PKIoverheid: TSP KPN ETSI Audit Finding #13 – Restore Test (Incident Report #13) – Restore Test
This case is an incident report by PKIoverheid (Policy Authority PKIoverheid) concerning an ETSI audit finding for TSP KPN. The CAB noted that a backup/restore test had not taken place during the period since the last audit visit, which was recorded as a minor non-conformity. PKIoverheid disclosed the incident and provided a root cause analysis stating that not all requirements were implemented in time because changes were not fully tracked or prioritized during the transition period, and responsibility for tracking/prioritizing was not clearly assigned. The CA’s remediation actions included scheduling and executing comprehensive restore tests, executing a gap analysis and implementing remaining ETSI EN 319 401 requirements, and improving the structured process for tracking and implementing new requirements, including deadlines, periodic reviews, and escalation to management. PKIoverheid later reported that action item #1 (the restore test) had been executed, and that remediation was complete. The incident report closure request was to be submitted, and a final call for comments was issued before the bug would be closed.
- An auditor identified ETSI Finding #13 that a backup/restore test had not been performed since the last audit visit.
- A corrective action plan was created for the finding.
- The corrective action plan was approved by the auditor.
- The comprehensive restore test (action item #1) was executed, and remediation was declared complete.
- A final call for comments was issued before the incident report would be closed.
- Logius representative — Opened a preliminary incident report stating the minor non-conformity was that the restore test had not been performed.
- Logius representative — Posted the full incident report for ETSI Finding #13, including the CAB’s observation, root cause analysis, and action items with due dates and statuses.
- Logius representative — Provided an updated action-items table correcting an error in evaluation criteria formatting and noted monitoring for questions.
- Logius representative — Updated statuses: action items #2 and #3 were completed, while action item #1 remained in progress as planned for completion by 2025-10-11.
- Logius representative — Reported that action item #1 was done (test executed) and stated remediation was complete, with a closure request to follow.
- Logius representative — Submitted a report closure summary requesting closure and stating all action items had been completed as described.
- CCADB representative — Issued a final call for comments and indicated the report would be closed on approximately 2025-11-19.