SwissSign: recommendation on log review process
SwissSign opened this CA Program bug as an incident disclosure based on an ETSI audit report. The audit report contained a recommendation to improve SwissSign’s review process of its logs and to align log review and retention processes with anticipated eIDAS regulatory requirements. SwissSign stated that certificate issuance was not halted because issuance was not impacted. SwissSign reported that existing archival retention periods (up to 11 years) did not proactively address potential eIDAS requirements mandating retention periods of up to 30 years. As remediation, SwissSign defined and implemented updated retention policies extending applicable log and information archival periods to 30 years for information governed by eIDAS, and had the updates reviewed by its auditors. The bug thread indicates the action item was completed and the report was closed, with SwissSign continuing to monitor the Bugzilla for community feedback.
- An ETSI audit report containing a recommendation on SwissSign’s log review and retention processes was published.
- SwissSign completed the action item to define and implement 30-year retention for eIDAS-governed information and had it reviewed by auditors.
- SwissSign AG — SwissSign submitted a preliminary incident report stating the audit report recommended improving its log review process.
- SwissSign AG — SwissSign provided a full incident report describing the audit recommendation, noting no issuance halt, and listing an action item to implement 30-year eIDAS-related retention.
- SwissSign AG — SwissSign said it was monitoring the Bugzilla for community feedback.
- SwissSign AG — SwissSign again stated it was monitoring the Bugzilla for community feedback.
- SwissSign AG — SwissSign reported completion of the 30-year retention action item, including auditor review, and stated the incident report was closed with continued monitoring.
- CCADB representative — CCADB posted a final call for comments and indicated the incident report would be closed around 2026-05-07.