PKIoverheid: TSP CIBG Findings in 2025 ETSI Audit - Incident Report #1 – Document Management
This case is an incident report from PKIoverheid (CA Owner CCADB unique ID A000068) regarding findings from a 2025 ETSI audit. The incident disclosure states that TSP document management was not in compliance with applicable ETSI 319 401 requirements, specifically that the approval process, document status, and version history were not applied uniformly across process and work instructions. The report also states that a scanned autograph was used in a letter to a subscriber without a formal process for using scanned autographs. PKIoverheid’s corrective actions included expanding the formal document management process to cover all work instructions and PKI-related process documents, and adopting legal advice regarding signing letters to subscribers. The report closure summary states that all action items were completed as described and requests closure. A CCADB incident-reporting message indicates a final call for comments before the bug would be closed on approximately 2026-02-06, and the bug is marked RESOLVED with resolution FIXED.
- An ETSI audit identified a finding related to non-uniform TSP document management and subscriber letter signing practices.
- A Corrective Action Plan was created in response to the audit finding.
- The Corrective Action Plan was approved by the auditor.
- Action items due date for expanding document management and adopting legal advice on subscriber letter signatures.
- A report closure summary was posted stating remediation was completed and closure was requested.
- Logius representative — Posted a preliminary incident report describing a minor non-conformity in document management disclosed via the annual ETSI audit.
- Logius representative — Noted the full incident report was in final review and would be posted shortly.
- Logius representative — Posted the full incident report detailing non-compliance causes and action items, including expanding document management and formalizing signature handling.
- Logius representative — Stated that all action items have been closed and that a report closure summary would be posted shortly.
- Logius representative — Posted the report closure summary, stating remediation was completed and requesting closure.
- CCADB representative — Issued a final call for comments and indicated the bug would be closed on approximately 2026-02-06 if no further input was received.