SwissSign: recommendation on BIA/BCP test coverage
SwissSign opened this CA Program incident report based on an audit finding. The audit report recommended improving SwissSign’s test coverage for BIA (Business Impact Analysis) and BCP (Business Continuity Plan). The report stated that certificate issuance was not halted because the audit recommendation did not impact issuance. SwissSign reviewed its existing BIA and BCP testing framework and updated internal documentation to explicitly map individual tests and their interconnections, clarifying how the tests collectively support business continuity objectives and alignment with ETSI EN 319 401 requirements. SwissSign reported that the action items from the audit recommendation were completed and reviewed by its auditors, and that ongoing reviews would ensure continued clarity and completeness of BIA and BCP test coverage. The CCADB team issued a final call for comments before closure.
- SwissSign submitted a preliminary incident report stating an audit recommendation to improve BIA/BCP test coverage.
- SwissSign published the full incident report with an audit timeline and action item to improve BIA/BCP test mapping.
- An audit report containing the BIA/BCP test-coverage recommendation was published.
- SwissSign completed the documentation update for BIA/BCP test mapping and reported auditor review; the incident report was prepared for closure.
- SwissSign AG — SwissSign submitted a preliminary incident report describing an audit recommendation to improve BIA/BCP test coverage and citing ETSI EN 319 401 and REQ-7.11.1-01X.
- SwissSign AG — SwissSign posted the full incident report, stating the audit recommendation was not tied to a non-compliance period and that issuance was not halted.
- SwissSign AG — SwissSign stated it was monitoring the Bugzilla for community feedback.
- SwissSign AG — SwissSign again stated it was monitoring the Bugzilla for community feedback.
- SwissSign AG — SwissSign reported completion of the action item (documenting BIA and BCP mapping) with auditor review and confirmed ongoing monitoring.
- CCADB representative — CCADB issued a final call for comments and indicated the incident report would be closed on approximately 2026-05-04.