Ballot SC069: Clarify router and firewall logging requirements

Ballot overview

• Ballot SC069, Clarify router and firewall logging requirements, is a Final Maintenance Guideline for the TLS Baseline Requirements.
• The ballot aims to clarify what data needs to be logged under the Firewall and router activities logging requirement.
• It modifies the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, based on Version 2.0.2.

Voting and adoption

• Voting results: 26 issuer votes yes, 0 no, 0 abstain.
• Voting results: 2 consumer votes yes, 0 no, 0 abstain.
• Bylaw 2.3(6) requirements were met for issuer, consumer, and category participation thresholds.
• Quorum was 16 and this requirement was met.
• The ballot page states that the ballot was adopted.

IPR review

• Start of Review Period: 13 March 2024 at 18:00 UTC.
• End of Review Period: 13 April 2024 at 18:00 UTC.
• The evidence includes the IPR policy and exclusion notice template, but it does not explicitly state whether any exclusion notices were filed for this ballot.

Normative change

• Section 5.4.1 was changed so the CA must record relevant router and firewall activities, as described in Section 5.4.1.1.
• Log records must include at least:
  • Date and time of event
  • Identity of the person making the journal record, when applicable
  • Description of the event
• A new Section 5.4.1.1 was added for router and firewall activities logs.
• Logging of router and firewall activities necessary to meet Section 5.4.1, Subsection 3.6 must at a minimum include:
  • Successful and unsuccessful login attempts to routers and firewalls
  • All administrative actions on routers and firewalls, including configuration changes, firmware updates, and access control modifications
  • All changes to firewall rules, including additions, modifications, and deletions
  • All system events and errors, including hardware failures, software crashes, and system restarts

Effective date

• The redline artifact lists the ballot as SC69 with an effective date of 15-April-2024 in the revisions table.
• The ballot page also shows the document version as 15-April-2024.
• This is the compliance date for the adopted logging changes.