Sectigo: Late termination of privileged access to Certificate Systems

This case involves Sectigo's late termination of privileged access to its Certificate Systems for an employee, identified as Employee X. The issue was discovered during a WebTrust audit update call, revealing that the termination notification was sent outside the required timeframe due to a weekend delay. Sectigo conducted an internal investigation, confirmed the discrepancy, and updated its termination procedures to ensure timely account access termination in the future. Although the case was initially resolved, a recurrence of the issue prompted Sectigo to reopen the bug for further monitoring and improvements to their offboarding processes. As of the latest updates, Sectigo has completed phases of an overhaul to enhance their internal procedures.

1. 2023-04-20 Sectigo discovered a discrepancy in the termination of privileged access during an audit.
2. 2024-03-25 Sectigo completed the second phase of their overhaul of internal processes related to account terminations.

1. 2023-04-26 Sectigo — Sectigo reported the late termination of access for Employee X discovered during an audit.
2. 2023-05-24 Sectigo — Sectigo confirmed completion of remediation and investigation, requesting to close the bug.
3. 2023-09-11 Sectigo — Sectigo reopened the bug due to a recurrence of the incident.
4. 2024-03-25 Sectigo — Sectigo indicated that further automation has been added to their offboarding process.