Disclosure Records of Recognized Certification Authorities

Disclosure Record for Digi-Sign Certification Services Limited

(This is page 19 of the disclosure record for Digi-Sign Certification Services Limited ("Digi-Sign") maintained by the Government Chief Information Officer ("GCIO") under section 31(1) of the Electronic Transactions Ordinance (Cap. 553) ("ETO"). Click this link to go back to page 1 of the disclosure record.)

Assessment Reports and Statutory Declarations in respect of Relocation of Disaster Recovery Data Centre

Digi-Sign planned to relocate its Disaster Recovery Data Centre by the end of 2010.

The GCIO considered that the changes as set out in the preceding paragraph as major changes. In this light, the GCIO had, by notice given to Digi-Sign, required Digi-Sign to furnish to the GCIO two sets of assessment report and statutory declaration pursuant to section 43A(1) of the ETO. In this connection, Digi-Sign arranged the preparation of two assessment reports produced by an independent assessor as well as furnished two statutory declarations made by a responsible officer of Digi-Sign in respect of the relocation of Disaster Recovery Data Centre. The first set of assessment report and statutory declaration was furnished before the relocation of the Disaster Recovery Data Centre, while the second set of assessment report and statutory declaration was furnished after the relocation of the Disaster Recovery Data Centre.

In accordance with section 43A(3) of the ETO, the GCIO must publish in the disclosure record for Digi-Sign as a recognized certification authority ("CA") the dates of and the material information in the assessment reports and statutory declarations on the CA services of Digi-Sign. Only those parts of the reports and statutory declarations containing material information are herewith published.

(I) 1^st Set of Assessment Report and Statutory Declaration

Assessment Report

(A) Date of the Report

The date of the report is 2 December 2010.

(B) Material Information

In the assessor's opinion, having regard to the planned relocation of Digi-Sign's Disaster Recovery Data Centre, Digi-Sign was capable of complying with the provisions of the ETO and the Code of Practice, as specified in paragraph 1 of Annex II of the notice issued by the GCIO (see Notes).

Statutory Declaration

(A) Date of the Declaration

The date of the declaration is 25 November 2010.

(B) Material Information

Having regard to Digi-Sign's planned relocation of its Disaster Recovery Data Centre, a responsible officer of Digi-Sign declared that Digi-Sign was capable of complying with the provisions of the ETO and the Code of Practice, as specified in paragraph 2 of Annex II of the notice issued by the GCIO (see Notes).

(II) 2^nd Set of Assessment Report and Statutory Declaration

Assessment Report

(A) Date of the Report

The date of the report is 22 December 2010.

(B) Material Information

In the assessor's opinion, having regard to the relocation of Digi-Sign's Disaster Recovery Data Centre that has occurred, Digi-Sign was and was capable of complying with the provisions of the ETO and the Code of Practice, as specified in paragraph 1 of Annex II of the notice issued by the GCIO (see Notes).

Statutory Declaration

(A) Date of the Declaration

The date of the declaration is 22 December 2010.

(B) Material Information

Having regard to Digi-Sign's relocation of its Disaster Recovery Data Centre that has occurred, a responsible officer of Digi-Sign declared that Digi-Sign was and was capable of complying with the provisions of the ETO and the Code of Practice, as specified in paragraph 2 of Annex II of the notice issued by the GCIO (see Notes).

Notes

Annex II of the notice issued by GCIO is reproduced below for reference:

Specifications of the Provisions of the Electronic Transactions Ordinance (Cap. 553)("ETO")
and of the Code of Practice for Recognized Certification Authorities
for the Purposes of Sections 43A(1)(c)(i) and (d)(i) of the ETO
in relation to Relocation of Disaster Recovery Data Centre
of Digi-Sign Certification Services Limited ("Digi-Sign")

1 For the purpose of section 43A(1)(c)(i) of the Electronic Transactions Ordinance (Cap. 553)

1.1 The following provisions of the ETO shall come within the scope of assessment to be performed by a qualified person approved by the Government Chief Information Officer ("GCIO").

(a) Part VII - Recognition of CAs and Certificates by GCIO: Section 21(4)(c).
(b) Part X - General Provisions as to Recognized CAs: Sections 36, 37, 39, 40, 44 and 45(1).
(c) Part XI - Provisions as to Secrecy, Disclosure and Offences: Sections 46, 47 and 48.

1.2 The following provisions of the Code of Practice for Recognized Certification Authorities ("Code of Practice") shall come within the scope of the assessment to be performed by a qualified person approved by the GCIO.

(a) General Responsibilities of a Recognized CA: Paragraphs 3.1 to 3.6 inclusive and 3.8.
(b) Certification Practice Statement: Paragraphs 4.1 to 4.13 inclusive.
(c) Trustworthy System: Paragraphs 5.1 to 5.3 inclusive, 5.6 to 5.17 inclusive and 5.19 to 5.21 inclusive.
(d) Certificates and Recognized certificates: Paragraphs 6.1 to 6.23 inclusive.
(e) Repositories:Paragraphs 9.1 to 9.5 inclusive.
(f) Disclosure of Information:Paragraphs 10.1 to 10.6 inclusive.
(g) Adoption of Standards and Technology:Paragraph 14.1.

2 For the purpose of section 43A(1)(d)(i) of the ETO

2.1 The following provision of the ETO shall be dealt with by means of a statutory declaration to be made by a responsible officer of Digi-Sign Certification Services Limited (Digi-Sign).

(a) Part VII - Recognition of CAs and Certificates by GCIO: Section 21(4)(e).

2.2 The following provisions of the Code of Practice shall be dealt with by means of a statutory declaration to be made by a responsible officer of Digi-Sign.

(a) General Responsibilities of a Recognized CA: Paragraphs 3.7 and 3.9.
(b) Trustworthy System: Paragraph 5.18.
(c) Disclosure of Information: Paragraphs 10.7 to 10.9 inclusive.
(d) Consumer Protection: Paragraph 16.1.