IdenTrust: Delay in updating CCADB incident report “Next update”/Closure Report for Bug 2014609
IdenTrust disclosed that it had an open CCADB incident-related bug, Bug 2014609, with a pending task, but the bug was not updated with the Closure Report or a “Next update” date for more than seven days. The CA stated this was due to oversight during a recent personnel transition, and that the CCADB Incident Reporting Guidelines version 3.2 requirement to update open incident reports within 7 days (when no “Next update” date is recorded) was not followed. IdenTrust provided a preliminary incident report and then a full incident report describing the non-compliance period (2026-02-27 to 2026-03-23) and the identified date (2026-03-21). IdenTrust remediation included updating its incident report procedure to include mandatory weekly updates and implementing automated reminders for open incidents, including an incident tracker with automated email alerts. The thread states that no customer certificate impact occurred and that all action items were completed, with a request to close the report. A CCADB incident-reporting mailbox made a final call for comments and indicated the report would be closed on approximately 2026-05-18; the bug is marked RESOLVED with resolution FIXED.
- Non-compliance period began for incident reporting related to Bug 2014609.
- IdenTrust identified the incident reporting deadline issue for Bug 2014609.
- Non-compliance period ended for the incident reporting issue.
- IdenTrust opened the CCADB incident reporting follow-up bug (this bug) with a preliminary incident report.
- IdenTrust posted the full incident report and action items.
- Automated reminders for open incidents were implemented (marked complete).
- CCADB indicated the incident report would be closed on approximately this date; bug status is RESOLVED.
- IdenTrust Services, LLC — IdenTrust posted a preliminary incident report stating the Bug 2014609 closure/next-update fields were not updated for more than seven days and cited CCADB Incident Reporting Guidelines v3.2.
- IdenTrust Services, LLC — IdenTrust said it would publish the full incident report no later than Friday April 3rd.
- IdenTrust Services, LLC — IdenTrust posted the full incident report, including root cause (personnel transition and tracking/weekly updates not ensured), impact (no customer certificate impact), and action items.
- IdenTrust Services, LLC — IdenTrust reported ongoing work to implement automated reminders and requested the “next-update” field be set to 2026-04-30.
- IdenTrust Services, LLC — IdenTrust marked the automated reminders action item as complete and described the implemented incident tracker with automated email alerts.
- IdenTrust Services, LLC — IdenTrust stated all action items were completed and that it would submit the closure report by end of the week.
- IdenTrust Services, LLC — IdenTrust posted a report closure summary, stating remediation steps were implemented and requesting closure.
- CCADB representative — CCADB issued a final call for comments and stated the report would be closed on approximately 2026-05-18.