2025917 - IdenTrust: Full Incident Report for bug 2016585 was not published within 14 days of discovering the issue

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[IdenTrust]

Preliminary Incident Report

Summary

• Incident Description
  IdenTrust had an open bug, Bug 2016585 however the Full Incident Report was not published within 14 days of notification, as required by CCADB policy.
• Relevant policies:
  Common CA Database - Incident Reporting Guidelines version 3.2: While Full Incident Reports SHOULD be posted as soon as possible, they MUST be posted within 14 days of the incident’s initial disclosure.
• Source of incident disclosure:
  Comment 4 on Bug 2016585 Wayne at 2026-03-21 18:24 PDT

Comment 1

[IdenTrust]

Will provide a full incident report this week, no later than Friday April 3rd

Comment 2

[IdenTrust]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000036

• Incident description:
  IdenTrust had an open bug, Bug 2016585 however the Full Incident Report was not published within 14 days of notification, as required by CCADB Incident Reporting Guidelines.

• Timeline summary:

  • Non-compliance start date: 2026-02-24
  • Non-compliance end date: 2026-02-26
  • Non-compliance identified date: 2026-03-21

• Relevant policies:
  Common CA Database - Incident Reporting Guidelines version 3.2: While Full Incident Reports SHOULD be posted as soon as possible, they MUST be posted within 14 days of the incident’s initial disclosure.

• Source of incident disclosure:
  Comment 4 on Bug 2016585 Wayne at 2026-03-21 18:24 PDT

Impact

No customers impact where identified, incident reporting process issue only.

Timeline

• 2026-02-10 9:15 PDT - Issue was identified.
• 2026-02-12 16:13 PDT - Preliminary Incident Report for Bug 2016585.
• 2026-02-26 08:30 PDT - Full Incident report was posted for Bug 2016585.
• 2026-03-21 18:24 PDT - Public follow-up comments note that required 14-day requirement was not met.
• 2026-03-22 16:11 PDT - IdenTrust responded to the public follow-up comment.
• 2026-03-24 10:24 PDT - Separate incident was opened for 14-day requirement violation.

Related Incidents

• Bug 2026452 - Microsoft PKI Services: Failure to publish Full Incident Report for Bugzilla 2021175 within 14 days
• Bug 2007948 - NETLOCK: Full Incident Report was not published within 14 days of notification

Root Cause Analysis

Root Cause # 1
IdenTrust understanding of the Incident Reporting Guidelines version 3.2 was that the posting of Preliminary Incident Report serves as "initial incident disclosure". We posted the final incident report 14 days after the preliminary report disclosure. However, The CCADB’s interpretation of "initial incident disclosure" is the moment the CA becomes aware of the issue, not when a preliminary report was filed.

Lessons Learned

• What went well: No customer certificate was impacted.
• What didn’t go well: CCADB initial incident reporting deadline was not followed as intended.
• Where we got lucky: The underlying incident was not affected.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Standardize and document final incident disclosure process to ensure timely disclosure	Prevent	Root Cause # 1	Update Incident report procedure to include clarified definition of the final incident report timeline	2026-04-30	Pending
Introduce reminders for reporting milestones	Prevent	Root Cause # 1	Milestones will be tracked internally	2026-04-30	Pending

Appendix

Comment 3

[IdenTrust]

Correcting the action items:

Update of the documentation was completed today:

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Standardize and document final incident disclosure process to ensure timely disclosure	Prevent	Root Cause # 1	Update Incident report procedure to include clarified definition of the final incident report timeline	2026-04-02	Complete
Introduce reminders for reporting milestones	Prevent	Root Cause # 1	Milestones will be tracked internally	2026-04-30	Pending

Comment 4

[IdenTrust]

Work continues on this action item:

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Introduce reminders for reporting milestones	Prevent	Root Cause # 1	Milestones will be tracked internally	2026-04-30	Pending

Request the "next-update" field be set to 2026-04-30.

Comment 5

[IdenTrust]

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Introduce reminders for reporting milestones	Prevent	Root Cause # 1	Milestones will be tracked internally	2026-04-29	Complete

• Incident tracker with automated email alerts, implemented. Reminders are set to notify of approaching deadlines, starting from time of issue-discovery.

Comment 6

[IdenTrust]

All action items have been completed, will submit closure report by end of the week

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Standardize and document final incident disclosure process to ensure timely disclosure	Prevent	Root Cause # 1	Update Incident report procedure to include clarified definition of the final incident report timeline	2026-04-02	Complete
Introduce reminders for reporting milestones	Prevent	Root Cause # 1	Milestones will be tracked internally	2026-04-30	Complete

Comment 7

[IdenTrust]

Report Closure Summary

• Incident description:

IdenTrust had an open bug 2016585 however the Full Incident Report was not published within 14 days of notification, as required by CCADB policy.

• Incident Root Cause(s):

IdenTrust understanding of the Incident Reporting Guidelines version 3.2 was that the posting of Preliminary Incident Report serves as "initial incident disclosure". We posted the final incident report 14 days after the preliminary report disclosure. However, The CCADB’s interpretation of "initial incident disclosure" is the moment the CA becomes aware of the issue, not when a preliminary report was filed.

• Remediation description:

IdenTrust standardized and documented its final incident disclosure process and introduced automated reminders for reporting milestones to ensure timely disclosure.

• Commitment summary:

IdenTrust will continue to follow its updated final incident disclosure process, to publish full incident reports in the timeframe consistent with CCADB Incident Reporting Guidelines.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 8

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-05-18.