1990276 - SwissSign: recommendation on evaluation of cloud service providers

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Sandy Balzer]

Preliminary Incident Report

Summary

• Incident description: The audit report contains a recommendation regarding the improvement of SwissSign’s internal questionnaire to further strengthen the evaluation of cloud service providers when used.

• Relevant policies: CA/B-F TLS BR, 8

• Source of incident disclosure: Audit

Comment 1

[Sandy Balzer]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000049
• Incident description: The audit report contains a recommendation regarding the improvement of SwissSign’s internal questionnaire to further strengthen the evaluation of cloud service providers when used.
• Timeline summary:
  • Non-compliance start date: N/A (audit recommendation and not non-compliance)
  • Non-compliance identified date: N/A (audit recommendation and not non-compliance)
  • Non-compliance end date: N/A (audit recommendation and not non-compliance)
• Relevant policies: CA/B-F TLS BR, 8
• Source of incident disclosure: Audit

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: Certificate issuance was not halted, as certificate issuance was not impacted.
• Analysis: N/A
• Additional considerations: SwissSign uses cloud services (e.g. AWS for MPIC, Atlassian cloud, M365, Service Now…). Cloud services that are in scope of CA/B regulation are part of the regular audit scope and SwissSign fulfills all the requirements. To evaluate cloud services, SwissSign has compiled a questionnaire based on the Cloud Security Alliance Cloud Control Matrix (CSA CCM).

Timeline

• 12.09.2025 Audit report containing this recommendation published

Related Incidents

none found

Root Cause Analysis

Contributing Factor #1:

• Description: Auditors recommend to match SwissSign's cloud service questionnaire against the relevant CA/B requirements to identify requirements that may be missing in the questionnaire. Note: For all cloud services in scope of CA/B regulation, all relevant aspects have been clarified and auditors were satisfied with the evidences provided. This recommendation goes beyond the CA/B regulation scope.
• Timeline: N/A
• Detection: Audit
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: N/A

Lessons Learned

• What went well: N/A
• What didn’t go well: N/A
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Check SwissSign cloud questionnaire against CA/B regulations to identify gaps	Prevent	Root Cause # 1	Questionnaire checked	2026-04-30	In progress

Appendix

N/A

Comment 2

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 3

[Sandy Balzer]

We're monitoring this Bugzilla for Community feedback.

Comment 4

[Sandy Balzer]

Update

Summary

We have completed below action item.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Check SwissSign cloud questionnaire against CA/B regulations to identify gaps	Prevent	Root Cause # 1	Questionnaire checked	2026-04-29	done

Appendix

N/A

Report Closure Summary

• Incident Description:
  An ETSI audit report for SwissSign included a recommendation to further strengthen the internal questionnaire used to evaluate cloud service providers by aligning it more explicitly with applicable CA/B Forum requirements.

• Incident Root Cause(s):
  The root cause was an opportunity for improvement identified by auditors, noting that SwissSign’s existing cloud service evaluation questionnaire, while based on the CSA Cloud Control Matrix and sufficient for audit purposes, was not explicitly mapped against all relevant CA/B Forum requirements.

• Remediation Description:
  SwissSign reviewed and updated the cloud service provider questionnaire to systematically check it against applicable CA/B Forum requirements and to identify and address any potential gaps. This ensured clearer traceability between questionnaire content and regulatory expectations.

SwissSign will continue monitoring this Bugzilla for Community feedback.

Comment 5

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-05-07.