Firmaprofesional: 2019 audit Finding #2 - 6.4 Facility, management, and operational controls

The case addresses an audit finding related to Firmaprofesional's management and operational controls. The audit revealed that auditors lacked sufficient access to review logs, which was a non-conformity noted prior to the eIDAS audit in March 2019. Firmaprofesional has since taken steps to rectify this by creating an auditor role with read-only access to logs in their CA software, EJBCA. They are also implementing a centralized log management system using Elastic Stack to enhance security and compliance. The issue has been resolved, and the CA continues to issue certificates without impact from this finding.

1. 2019-05-01 Non Conformity registered in JIRA and action plan established.
2. 2019-07-01 Issue presented to steering committee; project initiated for centralized log management.
3. 2019-12-01 Auditor role created in EJBCA.
4. 2020-01-01 Audit role delivered to personnel.
5. 2020-02-07 Remediation confirmed complete.