David Ross adds: For this and all other requirements, an external reseller of certificates operating under a CA's root certificate is considered to be an RA. AP4.3: "The maximum number of Assurance Points which can be allocated for an Assurance under this policy and under any act under any Subsidiary Policy (below) is 50 Assurance Points. .". AP6.1: "Each Subsidiary Policy must augment and improve the general standards in this Assurance Policy.". "General standards" can probably be interpreted as the AP1.1 "The Assurance Statement." CATS covers this requirement for Assurers, being internal RAs. CATS has operated for around a year, has 1,700 Assurers passed as of 200905xx. "Old Assurers" who were "approved" on basis of the old system of 100 (old) points only are to be dropped at some stage. Currently there are 10,107 as of 10090130.