Firmaprofesional: 2019 audit Finding #1 - 6.2 Identification and Authorization

This case concerns a 2019 audit finding for Firmaprofesional related to revocation handling and evidence of revocation requests. The audit identified that while the web application supports certificate revocation and prompt registration of requests, in other channels (e.g., revocation by email or telephone) no record of revocation requests was kept, so evidence could not be found that certificate status was changed within 24 hours of receiving a revocation request. The audit also noted that in some cases there was no explicit check to ensure revocation requests were originated by an authorized person, though the TSP stated that no non-authorized revocation cases occurred during the audit period. Firmaprofesional said it first became aware of the problem due to the eIDAS audit carried out in March 2019, and it registered the nonconformity in its JIRA system on 2019-05-19 with an action plan to establish a revocation process. Firmaprofesional stated that on 2019-10-11 its COO defined a revocation process requiring all revocations to be registered in JIRA regardless of whether they are made via mail, telephone, etc., and that since October 14, 2019 the new revocation process has been implemented. The bug was resolved as FIXED, with a later comment stating remediation was complete.

1. 2019-03-01 eIDAS audit identified that revocations not performed through the web lacked evidence of timely status changes and authorization checks in some channels.
2. 2019-05-19 Nonconformity was registered in Firmaprofesional’s JIRA and an action plan was established to establish a revocation process.
3. 2019-10-11 Firmaprofesional defined a revocation process requiring all revocations to be registered in JIRA and specifying how authorization is ensured.
4. 2019-10-14 The new revocation process was implemented in the company.
5. 2020-01-21 Bug 1610448 was filed to address the audit finding.

1. 2020-01-21 Isigma representative — Filed the case describing the audit finding and Firmaprofesional’s remediation steps, including the JIRA-based revocation process implemented in October 2019.
2. 2020-01-21 Community commenter — Asked for more detail on how the issue was introduced and how it went undetected, including whether it was examined in previous audits.
3. 2020-02-03 Isigma representative — Explained that a migration from OTRS to JIRA in mid-2018 left revocation management not fully migrated, creating an evidence gap during the transition period.
4. 2020-02-06 Community commenter — Stated there were no further questions.
5. 2020-02-07 Fastly representative — Commented that it appeared all questions were answered and remediation was complete.