3 Impact of other papers

3.1.1 Decision paper 1: Governance and accreditation tells us why we need to accredit CAs. The key points to note are that:

• The introduction of a new CA affects all inter-agency applications.

• The security of government systems is reliant on CA processes.

3.1.2 Decision paper 1 made the following recommendations:

• that the SSC's E-government unit should manage the accreditation of CAs for S.E.E. PKI on behalf of the S.E.E. Governance Board.

• that government agencies wishing to run their own S.E.E. PKI CA will also be required to have their CA operations accredited.

3.1.3 Decision Paper 1 also discussed some audit options but made no formal recommendations on this topic.

3.1.4 Decision paper 2: Public sector, private sector and offshore CAs made the following recommendations:

• that before any CA may issue any S.E.E. PKI certificate, that CA must have been accredited by the S.E.E. Steering Group, in accordance with S.E.E. PKI Paper #8 - CA Accreditation.

• that the supply of digital certificates and associated PKI services for S.E.E. PKI be governed by New Zealand law.

3.1.5 Decision paper 9: Certificate Policy (CP) draws together the recommendations from all papers with respect to S.E.E. requirements on CAs.