Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

4.9.8 Maximum Latency for CRLs
The maximum delay between the time a Subscriber certificate is revoked by a CA and the time
that this revocation information is available to Relying Parties shall be no greater than 24 hours.
4.9.9 Online Revocation Checking Availability
In addition to CRLs, CAs and Relying Party client software may optionally support on-line status
checking. Client software using on-line status checking need not obtain or process CRLs.
CSAs shall function in a manner that ensures that:
� Accurate and up-to-date information from the authorized CA is used to provide the
revocation status;
� Revocation status responses provide authentication and integrity services
commensurate with the assurance level of the certificate being checked.
If on-line revocation/status checking is supported by a CA, the latency of certificate status
information distributed on-line by the CA or its delegated status responders shall meet or
exceed the requirements for CRL issuance as stated in 4.9.7.
4.9.10 Online Revocation Checking Requirements
CAs are not required to operate a CSA covering the certificates they issue. The Raytheon PKI
Repository shall contain and publish a list of all CSAs operated by the Raytheon PKI.
Relying Parties may optionally use on-line status checking. Since Raytheon operates in some
environments that cannot accommodate on-line communications, all CAs shall be required to
support CRLs. Client software using on-line revocation checking need not obtain or process
CRLs.
4.9.11 Other Forms of Revocation Advertisements Available
Any alternate forms used to disseminate revocation information shall be implemented in a
manner consistent with the security and latency requirements for the implementation of CRLs
and on-line revocation and status checking.
4.9.11.1 Checking Requirements for Other Forms of Revocation
Advertisements
No stipulation.
4.9.12 Special Requirements Related To Key Compromise
None beyond those stipulated in Section 4.9.7.
4.9.13 Circumstances for Suspension
Suspension shall be permitted for certificates issued under the medium-hardware or medium-
CBP-hardware policies only, in the event that a user’s token is temporarily unavailable to them.
4.9.14 Who can Request Suspension
A human subscriber, human supervisor of a human subscriber, HR person for the human
subscriber, issuing CA, or RA may request suspension of a certificate.
39 7/25/2011