SwissSign: recommendation on self-assessment tool
This case concerns an audit recommendation for SwissSign’s additional self-developed Self-Assessment Tool. The audit report recommended improving the tool so it reflects SwissSign-specific certificate content beyond common linting tools. SwissSign stated that the recommendation was not tied to a period of non-compliance and that certificate issuance was not halted because issuance was not impacted. SwissSign identified a contributing factor that further development and enhancement of the self-audit tool had not been formally established as an ongoing, documented process with defined criteria, responsibilities, and review intervals. As remediation, SwissSign defined, documented, and implemented a process to govern ongoing enhancement of the self-audit tool, including responsibilities, evaluation criteria, and review mechanisms. The bug was resolved as FIXED, with action items completed and the process in operation as part of SwissSign’s compliance framework. SwissSign also indicated it would continue monitoring the Bugzilla for community feedback, and CCADB issued a final call for comments before closure.
- SwissSign opened a CA Program bug describing an audit recommendation about improving its self-assessment/self-audit tool.
- SwissSign stated it was monitoring the Bugzilla for community feedback.
- SwissSign reported completion of the action item to define and establish a process for updating the self-audit tool.
- The incident report was scheduled to close after a final call for comments.
- SwissSign AG — SwissSign provided a preliminary incident report stating the audit recommended improving its additional self-developed Self-Assessment Tool to reflect SwissSign-specific certificate content beyond common linting tools.
- SwissSign AG — SwissSign provided a full incident report, stating the recommendation was not about non-compliance and that certificate issuance was not impacted, and listed an action item to define and establish a process to update the self-audit tool.
- SwissSign AG — SwissSign said it was monitoring the Bugzilla for community feedback.
- SwissSign AG — SwissSign again stated it was monitoring the Bugzilla for community feedback.
- SwissSign AG — SwissSign reported the action item was completed, stating it defined and implemented a process governing ongoing enhancement of the self-audit tool and that the process is now in operation.
- CCADB representative — CCADB issued a final call for comments or questions and stated the incident report would be closed on approximately 2026-05-07.