Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

It is acceptable for the system to over-write audit logs after they have been backed up and
archived.
5.4.5 Audit Log Backup Procedures
Audit logs and audit summaries shall be backed up at least once every 30 days. A copy of the
audit log shall be sent off-site in accordance with the CPS every 30 days.
5.4.6 Audit Collection System (internal vs. external)
The audit log collection system may or may not be external to the CA, CSA, or RA. Audit
processes shall be invoked at system startup, and cease only at system shutdown. Should it
become apparent that an automated audit system has failed, and the integrity of the system or
confidentiality of the information protected by the system is at risk, then the CA shall determine
whether to suspend CA operation until the problem is remedied.
5.4.7 Notification to Event-Causing Subject
This CP imposes no requirement to provide notice that an event was audited to the individual,
organization, device, or application that caused the event.
5.4.8 Vulnerability Assessments
The CA, system administrator, and other operating personnel shall be watchful for attempts to
violate the integrity of the certificate management system, including the equipment, physical
location, and personnel. The security audit data shall be reviewed by the audit administrator for
events such as repeated failed actions, requests for privileged information, attempted access of
system files, and unauthenticated responses. Security auditors shall check for continuity of the
security audit data. The audit administrator shall document the summary results of the period
review of the audit logs.
5.5 Records Archival
5.5.1 Types of Records Archived
CA, CSA, and RA archive records shall be sufficiently detailed to establish the proper operation
of the component or the validity of any certificate (including those revoked or expired) issued by
the CA.
Data To Be Archived CA CSA RA
Certification Practice Statement X X X
Contractual obligations X X X
System and equipment configuration X X -
Modifications and updates to system or configuration X X -
Certificate requests X - -
Revocation requests X - -
Subscriber identity authentication data as per Section 3.2.3 X N/A X
Documentation of receipt and acceptance of certificates X N/A X
Documentation of receipt of Tokens X N/A X
All certificates issued or published X N/A N/A
53 7/25/2011