Attestation Authorities (AAAs)

AIMCIS Governance | Registered third-party certification bodies

Attestation Authorities are registered third-party organizations authorized to perform AL2 and AL3 certification assessments. They provide the independent verification that distinguishes AIMCIS from self-declared standards.

AAA Qualification Requirements

  • Professional liability insurance of at least $1M per incident
    • RequirementDescription
    Legal entityRegistered organization with legal authority to issue attestation certificates
    Auditor certificationMinimum 2 certified auditors per AAA, each having completed AIMCIS AAA training program
    HSM capabilityHardware Security Module for signing attestation certificates (AL3 requires dual-key HSM)
    Insurance coverage
    Conflict-of-interest policyDocumented COI policy with annual recertification

    AAA Registration Process

    1. Application: Submit AAA application form with auditor certifications, HSM details, and insurance proof.
    2. TSC Review: TSC reviews application against qualification requirements within 30 business days.
    3. Board Approval: Board votes on registration (simple majority).
    4. Registry Entry: Registered AAA added to public Registry with unique identifier and signing key fingerprint.

    AAA Responsibilities

    • AL2 Attestation: Conduct manual domain review, verify cryptographic provenance chains, test policy enforcement across 3+ agent hops
    • AL3 Recertification: Annual full portfolio audit with HSM key rotation verification and cross-domain linkage review
    • Certificate Issuance: Issue signed attestation certificates linked to Registry entries via ATR record IDs
    • Breach Notification: Notify Registry within 24 hours of any material misrepresentation or key compromise by a certified entity

    AAA Fee Structure

    ServiceFee
    AL2 initial attestation (per domain)$5,000–$15,000 (based on entity size and complexity)
    AL3 annual recertification (full portfolio)$25,000–$75,000 (based on domain count and content volume)
    Emergency audit$2,500 per hour

    The AAA Registry is public. All registered AAAs are listed with their identifiers, signing key fingerprints, and certification history.