certSIGN: delay in updating a Bugzilla ticket (Incident Report Closure/Next update missing)
This case is an incident disclosure by certSIGN about a delay in updating a related Bugzilla incident ticket (Bug 2016672). certSIGN stated that Bug 2016672 was completed with all actions done, but it lacked a Closure Report and a “Next update” date, and the ticket was not updated for more than 7 days. certSIGN reported that the delay was specifically in adding the Closure report, and that internally the activity was marked as done before it was performed. certSIGN provided a root cause analysis identifying contributing factors including a procedural issue relying on single-person ownership and a notifications configuration issue that closed after a time-out rather than remaining active until received. After feedback from the Chrome Root Program requesting a deeper RCA and clearer action items, certSIGN updated the report and action items, including an updated RCA document referenced in the thread. The thread includes a Report Closure Summary with remediation steps and states that all action items disclosed in the report have been completed as described, with a request to close the incident report. The CCADB incident reporting contact issued a final call for comments, indicating the report would be closed on approximately 2026-05-26, and the bug is marked RESOLVED with resolution FIXED.
- Non-compliance period began for the related incident ticket (Bug 2016672) due to missing Closure Report/“Next update” date.
- Non-compliance period ended after the Report Closure Summary was added to the related ticket.
- certSIGN posted the Report Closure Summary and requested closure of the incident report.
- The incident report was closed (bug status RESOLVED/FIXED).
- certSIGN — Opened a preliminary incident report stating Bug 2016672 was completed but missing a Closure Report and “Next update” date for more than 7 days, citing the 7-day update requirement.
- certSIGN — Submitted a full incident report with timeline, root cause analysis (procedural single-person reliance and notifications configuration), and action items.
- certSIGN — Reported that the action item “Update config” was completed and all actions were done.
- Google representative — Requested updates to the RCA and action items, noting the report lacked why the single point of failure existed and asking for a full 5-Whys breakdown.
- certSIGN — Stated the RCA and action items were updated and pointed to an attached updated RCA document.
- certSIGN — Posted the Report Closure Summary describing systemic root causes, remediation steps, and requesting closure, stating action items were completed.
- CCADB representative — Issued a final call for comments/questions and stated the incident report would be closed on approximately 2026-05-26.