Policy and practice answer different questions
| Document | Primary question | Typical focus |
|---|---|---|
| Certificate Policy (CP) | What rules apply to a defined certificate community and use? | Assurance, eligibility, acceptable use, responsibilities and policy identifiers. |
| Certification Practice Statement (CPS) | How does a certification authority implement relevant requirements? | Processes, controls, facilities, systems, personnel and operational practice. |
Organisations use different document models. A combined CP/CPS can work where the scope is clear, but the distinction between policy requirements and implementation statements should remain visible.
RFC 3647 as a framework
RFC 3647 provides a comprehensive topic structure covering participants, publication, identification, certificate lifecycle, controls, profiles, assessment and legal or business matters. It is a framework for drafting and comparison, not a complete set of requirements for every PKI.
The applicable content may also come from eIDAS, ETSI standards, browser or sector programmes, contracts, internal risk policy and the actual certificate-service design.
Keep the words and the system aligned
- Certificate-policy object identifiers match approved policy text and certificate profiles
- Eligibility and identity-proofing statements match registration processes
- Key protection statements match devices, roles and operating procedures
- Validity, renewal and revocation wording matches system behaviour and service levels
- Repository and publication commitments match available services
- Audit, logging and retention statements can be supported by evidence
- Supplier dependencies and delegated functions are explicit
- Versioning, approval and change notification are controlled