CFCA: reporting delayed when handling incident bug #2006333
CFCA reported that, while handling Bug #2006333, it did not submit the full incident report within the CCADB Incident Reporting Guidelines’ 14-day requirement, delaying submission by 14 days. The thread states that the delay occurred due to a misconception of the CCADB Incident Reporting Guidelines and that CFCA’s internal incident handling plan did not fully include the full reporting requirements. CFCA posted a Preliminary Incident Report and later posted the Full Incident Report on 2026-01-13, with this bug filed on 2026-01-15. CFCA provided a root cause analysis and action items, including updating its internal incident handling plan to fully align with the community requirements. CFCA later stated it completed the action items by aligning its internal Incident Handling Guidelines with BR and CCADB’s Incident Reporting Guidelines and requested closure. The bug is marked RESOLVED with resolution FIXED, and CFCA indicated it would submit a closure report if no further questions remained.
- Bug #2006333 was created and a Preliminary Incident Report was posted.
- 27 more non-compliant EV certificates were identified.
- All affected certificates were revoked.
- CFCA posted the Full Incident Report after a 14-day delay.
- This bug was filed.
- CFCA submitted a report closure summary requesting closure after completing action items.
- The bug was resolved (last change time recorded).
- Community commenter — CFCA described that, while handling Bug #2006333, it delayed submitting the full incident report by 14 days due to misunderstanding the CCADB Incident Reporting Guidelines.
- Community commenter — CFCA said it was preparing the Full Incident Report and would update soon.
- Community commenter — CFCA posted the Full Incident Report with a timeline, root cause analysis, and an action item to update its internal incident handling plan.
- Community commenter — CFCA said it was still monitoring the bug and would submit a closure report if there were no further questions.
- Community commenter — CFCA said it finalized a draft of Incident Handling Standards for review and would update status later.
- Community commenter — CFCA stated it completed the action items by aligning internal Incident Handling Guidelines with BR and CCADB Incident Reporting Guidelines.
- Community commenter — CFCA requested closure, stating remediation and commitments, and that all disclosed action items were completed.
- CCADB representative — CCADB’s incident-reporting account issued a final call for comments and noted closure would occur approximately 2026-02-18.