Operational Research Consultants, Inc
Total Page:16
File Type:pdf, Size:1020Kb
Certificate Policy for the WidePoint1 Non Federal Issuer Version 1.3.1 WidePoint Cybersecurity Solutions Corporation 11250 Waples Mill Road South Tower, Suite 210 Fairfax, Virginia 22030 31 July 2019 1 See “Notice” on next page regarding corporate name change. WidePoint NFI CP v1.3.1 Notice: Operational Research Consultants, Inc. (ORC), a wholly-owned subsidiary of WidePoint Corporation, has changed its legal name to WidePoint Cybersecurity Solutions Corporation, hereafter referred to simply as WidePoint. This is a legal name change only for branding purposes with no change to ownership, corporation type or other status. Any and all references to "WidePoint" within this document refers specifically and only to WidePoint Cybersecurity Solutions Corporation, the wholly- owned subsidiary of WidePoint Corporation, and not to WidePoint Corporation as a whole. Any reference or citing of personnel within this document, such as "WidePoint CEO", refers to the CEO of WidePoint Cybersecurity Solutions Corporation and not the CEO of WidePoint Corporation. ii © Copyright 2019, WidePoint Cybersecurity Solutions Corporation All Rights Reserved This document is proprietary and may not be disclosed to other parties, be it pursuant to the Freedom of Information Act or to any other law or regulation WidePoint NFI CP v1.3.1 RECORD OF CHANGES Change Number / Section Date Current CP Version Changes Version CP established in support of PIV-I Non- 1 All 4-26-10 Federal Issuer requirements, and in conformance to RFC 3647 Updated for cross-certification with 2 All 10-07-08 FBCA PIV-I requirements Updated in response to compliance mapping performed against “FPKI 3 All 12-6-10 Certification Applicant Requirements” by eValid8 Final edits resulting from mapping 4 All 1-3-11 performed against “FPKI Certification Applicant Requirements” by eValid8 Edits resulting from CPWG review of CP 5 All 3-8-11 mapping. Further edits resulting from CPWG 6 All 3-30-11 review of CP mapping. 7 Sections 8 & 9 6-3-11 Updates in response to CPWG review Correction of typographical errors 8 Section 1.2, Table 1 8-7-11 (spaces in OID names and OID field removed) Section 1.3.1.4; Section 8; Section 8.4; Updates in response to changes resulting 9 6-5-2013 Section 8.6; Glossary from FBCA CP v2.26. Addition of new WidePoint OIDs to be issued starting 4-1-2014; set date of 3- 10 Section 1.2 2-18-2014 31-2014 for cessation of issuing RSA OIDs. Sections: 1.2; 2.2.1; 3.3.1; 4.1.2; 4.9.3; Updates to address mapping with FBCA 5.2.1.1; 5.2.4; 5.3.2; 5.4.8; 5.5.4; 5.6; 5.7.3; CP. 11 9-30-2014 5.7.4; 6.1.1.1; 6.1.1.2; 6.1.7; 6.2.4.4; 6.3.2; 6.7; 7.1.2; Appendix B Updates to reflect WidePoint legal name Sections 3.2.3.1.3; 5.1.2.1; 5.1.2.4; 5.2.1; change to Widepoint: adjust for Cert-on- 12 3-28-2016 6.2.4.2; 6.2.4; 7.1.2; 8; Appendix lettering Device capability; further updates to address mapping w/FBCA CP. Insert of “Notice” to clarify legal name 13 Notice 4-28-2016 change and its implication. 14 Section 1.2 7-21-2016 Certificate policy description update 1.2 All 8-29-2018 Annual review and update 1.3 All 3-14-2019 Updates to address comments from FPKI 1.3.1 7-31-2019 in review of annual audit package. iii © Copyright 2019, WidePoint Cybersecurity Solutions Corporation All Rights Reserved This document is proprietary and may not be disclosed to other parties, be it pursuant to the Freedom of Information Act or to any other law or regulation WidePoint NFI CP v1.3.1 TABLE OF CONTENTS SECTION PAGE 1 INTRODUCTION........................................................................................................... 1 1.1 OVERVIEW ............................................................................................................... 2 1.1.1 Certificate Policy (CP) ........................................................................................ 2 1.1.2 Relationship Between the WidePoint NFI CP and the WidePoint NFI CA’s Certification Practice Statements (CPS) ........................................................................... 2 1.1.3 Relationship Between the WidePoint NFI CP and the Federal Bridge Certification Authority (FBCA) CP .................................................................................. 2 1.1.4 Scope ................................................................................................................... 2 1.1.5 Interaction with PKIs External to the Federal Government................................ 3 1.2 Document Identification ............................................................................................. 3 1.3 PKI Entities ................................................................................................................ 5 1.3.1 WidePoint PKI Authorities ................................................................................. 