1. Best Practices Working Group June 19-21, 2001 Munich, Germany

2. Best Practices Agenda Working Day 1 – Wednesday, June 20  3:45 – 4:15 p.m.: Review last Meeting, Actions & Missions  4:15 – 5:15 p.m.: Review Documentation Submissions Working Day 2 - Wednesday, June 21  9:00 –9:20 a.m.: Recommended vs. Best Practices Discussion  9:20 –9:40 a.m.: Action re: Endorsing/Adopting Policies & Standards  9:40 - 10:00 a.m.: Project Overview - White Book  10:00 –10:30 a.m.: Delegation of White Papers within White Book  10:45 – 12:15 a.m.: Review & Actions

3. Best Practices: Session 1 Wednesday, June 20 3:45 – 4:15 p.m. REVIEW LAST MEETING, ACTIONS & MISSIONS Introduction of new attendees (pass business cards) Review Mission Statement: To reach a consensus on an agreed-upon set of internationally recognized standards, policies and audit procedures that ensure the overall integrity, effectiveness and interoperability of trusted PKI- enabled implementations. Discuss BP BWG member commitment Comments/Questions/Concerns re: San Jose meeting

4. Best Practices: Session 2 Wednesday, June 20 4:15 – 5:15 p.m. REVIEW DOCUMENTATION SUBMISSIONS Thank you for your contributions to date: Jeff Stapleton (KPMG) & Bill Franklin (nCipher) – Key Management Outline; AICPA Web-Trust AICPA Web-Trust Project Status: –Working Group Review: Statement drafted by J. Stapleton & B. Franklin endorsing X9.79 and Web-Trust CA as the full extent of recommended PKI Policies & Practices, was forwarded to both the BWG & TWG so that all members had an opportunity to comment –Comment Period Now Closed: All comments were to be addressed and all revisions made by June 18, 2001

5. Best Practices: Session 2 Continued Action Items: - Board to Review & Approve: in Munich - “Publish” in the PKI Forum Template: end of _______, 2001 (Action: PKI Forum)

6. Best Practices: Session 3 Thursday, June 21 9:00 – 9:20 a.m. RECOMMENDED VS. BEST PRACTICES DISCUSSION Discussion: Should we promote practices as "best" or "recommended“? Question: Should the name of the Work Group be changed to “Recommended Practices” vs. “Best Practices”?

7. Best Practices: Session 4 Thursday, June 21 9:20 – 9:40 a.m. ACTION: ENDORSING/ADOPTING POLICIES & STANDARDS Examine ABA’s PAG Example 2 Example 3 Example 4

8. Best Practices: Session 5 Thursday, June 21 9:40 – 10:00 a.m. PROJECT OVERVIEW – WHITE PAPER BOOK  Revisit Purpose & Goals  Revisit White Paper Topics & Sections  Revisit Intended Audience for the BP Papers

9. Best Practices: Session 5 Continued White Paper Book Scope: Value proposition – what is the purpose of this document?

10. Best Practices: Session 5 Continued Table of Contents… 1.Risk Management – current/future state vs. best practices - contingency planning - mitigating controls - insurance, assurance, checklist, possible answers 2.Planning for Successful PKI deployment (Joe) - design, deploying, operating and maintaining - system management and helpdesk - roles, job descriptions, skill-sets, personnel - concept of operations - preparing and educating for PKI deployment - planning for Rook Key Ceremony 3.Key Management (Pierre) - private key protection - key recovery, key escrow - non-repudiation - procedures - policies 4.Trust Models - cross certification or alternatives - hierarchical models

11. Best Practices: Session 5 Continued Table of Contents (continued) … 5.Audit – 3 rd Party Attestation - SW auditing tools - attestations - expectations - procedures - requirements, policies - draft CPS (IETF’s RFC 2527) - what events are editable 6.Glossary 7.Legal FAQ and pointers 8.Registration Procedures 9.TimeStamping/proofing 10.Accreditation and independent validation 11.Acknowledgement page

12. Best Practices: Session 5 Continued Intended Audience for the BP Papers Intended Audience for the BP Papers …  Executives (CTOs)  IT security staff  Production managers  System integrators  Technical staff involved in the deployment and management of a PKI  End customers  Resellers

13. Best Practices: Session 6 Thursday, June 21 10:00 – 10:30 a.m. DELEGATION OF WHITE PAPERS WITHIN WHITE BOOK  Revisit Project Team Participation  Reassign Responsibilities as required  Project Work Plan

14. Project Work Plan: - Solicit Participation – accomplished - Revisit the White Paper topics & sections – Munich meeting - Reassign responsibilities to the Project Team – Munich meeting - Collect White Papers – July 13, 2001 - Assemble draft White Paper Book - August 2001 - Review by Project Team – next PKI Forum Meeting - Review by BWG & TWG – October 2001 - Send to Lisa for Board Approval – TBD (October 2001) - Publish & Distribute 1 st version of White Paper Book– November 2001 Best Practices: Session 6 Continued

15. Best Practices: Session 7 Thursday, June 21 10:45 a.m. – 12:15 p.m. REVIEW & ACTIONS Thank you for participating in the BP BWG! Ensure everyone submits their business card for follow-up For inquiries please contact: Blair Canavan – bcanavan@chrysalis-its.com Claudia Dunphy – cdunphy@chrysalis-its.com