NETLOCK: CPS 1.5.2 problem and contact information update
This case concerns NETLOCK’s CP/S section 1.5.2, specifically the contact information it provides to subscribers and relying parties. Wayne e-mailed NETLOCK on June 28, 2024, raising questions about the identity of the contact person and citing section 1.5.2 of the then-effective CP/S. NETLOCK stated that the provider displayed contact information in section 1.5.2, but that the BRG 4.9.3-required instructions for reporting suspected private key compromise, certificate misuse, or other fraud/compromise/misuse were missing from the CP/S. NETLOCK’s root cause analysis said the missing mandatory contact information resulted from a previous interpretation that the listed email address would be sufficient for immediate notification and action within the required timeframe. NETLOCK supplemented the CP/S on July 9, 2024 to include the mandatory elements required by BRG 4.9.3 and trained the relevant employees. The bug was later requested for closure with no additional action items remaining, and Mozilla indicated it would close the matter unless further discussion was needed. The bug is marked RESOLVED with resolution FIXED.
- Wayne emailed NETLOCK raising concerns about CP/S section 1.5.2 contact information and compliance with BRG 4.9.3.
- NETLOCK responded to Wayne’s email.
- NETLOCK modified CP/S section 1.5.2 to add the BRG 4.9.3-required reporting instructions and trained relevant staff.
- NETLOCK requested closure stating no additional items remained.
- Mozilla closed the bug as FIXED.
- Netlock — NETLOCK provided an incident report describing the missing BRG 4.9.3-required reporting instructions in CP/S section 1.5.2, the root cause, and the corrective action (CP/S supplementation and staff training on July 9, 2024).
- Mozilla representative — Ben asked whether any new or discovered action items remained and requested closure if none were outstanding.
- Netlock — NETLOCK requested closure and stated there had been no additional items performed.
- Mozilla representative — Ben said he would close the bug on 6-Sept-2024 unless additional discussions were needed.