FNMT: Minor non-conformities in 2021 audit statement
This case concerns minor non-conformities identified in FNMT’s 2021 audit statement. The findings were scheduled for remediation and included updates to the CP/CPS: adding a URL for Incorporating Agency information (Section 3.2), addressing CABF OIDs requirements for certificates issued after 9/30/2020 (Section 6.6), and implementing automated dual controls for older hierarchies issuing EV (Section 6.3), as well as ensuring trusted roles signing (Section 6.4). FNMT stated that the findings came from the preliminary audit report for the annual audit held from January 25 to February 5, 2021. FNMT provided a timeline of actions taken in response, including creation/publication of a “List of Registration Agencies” and publication of updated CPS versions to include the required URL, and internal steps to improve the validation/approval procedure with additional automated controls. The bug was resolved as FIXED. Mozilla’s Ben Wilson indicated that, if no questions or clarifications were needed, the bug could be closed on 30-April-2021.
- Annual audit took place from January 25 to February 5, 2021, leading to preliminary audit findings.
- Preliminary audit report determined non-conformities related to automated control procedures for separation of validation duties.
- Bug was created with a list of audit findings scheduled for remediation in FNMT’s CP/CPS.
- FNMT provided incident report details and a timeline of remediation actions for the audit findings.
- Mozilla indicated the bug could be closed if no further questions were needed.
- Mozilla representative — Created the bug with specific audit findings scheduled for remediation in FNMT’s CP/CPS (Sections 3.2, 6.3, 6.4, 6.6, and related items).
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Submitted an incident report and described how FNMT became aware of the issues and the timeline of actions taken to address the audit findings, including CPS updates and planned automated controls.
- Mozilla representative — Asked to close the bug on 30-April-2021 if no questions or clarifications were needed.