Access Control Policy
- Access to CA servers and the HSM is limited to named, background-checked EC staff.
- Sensitive operations require at least two people (dual control).
- M-of-N control: activating an HSM key, running a key ceremony or recovering a CA key requires a quorum of M out of N authorised key custodians, each holding a separate credential. No single person can use or restore a CA private key alone.
- Portal access follows least privilege through roles.
- Access is reviewed regularly, and removed promptly when no longer needed.