D-Trust: Delayed publication of audit attestation letters in the CCADB, with revised AALs now published
This case concerns D-Trust’s failure to upload required Audit Attestation Letters (AALs) to the CCADB within the 92-day deadline in CCADB Policy 5.2. The audit period ended on 2025-10-07, the submission deadline expired on 2026-01-07, and the AALs were uploaded to the CCADB on 2026-01-19. D-Trust and its auditor later explained that the delay was caused by a combination of requested corrections, the auditor’s planned absence, and a CCADB S/MIME capability metadata discrepancy. The thread also examined whether the AALs properly listed the policy and practice statement versions that were in force during the audit period. After community feedback, D-Trust reported that the AALs were updated to explicitly list all applicable CP/CPS/TSPS document versions and their validity periods. The latest status update says action items 2 and 3 are completed, while action item 1, the CCADB capability pre-flight check, remains ongoing for the next audit cycle.
- D-Trust’s audit period ended.
- The CCADB 92-day AAL submission deadline expired.
- D-Trust uploaded the Audit Attestation Letters to the CCADB.
- The auditor distributed an explanatory letter regarding the late AAL provision.
- D-Trust published revised AALs that explicitly list all applicable document versions and validity periods.
- D-Trust — D-Trust opened a preliminary incident report saying the AALs were uploaded after the 92-day CCADB deadline and identified the issue as self-reported.
- CCADB representative — CCADB noted the late filing, quoted the 92-day policy requirement, and said D-Trust needed an explanatory letter from its auditor and better internal processes.
- D-Trust — D-Trust filed a full incident report with the timeline, impact assessment, and the auditor’s explanatory letter date.
- Google representative — Chrome Root Program asked D-Trust to explain why the audit statements referenced policy versions published after the audit period and how multiple in-force versions were handled.
- Bdr representative — D-Trust said the auditor reviewed the versions in force during the audit period and that the AALs would be updated to list the applicable document versions more explicitly.
- Apple representative — Apple said the audit report must list all policy documents referenced during the audit and that later-effective versions cannot be used to show compliance for the audit period.
- Tuev-nord representative — The auditor said the template would be amended to require explicit reference to all document versions with their validity dates that fall into the audit period.
- Bdr representative — D-Trust said the AALs were updated to list all CP/CPS/TSPS versions and validity periods applicable during the audit period, and that action items 2 and 3 were completed.
- Bdr representative — D-Trust reported that action items 2 and 3 remain completed, while the CCADB capability pre-flight check remains ongoing for the next audit cycle.