Chunghwa Telecom: Failure to respond to CPR within 24 hours
Chunghwa Telecom (CHT) reported a compliance failure related to its handling of a Certificate Problem Report (CPR). A third party notified CHT that CHT certificates were published in PEM format instead of DER, and CHT became aware of the incident on 2025-12-10. CHT stated that, due to insufficient professional training and internal process issues, it did not provide any acknowledgment or preliminary response to the CPR filer within the required 24 hours, violating BR 4.9.5. CHT later provided the preliminary incident report after the 24-hour window and opened this bug to report the delayed response as procedural non-compliance. CHT documented root causes including lack of a real-time notification mechanism and unavailability/insufficient familiarity of designated contacts, and it listed remediation actions such as revising CPR incident reporting guidelines, updating notification procedures, enabling templated auto-acknowledgement on the shared mailbox, and conducting training and drills. The bug was set to RESOLVED with resolution FIXED, and CHT requested closure stating there were no remaining open deliverables for this incident.
- CHT received a third-party notification about CA certificates published in PEM format instead of DER.
- CHT became aware of the CPR-related incident and began investigation.
- CHT provided the preliminary incident report after failing to respond within the required 24 hours.
- Bug closure scheduled/updated as the incident report was finalized.
- Cht representative — CHT submitted a preliminary incident report explaining it failed to acknowledge or respond to the CPR filer within 24 hours due to insufficient staff training, citing BR 4.9.5.
- Cht representative — CHT posted a full incident report stating it violated BR 4.9.5 by failing to respond within 24 hours, provided a timeline, and described remediation actions and root causes.
- Cht representative — CHT stated it was monitoring the bug and had no new information.
- Cht representative — CHT stated it was monitoring the bug and had no new information.
- Cht representative — CHT stated it was monitoring the bug and had no new information.
- Cht representative — CHT updated the action items table with completed remediation steps and due dates (including procedure updates, workflow review, and training/drills).
- Cht representative — CHT corrected a date in the action items update and reiterated completed items.
- Cht representative — CHT provided a report closure summary describing the delayed CPR response non-compliance, root causes, remediation (procedure update, auto-acknowledgement, training), and requested closure.
- CCADB representative — CCADB sent a final call for comments and noted the bug would be closed around 2026-02-05.