2080698 - Certigna: Failure to announce completion of action item within prescribed time period

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Josselin Allemandou]

Preliminary Incident Report

• Incident description: Bug 2076795 included an action item with a due date of 2026-10-02. We met that action item by the due date but failed to report it within three days of completion as required by CCADB Incident Reporting Guidelines.
• Relevant policies: CCADB Incident Reporting Guidelines v3.2.
• Source of incident disclosure: Third party reported by adding a comment to the bug report.

Comment 1

[Josselin Allemandou]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000011
• Incident description: Bug 2076795 included an action item with a due date of 2026-10-02. We met that action item by the due date but failed to report it within three days of completion as required by CCADB Incident Reporting Guidelines.
• Timeline summary:
  • Non-compliance start date: 2026-10-05
  • Non-compliance identified date: 2026-10-09
  • Non-compliance end date: 2026-10-19
• Relevant policies: CCADB Incident Reporting Guidelines v3.2.
• Source of incident disclosure: Third party reported by adding a comment to the bug report.

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: No, as no certificates had been affected.
• Was issuance stopped in response to this incident, and why or why not?: No
• Analysis: N/A
• Additional considerations: N/A

Timeline

2025-07-15 : CCADB Incident Reporting Guidelines version 3.1 is published, specifying that Action Item updates are due within three days of change, completion, or delay.
2026-09-30 : Bug 2076795 has been created with an action plan, and the final action is scheduled for October 2, 2026.
2026-10-05: Deadline for updating the ticket to confirm that the planned actions have been implemented.
2026-10-07: The bug report has been updated to confirm that all actions were implemented.
2026-10-09 : A comment reminds us that we were supposed to update the ticket within 3 days of implementing the actions.
2026-10-19: Update of our corrective action management procedures, considering the 3-day update deadline.
2026-10-19: Raising staff awareness of the procedures.

Related Incidents

Bug	Date	Description
Bug 2077508	2026-10-02	Sectigo: Failure to announce completion of action item within prescribed time period
Bug 2021175	2026-03-04	Microsoft PKI Services: Failure to update action item status within 3 days

Root Cause Analysis

Contributing Factor #: title The guidelines for managing corrective actions have not been updated

• Description: Our procedures for managing corrective actions were not updated in 2025 to reflect changes in the CCADB Incident Reporting Guidelines regarding the delay in updating a ticket after an action has been processed. These procedures are separate from those used for incident reporting or non-conformities management.
• Timeline: 2025-07-15 – 2026-10-19
• Detection: Third-party reported
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: 5-Whys

Lessons Learned

• What went well: The corrections were made promptly after the report, with no impact on our services.
• What didn’t go well: We failed to provide the status update according to specified timelines.
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
The bug report has been updated to confirm that all actions were implemented	Mitigate	Root Cause # 1	Bug updated with the status of corrective actions	2026-10-07	Complete
Update of corrective action management procedures, considering the 3-day update deadline	Prevent	Root Cause # 1	Should reduce the occurrence of this type of non-compliance	2026-10-19	Complete
Raising staff awareness of the procedures	Prevent	Root Cause # 1	Should reduce the occurrence of this type of non-compliance	2026-10-19	Complete