2026452 - Microsoft PKI Services: Failure to publish Full Incident Report for Bugzilla 2021175 within 14 days

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Microsoft PKI Services]

Preliminary Incident Report

Summary

• Incident description:

Microsoft PKI Services opened Bugzilla 2021175 on 2026-03-04 at 16:48 PST. The Full Incident Report was published on 2026-03-18 at 21:19 PST. This exceeds the mandatory 14 day timeline stated in CCADB Incident Reporting Guidelines by 4 hours and 31 minutes.

• Relevant policies:

CCADB Incident Reporting Guidelines - While Full Incident Reports SHOULD be posted as soon as possible, they MUST be posted within 14 days of the incident’s initial disclosure.

• Source of incident disclosure:
  Third Party

Comment 1

[Microsoft PKI Services]

Full Incident Report

Summary

• CA Owner CCADB unique ID:
  A002577

• Incident description:
  Microsoft PKI Services opened Bugzilla 2021175 on 2026-03-04 at 16:48 PST. The Full Incident Report was published on 2026-03-18 at 21:19 PST. This exceeds the mandatory 14 day timeline stated in CCADB Incident Reporting Guidelines by 4 hours and 31 minutes.

• Timeline summary:

  • Non-compliance start date:
    2026-03-18 16:48 PST
  • Non-compliance identified date:
    2026-03-18 19:48 PST
  • Non-compliance end date:
    2026-03-18 21:19 PST

• Relevant policies:
  CCADB Incident Reporting Guidelines - While Full Incident Reports SHOULD be posted as soon as possible, they MUST be posted within 14 days of the incident’s initial disclosure.

• Source of incident disclosure:
  Third Party

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: N/A
• Analysis: N/A
• Additional considerations: N/A

Timeline

• 2026-03-04 16:48 PST - Bug 2021175 was opened to track failure to update an action item status within 3 days. The Preliminary Incident Report was posted
• 2026-03-18 19:48 PST – An industry member commented (Comment 1) that the MPS surpassed the 14 day timeline to post the Full Incident Report
• 2026-03-18 21:19 PST – MPS posted the Full Incident Report
• 2026-03-19 12:00 PST – MPS initial analysis did not believe this was a non-compliance as they were interpreting requirements based on calendar days.
• 2026-03-22 06:34 PST – Same industry member commented (Comment 5), that MPS failed to open a bugzilla for the delayed Full Incident Report.
• 2026-03-24 12:00 PST – Upon further review MPS decided that the stricter timestamp interpretation should be followed versus the original interpretation of calendar day. MPS then began drafting documents to open a Bugzilla.
• 2026-03-25 19:05 PST - Bug 2026452 was opened to track MPS failure to publish Full Incident Report for Bugzilla 2021175 within 14 days.

Related Incidents

Bug	Date	Description
2025913	2026-03-24	IdenTrust also failed to publish their FIR within 14 days of discovery.
2025914	2026-03-24	IdenTrust also failed to publish their FIR within 14 days of discovery.
2025917	2026-03-24	IdenTrust also failed to publish their FIR within 14 days of discovery.
2025536	2026-03-23	Firmaprofesional also failed to publish their FIR within 14 days of discovery.
2007948	2025-12-29	NetLock also failed to publish their FIR within 14 days of discovery.

Root Cause Analysis

Contributing Factor #1: Incorrect interpretation of due date

• Description:
  Microsoft PKI Services' internal procedure for calculating the Full Incident Report (FIR) submission deadline from the initial disclosure event does not specify the requirements down to exact timestamp. Internally, FIR reporting timelines were operationalized by calendar day, with the deadline tracked as the end of the 14th day following disclosure.
  As a result, for Bugzilla 2021175, the FIR due date was internally interpreted as the end of day on 2026‑03‑18, rather than 14 elapsed 24‑hour periods from the disclosure timestamp of 2026‑03‑04 16:48 PST. This resulted in publication of the FIR at 2026‑03‑18 21:19 PST, exceeding the expected reporting timeline by 4 hours and 31 minutes.

