Discussion Period Begins: NS-010 v2: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

[Tim Hollebeek]

Ballot NS-010 is proposed by Tim Hollebeek (DigiCert) and is endorsed by Trevoli Ponds-White (Amazon) and Andrea Holland (IdenTrust).

Purpose of Ballot

This ballot proposes the following changes to the NCSSRs:

Structural changes

 - New Section 1 "CA Infrastructure Inventory": the inventory requirement ("The CA MUST define an inventory of its CA Infrastructure") is separated into its own top-level section for clarity and emphasis.

 - Section renumbering - all subsequent sections bumped by one:

     Section 1 to Section 2 (CA Infrastructure and Network Boundary Control Configuration)

     Section 2 to Section 3 (Access Control)

     Section 3 to Section 4 (Monitoring, Logging, Auditing, and Incident Response)

     Section 4 to Section 5 (Vulnerability Management)

 - Cross-references updated: all internal section references and anchor links updated to reflect the new numbering.

Removal of expired effective dates

 - Removed "Prior to 12-Nov-2025 / Effective 12-Nov-2025" transition language (the date is now past).

 - Consolidated vulnerability-management applicability: replaced the phased SHOULD/MUST language (expired 15-Apr-2026) with a single MUST statement.

External reference update

 - Updated the NIST reference in Section 3.2.5 from "NIST 800-63B Revision 3 Appendix A" to "NIST SP 800-63B Revision 4 Appendix A".

Motion

The following motion has been proposed by Tim Hollebeek (DigiCert) and endorsed by Trevoli Ponds-White (Amazon) and Andrea Holland (IdenTrust).

You can view and comment on the Github pull request representing this ballot here.

Motion begins

This ballot modifies the "Network and Certificate System Security Requirements," based on version 2.0.5, as shown in the immutable redline: https://github.com/cabforum/netsec/compare/3c98854b95b1bcaf0525db6e9c06908aa1999814...fde959546c1223fa6b3bc937b77740aa4af1a5fb

Motion ends

Discussion (at least 7 days)

• Start time: Tuesday, July 14, 2026 16:00:00 UTC
• End time: on or after Tuesday,  July 21, 2026 16:00:00 UTC

Vote for approval (7 days)

• TBD
  
  

If the Initial Vote passes, a 30-day IPR Review Period will follow per Bylaws Section 2.4 and the IPR Policy.

[Scott Rea]

eMudhra votes YES on Ballot NS-010v2

From: 'Tim Hollebeek' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Date: Tuesday, 14 July 2026 at 10:05 AM
To: 'Brittany Randall' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Subject: [netsec] Discussion Period Begins: NS-010 v2: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

CAUTION: This email is originated from outside of the organization. Do not open the links or the attachments unless you recognize the sender and know the content is safe.

--
You received this message because you are subscribed to the Google Groups "NetSec WG - Public (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to netsec+un...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/PH0PR14MB4456E0A87C52A307F5B2EF4383F92%40PH0PR14MB4456.namprd14.prod.outlook.com.

Disclaimer: The email and its contents hold confidential information and are intended for the person or entity to which it is addressed. If you are not the intended recipient, please note that any distribution or copying of this email is strictly prohibited as per Company Policy, you are requested to notify the sender and delete the email and associated attachments with it from your system.

[Scott Rea]

We don’t need to do discussion over again do we?

Technically NS-010v2 was “discussed” in NS-010 wasn’t it??

Regards,

_Scott

From: 'Tim Hollebeek' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Date: Tuesday, 14 July 2026 at 10:05 AM
To: 'Brittany Randall' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Subject: [netsec] Discussion Period Begins: NS-010 v2: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

CAUTION: This email is originated from outside of the organization. Do not open the links or the attachments unless you recognize the sender and know the content is safe.

--
You received this message because you are subscribed to the Google Groups "NetSec WG - Public (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to netsec+un...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/PH0PR14MB4456E0A87C52A307F5B2EF4383F92%40PH0PR14MB4456.namprd14.prod.outlook.com.

[Tim Hollebeek]

V2 is still in the discussion period. I will send out another email next week when it is ready for voting.

-Tim

---

From: 'Scott Rea' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Sent: Tuesday, July 14, 2026 12:46 PM
To: net...@groups.cabforum.org <net...@groups.cabforum.org>
Subject: [netsec] Re: Discussion Period Begins: NS-010 v2: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/KL1PR0401MB5017F09DDC079A840A0943ADF0F92%40KL1PR0401MB5017.apcprd04.prod.outlook.com.

[Tim Hollebeek]

The ballot was changed. Any changes to the ballot require a new 7-day discussion period.

-Tim

---

From: 'Scott Rea' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>

Sent: Tuesday, July 14, 2026 12:49 PM
To: net...@groups.cabforum.org <net...@groups.cabforum.org>
Subject: [netsec] Re: Discussion Period Begins: NS-010 v2: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

 

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/KL1PR0401MB501738D287DEFBBF2F0E98C4F0F92%40KL1PR0401MB5017.apcprd04.prod.outlook.com.

[Martijn Katerbarg]

I missed the call (sorry!), so I tried looking for what changed between v1 and v2, but it looks like the redline URL is the same as for v1. 

Did anything in that case actually change in the language?

From: 'Tim Hollebeek' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Date: Tuesday, 14 July 2026 at 20:28
To: net...@groups.cabforum.org <net...@groups.cabforum.org>
Subject: [netsec] Re: Discussion Period Begins: NS-010 v2: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

This Message Is From an External Sender

This message came from outside your organization.

Report Suspicious

 

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/PH0PR14MB445623D793B2EDF1DDEFB5CF83F92%40PH0PR14MB4456.namprd14.prod.outlook.com.

[Tim Hollebeek]

Nothing changed in the actual language. I'll let Clint and the minutes speak for what happened, I just wanted to get the clock running ASAP so we can get this ballot across the finish line.

-Tim

---

From: 'Martijn Katerbarg' via NetSec WG - Public (CA/B Forum) <net...@groups.cabforum.org>
Sent: Tuesday, July 14, 2026 2:35 PM

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/DS0PR17MB60794194C53B6D3530692A48E3F92%40DS0PR17MB6079.namprd17.prod.outlook.com.