Ballot 171 – Updating the ETSI standards in the CABF documents

Ballot overview

• Ballot 171 updates references in the CA/Browser Forum documents to newer ETSI standards.
• The motion changes several sections of the Baseline Requirements and EV Guidelines to replace ETSI TS 119 403 and ETSI TS 102 042 references with ETSI EN 319 403 and ETSI EN 319 411-1, and to add related audit and disclosure language.
• The ballot text also adds a readiness assessment requirement before issuing EV Certificates when certain ETSI audit conditions apply.

Voting result

• Voting on Ballot 171 is now closed.
• The CAs cast 13 YES, 0 NO, and 3 abstentions.
• The Browsers cast 1 YES, 0 NO, and 0 abstentions.
• The ballot passes.

Timing stated in the ballot

• The review period commenced at 2200 UTC on 17 June 2016.
• The review period closed at 2200 UTC on 24 June 2016.
• The voting period started immediately after the review period.
• The voting period closed at 2200 UTC on 1 July 2016.

Requirement changes described in the motion

• In the Baseline Requirements, section 1.6.3 References is updated to replace ETSI TS 119 403 with ETSI EN 319 403 and add ETSI EN 319 411-1.
• In section 8.2 Identity/qualification of assessor, the ETSI audit accreditation language is changed to ISO 17065 applying ETSI EN 319 403 requirements.
• In section 8.4 Topics covered by assessment, the national scheme reference is expanded to ETSI TS 102 042 / ETSI EN 319 411-1.
• In the EV Guidelines, section 8.2.1 Implementation is updated so EVCP policy may use ETSI EN 319 411-1.
• In section 8.2.2 Disclosure, public disclosure requirements are expanded to include ETSI EN 319 411-1.
• In section 17.1 Eligible audit schemes, ETSI EN 319 411-1 audit for EVCP policy is added.
• In section 17.4 pre-issuance readiness audit, a new readiness assessment requirement is added for CAs with a currently valid ETSI EN 319 411-1 audit for EVCP policy, and the existing readiness language is expanded to include ETSI EN 319 411-1 for EVCP policy.

Compliance timing

• The ballot text provides review and voting dates, but it does not state a separate effective date for the normative changes in the supplied evidence.