Firmaprofesional: 2020 Audit Report Finding 3 out of 4

This case concerns Firmaprofesional’s 2020 annual audit report finding #3 out of 4. The finding related to firewall controls: while frequent reviews of firewall rules were performed, the CA could not evidence adequate documentation of those reviews and results. Firmaprofesional stated that the issue was registered as a non-conformity in its JIRA on 2020-04-14 and that an action plan was established. The CA reported remediation steps including enabling an audit trail in the firewalls (enabled on 2020-06-16), drafting a Firewall Configuration Policy (planned for 2020-06 and referenced as written on 2020-07), and centralizing firewall logs in a new log management tool (Elasticsearch) with logs redirected to it (centralization referenced for 2020-06-16 and tool launched in 2020-07). A Mozilla participant indicated they were inclined to close the audit finding as remediated and scheduled closure for around 17-Sep-2020 if no further questions arose. The bug is currently marked RESOLVED with resolution FIXED.

1. 2020-04-14 Firmaprofesional registered the audit non-conformity in its JIRA and established an action plan.
2. 2020-06-16 Firmaprofesional enabled an audit trail in its firewalls and centralized firewall logs in a new log management tool.
3. 2020-07 Firmaprofesional drafted/wrote a Firewall Configuration Policy and launched Elasticsearch for firewall log centralization.
4. 2020-09-09 Mozilla indicated intent to close the audit finding as remediated, pending no further questions.

1. 2020-07-01 Autoridad de Certificacion Firmaprofesional — Reported that the annual audit found an unqualified audit report and described finding #3 about inadequate documentation of firewall rule review evidence.
2. 2020-07-26 Community commenter — Asked why the CA believed the issue did not represent a non-conformity.
3. 2020-07-28 Autoridad de Certificacion Firmaprofesional — Responded that the CA viewed it as an opportunity to improve evidence collection based on different auditors.
4. 2020-07-29 Autoridad de Certificacion Firmaprofesional — Added that firewall auditing functionalities were enabled, a Firewall Configuration Policy was drafted, and firewall logs were redirected to a new Elasticsearch-based log centralization tool.
5. 2020-08-02 Community commenter — Criticized the explanation as not addressing why it was not a non-conformity and emphasized expectations for maintaining evidence.
6. 2020-08-04 Isigma representative — Clarified that once the issue appears in an audit report it is a non-conformity, and stated the CA implemented measures to provide required evidence next time.
7. 2020-09-09 Mozilla representative — Stated they were inclined to close the audit finding as remediated and would schedule closure around 17-Sep-2020 if no additional issues were raised.