This is a translation of PolicyDrafts/OrganisationAssuranceGerman
DRAFT in Progress ...
It is made by using babelfish by a non-native-english-speaker - so it is _not_ good english. Native speakers, who would like to correct it, are welcome on board.
[Hi. I'm SteveHolden, a native English speaker. I'm also a director of the Python Software Foundation, and would like to say I'm happy to see you using MoinMoin. One important decision is whether to treat European English and American English as two separate languages :-)]. The Board have asked for help, so this is my way of supporting them.
See PolicyDrafts/OrganisationAssuranceGerman for updates and/or finish this translation.
Concept for CAcert Organization Assurance:
CAcert Organization Assurer (COA) driven Organization Assurance (OA)
Perhaps here (if not somewhere else) a brief note about the kind of organi{z,s}ations that might want to seek assurance, and why they might do so. SH
- An assurer of an organization (COA) needs both :
1/ * providing a proof of final legal training/study (eg. lawyer, Rechtspfleger, Clerk, Greffier) and OR 2/ * a proof of a completed juridical degree or training (eg. fully qualified lawyer, officer of justice) and * being already a CAcert Assurer with 150 points
How about Individuals who assure organizations should normally be an accepted member of the legal profession in their country of practice. SH
* CAcert Organization Assurer should assure organizations only from the countries, whose right system they were trained and/or whose right system they studied. OR * The Cacert organisation assurer should only be appointed if he/she is trained or graduated on the appropriate country legal system/ground and is knowledgeable for this.
How about Assurers may only practice in the countries in which they are legally qualified to do so. SH
The Assurance (process?) must be requested by the executive committee of the organization in by number entitled to act as substitute and/or be accordingly authorized the applicants and be proven this (note : hard to understand)
I read: The Assurance process must be requested by the executive committee (board?) of the organization or by an enough number of its members acting as a trusted substitute properly authorized
How about Requests for assurance can only be undertaken for organizations able to prove that the request has been properly authorized by an executive decision according to applicable constitutional and legal requirements (This is also a bit long-winded. Board motions are acceptable, a telephone call from the Chief Accountant is not. Do examples help?) SH.
The legal existence and main office place of the organization must be proven with an official document, which should not be older as one week and may not be older than one month. (is it a 1 week limit or 1 month limit ?) or in the middle ???
- If an official register exists, then a certified excerpt from the register must be provided.
- As far as possible the record document should be handed out or sent directly by the issuing place ("the register office") to the assurer.
- The assurer takes the documents to (fill?) the request. All documents are to be kept for 10 years.
This all seems to be trying to say what the assurer should accept as legal proof of corporate identity. Perhaps it would be easier to suggest that assurers must be prepared to defend their acceptance of a proof of identity in a court of law. That way the variations in jurisdiction need not affect the CPS SH
Trusted Third Parties (TTP) driven Organization Assurance
A special form must be filled out, and be signed by the executive committee of the organization in number entitled to act as substitute and provided with firm stamp. (see beyond)
The existence and agency authorization (legal identity?) (see beyond) of the organization must be proven with an official document, which should be not older as one week and may not be older than one month.
As far as official registers exist a certified exerrpt from the register must be submitted. (see beyond)
- The TTP confirms the existence of the organization and agency authorization (?) on the form.
- The forms have to be sent to an OA or at CAcert.
This is a situation where again the acceptable authority might vary from place to place, so we need to avoid local considerations somehow. SH
Organization Assurance Main Features
- Each organization is assigned a special Organization Master Account (OMA). With this account the following administrative tasks can be done:
- adding a domain (with verified by email request)
We should note that all email communications should be authenticated by encryption with a CAcert or other acceptable certificate. SH
- adding a organization unit (OU)
adding normal CAcert accounts as Organization Branch Accounts (OBA)
- allocation of OU to OBAs
- signing of server certificates
- generating client certificates
- signing of PGP keys
- adding a domain (with verified by email request)
- The Organization Branch Accounts (OBA) can do the following administrative tasks under use of the organization data and domains as well as the assigned organization units:
- signing of server certificates
- generating client certificates
- signing of PGP keys
Consequences of the changes in the life of the assured Organization
If changes occur in the agency authorization (existence or legal form of the organization?), the new agency-authorized (organization?) is justified (entitled?) to request the allocation (transfer?) of the organization to another OMA or the deletion of the organization in the CAcert systems and then to revoke of all the certificates issued for the organization.
How about If the assured organization ceases to exist CAcert may at its discretionn immediately add any certificates issued to the assured organization to its Certificate Revocation List (CRL). Transfer of an assured organizational identity to some other individual or organization will be made at CAcert's discretion only after the receipt of proof of legal title to the assured identity. Basically I'm trying to say that mergers and takeovers are acceptable, arbitrary changes aren't. But we also need to say who decides, a question I have not addressed as I was not a party to the discussion. SH
I suspect we should also add CategoryCertificationPracticesStatement and add this page to that category. SH