Ballot SMC04: Addition of ETSI TS 119 411-6 to audit standards

Ballot overview

• Ballot SMC04 adds ETSI TS 119 411-6 to the audit standards for the S/MIME Baseline Requirements.
• The ballot also makes related corrections, including clarifying the revisions table to distinguish publication date from additional compliance dates.
• The ballot modifies the S/MIME Baseline Requirements to Version 1.0.2.

Voting and IPR results

• The voting period completed and the ballot passed.
• Bylaw requirements were met for Certificate Issuers, Certificate Consumers, and quorum.
• The IPR review period completed, no IPR Exclusion Notices were filed, and the ballot was adopted as of December 8, 2023.
• The new S/MIME BR were published to the CABF public website in accordance with the Bylaws.

Requirements introduced by the ballot

• CAs conducting audits under the S/MIME Baseline Requirements may use ETSI TS 119 411-6 v1.1.1 or newer as an audit scheme.
• The ETSI-based audit scheme includes normative references to ETSI EN 319 401, ETSI EN 319 411-1, and ETSI EN 319 411-2.
• Audit reports for audits conducted under ETSI standards must state whether the audit was a full audit or a surveillance audit and identify the criteria applied and evaluated, including ETSI TS 119 411-6.

Dates

• Discussion ran from October 25, 2023 17:00 UTC to November 1, 2023 17:00 UTC.
• The IPR review period ran from November 8, 2023 to 1700 UTC on December 8, 2023.
• The ballot was adopted as of December 8, 2023.
• The revisions table in the linked draft shows Version 1.0.2 with publication date TBD and an additional compliance date of September 15, 2024 for Transition end for Extant S/MIME CAs.
• The draft states that these requirements apply only to relevant events that occur on or after the relevant Effective Date described in Section 1.2.1.