Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

Auditable Event CA CSA RA
Software error conditions X X X
Software check integrity failures X X X
Receipt of improper messages X X X
Misrouted messages X X X
Network attacks (suspected or confirmed) X X X
Equipment failure X - -
Electrical power outages X - -
Uninterruptible Power Supply (UPS) failure X - -
Obvious and significant network service or access failures X - -
Violations of Certificate Policy X X X
Violations of Certification Practice Statement X X X
Resetting Operating System clock X X X
5.4.2 Frequency of Processing Audit Logs
Audit logs shall be reviewed at least once every 30 days. Statistically significant sample of
security audit data generated by the CA, CSA, or RA since the last review shall be examined
(where the confidence intervals for each category of security audit data are determined by the
security ramifications of the category and the availability of tools to perform such a review), as
well as a reasonable search for any evidence of malicious activity. The Audit Administrator shall
explain all significant events in an audit log summary. Such reviews involve verifying that the
log has not been tampered with, there is no discontinuity or other loss of audit data, and then
briefly inspecting all log entries, with a more thorough investigation of any alerts or irregularities
in the logs. Actions taken as a result of these reviews shall be documented.
5.4.3 Retention Period for Audit Logs
Audit logs shall be retained onsite for at least sixty days as well as being retained in the manner
described below. For the CA and CSA the Audit Administrator shall be the only person
responsible to manage the audit log (e.g., review, backup, rotate, delete, etc.). For the RA
System, a System Administrator other than the RA shall be responsible for managing the audit
log.
5.4.4 Protection of Audit Logs
System configuration and procedures shall be implemented together to ensure that:
� Only authorized people 5 have read access to the logs;
� Only authorized people may archive audit logs; and,
� Audit logs are not modified.
The person performing audit log archive need not have modify access, but procedures must be
implemented to protect archived data from destruction prior to the end of the audit log retention
period (note that deletion requires modification access). Audit logs shall be moved to a safe,
secure storage location separate from the CA equipment.
5 For the CA and CSA, the authorized individual shall be the Audit Administrator. For the RA system, the
authorized individual shall be a system administrator other than the RA.
52 7/25/2011