Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

� Any incident preventing a CA from issuing a CRL within 24 hours of the time specified in
the next update field of its currently valid CRL.
The ROA shall reestablish operational capabilities as quickly as possible in accordance with
procedures set forth in the respective CPS.
When Raytheon has detected an incident or compromise of the RRCA and/or Raytheon signing
CA, and upon approval by the Raytheon CISO, the Raytheon PMA shall notify the CertiPath
PMA.
The above measures will allow member entities to protect their interests as Relying Parties.
5.7.2 Computing Resources, Software, and/or Data are Corrupted
The CA shall maintain backup copies of system, databases, and private keys in order to rebuild
the CA capability in case of software and/or data corruption.
If a CA or CSA equipment is damaged or rendered inoperative, but the signature keys are not
destroyed; the operation shall be reestablished as quickly as possible, giving priority to the
ability to generate certificate status information. If a CA cannot issue a CRL prior to the time
specified in the next update field of its currently valid CRL, then all CAs that have been issued
certificates by the CA shall be securely 6 notified immediately. This will allow other CAs to
protect their subscribers' interests as Relying Parties.
The CA shall reestablish revocation capabilities as quickly as possible in accordance with
procedures set forth in the respective CPS. If revocation capability cannot be established in a
reasonable time-frame, the CA shall determine whether to request revocation of its certificate(s).
If the CA is a Root CA, the CA shall determine whether to notify all subscribers that use the CA
as a trust anchor to delete the trust anchor.
5.7.3 Private Key Compromise Procedures
If a CA signature keys are compromised, lost, or suspected to be compromised:
1. All cross certified CAs shall be securely notified at the earliest feasible time (so that
entities may issue CRLs revoking any cross-certificates issued to the CA);
2. A CA key pair shall be generated by the CA in accordance with procedures set forth in
the applicable CPS;
3. New CA certificates shall be requested in accordance with the initial registration process
as described in section 3.2.;
4. All Subscribers shall be notified and requested to register in accordance with the initial
registration process as described in section 3.2; and
5. If the CA is the Root CA, it shall provide the Subscribers the new trust anchor using
secure means.
The ROA shall also investigate what caused the compromise or loss, and what measures must
be taken to preclude recurrence.
If a CSA key is compromised, all certificates issued to the CSA shall be revoked, if applicable.
The CSA shall generate a new key pair and request new certificate(s), if applicable. If the CSA
is a trust anchor, the relying parties shall be provided the new trust anchor in a secure manner
(so that the trust anchor integrity is maintained) to replace the compromised trust anchor.
6 With confidentiality, source authentication, and integrity security services applied.
56 7/25/2011