certSIGN: Findings in 2023 ETSI Audit for certSIGN ROOT CA G2 - Audit Incident Report

This case documents findings from a 2023 ETSI audit for the certSIGN ROOT CA G2, reported in the LSTI Audit Attestation dated 2023-05-11. The auditors considered the findings to be minor nonconformities, and certSIGN provided a remediation plan for multiple issues. The thread records remediation progress, including that seven of eight findings were closed and one finding remained ongoing for a period. Mozilla asked for a status update and a timeline for completion of the final unresolved finding. certSIGN stated that the final solution would be implemented by 31-Oct-2023 and validated/closed by 10-Nov-2023. certSIGN later reported that Issue #1 was validated and closed as planned, with no additional remediation items. Mozilla indicated it would close the bug on Friday, 17-Nov-2023, unless issues were raised, and the bug is marked RESOLVED with resolution FIXED.

1. 2023-05-11 LSTI Audit Attestation for certSIGN LSTI_AAL_1612-300_V1.0 reported minor nonconformities from the 2023 ETSI audit for certSIGN ROOT CA G2.
2. 2023-11-15 certSIGN validated and closed the final unresolved audit finding as planned.

1. 2023-05-17 certSIGN — Opened the bug with the audit findings and remediation plans, including Issue #1 status as ongoing and other issues marked completed.
2. 2023-06-08 certSIGN — Provided updates that a pilot for Issue #1 was being prepared and that Issue #8 was completed, with 7 of 8 findings closed and 1 still ongoing.
3. 2023-08-22 certSIGN — Reported the Issue #1 pilot was finalized and testing/conclusions were ongoing, with 7 of 8 findings closed and 1 still ongoing.
4. 2023-09-26 Mozilla representative — Requested a status update on remediation of the final unresolved finding.
5. 2023-09-27 certSIGN — Reiterated that Issue #1 testing was ongoing and that 7 of 8 findings were closed with 1 still ongoing.
6. 2023-09-27 Mozilla representative — Asked for a completion timeline and indicated weekly updates would be expected otherwise.
7. 2023-09-28 certSIGN — Provided the Issue #1 timeline: implement final solution by 31-Oct-2023 and validate/close by 10-Nov-2023.
8. 2023-11-01 certSIGN — Updated the Issue #1 timeline to final solution implemented and validate/close by 10-Nov-2023.
9. 2023-11-15 certSIGN — Confirmed Issue #1 was validated and closed as planned and that there were no additional remediation items.
10. 2023-11-15 Mozilla representative — Stated it would close the bug on 17-Nov-2023 unless issues were raised.