SwissSign: Findings in 2024 Audit
SwissSign submitted an audit incident report covering findings from its 2024 audit. The report references an audit attestation letter dated 4 September 2024 and states that the full incident report would be published after non-conformities were closed and verified by the auditor. The findings listed include access control for PEM device tokens, training for relevant employees on the mis-issuance procedure, media handling for customer document deletion, and operation security requiring dual control in the DSS. The report also includes certificate issuance monitoring for SHA-1 signed CSRs, process requirements for handling mis-issuance reports via the mis-issuance mailbox, and logging/monitoring alerting for logins in Online HSMs. SwissSign described root causes and action items for at least some of the findings, and noted that separate Bugzilla issues were opened for certain findings. The bug was requested to be closed, and Mozilla stated it would close it on Friday, 1-Nov-2024 unless additional questions or issues remained. The bug is marked RESOLVED with resolution FIXED.
- SwissSign’s audit attestation letter for the 2024 audit was dated.
- SwissSign opened the CA Program bug to report findings from its 2024 audit and provide the attestation link.
- SwissSign posted the post-audit incident report details, including root cause analysis and action items.
- SwissSign requested closure of the bug and Mozilla indicated it would close it on 2024-11-01 if no further issues were raised.
- SwissSign AG — SwissSign reported the initial 2024 audit incident findings and linked the audit attestation letter, listing multiple findings and noting separate Bugzilla issues for some items.
- SwissSign AG — SwissSign posted the post-audit incident report, stating it would be published after non-conformities were closed and verified, and provided root cause analysis and action items for several findings.
- SwissSign AG — SwissSign requested that the Bugzilla be closed if there were no further questions.
- Mozilla representative — Mozilla said it would close the bug on Friday, 1-Nov-2024, unless additional questions or issues remained.