Changes

# How well and closely does the CA track changes to industry requirements? How does the CA plan to stay informed and compliant with the ever-changing requirements?

# Who are applicant’s personnel who are familiar with CABF and IETF standards? How much PKI domain experience do these skilled employees have? What is the depth of their understanding and knowledge? (Risks arise when CAs stop investing in training or employ people who aren’t as qualified as the people who the CA presented during the inclusion process.)

# To what extent have CA personnel reviewed the CA incidents that have been reported in Bugzilla over the past several years? How have systems been designed to avoid similar mistakes?