> Does the EV certification process put any requirements on the CA, such as mandatory independent audits or some other overwatch mechanism? CAs are audited (to

> Does the EV certification process put any requirements on the CA, such as mandatory independent audits or some other overwatch mechanism? CAs are audited (to reiterate) for compliance every year on three audit standards: - WebTrust for CAs - WebTrust for CAs EV - CA/B Baseline Requirements There is another standard, used by some in the EU, ETSI TS 102 042, which replaces WebTrust. The auditors are always independent of the CA. Unfortunately, the audit reports are not public but management attestations are. https://certly.io/audits.php https://certly.io/audits.php has links to GlobalSign and Comodo statements if you're curious.