11.1

Computing Resources, Software and/or Data are Computed.-The Certifying Authority must establish business continuity procedures that outline the steps to be taken in the event of the corruption or loss of computing and networking resources, nominated website, repository, software and/or data. Where a repository is not under the control of the Certifying Authority, the Certifying Authority must ensure that any agreement with the repository provides for business continuity procedures.

11.2

Secure facility after a natural or other hype of disaster.-The Certifying Authority must establish a disaster recovery plan outlining the steps to be taken to re-establish a secure facility in the event of a natural or other type of disaster. Where a repository is not under the control of the Certifying Authority, the Certifying Authority must ensure that any agreement with the repository provides that a disaster recovery plan be established and documented by the repository.

11.3

Incident Management Plan.-An incident management plan shall be developed and approved by the management. The plan shall include the following areas :-

(i) Certifying Authority's certification key compromise;

(ii) Hacking of systems and network;

(iii) Breach of physical security;

(iv) Infrastructure availability;

(v) Fraudulent registration and generation of Digital Signature Certificates; and

(vi) Digital Signature Certificate suspension and revocation information.

(i) Compromise control;

(ii) Notification to user community; (if applicable)

(iii) Revocation of affected Digital Signature Certificates; (if applicable)

(iv) Responsibilities of personnel handling incidents;

(v) Investigation of service disruption;

(vi) Service restoration procedure;

(vii) Monitoring and audit trail analysis; and

(viii) Media and public relations.