Subject: question on RFC 3647

From: "Merkle, Johannes" <[email-masked]>
Date: Mon, 9 Feb 2004 10:40:56 +0100

I have question regarding RFC 3647: What is the difference in the scope
of sections 6.2.1 and 6.2.11? The explanation of 6.2.1 refers to the
same controls and standards as 6.2.1 and only seems to be more detailed.
For me 6.2.1 looks like the requirements I would include in a CP whereas
6.2.11 looks like the description of how these requirements are actually
met. However, usually there are no separate sections for a CP and a CPS,
so my interpretation must be wrong.

Can anybody help me with this issue?

Kind regards,
Johannes

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 9 Feb 2004 07:47:02 -0500

Johannes:

I agree with you that they are redundant.  We missed removing 6.2.11

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Merkle, Johannes
Sent: Monday, February 09, 2004 4:41 AM
To: [email-masked]
Subject: question on RFC 3647

I have question regarding RFC 3647: What is the difference in the scope of
sections 6.2.1 and 6.2.11? The explanation of 6.2.1 refers to the same
controls and standards as 6.2.1 and only seems to be more detailed. For me
6.2.1 looks like the requirements I would include in a CP whereas 6.2.11
looks like the description of how these requirements are actually met.
However, usually there are no separate sections for a CP and a CPS, so my
interpretation must be wrong.

Kind regards,
Johannes

---

From: "Joel S. Kazin" <[email-masked]>
Date: Mon, 09 Feb 2004 09:16:25 -0500

At 10:40 AM 2/9/2004 +0100, Merkle, Johannes wrote:

>met.

I concur with your interpretation.

>  However, usually there are no separate sections for a CP and a CPS,

The "Framework" is intended to be CP/CPS agnostic. This appears to be an 
exception.

>Can anybody help me with this issue?

I have checked what I wrote in three actual CPS that follow the RFC for 
clients; from the section titles 6.2.1 is a slightly broader requirement 
while 6.2.11 is specific to the hardware module.  Unfortunately, as none of 
these CPS have been made public I can't share the specific text with you.

>Johannes

Joel S. Kazin CPA, CISA, CISSP, CISM
Senior Consultant
Atos Origin
40 Old Sleepy Hollow Road
Pleasantville, New York 10570-3802
USA
Phone  +1 914-769-8780
Mobile  +1 914-564-1484
email    [email-masked]
www.atosorigin.com