Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

8 COMPLIANCE AUDIT AND OTHER ASSESSMENTS
The Raytheon Policy Management Authority, working with the Raytheon Operational Authority
shall have a compliance audit mechanism in place to ensure that the requirements of applicable
MOAs, this CP and applicable CPS are being implemented and enforced.
8.1 Frequency or Circumstances of Assessments
The CAs, RAs, and CSAs shall be subject to a periodic compliance audit at least once per year.
The CAs have the right to require periodic and aperiodic compliance audits or inspections of
subordinate CA or RA operations to validate that the subordinate entities are operating in
accordance with the security practices and procedures described in their respective CPS.
Further, the RPMA has the right to require aperiodic compliance audit of the RRCA (and, when
needed, their subordinate CAs) and Raytheon Signing CAs that interoperate with the Raytheon
CAs under this CP. The RPMA shall state the reason for any aperiodic compliance audit.
8.2 Identity and Qualifications Of Assessor
The compliance auditor shall demonstrate competence in the field of compliance audits, and
shall be thoroughly familiar with requirements of this CP. The compliance auditor must perform
such compliance audits as a primary responsibility. The applicable CPS shall identify the
compliance auditor and justify the compliance auditor's qualifications.
8.3 Assessor’s Relationship To Assessed Entity
The compliance auditor shall be a private firm, which is independent from the entity being
audited.
8.4 Topics Covered By Assessment
The purpose of a compliance audit shall be to verify that a component operates in accordance
with this CP, applicable CPS, and the applicable MOAs between the Raytheon PKI, CertiPath,
and other Entities (e.g. Federal PKI).
8.5 Actions Taken as a Result of Deficiency
The RPMA may determine that a CA is not complying with its obligations set forth in this CP or
the respective MOA. When such a determination is made, the RPMA may suspend operation of
a noncompliant CA it controls, or may direct the Raytheon Operational Authority to cease
interoperating with the affected CA (e.g., by revoking the cross or subordinate certificate issued
to the CA), or may direct that other corrective actions be taken which allow interoperation to
continue. If the compliance auditor finds a discrepancy between how the CA is designed or is
being operated or maintained, and the requirements of this CP, the MOA, or the applicable
CPS, the following actions shall be performed:
� The compliance auditor shall note the discrepancy;
� The compliance auditor shall notify the CA of the discrepancy. The CA shall notify the
RPMA promptly;
� The party responsible for correcting the discrepancy shall determine what further
notifications or actions are necessary pursuant to the requirements of this CP and the
MOA, and then proceed to make such notifications and take such actions without delay.
Depending upon the nature and severity of the discrepancy, and how quickly it can be
corrected, the RPMA may decide to halt temporarily operation of a Raytheon CA, to revoke a
73 7/25/2011