5 1.3.1.1 WidePoint PKI Policy Management Authority ........................................................................5 1.3.1.2 WidePoint PKI Program Manager ...........................................................................................5 1.3.1.3 WidePoint NFI Certification Authority ...................................................................................5 1.3.1.4 Certificate Status Server ..........................................................................................................6 1.3.1.5 Cross-Certification with the FBCA ..........................................................................................6 1.3.1.6 WidePoint PKI Policy Management Authority ........................................................................6 1.3.1.7 Key Escrow Database (KED) ..................................................................................................6 1.3.2 Registration Authority (RA) ............................................................................... 6 1.3.3 Key Recovery Agent (KRA) ............................................................................... 6 1.3.4 Card Management System (CMS) ...................................................................... 7 1.3.5 Subscribers .......................................................................................................... 7 1.3.6 Affiliated Organizations...................................................................................... 7 1.3.7 Relying Parties .................................................................................................... 7 1.3.8 Key Recovery Requestors ................................................................................... 8 1.3.8.1 Subscriber ................................................................................................................................8 1.3.8.2 Internal Third-Party Requestor ................................................................................................8 1.3.8.3 External Third-Party Requestor ...............................................................................................8 1.3.9 Other Participants................................................................................................ 8 1.4 CERTIFICATE USAGE ............................................................................................ 8 1.4.1 Appropriate Certificate Uses ............................................................................... 8 1.4.2 Prohibited Certificate Uses ................................................................................. 9 1.5 POLICY ADMINISTRATION .................................................................................. 9 1.5.1 Organization Administering the Document ........................................................ 9 1.5.2 Contact Person .................................................................................................... 9 1.5.3 Person Determining Certification Practices Statement (CPS) Suitability for this Policy (CP) ................................................................................................................. 9 1.5.4 CPS Approval Procedures................................................................................. 10 1.6 DEFINITIONS AND ACRONYMS ........................................................................ 10 iv © Copyright 2019, WidePoint Cybersecurity Solutions Corporation All Rights Reserved This document is proprietary and may not be disclosed to other parties, be it pursuant to the Freedom of Information Act or to any other law or regulation WidePoint NFI CP v1.3.1 2 PUBLICATION & REPOSITORY RESPONSIBILITIES ...................................... 11 2.1 REPOSITORIES ...................................................................................................... 11 2.1.1 Repository Obligations ..................................................................................... 11 2.2 PUBLICATION OF CERTIFICATION INFORMATION ..................................... 11 2.2.1 Publication of Certificates and Certificate Status ............................................. 11 2.2.2 Publication of CA Information ......................................................................... 12 2.2.3 Interoperability .................................................................................................. 12 2.3 FREQUENCY OF PUBLICATION ........................................................................ 12 2.4 ACCESS CONTROLS ON REPOSITORIES ......................................................... 12 3 IDENTIFICATION & AUTHENTICATION ............................................................ 13 3.1 NAMING ................................................................................................................