2005194 - Buypass: Findings in 2025 ETSI Audit - Audit Incident Report #1 - Compliance auditing on support processes

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Mads Henriksveen]

Preliminary Incident Report

Summary

• Incident description: Minor nonconformity: Compliance auditing on support processes is present but not effectively performed, according to procedures and planning.
• Relevant policies: ETSI EN 319401 v3.1.1 (REQ-7.13-02)
• Source of incident disclosure: Audit

Comment 1

[Mads Henriksveen]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000007
• Incident description: The CAB stated that compliance auditing on support processes is present but not effectively performed, according to procedures and planning. The finding is related to internal audits for support processes common to Buypass operation in general. Internal audits related to certificate issuance and management was performed according to procedures and planning.
• Timeline summary:
  • Non-compliance start date: N/A
  • Non-compliance identified date: 2025-12-08
  • Non-compliance end date: N/A
• Relevant policies: ETSI EN 319 401 v3.1.1 (REQ-7.13-02)
• Source of incident disclosure: Audit

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: Certificate issuance was not stopped as it was not affected
• Analysis: N/A
• Additional considerations: N/A

Timeline

• 2025-01-15: Start work on new version of Buypass ISMS compliant with ISO 27001:2022
• 2025-02-05: A new and revised internal audit plan for support processes established
• 2025-04-01: CISO resigns and a handover process starts
• 2025-05-30: First internal audits performed, realized that the approach was too ambitious
• 2025-06-01: CISO leaves Buypass and the new CISO is operational
• 2025-10-14: Buypass ISMS approved in ISO Audit by external auditor
• 2025-12-08: CAB defined this nonconformity in ETSI Audit 2025
• 2025-12-09: Start root cause analysis, impact and actions to be taken
• 2025-12-10: Registered Preliminary Incident Report
• 2025-12-23: Registered Full Incident Report

Related Incidents

Bug	Date	Description
1983263	2025-08-15	Internal audit plan missing/not performed
1983262	2025-08-15	Not compliant with ETSI EN 319 401 v3.1.1 REQ-7.13-02

Root Cause Analysis

Root causes are subject to CAB's approval in the Corrective Action Plan review (anticipated no later than mid-January).

Contributing Factor #1: Ambitious internal audit plan for support processes

• Description: A new and revised internal audit plan was defined to strengthen internal audits for support processes in Buypass in general.
  The main focus was controls according to ISO 27001:2022 and the idea was to test this approach on specific topics for selected departments to verify the plan's sustainability. The first tests showed that this approach was too ambitious. This happened during handover from the resigning CISO to the new CISO (which also was responsible for the internal audit plan). As a result, the internal audit plan was left unchanged until the ETSI audit.
• Timeline:
  • 2025-02-01 A new and revised internal audit plan for support processes established
  • 2025-05-30 First internal audits completed as defined in the new plan, the result was that we realized that the approach was too ambitious
  • 2025-06-01 New CISO operational, focusing on the new role
  • 2025-12-08 CAB defined this nonconformity in ETSI Audit 2025, no updates had been made on the initial internal audit plan
• Detection: Detected in ETSI Audit
• Interaction with other factors: Contributing factor #2 and #3
• Root Cause Analysis methodology used: 5-Whys

Contributing Factor #2: New version of ISMS compliant with ISO 27001:2022

• Description: New version of ISMS compliant with ISO 27001:2022 required a lot of effort from the new CISO. The new ISMS had to be audited and approved before expiry date of the previous ISO certificate, i.e this was a hard deadline.
• Timeline:
  • 2025-01-15 Start work on new version of Buypass ISMS compliant with ISO 27001:2022
  • 2025-06-01 New CISO operational, must focus on Buypass ISMS
  • 2025-10-14 Buypass ISMS approved in ISO Audit by external auditor
  • 2025-12-08 CAB defined this nonconformity in ETSI Audit 2025
• Detection: Detected in ETSI Audit - Missing internal audit according to plan was not detected in the ISO Audit
• Interaction with other factors: Contributing factor #1 and #3
• Root Cause Analysis methodology used: 5-Whys

Contributing Factor #3: Change of CISO

• Description: Change of CISO affected ongoing work with internal audits such that these were not effectively performed. Handover processes and working with new ISMS was prioritized by the new CISO (initially in charge of the internal audit planning and implementation).
• Timeline:
  • 2025-04-01 The CISO resigns from his position and the handover process to the new CISO starts
  • 2025-06-01 CISO leaves Buypass and the new CISO is operational
  • 2025-12-08 CAB defined this nonconformity in ETSI Audit 2025
• Detection: Detected in ETSI Audit - The new CISO had to prioritize activities with deadlines, i.e. handover before CISO leaves and ISMS
• Interaction with other factors: Contributing factor #1 and #2
• Root Cause Analysis methodology used: 5-Whys

Lessons Learned

• What went well: Internal audits related to certificate issuance and management was performed according to procedures and planning
• What didn’t go well: Internal audits for support processes were not effectively performed according to plan, the new approach was too ambitious.
• Where we got lucky: N/A
• Additional: Due to work with new version of ISMS, resources working with internal audits for support processes (including new CISO) prioritized updates of ISMS for ISO 27001:2022 prior to ISO Audit.

