The CA machine used for signing is maintained at a appropriate level of security by applying relevant security patches. It is not connected to any kind of network, and unauthorised physical access is prohibited.
The systems used by the CA to hold on-line repositories are maintained at a high level of security by applying all recommended and applicable security patches. The machine(s) are protected by a suitable firewall.