PKIoverheid: TSP CIBG Findings in 2025 ETSI Audit - Incident Report #8 – Human Resources Management
PKIoverheid (PKIoverheid/Logius) opened this CA Program bug as an incident report following its annual ETSI audit finding. The finding concerned Human Resources Management: the HR onboarding process did not establish a clear link between terms and conditions and the different Trusted Roles, and the job descriptions did not clearly define Trusted Roles or the mandatory training sessions for each trusted role. The incident was identified on 26-Sep-2025, with a corrective action plan created on 23-Oct-2025 and approved by the auditor on 06-11-2025. Remediation included including Trusted Roles in the HRM process, retrofitting existing vacancy texts with training and other specific requirements, and adding these documents to the annual review process; it also included triggering a pre-audit inquiry with the auditor after major standards updates or auditor changes. The report closure summary states that all action items were completed as described and requests closure. The bug is marked RESOLVED with resolution FIXED.
- An auditor identified a non-conformity in the TSP HR onboarding process related to Trusted Roles and mandatory training definitions.
- A corrective action plan was created for the HR management non-conformity.
- The corrective action plan was approved by the auditor.
- A report closure summary stated remediation was completed and requested closure.
- Logius representative — Opened a preliminary incident report describing a minor non-conformity in Human Resources Management and noting it came from the annual ETSI audit.
- Logius representative — Reported that the full incident report was in final review and would be posted shortly.
- Logius representative — Posted the full incident report, stating the HR onboarding process lacked a clear link to Trusted Roles and that Trusted Roles and mandatory training sessions were unclear in job descriptions.
- Logius representative — Stated that all action items had been closed and that a report closure summary would be posted shortly.
- Logius representative — Posted the report closure summary, describing remediation (Trusted Roles added to HRM process, vacancy text retrofits, annual review updates, and pre-audit inquiries) and requesting closure.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed approximately 2026-02-06 if no further questions were raised.