2025598 - IdenTrust: Delay in updating a Bug 2016585 - Action item

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[IdenTrust]

Preliminary Incident Report

Summary

• Incident Description
  IdenTrust had an open bug, Bug 2016585 with a pending task which was completed, but the bug was not updated within 3 days of the action Item being completed.
• Relevant policies:
  Common CA Database - Incident Reporting Guidelines version 3.2: Unless a Closure Report has been posted and no further questions have been raised, open incident reports MUST be updated within 3 days of an Action Item being changed, completed, or delayed.
• Source of incident disclosure:
  Comment 4 on Bug 2016585 Wayne at 2026-03-21 18:24 PDT

Comment 1

[IdenTrust]

Working on our full incident report, will be published no later than Friday April 3rd

Comment 2

[IdenTrust]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000036

• Incident description: IdenTrust had an open bug, Bug 2016585 with a pending task which was completed, but the bug was not updated within 3 days of the action Item being completed due to oversight.

• Timeline summary:

  • Non-compliance start date: 2026-03-02
  • Non-compliance End date: 2026-03-23
  • Non-compliance identified date: 2026-03-21

• Relevant policies:

  • Common CA Database - Incident Reporting Guidelines version 3.2: Unless a Closure Report has been posted and no further questions have been raised, open incident reports MUST be updated within 3 days of an Action Item being changed, completed, or delayed.

• Source of incident disclosure:

  • Comment 4 on Bug 2016585 Wayne at 2026-03-21 18:24 PDT

Impact

No customers impact where identified, incident reporting process issue only

Timeline

• 2026-02-26 08:30 PDT - Full Incident report was posted for bug 2016585
• 2026-03-05 - Action item was completed
• 2026-03-21 18:24 PDT - Public follow-up comment on CCABD’s required update within 3 days of a change or delay was not met
• 2026-03-22 16:07 PDT - IdenTrust responded to the public follow-up comment 2026-03-23 15:03 PDT - Separate incident Bug 2025598 was opened for track delayed weekly updates violation
• 2026-03-30 07:02 PDT - Status Update posted

Related Incidents

• Bug 2025318 - certSIGN: delay in updating a Bugzilla ticket
• Bug 2025538 - Firmaprofesional: Delayed weekly updates and responses on open incident reports

Root Cause Analysis

Root Cause # 1

There was a personnel transition recently. Incident bugs were not properly tracked to ensure that weekly updates were posted within the timelines required by the CCADB Incident Reporting Guidelines during the personnel transition.

Lessons Learned

• What went well: No customer certificate was impacted

• What didn’t go well: CCADB initial incident reporting deadline was not followed as intended

• Where we got lucky: The underlying incident was not affected.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update procedure to mandatory provides weekly update on all incidents where next update date is not specified	Prevent	Root Cause # 1	Incident report procedure to include mandatory weekly update	2026-04-02	Complete
Implement automated reminders for open incidents	Prevent	Root Cause # 1	Automated reminders	2026-04-30	Ongoing

Comment 3

[IdenTrust]

Work to implement this action item is ongoing:

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Implement automated reminders for open incidents	Prevent	Root Cause # 1	Automated reminders	2026-04-30	Ongoing

Request the "next-update" field be set to 2026-04-30.

Comment 4

[IdenTrust]

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Implement automated reminders for open incidents	Prevent	Root Cause # 1	Automated reminders	2026-04-29	Complete

• Incident tracker with automated email alerts, implemented. Open tickets, trigger email alerts that notify when the ticket requires an update.

Comment 5

[IdenTrust]

All action items have been completed, will submit closure report by end of the week

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update procedure to mandatory provides weekly update on all incidents where next update date is not specified	Prevent	Root Cause # 1	Incident report procedure to include mandatory weekly update	2026-04-02	Complete
Implement automated reminders for open incidents	Prevent	Root Cause # 1	Automated reminders	2026-04-30	Complete

Comment 6

[IdenTrust]

Report Closure Summary

• Incident description:

IdenTrust had an open bug 2016585 with a pending task which was completed, but the bug was not updated within 3 days of the action Item being completed.

• Incident Root Cause(s):

There was a personnel transition recently. Incident bugs were not properly tracked to ensure that action items were posted within the timelines required by the CCADB Incident Reporting Guidelines during the personnel transition.

• Remediation description:

IdenTrust updated the incident report procedure to include mandatory weekly updates and introduced automated reminders for reporting milestones.

• Commitment summary:

IdenTrust will continue to follow its updated incident reporting process, to publish responses in the timeframe consistent with CCADB Incident Reporting Guidelines.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 7

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-05-18.