Ballot SC-089: Mass Revocation Planning

Ballot overview

• Ballot SC-089 proposes adding a new subsection, Section 5.7.1.2 – Mass Revocation Planning, to the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates.
• The purpose is to require CAs to develop, maintain, and annually test a Mass Revocation Plan as part of their overall business continuity strategy.
• The ballot states this is already a requirement of the Mozilla Root Program.

What the ballot requires (as described in the provided evidence)

• CAs must have a mass revocation plan.
• As of December 1, 2025, CAs must assert in section 5.7.1 of their CPS or combined CP/CPS that they maintain a comprehensive and actionable plan for mass revocation events.
• The plan must include annual testing, and CAs must incorporate lessons learned from testing to continually improve preparedness.
• The plan must include clearly defined, actionable, and comprehensive procedures for rapid, consistent, and reliable response to large-scale certificate revocation scenarios.
• The CA is not required to publicly disclose the mass revocation plan, but must make it available to auditors upon request.
• The CA must annually test, review, and update the plan and procedures.
• The plan must include:
  • Activation criteria (specific, objective, measurable thresholds)
  • Customer contact information (storage, maintenance, and keeping details up to date)
  • Automation points (what is automated vs. requires manual intervention)
  • Targets and timelines (incident triage, revocation initiation, certificate replacement, and post-event review)
  • Subscriber notification methods
  • Role assignments (roles and responsibilities)
  • Training and education
  • Plan testing (annual operational testing using tabletop exercises, simulations, parallel testing, or controlled test environments that do not involve revocation of active Subscriber Certificates)
  • Post-test analysis and update schedule (how lessons learned are incorporated and how often the plan is reviewed/updated)

Review and voting process (as described in the provided evidence)

• Review Notice (IPR review period) is described as a 30-day review period for one Final Maintenance Guideline.
• Members with Essential Claims to exclude must forward a written Notice to Exclude Essential Claims to the Working Group Chair and submit a copy to the CA/B Forum public mailing list before the end of the Review Period.
• The ballot page states the bylaws requirements were MET, including voting thresholds for both Certificate Issuers and Certificate Consumers, and quorum.

Voting result (as described in the provided evidence)

• Voting Results show 29 voting YES and 0 voting NO, with 1 ABSTAIN in the Certificate Issuer category; and 3 voting YES in the Certificate Consumer category.
• The ballot page indicates the bylaws requirements were MET and the ballot is marked as passed in the provided evidence.