MP127 SMKI RAPP Security Screening clarification

The Security Sub-Committee (SSC) has confirmed that the obligations in SEC Section G ‘Security’ G4.2 and G4.3 apply to Authorised Responsible Officers (AROs) and that AROs should be subject to security screening to British Standard (BS) 7858:2019 or equivalent. However, this obligation isn’t made explicit in the Appendix D ‘SMKI Registration Authority Policies and Procedures’ (SMKI RAPP) which is followed by Users and the Data Communications Company (DCC) Registration Authority in processing applications for the appointment of AROs. Failure to comply with the obligation in Section G4.3 will result in a non-compliance being raised during a User Security Assessment.

The Proposed Solution is to amend the sections of the SMKI RAPP that explain the process of the becoming an ARO, making it clear that AROs must be subject to BS 7858:2019 or equivalent. SEC Parties should not be impacted by this modification as they should already be screening AROs under the obligation in Section G4.3.

No Parties are impacted

Appendix D ‘SMKI Registration Authority Policies and Procedures’