Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

Medium-CBPsoftware
Medium-hardware
or Medium-CBPhardware
High-hardware
consequences of data compromise are moderate. This may
include transactions having substantial monetary value or risk of
fraud, or involving access to private information where the
likelihood of malicious access is substantial. Subscriber private
keys are stored in software at this assurance level.
This level is relevant to environments where risks and
consequences of data compromise are moderate. This may
include transactions having substantial monetary value or risk of
fraud, or involving access to private information where the
likelihood of malicious access is substantial. Subscriber private
keys are stored in hardware at this assurance level.
This level is relevant to environments where risks and
consequences of data compromise are high. This may include
transactions having high monetary value or risk of fraud, or
involving access to private information where the likelihood of
malicious access is high. Subscriber private keys are stored in
hardware at this assurance level.
1.3.6.1 Factors in Determining Usage
The Relying Party must first determine the level of assurance required for an application, and
then select the certificate appropriate for meeting the needs of that application. This shall be
determined by evaluating various risk factors including the value of the information, the threat
environment, and the existing protection of the information environment. These determinations
are made by the Relying Party and are not controlled by the RPMA or the Raytheon Operational
Authority. Nonetheless, this CP contains some helpful guidance, set forth herein, which Relying
Parties may consider in making their decisions.
1.3.6.2 Obtaining Certificates
This CP requires publication and access to CA certificates and CRL. This CP imposes no
requirements in terms of publication and access to end entity (i.e., subscriber) certificates. The
relying party applications must make their own agreement for obtaining the subscriber
certificates. This could be trivially done for signature applications by including the signer
certificate in the application protocol. For encryption applications, the relying party must
develop a means to access subscriber certificates. Use of X.500 and LDAP Repositories is one
way to achieve this, but this or no mechanism is mandated by this CP.
1.4 Certificate Usage
1.4.1 Appropriate Certificate Uses
Certificates asserting a Policy OID defined in this document shall only be used for transactions
related to Raytheon business in accordance with Raytheon policy. CAs must state this
requirement in their CPS and impose a requirement on Subscribers to abide by this limitation.
1.4.2 Prohibited Certificate Uses
See section 1.4.1 above.
20 7/25/2011