Action Items

Action items (including due dates) are subject to CAB's approval in the Corrective Action Plan review (anticipated no later than mid-January).

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Revisit approach for internal audits for support processes	Prevent, Mitigate	Contributing factor #1, What didn’t go well	The approach on internal audits is sustainable and effective	2026-02-15	Ongoing
Redefine internal audit plan according to revisited approach	Mitigate	Contributing factor #1 and #2, What didn’t go well	Internal audit plan updated and approved by Management and CAB	2026-03-01	Ongoing
Perform internal audit for selected topics within support processes according to revisited approach	Mitigate	Contributing factor #1, What didn’t go well	Internal audit performed and approved by CAB	2026-03-01	Ongoing

Appendix

N/A

Comment 2

[Mads Henriksveen]

Buypass is monitoring this bug for comments and questions. We have no new information at the moment.

Comment 3

[Mads Henriksveen]

Buypass is monitoring this bug for comments and questions. We have no new information at the moment.

Comment 4

[Mads Henriksveen]

Buypass is monitoring this bug for comments and questions. We have no new information at the moment.

Comment 5

[Mads Henriksveen]

The root causes and action items have now been approved by the CAB in the Corrective Action Plan review. We kindly ask that the next update be set to 2026-02-15, the first due date for the action items.

Comment 6

[Mads Henriksveen]

One of the Action Items have now been completed.

Updated Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Revisit approach for internal audits for support processes	Prevent, Mitigate	Contributing factor #1, What didn’t go well	The approach on internal audits is sustainable and effective	2026-02-15	Complete
Redefine internal audit plan according to revisited approach	Mitigate	Contributing factor #1 and #2, What didn’t go well	Internal audit plan updated and approved by Management and CAB	2026-03-01	Ongoing
Perform internal audit for selected topics within support processes according to revisited approach	Mitigate	Contributing factor #1, What didn’t go well	Internal audit performed and approved by CAB	2026-03-01	Ongoing

Comment 7

[Mads Henriksveen]

Buypass is monitoring this bug for comments and questions. We have no new information at the moment.

Comment 8

[Mads Henriksveen]

One of the Action Items have been completed. The third Action Item is delayed and the due date is updated.

Updated Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Revisit approach for internal audits for support processes	Prevent, Mitigate	Contributing factor #1, What didn’t go well	The approach on internal audits is sustainable and effective	2026-02-15	Complete
Redefine internal audit plan according to revisited approach	Mitigate	Contributing factor #1 and #2, What didn’t go well	Internal audit plan updated and approved by Management and CAB	2026-03-01	Complete
Perform internal audit for selected topics within support processes according to revisited approach	Mitigate	Contributing factor #1, What didn’t go well	Internal audit performed and approved by CAB	2026-04-08	Ongoing

Comment 9

[Mads Henriksveen]

Buypass is monitoring this bug for comments and questions. We have no new information at the moment. We kindly ask that the next update be set to 2026-04-08, the last due date for the Action Items.

Comment 10

[Mads Henriksveen]

Buypass is monitoring this bug for comments and questions. We have no new information at the moment. We kindly ask that the next update be set to 2026-04-08, the last due date for the Action Items.

Comment 11

[Mads Henriksveen]

All Action Items have now been completed.

Updated Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Revisit approach for internal audits for support processes	Prevent, Mitigate	Contributing factor #1, What didn’t go well	The approach on internal audits is sustainable and effective	2026-02-15	Complete
Redefine internal audit plan according to revisited approach	Mitigate	Contributing factor #1 and #2, What didn’t go well	Internal audit plan updated and approved by Management and CAB	2026-03-01	Complete
Perform internal audit for selected topics within support processes according to revisited approach	Mitigate	Contributing factor #1, What didn’t go well	Internal audit performed and approved by CAB	2026-04-08	Complete

Comment 12

[Mads Henriksveen]

Report Closure Summary

• Incident description:
  The CAB stated that compliance auditing on support processes is present but not effectively performed, according to procedures and planning. The finding is related to internal audits for support processes common to Buypass operation in general. Internal audits related to certificate issuance and management was performed according to procedures and planning.

• Incident Root Cause(s):
  A new and revised internal audit plan was defined to strengthen internal audits for support processes in Buypass in general. The main focus was controls according to ISO 27001:2022 and the idea was to test this approach on specific topics for selected departments to verify the plan's sustainability. The first tests showed that this approach was too ambitious. This happened during handover from the resigning CISO to the new CISO (which also was responsible for the internal audit plan). As a result, the internal audit plan was left unchanged until the ETSI audit.
  New version of ISMS compliant with ISO 27001:2022 required a lot of effort from the new CISO. The new ISMS had to be audited and approved before expiry date of the previous ISO certificate, i.e this was a hard deadline. Change of CISO affected ongoing work with internal audits such that these were not effectively performed. Handover processes and working with new ISMS was prioritized by the new CISO (initially in charge of the internal audit planning and implementation).

• Remediation description:
  Revisit approach for internal audits for support processes. Redefine internal audit plan according to revisited approach. Perform internal audit for selected topics within support processes according to revisited approach.

• Commitment summary:
  Buypass commits to perform compliance auditing on support processes using a structured, proactive and risk-based approach. In addition to the implemented actions, Buypass will regularly evaluate and update the approach.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 13

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-04-21.