NetLock: Failure to provide regular and timely incident updates

This case concerns NetLock’s failure to provide regular and timely incident updates after an incident was raised in relation to bug 1462423. Wayne Thayer reported that NetLock repeatedly failed to respond and provide updated information, and requested that NetLock submit an incident report using Mozilla’s template explaining why updates were not received and how NetLock would prevent recurrence. NetLock responded with an incident report stating it became aware of the problem via an email from Wayne Thayer to NetLock’s primary and secondary POCs, and provided a timeline of actions taken. NetLock stated that no problematic certificates were involved and that it was not a certificate issuance case. NetLock attributed the missed answers to a mail filter issue (with the Bugzilla mail address whitelisted) and to misunderstanding of thread comments, and said it changed how it handles communications by asking for clarification when a ticket update comment is not fully clear. NetLock also discussed structural changes to its organization and processes and requested modification of its primary and secondary POCs. The thread later notes that CCADB was updated and that bug 1462423 was resolved. The bug is marked RESOLVED with resolution FIXED.

1. 2019-08-11 Mozilla CA Program bug opened requesting NetLock provide an incident report with regular and timely updates.
2. 2019-08-13 NetLock submitted an incident report describing causes of missed updates and remediation steps.
3. 2019-08-16 NetLock described process review, organizational changes, and requested POC modification guidance.
4. 2019-08-27 Mozilla staff requested future Bugzilla account(s) to be used for POC communications.
5. 2019-09-04 CCADB POC update coordination continued and NetLock indicated the POC replacement.
6. 2019-10-04 CCADB was confirmed updated and related bug 1462423 was resolved.

1. 2019-08-11 Community commenter — Reported NetLock repeatedly failed to respond and provide updated incident information in bug 1462423 and requested an incident report using Mozilla’s template.
2. 2019-08-13 Community commenter — Submitted an incident report describing how NetLock became aware, providing a timeline, stating no problematic certificates were involved, and explaining causes and remediation (mail filter whitelisting and communication clarification rule).
3. 2019-08-13 Community commenter — Re-sent the timeline portion of the incident report due to garbled numbering.
4. 2019-08-16 Community commenter — Explained that a broader review identified gaps leading to lack of timely updates, described structural changes, and requested guidance on modifying primary/secondary POCs.
5. 2019-08-27 Community commenter — Asked which Bugzilla account(s) should be used in the future for CCADB-related coordination.
6. 2019-08-27 Community commenter — Set a needinfo-related instruction to Wayne indicating whether comment #3 addressed comment #0.
7. 2019-09-04 Community commenter — Cleared needinfo after emailing Szabolcs for details on updating NetLock’s POCs in CCADB and planned to make changes after a reply.
8. 2019-09-04 Community commenter — Replied that an email was sent to Kathleen requesting POC updates in CCADB and stated Szabolcs would replace Andras Somkuti as contact.
9. 2019-10-04 Community commenter — Confirmed CCADB was updated and that bug 1462423 was resolved.