1990254 - SwissSign: recommendation on risk assessment

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Sandy Balzer]

Preliminary Incident Report

Summary

• Incident description: The audit report contains a recommendation regarding the improvement of SwissSign’s risk assessment processes and the tracking of countermeasures.

• Relevant policies: ETSI EN319 401, REQ 5-04

• Source of incident disclosure: Audit

Comment 1

[Sandy Balzer]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000049
• Incident description: The ETSI audit report for SwissSign contains a recommendation to improve SwissSign’s risk assessment processes and the tracking of countermeasures.
• Timeline summary:
  • Non-compliance start date: N/A (audit recommendation and not non-compliance)
  • Non-compliance identified date: N/A (audit recommendation and not non-compliance)
  • Non-compliance end date: N/A (audit recommendation and not non-compliance)
• Relevant policies: ETSI EN319 401, REQ 5-04
• Source of incident disclosure: Audit

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: Certificate issuance was not halted, as certificate issuance was not impacted.
• Analysis: N/A
• Additional considerations: N/A

Timeline

• 2025-09-12 Audit report containing this recommendation published

Related Incidents

none found

Root Cause Analysis

Contributing Factor #1: Improvement of risk assessment and countermeasure tracking

• Description: Risk assessments are being performed, while the documentation and structured tracking of countermeasures do not fully match current best practices of ETSI EN 319 401 §5-04 .
• Timeline: N/A
• Detection: Audit
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: N/A

Lessons Learned

• What went well: N/A
• What didn’t go well: N/A
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update risk assessment process to match current best practices to ETSI EN 319 401 §5-04	Prevent	Root Cause #1	documentation update	2026-04-30	in progress

Appendix

N/A

Comment 2

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 3

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 4

[Jacob Hoffman-Andrews]

Can I request that the Next Update field for this and the other SwissSign incident reports be set to the Due Date (e.g. 2026-04-30) listed under Action Items? This would eliminate the need for SwissSign to provide weekly updates, which in turn would reduce the burden for other CAs to read all bugzilla incident report updates.

Thanks,
Jacob

Comment 5

[incident-reporting]

[In response to Comment 4]

That seems like a reasonable course of action. Of course, if SwissSign prefers to continuing offering updates, they are welcome to do so.

We've also recorded an issue to more strongly encourage CA Owners to make nextUpdate recommendations going forward.

Comment 6

[Sandy Balzer]

Update & Report Closure Summary

Update

We have completed below action item and had it reviewed by our Auditors.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update risk assessment process to match current best practices to ETSI EN 319 401 §5-04	Prevent	Root Cause #1	documentation update	2026-04-27	done

Appendix

N/A

Report Closure Summary

Incident Description

An ETSI audit report for SwissSign included a recommendation to further improve the risk assessment process and the structured tracking of countermeasures in alignment with ETSI EN 319 401 §5‑04. Certificate issuance was not affected at any time.

Incident Root Cause(s)

While risk assessments were being performed, the documentation and systematic tracking of identified risks and corresponding countermeasures did not fully reflect current best practices as defined in ETSI EN 319 401 §5‑04.

Remediation Description

SwissSign has updated and formalized its risk assessment process to align with ETSI EN 319 401 §5‑04. The remediation included improved documentation standards and the implementation of a structured approach for tracking identified risks and associated countermeasures. The updated process has been completed and internally validated.

Commitment Summary

All action items resulting from the audit recommendation have been completed as described. SwissSign commits to maintaining the updated risk assessment and countermeasure tracking framework and to continuously monitoring its effectiveness as part of its ongoing compliance and audit readiness activities.

All Action Items disclosed in this report have been completed, and SwissSign will continue monitoring this Bugzilla for Community feedback.

Comment 7

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-05-04.