Izenpe: Failure to provide a preliminary report within 24 hours

The case concerns Izenpe’s handling of an incident involving two invalid EV certificates (with "France" in the stateOrProvinceName field) that were reported by an external party on June 20, 2020. In response, Izenpe provided an incident report explaining that the initial email to their CPS contact did not reach the correct people due to an incorrectly configured distribution list. Izenpe stated that both affected certificates would be revoked before next Wednesday at 1:45, and it described mitigation steps including training validation operators and developing a script to email validation operators for each certificate issued. The thread also includes Mozilla’s request for a fully complete and compliant final incident report and a follow-up bug created for the incorrect stateOrProvinceName issue. For the specific preliminary-report timing issue, Izenpe later updated its CPS contact to a new i**********s@izenpe.eus distribution list and notified CCADB. The bug is marked RESOLVED with resolution FIXED.

1. 2020-06-20 George reported a misissuance of two EV certificates to Izenpe’s CPS contact, but the message did not reach the correct people due to an incorrectly configured distribution list.
2. 2020-06-22 Izenpe provided an incident report and stated it would revoke both affected certificates before the stated deadline.
3. 2020-07-16 Izenpe updated its CPS with a new i**********s@izenpe.eus contact distribution list and notified CCADB.

1. 2020-06-21 Fozzie representative — Reported that he sent a problem report to i**********o@izenpe.com about two invalid EV certificates and had not yet received a response as of June 21 09:40 UTC.
2. 2020-06-22 Izenpe S.A. — Submitted an incident report describing how Izenpe became aware of the problem, the misconfigured CPS contact distribution list issue, training actions, and stated that the two affected certificates would be revoked before next Wednesday at 1:45.
3. 2020-06-22 Community commenter — Asked for clarification on which CPS was relevant and raised concerns about missing root-cause details and the adequacy of the incident response.
4. 2020-06-23 Izenpe S.A. — Provided CPS and contact details, explained the stateOrProvinceName reduction cause, and described mitigation steps including a new security-incidence distribution list and validation controls.
5. 2020-07-06 Mozilla representative — Requested a new, fully complete and compliant final incident report with instructions and a wiki link.
6. 2020-07-16 Izenpe S.A. — Created a new bug for the incorrect stateOrProvinceName issue and updated the CPS with the new i**********s@izenpe.eus contact, then notified CCADB.
7. 2020-09-09 Mozilla representative — Indicated intent to close the bug on or about 14-Sept-2020.