Sectigo incident report on repeated delays in responding to Mozilla incident reports

This case concerns Sectigo’s repeated failure to provide timely responses to Mozilla incident reports. It was opened by Mozilla after Ryan Sleevi cited a pattern across several other Sectigo bugs where responses were delayed beyond Mozilla’s expected one-week update cadence. Sectigo acknowledged the concern and said it would treat the matter as an incident report, then described the underlying cause as being under-resourced in people with the right skills for detailed incident reporting. Over time, Sectigo said it created a leadership group, increased meeting cadence, introduced a buddy system for bug ownership, and continued to refine its incident-response process. The bug was later marked resolved/fixed, and Sectigo said this bug was ready to close after a dependent bug was closed.

1. 2019-07-04 Mozilla opened a case about Sectigo’s delayed incident-report responses after citing multiple prior bugs.
2. 2019-09-20 Sectigo provided an incident-response explanation and said it would respond promptly and weekly thereafter.
3. 2020-08-07 Sectigo described root causes for the delays and outlined process changes to improve incident handling.
4. 2020-08-25 Sectigo said it had increased the working-meeting cadence to twice per week and added a buddy system for bug co-ownership.
5. 2021-03-31 Sectigo said this bug was ready to close after its dependency was closed.

1. 2019-07-04 Community commenter — Ryan Sleevi opened the bug, said Sectigo had a worrying pattern of not responding to incident reports in time, and asked for an explanation and prevention steps.
2. 2019-07-05 Sectigo — Robin Alden said Sectigo would follow up the next week.
3. 2019-09-20 Sectigo — Robin Alden said the underlying cause was under-resourcing for detailed incident reporting and committed to weekly updates and remediation work.
4. 2020-08-07 Sectigo — Rob Stradling said Sectigo had identified root causes for the lack of timeliness and was putting measures in place to improve incident response.
5. 2020-08-25 Sectigo — Tim Callan said a combination of user error and PTO caused gaps in the seven-day update window and that Sectigo had increased meeting cadence and added co-owners for each bug.
6. 2021-01-19 Sectigo — Tim Callan said Sectigo was still tracking open issues and responding within the specified timeframes, and that this bug remained open for community discussion and dependency reasons.
7. 2021-03-31 Sectigo — Tim Callan said that because the dependent bug was closed, this bug was ready to close too.
8. 2021-04-02 Mozilla representative — Ben Wilson said he would close the bug on or about 7-Apr-2021 unless someone objected.