Security requirements imposed on the conforming CA are indicated in the CPS. In every case this policy states that CA MUST be run on a dedicated workstation. The workstation MUST be physically secured.

5.1. Physical Controls

5.1.2. Physical access

The physical access to the site in which the CA operates MUST be restricted only to explicitly authorized people.

5.1.4. Water exposures

No stipulation.

5.1.6. Media storage

No stipulation.

5.1.7. Waste disposal

No stipulation.

5.1.8. Off-site backup

No stipulation.

5.2. Procedural Controls

All the issues related to procedural control like the definition of trusted roles MUST be specified in the CPS.

5.2.1. Trusted roles

No stipulation.

5.3. Personnel Controls

The personnel operating the CA MUST be technically and professionally competent. Every conforming CA SHOULD specify in the CPS further details concerning this particular topic and the related issues.