1990272 - SwissSign: recommendation on backup testing

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Sandy Balzer]

Preliminary Incident Report

Summary

• Incident description: The audit report contains a recommendation regarding the further improvement of SwissSign’s regular backup testing.

• Relevant policies: ETSI EN 319 401, REQ-7.11.2-04X

• Source of incident disclosure: Audit

Comment 1

[Sandy Balzer]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000049
• Incident description: The audit report contains a recommendation regarding the further improvement of SwissSign’s regular backup testing.
• Timeline summary:
  • Non-compliance start date: N/A (audit recommendation and not non-compliance)
  • Non-compliance identified date: N/A (audit recommendation and not non-compliance)
  • Non-compliance end date: N/A (audit recommendation and not non-compliance)
• Relevant policies: ETSI EN 319 401, REQ-7.11.2-04X
• Source of incident disclosure: Audit

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: Certificate issuance was not halted, as certificate issuance was not impacted.
• Analysis: N/A
• Additional considerations: SwissSign does full backup including verification of the written data. We also perform regular restore tests to ensure that the backup media are still readable.

Timeline

• 12.09.2025 Audit report containing this recommendation published

Related Incidents

none found

Root Cause Analysis

Contributing Factor #1:

• Description: Auditors recommend to enhance the restore tests to restore the complete backup instead of just partial restore.
• Timeline: N/A
• Detection: Audit
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: N/A

Lessons Learned

• What went well: N/A
• What didn’t go well: N/A
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Enhance restore test to restore complete backup instead of partial restore	Prevent	Root Cause # 1	Complete restore implemented	2026-04-30	In progress

Appendix

N/A

Comment 2

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 3

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.