CSS Certificate Authority audit clarification
Summary
CSS Certificate Authority Service Definition clause 9.1 states that the CSS CA Service will be audited each year by a third party against an approved compliance standard and or methodology. The clause however does not state who initiates the audit (i.e. RECCo, the Code Manager, Switching Operator etc.) and engages with the third party.
Latest update and next planned activity
Date of latest update
Latest Update
This Change Proposal has been implemented as part of the February 2026 REC Release.
Impacts Overview
Impacted REC Parties and Market Participants
DCC
Priority and rationale
Standard
Priority last updated on 29 May 2026
Solution development
Problem Statement
Section 9 of the CSS Certificate Authority Service Definition document mandates an annual third-party audit of the CSS Certificate Authority Service against an approved compliance standard or methodology. However, it does not specify the audit technique or methodology to be used, nor does it specify who is responsible for initiating the audit and engaging with the third-party.
No documents available.
Change Plan
Proposal Plan approved at Change Panel
Completed
Start:
Due:
Completion:
21 Oct 2025Original submission
Change details
- - -
9 Sep 2025
Change details
CSS Certificate Authority audit clarification
CSS Certificate Authority Service Definition clause 9.1 states that the CSS CA Service will be audited each year by a third party against an approved compliance standard and or methodology. The clause however does not state who initiates the audit (i.e. RECCo, the Code Manager, Switching Operator etc.) and engages with the third party.
Clause 9.1’s ambiguity has led to discussions between RECCo, the Code Manager and DCC acting as the Switching Operator to determine ownership of the audit activities. Clarifying this will result in a more efficient process which can be carried out on an annual basis.
It has been agreed that DCC, acting as the Switching Operator, will be responsible for ensuring that the audit takes place on an annual basis. During discussions, the Code Manager and DCC have agreed the approved compliance standard as being tScheme S3A accreditation. The REC Schedule should be updated to reflect this agreed approach.
Proposed wording for 9.1: The Switching Operator shall ensure the CSS Certificate Authority Service is audited on an annual basis by a third party against an approved compliance standard or methodology to be approved by the PAB.
Proposed wording for 9.1: The Switching Operator shall ensure the CSS Certificate Authority Service is audited on an annual basis by a third party against an approved compliance standard or methodology to be approved by the PAB.
The approach was initially agreed between the Code Manager and DCC following DCC’s submission of evidence as part of the six-monthly ‘Deep Dives’ as captured within the Performance Assurance Operating Plan (PAOP). This was then formally agreed at the June 2025 PAB meeting. DCC has provided updates to RECCo throughout.
Impacts
No details provided
Other (please provide details in Additional information box below)
None. This proposal adds clarification to the REC.
No details provided
-
No details provided
-
CSS Certificate Authority Service Definition
-
No details provided
-
No details provided
-
CSS Certificate Authority
-
DCC
-
No details provided
-
-
No details provided
Priority & timing
No
-
-
-
No details provided
Other (please provide details in the Additional information box below)
Activity
Status has been changed to Implemented.
Implementation Date has been updated to 27 Feb 2026.
amoden has been allocated as SME.