Organizations need a PKI incident response plan that must be regularly reviewed and rehearsed as part of best practices.

Disaster recovery must include the recovery of the CA database.

Disaster recovery must include the ability of the CA to issue certificates.

You should put the CRL capabilities toward the top of your priority list of features to recover in a disaster situation. Checking on the currently posted CRL and determining how long that CRL will be valid is very important. The closer that CRL is to expiration, the more pressure you are under to produce a new CRL and get that new CRL posted so that all of the subscribers can get to it to check the status of their certificates. Prioritizing the CRL signing capability near the top of your DR priority list will prevent turning the PKI disaster into a companywide disaster situation.

Disaster recovery must include the ability of the PKI to generate CRL information.

Inconsistent CA documentation can leave a trail of confusion in its wake.

Sometimes only the trust anchor (TA) is preinstalled on the relying party’s system; other times the certificate chain is preinstalled.

There is no one-size-fits-all when it comes to BC and DR plans. The plans that work the best are the ones your write, test, and can rely upon. Many formats and specific tasks can be included, but only when the plans are regularly tested and updated can they save your PKI operations.