Bugzilla

[In response to [Comment 6](https://bugzilla.mozilla.org/show_bug.cgi?id=1999296#c6)]

> Q1 and Q2, We thank you for your detailed observation, the timeline presented is missing on relevant event for November the 7th. We received the written audit conclusion from the auditors on the Friday the 7th confirming their findings that were verbally discussed on the last audit onsite day the 5th of November. The conclusions verified and provided details of the identified non-conformity. After reviewing the conclusions preliminary on Friday the 7th we had final confirming meeting internally on Monday the 10th of November prior submitting our preliminary audit report. The delivery of the conclusions started our countdown of three days to submit the preliminary incident report as required by the IRGs in CCADB Incident Reporting Guidelines.

Thank you for this explanation. However, the CCADB IRG’s state (emphasis ours):

> “**Within 72 hours of a CA Owner becoming aware** of an incident (i.e., the “initial incident disclosure”) or an audit finding not previously disclosed in an Incident Report…”

We interpret the timeline provided and the explanation offered in response to our questions to indicate Telia became aware of this issue on 05 November. Given the verbal discussion on 05 November, and acknowledging we do not know the details of that discussion, it seems Telia could have independently concluded the non-compliance instead of waiting for the auditor’s written report to start the disclosure clock. Receiving written confirmation from the auditor should not alter alter the facts of the technical non-compliance, nor does it change the date on which Telia became aware of those facts.

Waiting for a final or written artifact from an auditor that “officially” communicates a finding could arbitrarily delay the disclosure process (in some cases upward of 90 days) - which is why the IRGs specifically consider the clock starting when the CA becomes _aware_.

[In response to [Comment 6](https://bugzilla.mozilla.org/show_bug.cgi?id=1999296#c6)]

> Q1 and Q2, We thank you for your detailed observation, the timeline presented is missing on relevant event for November the 7th. We received the written audit conclusion from the auditors on the Friday the 7th confirming their findings that were verbally discussed on the last audit onsite day the 5th of November. The conclusions verified and provided details of the identified non-conformity. After reviewing the conclusions preliminary on Friday the 7th we had final confirming meeting internally on Monday the 10th of November prior submitting our preliminary audit report. The delivery of the conclusions started our countdown of three days to submit the preliminary incident report as required by the IRGs in CCADB Incident Reporting Guidelines.

Thank you for this explanation. However, the CCADB IRG’s state (emphasis ours):

> “**Within 72 hours of a CA Owner becoming aware** of an incident (i.e., the “initial incident disclosure”) or an audit finding not previously disclosed in an Incident Report…”

We interpret the timeline provided and the explanation offered in response to our questions to indicate Telia became aware of this issue on 05 November. Given the verbal discussion on 05 November, and acknowledging we do not know the details of that discussion, it seems Telia could have independently concluded the non-compliance instead of waiting for the auditor’s written report to start the disclosure clock. Receiving written confirmation from the auditor should not alter the facts of the technical non-compliance, nor does it change the date on which Telia became aware of those facts.

Waiting for a final or written artifact from an auditor that “officially” communicates a finding could arbitrarily delay the disclosure process (in some cases upward of 90 days) - which is why the IRGs specifically consider the clock starting when the CA becomes _aware_.