Sectigo: Late termination of privileged access to Certificate Systems

Sectigo identified a delay in terminating privileged access for an employee, which was reported during a WebTrust audit. The termination notice was sent after the employee's contract expired, violating the 24-hour requirement set by the NSRs. Following an internal investigation, Sectigo updated its termination procedures and automated parts of its audit checks to ensure compliance. Despite these efforts, a recurrence of the issue was noted, prompting further discussions on restructuring the offboarding process. Ongoing improvements are being made to prevent future occurrences.

1. 2022-11-18 Employee X's contract set to expire.
2. 2023-04-20 Discrepancy found in account termination during audit.
3. 2023-05-24 Remediation and investigation completed.
4. 2023-09-11 Recurrence of incident noted.
5. 2024-01-31 Phase 1 of overhaul completed.
6. 2024-03-25 Phase 2 of overhaul completed.