Physical, Procedural and Personnel Security Controls

The technical and physical infrastructure of the Root Facility (RF), established for the operation of the Root Certifying Authority of India (RCAI), and the National Repository of Digital Certificates (NRDC) is fully secured in accordance with the requirements laid down under the IT Act.

5.1 Physical controls

5.1.1 Site Location and Construction
The Root CA of India (RCAI) operations are being conducted from the Root Facility of CCA. The National Repository (NR) and its operations are conducted from Jawaharlal Nehru Stadium, New Delhi.

5.1.2 Physical access
Physical access to RF for performing RCAI operations is controlled and restricted to the authorized individuals only.

Entry to the working area (WA), anteroom (AR) and the SR are registered in the log register. Entry to the WA is done using an access control system. The log register and access control audit trail files are reviewed regularly.

Six-tier security has been implemented at the RF.

• Tier 1 - The security of the building where the RF is located, forms the first level of security.
• Tier 2 - Entry to the WA is after entering details to a log register and proper physical verification by the security guard at the entrance. This is the second tier of Security.
• Tier 3 - Entry to the WA is through a proximity access control system. This forms the third tier of security.
• Tier 4 - Entry to SR is through AR. The entry to AR is restricted by twin doors and proximity access control system. This forms the fourth tier of security.
• Tier 5 - The entry to SR is restricted by twin doors and a combination of proximity and biometric access control system. This is the fifth-tier of security.
• Tier 6 - A fire resistant safe is placed inside the SR. This forms the sixth-tier of security.

5.1.2.2 By-pass or deactivation
The By-pass or deactivation of normal physical security arrangements are authorized and documented.

5.1.2.3 Trespass detection and alarm system
Access to the site is controlled through proximity cards. In addition, a biometric access system is used for access to the SR, of the authorized personnel.

Vibration sensors along with motion sensing and alert devices have been installed to ensure that no unauthorized personnel can gain access to the RF. In the case of a forceful entry, alert gets activated and is sounded at the designated place.

5.1.2.4 Sensing and preventive measures for RF.
The RF is monitored using appropriate equipment for surveillance based on various sensors. The sensors installed are:

• Motion sensors
• Vibration sensors
• Smoke sensors

These sensors are connected to an alarm system. On security breach the alarm gets activated. The security guard in the RF and the Chief Security Officer (CSO) take suitable escalation procedures.

5.1.2.5 DVR (Digital Video Recorder) system
The RF is constantly monitored using a CCTV system, to detect any unusual activities.

5.1.2.6 HSM and smart card storage at the SR
The Hardware Security Module (HSM) is installed in one of the server in SR. The smart cards in the SR are protected by the tier-6 of security.

5.1.2.7 At RF site, it is ensured that:

• Access to RF is restricted to authorized personnel.
• The RF is provided with physical security round the clock.

5.1.2.8 Emergency planning for RF
Following measures are in position to attend to any emergency situation at the RF:

• Provisions have been made to provide access to the security guards in case of emergency.
• Fire extinguishers are placed in the RF, to overcome fire hazards.
• In case of any untoward incident or emergency the designated AC(Tech) will be informed by Security officer and guard.
• Officers, staff and security guards are given adequate training and routine mock drills are conducted to ensure their readiness.

5.1.2.9 Power supply and air conditioning

• Continuous power supply has been ensured by suitable deployment of UPS and DG set.
• Emergency lights are also placed in the RF.
• The air conditioning system installed in the RF is equipped with temperature and humidity control.

5.1.2.10 Natural disaster protection
Necessary precautions have been taken to protect and prevent the impact of natural disasters such as flood, earthquake etc.

5.1.2.11 Water exposures
The RF is well protected from potential water related threats.

5.1.2.12 Fire prevention and protection
Fire alarm system has been installed to handle any emergent situation arising out of fire.

5.1.2.13 Media storage
Storage media are protected from environment threats such as temperature, humidity and magnetic field. Any media which is to be transported to National Repository (NR) is done so in secured and tamper proof manner.

5.1.2.14 Waste disposal
Sensitive documents and materials are shredded before disposal. Media used to collect or transmit sensitive information are rendered unreadable before disposal. HSM and related devices are physically destroyed or zeroized in accordance with the manufacturers' guidance prior to disposal. Other waste is disposed off in accordance with the CCA's normal waste disposal requirements.

5.1.2.15 Off-site backup for RF
Routine backups of the system data, audit log data, and other sensitive information are performed and stored in a secure place at the CCA's office.

5.2 Procedural controls

5.2.1 Trusted roles
The following roles have been identified in connection with RCAI operations at SR:

• Coordinator
• System Administrator
• System Operator
• Auditor

·  At least two persons are required to perform each critical and routine task in the RCAI operation.

·  DC (T) authorizes all the activities of RCAI operation. For each session DC (T) designates an AC (T) as a coordinator. The AC (T) in turn assigns the roles to various officers

·  All the officers designated to perform various roles have been issued proximity cards and granted access to specific locations. They are also issued electronic tokens for the session by the coordinator to perform specific functions.

5.3 Personnel Controls

5.3.1 Background, qualifications, experience, and clearance requirements

The background, qualifications, and experience of the technical personnel are verified as per the rules and regulations.

5.3.2 Employees Verification/Investigation
CCA has followed appropriate government procedures for appropriate investigation of all personnel.

5.3.3 Training Requirements
CCA has provided comprehensive training to all the technical personnel performing duties, in the following areas:

• Relevant aspects of the IT Security Policy and Security Guidelines framed in IT (CA) Rules, 2000;
• RCAI related software /hardware training
• RCAI related duties they are expected to perform
• Disaster recovery and continuity procedures.

5.3.4 Re-training frequency and requirements
Refresher training of technical personnel is conducted as and when required, and CCA reviews these requirements on a regular basis.

5.3.5 Sanctions for unauthorized actions
In the event of actual or suspected unauthorized actions by a person performing duties with respect to RCAI operation, access to RF is denied to him/her, with immediate effect. Further actions will be initiated as per government procedures/rules.

5.3.6 Contracting personnel requirements
No contractor is allowed access to RCAI system.

5.3.7 Documentation supplied to personnel
Officers/staff operating SR have been provided with comprehensive user manuals detailing the procedure of certificate creation, update, renewal, suspension, and revocation, and software functionality etc.

5.4 Compliance with Security Service Regulations
Office of CCA observes and adheres strictly to 'Security Service Regulations' for the security measures, which are not shown in the Certification Practice Statement.