• Timeline:

  • 2026-03-04 16:48 PST - Bug 2021175 was opened to track failure to update an action item status within 3 days. The Preliminary Incident Report was posted
  • 2026-03-18 19:48 PST – An industry member commented (Comment 1) that the MPS surpassed the 14 day timeline to post the Full Incident Report
  • 2026-03-18 21:19 PST – MPS posted the Full Incident Report
  • 2026-03-19 12:00 PST – MPS initial analysis did not believe this was a non-compliance as they were interpreting requirements based on calendar days.

• Detection:
  The reporting delay was identified through third‑party community review on 2026‑03‑18 following publication of the Full Incident Report.

• Interaction with other factors:
  Internal governance procedures interpreted mandatory reporting timelines expressed in days as calendar‑day obligations rather than elapsed time from the disclosure timestamp. This interpretation introduced ambiguity in the calculation of reporting deadlines and contributed to delayed submission of the required report.

• Root Cause Analysis methodology used:
  5 Whys

Lessons Learned

• What went well:

  • N/A

• What didn’t go well:

  • Mandatory reporting deadlines were tracked using calendar‑day calculations rather than elapsed time from the incident disclosure timestamp, introducing ambiguity in deadline determination.

• Where we got lucky:

  • The incident was limited to a reporting governance issue and did not impact certificate issuance, revocation, or subscriber security posture.

• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
#1 Update governance procedures to standardize calculation of all mandatory reporting deadlines based on timestamps rather than calendar-day tracking.	Prevent	Root Cause # 1	Effectiveness will be measured through absence of future reporting delays attributable to misinterpretation of mandatory reporting deadlines calculated from incident disclosure timestamp.	2026-04-10	In Progress

Appendix

• Related Bug: Bugzilla 2021175

Comment 2

[Microsoft PKI Services]

Weekly Status Update

---

We have completed the work for Action Item #1 and have marked it complete. All action items associated with this bug are now complete and we will be posting our closure report soon.

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
#1 Update governance procedures to standardize calculation of all mandatory reporting deadlines based on timestamps rather than calendar-day tracking.	Prevent	Root Cause # 1	Effectiveness will be measured through absence of future reporting delays attributable to misinterpretation of mandatory reporting deadlines calculated from incident disclosure timestamp.	2026-04-10	Complete

Comment 3

[Microsoft PKI Services]

Report Closure Summary

• Incident description:
  Microsoft PKI Services exceeded the mandatory 14 day timeline required by the CCADB Incident Reporting Guidelines to publish the Full Incident Report (FIR) associated with Bugzilla 2021175. The FIR was published on 2026-03-18 at 21:19 PST, which exceeded the required reporting deadline of 14 elapsed days from the initial disclosure timestamp of 2026-03-04 16:48 PST by 4 hours and 31 minutes.

• Incident Root Cause(s):
  The reporting delay was caused by Microsoft PKI Services’ internal governance procedures interpreting mandatory reporting timelines expressed in days as calendar day obligations rather than elapsed time from the incident disclosure timestamp. Internal procedures did not specify deadline calculations down to the exact timestamp, resulting in the FIR due date being interpreted as the end of day on 2026-03-18 rather than 14 elapsed 24 hour periods from the initial disclosure timestamp.

• Remediation description:
  Microsoft PKI Services has completed all remediation actions identified in the Full Incident Report. Governance procedures have been updated to standardize the calculation of all mandatory reporting deadlines based on elapsed time from the initial incident disclosure timestamp rather than calendar day tracking. These updates are intended to ensure accurate determination of mandatory reporting deadlines and prevent future delays attributable to misinterpretation of CCADB reporting timelines.

• Commitment summary:
  In addition to the completed remediation actions, we will conduct regular training for MPS personnel on CCADB Incident reporting guidelines, to ensure ongoing understanding of the requirements.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 4

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-04-21.