PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #6 – Security Incident Procedure
This case is an incident report from PKIoverheid (CA owner CCADB unique ID A000068) regarding a 2025 ETSI audit finding related to the security incident procedure. The CAB identified a minor non-conformity where handling of security incidents was not in line with established procedures, including that a new security officer was not properly informed and trained to establish responsibilities for escalating security incidents. The report also states that agreements with a subcontractor of KPN were not aligned with the procedures for handling security incidents at KPN, so registration and handling were not always in line with established procedures. PKIoverheid reported remediation steps including targeted briefing to the security officer on subcontractor responsibilities and incident handling protocols, revising the handover process with documented responsibilities and recurring tasks, and updating incident handling procedures in coordination with subcontractors. The thread states that action items were completed as described and requests closure of the incident report. A final call for comments was made, with closure expected around 2025-11-19, and the bug is marked RESOLVED with resolution FIXED.
- An ETSI audit identified a finding (ETSI Finding #6) about the security incident procedure not being followed as established.
- A corrective action plan was created in response to the audit finding.
- The corrective action plan was approved by the auditor.
- Remediation action items were completed, including briefing and procedure/documentation updates.
- The incident report was expected to be closed after a final comment period.
- Logius representative — Opened a preliminary incident report describing a minor non-conformity for the security incident procedure and citing ETSI 319 401 requirements.
- Logius representative — Provided the full incident report, stating the CAB finding, two root causes, and listing action items with due dates and statuses.
- Logius representative — Corrected an error in the action-items table and updated evaluation criteria while monitoring the bug.
- Logius representative — Reported that action item #3 was completed and updated the action-items list and statuses.
- Logius representative — Reported action item #2 completed and indicated intent to submit a closure request shortly.
- Logius representative — Submitted a report closure summary stating remediation steps were completed, periodic reviews would be executed, and requested closure.
- CCADB representative — Issued a final call for comments and stated the bug would be closed around 2025-11-19 if no further input was received.