More tyops

TODO

### 4.2.9 Requirements

TODO

## 4.3 Large enterprise and public PKI context

### 4.3.1 Use

The reasonably foreseeable use of the product is to support certification services provided within a large enterprise or provided by a CA to the public, and where a compromise carries a significant risk of impact to the security of other products, networks or services, or to the health, security or safety of the public.

The reasonably foreseeable use of the PKI product is to support certification services provided within a large enterprise or provided by a CA to the public, and where a compromise carries a significant risk of impact to the security of other products, networks or services, or to the health, security or safety of the public.

EXAMPLE 1: Software used to issue certificates for public web sites.

-	<strong>Revocation management service:</strong> as described in clause 4.2.2.1.

EXAMPLE 2: THis service verifies that revocation requests are submitted by authorised parties.

EXAMPLE 2: This service verifies that revocation requests are submitted by authorised parties.

EXAMPLE 3: This service obtains confirmation from the subscriber if a compromise is reported by a third party.

-	<strong>Certificate status service:</strong> as described in clause 4.2.2.1.

EXAMPLE 4: This service publishes CRLs and responds to OCSP queries.

Each component service will require configuration and maintenance by system administrators.

#### 4.3.2.2 Logging

#### 4.3.2.3 Accounts

In the public PKI product context, the product will support one or more of the following user accounts:

In the large enterprise and public PKI product context, the product will support at least the following user accounts:

- <strong>System administrator account:</strong> authorised to install, configure and update the product.

EXAMPLE 3: Revocation management and certificate status services might not needed if the CA only issues short-lived certificates that are not intended to be revoked.

PKI products intended for large enterprise or public PKI use can be designed so that each instance of the product provides a single component service with multiple instances of the product networked together to provide the full CA functionality.

PKI products intended for large enterprise or public PKI use can be designed to be modular so that each instance of the product provides a single component service with multiple instances of the product networked together to provide the full CA functionality.

The PKI can also be designed to use generic enterprise products to support the functionality of some component services.

EXAMPLE 5: A third-party logging service might be used to store and manage event logs. 

### 4.3.4 

### 4.3.4 Operational environment

#### 4.3.4.1	Deployment

### 4.3.5 User description 

In the large enterprise and public PKI context, the CA will employ staff who have the necessary expertise and experience for their roles, including an understanding of cybersecurity and data protection where relevant.

A large enterprise or public CA will employ staff who have the necessary expertise and experience for their roles, including an understanding of cybersecurity and data protection where relevant.

The CA will provide staff with regular training on current security practices and apply appropriate disciplinary sanctions to staff who violate the CA's policies or procedures.

### 4.3.8 Risks

### 4.3.9 Requirements