1990266 - SwissSign: recommendation on BIA/BCP test coverage

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Sandy Balzer]

Preliminary Incident Report

Summary

• Incident description: The audit report contains a recommendation regarding the improvement of SwissSign’s test coverage for BIA and BCP.

• Relevant policies: ETSI EN 319 401, REQ-7.11.1-01X

• Source of incident disclosure: Audit

Comment 1

[Sandy Balzer]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000049
• Incident description: The audit report contains a recommendation regarding the improvement of SwissSign’s test coverage for BIA and BCP.
• Timeline summary:
  • Non-compliance start date: N/A (audit recommendation and not non-compliance)
  • Non-compliance identified date: N/A (audit recommendation and not non-compliance)
  • Non-compliance end date: N/A (audit recommendation and not non-compliance)
• Relevant policies: ETSI EN 319 401, REQ-7.11.1-01X
• Source of incident disclosure: Audit

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: Certificate issuance was not halted, as certificate issuance was not impacted.
• Analysis: N/A
• Additional considerations: N/A

Timeline

• 12.09.2025 Audit report containing this recommendation published

Related Incidents

none found

Root Cause Analysis

Contributing Factor #1:

• Description: Auditors recommend to improve the mapping between the different tests to clarify interconnections.
• Timeline: N/A
• Detection: Audit
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: N/A

Lessons Learned

• What went well: N/A
• What didn’t go well: N/A
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
improve mapping to clarify interconnections	Prevent	Root Cause # 1	BIA and BCP mapping documented	2026-04-30	In progress

Appendix

Comment 2

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 3

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 4

[Sandy Balzer]

Update

Summary

We have completed below action item and had it reviewed by our Auditors.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
improve mapping to clarify interconnections	Prevent	Root Cause # 1	BIA and BCP mapping documented	2026-04-27	done

Appendix

N/A

Report Closure Summary

• ** Incident Description:**
  The audit report contains a recommendation regarding the improvement of SwissSign’s test coverage for BIA and BCP.

• ** Incident Root Cause(s):**
  The audit identified that existing BIA and BCP tests were performed, but the documented mapping between individual tests and their interdependencies was not sufficiently explicit to clearly demonstrate full test coverage.

• ** Remediation Description:**
  SwissSign reviewed the existing BIA and BCP testing framework and updated the internal documentation to explicitly map the individual tests and their interconnections. This clarified how the tests collectively support business continuity objectives and alignment with ETSI EN 319 401 requirements.

• ** Commitment Summary:**
  All action items resulting from the audit recommendation have been completed. SwissSign confirms that the updated documentation is in effect and that ongoing reviews will ensure continued clarity and completeness of BIA and BCP test coverage.

SwissSign will continue monitoring this Bugzilla for Community feedback.

Comment 5

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-05-04.