Shared Environment Startup Audits for FAA/NAS Digital Identity and NPE Certificates
The FAA/NAS plans to used a shared PKI environment physically based in Ashburn, VA, connected to a backend cloud infrastructure operated by DigiCert to continue to support digital identity certificates through the SSP Program and simultaneously supporting NPE certificates through a new governance structure cross-certified to an interim Bridge Authority supported by the International Aviation Trust Framework (IATF). The aim of the IATF is to provide a high-level globally inter-operable architecture to manage the vast number of new aviation entrants – such as drone operators – while helping to protecting communication links between UTM and ATM systems from cyber threats. This interim authority will be a steppingstone bridge to the formal conception of the IATF Root Authority expected to commence by the end of 2021.
This shared environment has two separate audit requirements:
FAA/NAS Shared Service Provider Audit Requirement
To satisfy the Federal Bridge PKI’s annual audit requirement, FAA/NAS need to adopt a Registration Practice Statement (RPS) which documents enrollment and registration practices it has deployed to supports its agency’s issuance of digital identity certificates. This RPS must be developed from DigiCert’s supplied RPS template since it is part of DigiCert’s root operating requirements. The SSP Program requires an audit of assertions contained within the RPS
