Microsoft PKI Services: Overdue Audit Reports 2021
This case concerns Microsoft PKI Services’ WebTrust audit reporting to CCADB for the 2021 audit period. The CA did not upload final audit reports to CCADB within three months of the audit period end date, and the preliminary reports posted on 2021-07-26 were later found to be missing 16 cross-signed ICAs that were in the audit scope. Microsoft stated it was in the three-month grace period and that the final audit letters/assertions were completed and signed off by management and auditors on 2021-07-30, but the final audit letters were not posted to a CCADB audit case until 2021-08-06. After being notified by a cross-signed CA on 2021-08-03 that the preliminary audit reports were missing the ICAs, Microsoft worked with its auditor and provided corrected reports on 2021-08-05, then posted final audit reports to Bugzilla and added final audit report links to CCADB on 2021-08-06. Microsoft also stated that no certificates were mis-issued during the incident because there were no technical issues related to certificate issuance due to the late audit updates. Microsoft reported remediation actions including updating documentation and timelines for audit end processes, training personnel with CCADB access, and updating scoping audit documentation to check for cross-signed agreements; Microsoft later confirmed all remediations were completed and requested the bug be marked Resolved.
- End of the WebTrust audit period for Microsoft PKI Services.
- Preliminary audit reports were posted to CCADB using the “Test Preliminary Audit Statements” process.
- Microsoft was notified by a cross-signed CA that preliminary reports were missing 16 cross-signed ICAs.
- Corrected audit reports were provided by the auditor to include the missing ICAs.
- Final audit reports were posted to Bugzilla and final audit report links were added to CCADB.
- Final seals were issued from CPA Canada.
- Microsoft reported that the remaining remediation was on track to be completed.
- Microsoft confirmed all remediations identified in the bug were completed and requested the bug be marked Resolved.
- Microsoft Corporation — Microsoft reported that final audit reports were not uploaded to CCADB within three months, described the timeline, and said corrected final reports were being posted while troubleshooting a CCADB submission issue.
- Microsoft Corporation — Microsoft provided an incident report explaining two issues: late posting of final audit reports and preliminary reports missing 16 cross-signed ICAs, and it described corrective actions and a timeline.
- Microsoft Corporation — Microsoft stated it was on track with open remediations, including updating documentation/timelines and training personnel, and updating scoping audit documentation for cross-signed agreements.
- Microsoft Corporation — Microsoft reported closing two remediations and said additional training/documentation was already improving planning for current audit cycles.
- Microsoft Corporation — Microsoft confirmed all remediations identified in the bug were completed and formally requested the bug be marked Resolved.
- Mozilla representative — Mozilla indicated it would close the bug on Friday 1-Oct-2021 unless there were objections.