at 10:36 AM Jeff Ward via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > On Thursday, October 22, 2020 at 1:53:40 PM UTC-5, Ben Wilson wrote: > > The purpose of this email is to begin public discussion on the addition > of > > a subsection 11 to section 3.1.4 of the Mozilla Root Store Policy. Issue > > #187 <https://github.com/mozilla/pkipolicy/issues/187> in GitHub > proposes > > to require audit reports to list all incidents occurring (or open) > during > > the audit period of which the auditor has been made aware or to state > that > > the auditor is unaware of any incidents. This is related to Issue #154 > > <https://github.com/mozilla/pkipolicy/issues/154> (management assertion > > disclosures). That proposal is to have section 2.4 read as follows: "If > > being audited to the WebTrust criteria, the Management Assertion letter > > MUST include all known incidents that occurred or were still > > open/unresolved at any time during the audit period." > > > > Proposed language may be found in the following commits: > > > > - > > > https://github.com/BenWilson-Mozilla/pkipolicy/commit/f6639f503b743aae402dc0f4841dc3dd5ba88753 > > - > > > https://github.com/BenWilson-Mozilla/pkipolicy/commit/6c07c44e4db473dc4d34009f1bc955a0e18cb4c1 > > - > > > https://github.com/BenWilson-Mozilla/pkipolicy/commit/5dec00e53b4c6361d85af7644660fe185fcf463d > > > > Proposed language for section 3.1.4 is: > > > > "11. all incidents (as defined in section 2.4) that occurred or were > still > > open/unresolved at any time during the audit period, or a statement that > > the auditor is unaware of any;" > > > > I look forward to your comments, suggestions and discussions. > > > > Ben > > Thanks for bringing this up Ben. It is important to consider this > requirement in conjunction with #154 and address them together. It seems > reasonable to require a CA to disclose all known incidents that are > applicable during a given period. It would be important, however, to define > “known incident” as a “verified bug” and exclude items such as bugs closed > as a duplicate, invalid, etc. It would also make sense to clarify that an > incident should only be disclosed once and eliminate duplication when an > incident spans two audit periods. > > Also keep in mind an auditor typically issues an opinion on management’s > assertion of its controls. Audit opinions do not make negative assurance > statements, such as not being aware of any incidents during the period. If > the CA is required to make this assertion, the auditor’s opinion will > consider that statement. > > Thanks, > > Jeff > _______________________________________________ > dev-security-policy mailing list > dev-security-policy@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-security-policy > _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
