Firmaprofesional: 2019 audit Finding #1 - 6.2 Identification and Authorization

The case addresses an audit finding from 2019 regarding Firmaprofesional's certificate revocation process. It was identified that revocation requests made via methods other than the web were not adequately documented, leading to a lack of evidence for timely updates to certificate status. Although no unauthorized revocations occurred, the CA implemented a new revocation process on October 14, 2019, to ensure all requests are recorded in their JIRA system. The issue arose during a transition from OTRS to JIRA, which resulted in gaps in evidence during that period.

1. 2019-03-01 eIDAS audit identified revocation documentation issues
2. 2019-05-19 Non Conformity registered in JIRA and action plan established
3. 2019-10-14 New revocation process implemented