PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #4 – Training
This case is an incident report from PKIoverheid (CA owner CCADB unique ID A000068) regarding a training-related non-conformity found during the annual ETSI audit. The CAB reported that there was no evidence available showing that new KPN employees had received the required training referenced in the security handbook. The incident was identified as a minor non-conformity, with the non-compliance identified on 11-Aug-2025 and described as ongoing at the time of reporting. PKIoverheid’s corrective actions included retroactively training new employees, rewriting and improving the handover procedure for key roles such as the security officer, and building a monitoring display/report to track training progress and serve as audit evidence. PKIoverheid later reported that action items #3 and #4 were completed, and subsequently that KPN reported action items #1 and #2 were also completed, stating remediation was complete. The bug thread includes a report closure summary requesting closure after all disclosed action items were completed, and a final call for comments before closure.
- An ETSI audit finding identified a training-related non-conformity: no evidence that new KPN employees had completed required security handbook training.
- A corrective action plan was created following the auditor’s identification of the finding.
- The corrective action plan was approved by the auditor.
- KPN reported completion of action items #1 and #2, stating remediation was complete and requesting bug closure.
- The incident report was scheduled to be closed if no further comments were received.
- Logius representative — Opened a preliminary incident report describing a minor non-conformity related to training and citing ETSI 319 401 requirements.
- Logius representative — Provided the full incident report for ETSI Finding #4 – Training, stating the CAB found missing evidence of required training for new KPN employees and listing root causes and action items.
- Logius representative — Noted PKIoverheid was monitoring the bug and had no updates on the action items at that time.
- Logius representative — Updated action item status, stating action items #3 and #4 were completed while #1 and #2 were still in progress.
- Logius representative — Reported that KPN completed action items #1 and #2, said remediation was complete, and requested closing the bug.
- Logius representative — Submitted a report closure summary describing the incident, root causes, remediation steps, and commitment to ongoing monitoring, requesting closure.
- CCADB representative — Issued a final call for comments and stated the bug would be closed on approximately 2025-11-19 if no comments were received.