SwissSign: recommendation on BIA/BCP review

This case is based on an audit report for SwissSign that included a recommendation to improve the regular review of the BIA and the BCP so they remain synchronized. SwissSign states that the audit identified that, although both documents were reviewed periodically, their review cycles were not formally aligned within a coordinated process, creating a potential risk of divergence. SwissSign reported that certificate issuance was not halted because the audit recommendation did not impact issuance. As remediation, SwissSign synchronized the review periodicity of the BIA and BCP and formally documented the requirement, updating internal procedures to mandate coordinated reviews within the same review cycle and communicating the updated process to relevant stakeholders. SwissSign later reported that the action item was completed and reviewed by its auditors, and that all action items associated with the audit recommendation have been completed. The CCADB team posted a final call for comments or questions and indicated the incident report would be closed on approximately 2026-05-04 if no further comments were received.

1. 2025-09-23 SwissSign’s audit report was published containing a recommendation to synchronize BIA and BCP review periodicity.
2. 2026-04-27 SwissSign completed the action item to synchronize BIA/BCP review periodicity and documented the updated coordinated review process.

1. 2025-09-23 Community commenter — Opened a preliminary incident report stating the audit recommended improving regular review of the BIA and BCP to keep them synchronized.
2. 2025-10-06 Community commenter — Submitted the full incident report, stating the audit recommendation was the incident source and that issuance was not halted because issuance was not impacted.
3. 2025-10-13 Community commenter — Noted that SwissSign was monitoring the Bugzilla for community feedback.
4. 2025-10-21 Community commenter — Again stated SwissSign was monitoring the Bugzilla for community feedback.
5. 2026-04-27 Community commenter — Reported completion of the action item, including auditor review, and described remediation by synchronizing BIA/BCP review periodicity and updating internal procedures.
6. 2026-04-27 CCADB representative — Posted a final call for comments or questions and said the incident report would be closed on approximately 2026-05-04.