Subdivision 1. Annual audit; auditor qualifications; rules. A certified public accountant having expertise in computer security must audit the operations of each licensed certification authority at least once each year to evaluate compliance with this chapter. The secretary may by rule specify the qualifications of auditors.
Subd. 2. Compliance categories. Based on information gathered in the audit, the auditor must categorize the licensed certification authority's compliance as one of the following:
(a) Full compliance. The certification authority appears to conform to all applicable statutory and regulatory requirements.
(b) Substantial compliance. The certification authority appears generally to conform to applicable statutory and regulatory requirements. However, one or more instances of noncompliance or of inability to demonstrate compliance were found in an audited sample, but were likely to be inconsequential.
(c) Partial compliance. The certification authority appears to comply with some statutory and regulatory requirements, but was found not to have complied or not be able to demonstrate compliance with one or more important safeguards.
(d) Noncompliance. The certification authority complies with few or none of the statutory and regulatory requirements, fails to keep adequate records to demonstrate compliance with more than a few requirements, or refused to submit to an audit.
The secretary shall publish in the certification authority disclosure record it maintains for the certification authority the date of the audit and the resulting categorization of the certification authority.
Subd. 3. [Repealed, 1998 c 321 s 31]
Subd. 4. [Repealed, 1998 c 321 s 31]
Subd. 5. [Repealed, 1998 c 321 s 31]
1997 c 178 s 7
Structure Minnesota Statutes
Chapters 324 - 341 — Trade Regulations, Consumer Protection
Chapter 325K — Electronic Authentication
Section 325K.001 — Short Title.
Section 325K.01 — Definitions.
Section 325K.02 — Purposes And Construction.
Section 325K.03 — Role Of The Secretary.
Section 325K.05 — Licensure And Qualifications Of Certification Authorities.
Section 325K.06 — Performance Audits.
Section 325K.07 — Enforcement Of Requirements For Licensed Certification Authorities.
Section 325K.08 — Dangerous Activities By Certification Authority Prohibited.
Section 325K.09 — General Requirements For Certification Authorities.
Section 325K.10 — Issuance Of Certificate.
Section 325K.11 — Warranties And Obligations Upon Issuance Of Certificate.
Section 325K.12 — Representations And Duties Upon Accepting Certificate.
Section 325K.13 — Control Of Private Key.
Section 325K.14 — Suspension Of Certificate.
Section 325K.15 — Certificate Revocation.
Section 325K.16 — Certificate Expiration.
Section 325K.17 — Recommended Reliance Limits.
Section 325K.18 — Collection Based On Suitable Guaranty.
Section 325K.19 — Satisfaction Of Signature Requirements.
Section 325K.20 — Unreliable Digital Signatures.
Section 325K.21 — Digitally Signed Document Is Written.
Section 325K.22 — Digitally Signed Originals.
Section 325K.23 — Acknowledgments.
Section 325K.24 — Presumptions In Adjudicating Disputes; Liability Allocation.