← Buypass cases
Bugzilla #2005196
Self Reported Incident
Audit Finding
Buypass: Findings in 2025 ETSI Audit - Audit Incident Report #2 - Supply chain policy
RESOLVED
FIXED
Buypass
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Buypass reported a minor nonconformity identified during the 2025 ETSI audit, where new requirements from ETSI EN 319 401, paragraph 7.14, were not implemented in their Supply Chain policy. The CA disclosed this incident proactively, detailing the lack of sufficient coverage for specific ETSI requirements in their Supplier Management documents. A corrective action plan was developed and approved by the CA's Change Advisory Board (CAB), which included updating procedures and agreements to ensure compliance. All action items have since been completed, and Buypass has committed to continuous monitoring and improvements to their processes.
Chronology
- Non-compliance identified during ETSI audit.
- All action items related to the incident have been completed.
Thread Activity
- Buypass — Registered Preliminary Incident Report regarding nonconformity in Supply Chain policy.
- Buypass — Confirmed that the incident was evaluated against Network Security Requirements and found compliant.
- Buypass — Submitted Report Closure Summary detailing root causes and remediation actions taken.
Participants
Buypass
Apple representative
CCADB representative
External References
Similar Local Cases
Buypass: Findings in 2025 ETSI Audit - Audit Incident Report #1 - Compliance auditing on support processes
Buypass: Missing NCA identifier in cabfOrganizationIdentifier in PSD2 QWACs
Buypass: Using an external DNS Resolver for DNS lookups
Buypass: Illegal Business Category in a PSD2 QWAC
Buypass: Insufficient Serial Number Entropy
SwissSign: recommendation on linting software updates
PKIoverheid: TSP CIBG Findings in 2025 ETSI Audit - Incident Report #7 – Change Management
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #3 - Missing vulnerability scan