Trustis: Gap between audit periods

This case concerns Trustis’s CA audit statements and a perceived gap in audit coverage between 15 January 2019 and 17 February 2019. The issue was raised in the context of audit statement dates provided for the CA, where updated statements still left a gap in the stated audit period. Trustis responded that there was full audit coverage for the periods concerned, but that the audit statements were not articulated well and contained incorrect dates, creating confusion. Trustis later provided an “Incident Report - Perceived Audit Gap,” describing that incorrect dates were inserted into audit statements due to administrative/quality issues in generating the audit document pack, and that the underlying detailed audit reports were correctly dated. Trustis stated it would define future audit periods in advance and implement a more rigorous review process by Entrust to ensure audit statement accuracy before release to Mozilla. The bug was marked RESOLVED with resolution FIXED, and Trustis noted it was transitioning off the “Trustis FPS Root CA” and had not issued certificates since January 2018.

1. 2018-01-02 Trustis stated that no certificates had been issued since January 2018.
2. 2019-01-15 The audit statement dates as submitted left a perceived gap starting 15 January 2019.
3. 2019-02-17 The perceived audit gap ended when the audit period start date was shown as 17 February 2019 in submitted statements.
4. 2020-05-13 Trustis provided an incident report explaining the perceived audit gap and an updated audit statement.

1. 2020-03-18 Mozilla representative — Kathleen Wilson pointed out that the audit statements showed a gap between 15 January 2019 and 17 February 2019 and requested an incident report explaining how it would be resolved and not repeated.
2. 2020-03-27 Trustis representative — Blake Morgan said Trustis recognized the concerns, stated there was full audit coverage over the periods concerned, raised the issue with the auditors, and said a full incident report would be provided after the auditors responded.
3. 2020-04-30 Mozilla representative — Kathleen Wilson asked for clarification about dates referenced in Trustis’s January 2020 CA communication and how to set the server-distrust-after date.
4. 2020-05-13 Trustis representative — Blake Morgan posted the “Incident Report - Perceived Audit Gap,” explaining that incorrect dates were inserted into audit statements and describing corrective steps for future audit statement accuracy.
5. 2020-05-13 Mozilla representative — Kathleen Wilson shared an updated audit statement link and noted Trustis’s transition off the root, agreeing the bug could be closed as resolved fixed.