14. Employees and Third Parties

14.1 Trustworthiness and Competence

As specified in BR Section 5.3.

14.2 Delegation of Functions to Registration Authorities and Subcontractors

14.2.1 General

Except as stated in Section 14.2.2 of this document, the CA MAY delegate the performance of all, or any part, of these Requirements to a Delegated Third Party, provided that the process as a whole fulfills all of the requirements of this document.

Before the CA authorizes a Delegated Third Party to perform a delegated function, the CA MUST contractually require the Delegated Third Party to:

1.Meet the qualification requirements of BR Section 5.3 when applicable to the delegated function,

2.Retain documentation in accordance with BR Section 5.4.1,

3.Abide by the other provisions of these Requirements that are applicable to the delegated function, and

4.Comply with (a) the CA’s Certificate Policy/Certification Practice Statement or (b) the Delegated Third Party’s practice statement that the CA has verified complies with these Requirements.

The CA MUST verify that the Signing Service and any other Delegated Third Party’s personnel involved in the issuance of a Certificate meet the training and skills requirements of Section 14 of this document and the document retention and event logging requirements of Section 15 of this document.

If a Delegated Third Party fulfills any of the CA’s obligations under Section 11.5 (High Risk Requests) of this document, the CA MUST verify that the process used by the Delegated Third Party to identify and further verify High Risk Certificate Requests provides at least the same level of assurance as the CA’s own processes.

14.2.2 Compliance Obligation

In all cases, the CA MUST contractually obligate each Delegated Third Party to comply with all applicable requirements in these Requirements and to perform them as required of the CA itself. The CA MUST enforce these obligations and internally audit each Delegated Third Party’s compliance with these Requirements on an annual basis.

14.2.3 Allocation of Liability

As specified in Section BR Sections 9.8 and 9.9.