SwissSign: recommendation on backup testing

This case documents an ETSI audit report for SwissSign that included a recommendation to further improve SwissSign’s regular backup and restore testing. The audit recommendation specifically called for enhancing restore tests to restore the complete backup rather than only performing partial restores. SwissSign stated that certificate issuance was not halted because the recommendation did not impact issuance. SwissSign reported that it already performs full backup including verification of written data and performs regular restore tests to ensure backup media are readable. As remediation, SwissSign implemented complete restore testing of complete backups and had the updated approach reviewed by its auditors. The bug was resolved as FIXED, and SwissSign stated that all action items associated with the audit recommendation were completed, with continued monitoring of the Bugzilla for community feedback.

1. 2025-09-23 SwissSign’s ETSI audit report containing a recommendation on improving backup/restore testing was published.
2. 2026-04-27 SwissSign completed implementation of enhanced full-backup restore testing and had it reviewed by its auditors.

1. 2025-09-23 SwissSign AG — Opened a preliminary incident report stating the audit report recommended further improvement of SwissSign’s regular backup testing.
2. 2025-10-06 SwissSign AG — Submitted a full incident report describing the recommendation to enhance restore tests to restore complete backups instead of partial restores, and listed an action item to implement complete restore testing (initially marked In progress with a due date of 2026-04-30).
3. 2025-10-13 SwissSign AG — Noted that SwissSign was monitoring the Bugzilla for community feedback.
4. 2025-10-21 SwissSign AG — Noted again that SwissSign was monitoring the Bugzilla for community feedback.
5. 2026-04-27 SwissSign AG — Reported completion of the action item, stating complete restore testing was implemented and reviewed by auditors, and included a report closure summary indicating all action items were completed.
6. 2026-04-27 CCADB representative — Posted a final call for comments or questions and stated the incident report would be closed approximately 2026-05-04.