(d) Where a governmental entity agrees to use or accept an electronic signature that involves the services of a certification authority, the certification authority shall meet the following standards and operating practices:

1. (1) produce and maintain a certification practice statement or other documents containing, but not limited to, the following information:

   1. (i) community and applicability—describing the types of entities that the certificate authority certifies and the applications for which certificates may be used, and any restrictions relating to their use;
   2. (ii) identification and authentication policy—the policies used to bind a public key to an individual, including those policies addressing initial registration, reissuing a certificate with a new public key, reissuing a certificate with a new public key after revocation, revocation request and how name disputes, if any, are resolved;
   3. (iii) key management policy—describing the security measures taken by the certificate authority to protect its cryptographic keys and critical security parameters including the life- cycle management of keys from generation, through storage and usage, to archiving and destruction;
   4. (iv) local security policy—describing the physical, personnel and procedural controls used by the certificate authority to perform certificate authority functions securely, including key generation, user authentication, certificate registration, certificate revocation, audit, and archival and records management;
   5. (v) technical security policy—describing the software, hardware and network security controls used by a certificate authority to perform certificate authority functions including key generation, user authentication, certificate registration, certificate revocation, audit, and archival and records management;
   6. (vi) operations policy—describing the frequency of routine certificate revocation list (CRL) issuance, frequency of special CRL issuance (e.g., key compromise CRL), and frequency of certificate authority key changeover;
   7. (vii) legal provisions—describing the liability and obligations of the parties. This information must be prominently displayed in the documents required by this paragraph;
   8. (viii) certificate and CRL standards—describing the standards, versions and data included;
   9. (ix) policy administration—defining the authority that is responsible for the registration, maintenance and interpretation of policy including contact information and practice statement change procedures;
   10. (x) audit policy—describing the type and frequency of internal and external audits;
   11. (xi) personal privacy policy—reciting the certification authority's statutory obligation to maintain the confidentiality of personal information in accordance with the provisions of subdivision 2 of section 308 of the State Technology Law and section 540.6 of this Part;
2. (2) make the certification practice statement or other documents maintained in accordance with paragraph (1) of this subdivision available to any person who requests the same;
3. (3) have an audit performed by a certified public accounting firm that reports on the policies and procedures of the certification authority as set forth and maintained in accordance with the provisions of this subdivision, and tests the operational effectiveness of such procedures during the first year in service to a governmental entity, and every two years thereafter or when there is material change to its certification practices, whichever comes first; and
4. (4) make available to the public the final opinion letter resulting from an audit performed under paragraph (3) of this subdivision.