Chunghwa Telecom: Delayed disclosure of GTLSCA audit finding (Domain validation records without TLS BR version)
Chunghwa Telecom (GTLSCA) disclosed that it became aware of an audit finding from its 2025 WebTrust audit that had not been included in the public incident report within the required timeframe. The audit finding concerned “Domain validation records without the TLS BR version,” which the auditor attributed to incomplete information captured and outdated practices in the record-keeping process. Chunghwa Telecom stated that, under CCADB Policy 5.2, audit “findings” must be disclosed to Bugzilla within 72 hours, and that this disclosure was not completed within that window. The company said the oversight was ultimately reported by a third party, after which it initiated corrective disclosure. The bug includes action items such as mandatory CCADB Policy 5.2 training (including the 72-hour disclosure rule), adding a CCADB Disclosure Decision Gate to the audit workflow, and deploying an audit-finding monitoring dashboard. The incident report closure summary states that the action items were completed as described and requests closure. The bug is marked RESOLVED with resolution FIXED.
- Non-compliance period began after the required 72-hour disclosure window was missed for the audit finding.
- The annual audit report (including findings) was obtained.
- The audit finding was identified as not disclosed in the public incident report.
- Chunghwa Telecom posted the full incident report for the delayed disclosure on Bugzilla.
- The bug was resolved (status RESOLVED, resolution FIXED).
- Cht representative — Posted a preliminary incident report stating that the annual audit report was obtained on 2025/12/13 and that an audit finding (Bug 2008788) was not disclosed in the public incident report on 2026/1/6.
- Cht representative — Posted the full incident report describing the delayed disclosure as a CCADB Policy 5.2 compliance/process issue and provided a timeline and remediation context.
- Cht representative — Updated the full incident report (fixed typo).
- Cht representative — Stated Chunghwa Telecom was monitoring the bug and had no new information.
- Cht representative — Provided an action items update including training, a disclosure decision gate in the audit workflow, and an audit-finding monitoring dashboard.
- Cht representative — Provided another action items update (including a date correction) and indicated ongoing/completed statuses.
- Cht representative — Posted a report closure summary stating remediation steps were mandated/added and that all action items were completed as described, requesting closure.
- CCADB representative — Issued a final call for comments or questions before closure.