Chunghwa Telecom: Delayed disclosure of GTLSCA WebTrust audit finding (Mass Certificate Revocation Plan)
Chunghwa Telecom reported a CCADB compliance issue related to GTLSCA’s annual WebTrust audit. The CA said it obtained the annual audit report on 2025/12/13 and became aware of an audit finding (referencing Bug 2008782) that was not disclosed in a public incident report by 2026/1/6. The thread states this case was categorized as a compliance/process “Delayed Disclosure” incident, not a security incident or mis-issuance, and that the required disclosure window was missed. The CA attributed the delay to insufficient understanding of CCADB Policy 5.2 requirements and said disclosure was triggered only after a third-party notification. The CA reported corrective actions including mandatory CCADB Policy 5.2 training (including the 72-hour disclosure rule), adding a CCADB disclosure decision gate to the audit workflow, and deploying an audit-finding monitoring dashboard. The bug was resolved as FIXED, and the CA requested closure after stating all action items were completed as described.
- Non-compliance period began after the 2025 WebTrust audit finding was identified.
- GTLSCA obtained the annual audit report containing the audit finding.
- The CA identified that the audit finding had not been disclosed in the public incident report by this date.
- The CA posted the full incident report for the delayed disclosure issue.
- The bug was resolved (FIXED).
- Cht representative — Posted a preliminary incident report stating the audit report was obtained on 2025/12/13 and the audit finding was not disclosed in the public incident report by 2026/1/6, noting the source as third-party reported.
- Cht representative — Posted the full incident report describing the issue as a delayed disclosure compliance/process incident tied to CCADB Policy 5.2’s 72-hour disclosure requirement and provided a timeline and remediation context.
- Cht representative — Stated Chunghwa Telecom was monitoring the bug for comments/questions and had no new information.
- Cht representative — Provided an action-items update listing training, a disclosure decision gate in the audit workflow, and an audit-finding monitoring dashboard with statuses and due dates.
- Cht representative — Provided a second action-items update showing completion of the listed action items, including the disclosure decision gate and dashboard.
- Cht representative — Submitted a report closure summary describing root causes, remediation (training, workflow gate, dashboard), and requested closure.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed around 2026-02-19.