NS-010: Restructure Requirements Sections, Remove Expired Effective Dates, and Update NIST Reference

[qaisalhajri96]

Overview

This ballot proposes cleanup changes to the NCSSRs to improve document structure, remove expired transition language, and update an external reference.

Structural Changes

• New Section 1 "CA Infrastructure Inventory": The inventory requirement ("The CA MUST define an inventory of its CA Infrastructure") is separated into its own top-level section for clarity and emphasis
• Section renumbering: All subsequent sections bumped by 1:
  • Section 1 -> Section 2 (CA Infrastructure and Network Boundary Control Configuration)
  • Section 2 -> Section 3 (Access Control)
  • Section 3 -> Section 4 (Monitoring, Logging, Auditing, and Incident Response)
  • Section 4 -> Section 5 (Vulnerability Management)
• Cross-references updated: All internal section references and markdown anchor links updated to reflect new numbering

Removal of Expired Effective Dates

• Removed "Prior to 12-Nov-2025 / Effective 12-Nov-2025" transition language (date is now past)
• Consolidated vulnerability management applicability: replaced phased SHOULD/MUST language (expired 15-Apr-2026) with a single MUST statement

Vulnerability Management Applicability (Section 5)

• Consolidated to: "These policies and procedures MUST apply to all Certificate Systems, all Security Support Systems, and all Network Boundary Controls."
• Added Oxford comma and repeated "all" qualifier for auditor clarity

External Reference Update

• Updated NIST reference in Section 3.2.5 from NIST 800-63B Revision 3 Appendix A to NIST SP 800-63B Revision 4 Section 3.1.1