Certigna: Findings in 2024 ETSI Audit – Audit Incident Report

This case involves Certigna's findings from a 2024 ETSI audit, which identified several areas for improvement. The audit revealed non-conformities related to the deployment of new CA hierarchies, training of RA operators, documentation of OIDs, periodic review of the information security policy, and documentation on trusted roles. Certigna has since implemented corrective actions for each finding, and all issues were closed by the auditor in June 2024. The current status of the case is resolved, with all actions operational as confirmed by Certigna.

1. 2024-06-29 Completion of the ETSI audit with findings reported.

1. 2024-07-15 Dhimyotis representative — Audit incident report findings were detailed, including action items for improvement.
2. 2024-07-15 Google representative — Questions raised regarding the level of detail in the findings and root cause analysis.
3. 2024-07-16 Dhimyotis representative — Attachments of audit attestation letters were provided.
4. 2024-08-27 Dhimyotis representative — Confirmed that all actions have been implemented and findings are closed.
5. 2024-08-27 Mozilla representative — Indicated intention to close the bug unless additional items are addressed.