Chunghwa Telecom: Delayed disclosure to Bug 2008803 GTLSCA Audit Incident Report #4 - Missing evaluation for third parties
This case concerns Chunghwa Telecom’s GTLSCA annual audit disclosure being submitted late to Mozilla Bugzilla. The CA said it obtained the annual audit report on 2025/12/13 and became aware of an audit finding referenced in Bug 2008803 that was not disclosed in the public incident report by 2026/1/6. The thread states the issue was a compliance/process “Delayed Disclosure” incident under CCADB Policy 5.2, not a security incident or mis-issuance, and that the WebTrust audit finding related to missing evaluation for third parties (evaluation of applicability and professional competence of third-party vendors). The CA reported that it missed the required 72-hour disclosure window because it did not recognize the audit finding as requiring mandatory disclosure. The CA initiated corrective disclosure by posting preliminary and full incident reports on Bugzilla, and later provided an action-items update describing CCADB Policy 5.2 training and workflow/monitoring changes. The bug is marked RESOLVED with resolution FIXED, and the CA requested closure after stating the action items were completed.
- Non-compliance period began after the CA identified the audit finding that required disclosure under CCADB Policy 5.2.
- The CA obtained the annual audit report containing the audit finding.
- The CA became aware that the audit finding had not been disclosed in the public incident report within the required timeframe.
- The CA posted a preliminary incident report on Bugzilla for the delayed disclosure.
- The CA posted the full incident report on Bugzilla and requested closure after remediation updates.
- Cht representative — Posted a preliminary incident report stating the annual audit report was obtained on 2025/12/13 and that an audit finding (Bug 2008803) was not disclosed in the public incident report by 2026/1/6, with source of disclosure described as third-party reported.
- Cht representative — Posted the full incident report explaining the WebTrust finding about missing evaluation for third parties, stating the 72-hour disclosure window was missed, and providing a timeline and remediation context.
- Cht representative — Stated Chunghwa Telecom was monitoring the bug and had no new information.
- Cht representative — Provided an action-items update including CCADB Policy 5.2 training and adding a disclosure decision gate and monitoring dashboard to the audit workflow.
- Cht representative — Updated the action items, marking some items as completed and others as ongoing/completed.
- Cht representative — Submitted a report closure summary describing the delayed disclosure incident, remediation steps, and stating action items were completed and closure was requested.
- CCADB representative — Issued a final call for comments and stated the bug would be closed approximately 2026-02-19.