Certigna: Finding #3 ETSI Audit – Event log protection beyond seven years shall be improved
This case is a self-disclosed incident report from Certigna regarding an ETSI EN 319 411-1 finding about event log protection. Certigna stated that logs are retained for 7 years after the expiry of associated certificates, but the log integrity protection tool was configured for 7 years only. The non-compliance was identified by an ETSI auditor on 2025-03-28, after a configuration had been set on 2024-03-13. Certigna reported that no impact on certificates was identified. As remediation, Certigna updated its logging procedure to reinforce guidelines for configuring protection of archived logs and regular monitoring, raised team awareness, and updated repository configurations to adapt protection duration to the lifetime of associated certificates. Certigna’s report closure summary states that all action items were completed as described and requests closure, and the bug was resolved as FIXED.
- Certigna configured log integrity protection for a maximum of 7 years for logs linked to new short-lived certificates (30-minute lifetime).
- An ETSI auditor identified that the 7-year log integrity protection configuration applied to all logs, not only those linked to short-lived certificates.
- Certigna received the audit report and updated its logging procedure and monitoring guidelines, and raised team awareness.
- Certigna updated repository configurations to adapt archived log protection duration to the lifetime of associated certificates.
- The auditor validated the deviation resolution after reviewing log repository configurations and the procedure.
- Dhimyotis representative — Posted the full incident report for ETSI EN 319 411-1 finding OVR-6.4.6-01, describing the 7-year-only log integrity protection configuration and the remediation timeline and action items.
- Dhimyotis representative — Provided a report closure summary stating the remediation steps taken and requesting closure after completion of action items.
- Certigna — Confirmed that all action items were completed as described and requested closure while continuing to monitor the bug.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed on approximately 2025-07-02.