PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #11 – Anti-Malware Software

This case involves a minor non-conformity identified during an annual ETSI audit of PKIoverheid, where anti-malware software was either absent or not updated frequently enough on several servers. The CA disclosed this incident proactively, detailing the timeline of non-compliance and corrective actions taken. A Corrective Action Plan was created and approved, leading to the implementation of an anti-malware solution and improvements in tracking compliance with new requirements. All action items have been completed, and the CA has committed to periodic reviews of ETSI regulations to maintain compliance.

1. 2025-02-28 Effective date of updated ETSI EN 319 401 requirements.
2. 2025-07-11 Non-compliance identified by auditor.
3. 2026-01-11 Implementation of anti-malware solution completed.

1. 2025-08-15 Logius representative — Preliminary incident report submitted detailing minor non-conformity.
2. 2025-08-28 Logius representative — Full incident report provided with detailed findings and corrective actions.
3. 2026-01-07 Logius representative — Report closure summary submitted, confirming all action items are completed.