ANF AC: 2023 Audit Report Finding (contingency plan testing timeframes)
This case reports a finding from ANF AC’s eIDAS/ETSI audit carried out in March–April 2023. The audit team found that, although disaster contingency plan testing was analyzed for the main CPD and the replacement CPD, the annual testing evidence did not consider the time frames for the availability of disaster CPD personnel needed to access the ANF AC rack during holidays or outside business hours. ANF AC explained that annual simulation of the contingency plan requires activating an alternative (passive) CPD and that physical access involves ANF AC trusted role personnel and CPD personnel, with customer service coordinating access details. ANF AC stated that the audit period was close to national holidays, leading auditors to check operational officer availability during non-working hours; ANF AC verified the operational officer is available 24 hours a day but not in person at the CPD during non-working hours, which could add travel time not contemplated by the continuity plan. In response, ANF AC registered the issue in its ticketing system on 2023-05-04 and updated the contingency procedure on 2023-05-16 for scenarios requiring use of the DR site as primary CPD. Mozilla asked whether any action items remained, and ANF AC indicated the bug could be closed, after which Mozilla closed it on 2023-10-11.
- eIDAS/ETSI audit identified a finding about contingency plan testing not covering disaster CPD personnel availability timeframes during non-working hours.
- ANF AC registered the audit finding in its ticketing system.
- ANF AC updated the contingency procedure for scenarios requiring the DR site as primary CPD.
- Mozilla closed the bug after confirming no further action items were needed.
- Autoridad de Certificación (ANF AC) — ANF AC described the audit finding and the contingency procedure update, explaining why non-working-hours availability and travel time were not covered by the tested timeframes.
- Mozilla representative — Mozilla asked whether any action items remained and whether the bug could be closed.
- Autoridad de Certificación (ANF AC) — ANF AC said the bug could be closed unless further clarification was needed.
- Mozilla representative — Mozilla stated it would close the bug on Wed 11-Oct-2023.