Telia BR audit statement qualifications and remediation tracking

This case tracked Telia’s qualified BR audit statement and the remediation of the audit qualifications. Mozilla opened the bug after Telia received a qualified BR audit statement and asked Telia to close out each qualification and provide incident reports where needed. Telia responded with a public audit response and later filed a detailed incident report covering the listed deviations, including issues with older root CA certificates and validation processes. Over time, the thread focused on Telia’s remediation work, including automation for organization, locality, and address verification, plus added manual review steps while the new system was being built and deployed. Telia later reported that the new automation had been put into production in the ordering system, then extended to the portal, and that the final customer migrations were completed in February 2021. The bug was then marked resolved/fixed and Mozilla indicated it could be closed.

1. 2019-07-11 Telia received a qualified BR audit statement and the case was opened to track closure of the qualifications.
2. 2019-08-05 Telia submitted an incident report for the BR findings and linked a public response document.
3. 2020-09-30 Telia put street/postalcode/L/O/C automation into production in the SSL ordering system.
4. 2021-02-27 Telia completed the last customer migrations to automatic processing.

1. 2019-07-11 Mozilla representative — Kathleen Wilson said Telia had received a qualified BR audit statement and asked Telia to track closure of the qualifications and provide incident reports.
2. 2019-08-05 Teliasonera representative — Pekka Lahtiharju posted Telia’s incident report for the BR findings and described the deviations and remediation timeline.
3. 2020-03-06 Teliasonera representative — Pekka reported that Telia had solved the street-data verification issue and that Bisnode API data appeared reliable for the planned automation.
4. 2020-06-25 Teliasonera representative — Pekka said the authentication problem had been solved, the L project had been delayed, and the remaining audit issue concerned older root CA certificates.
5. 2020-09-11 Teliasonera representative — Pekka said Telia had created a root inclusion application for a new root and that the L automation project was proceeding toward production.
6. 2021-02-27 Teliasonera representative — Pekka confirmed that the last migrations had been completed and said the bug could be closed.
7. 2021-02-27 Mozilla representative — Ben Wilson said he would queue the bug to be closed the following week.