IdenTrust: Full Incident Report for Bug 2014609 was not published within 14 days of discovering the issue
IdenTrust reported that it had an open bug (Bug 2014609) but did not publish the Full Incident Report within 14 days of the incident’s initial disclosure, as required by CCADB Incident Reporting Guidelines version 3.2. In the initial report, IdenTrust stated that it would provide the full incident report by no later than April 3. The full incident report described a non-compliance period from 2026-02-16 to 2026-02-17, with the issue identified on 2026-03-21 based on a public follow-up comment on Bug 2014609. IdenTrust said there was no customer impact where identified and attributed the root cause to its understanding that posting the Preliminary Incident Report served as the “initial incident disclosure,” whereas CCADB’s interpretation was that initial disclosure is when the CA becomes aware of the issue. IdenTrust remediation included standardizing and documenting its final incident disclosure process and introducing automated reminders/alerts for reporting milestones. The bug was resolved as FIXED, with IdenTrust stating that all action items were completed and requesting closure, and CCADB issued a final call for comments before closing on approximately 2026-05-18.
- IdenTrust’s incident reporting non-compliance period began for Bug 2014609.
- IdenTrust’s incident reporting non-compliance period ended for Bug 2014609.
- IdenTrust identified the issue related to Bug 2014609 and later received public follow-up noting the 14-day requirement was not met.
- IdenTrust posted the full incident report and marked the documentation action item as complete.
- IdenTrust completed the action item to introduce automated reminders for reporting milestones.
- CCADB planned to close the incident report after the final comment window.
- IdenTrust Services, LLC — IdenTrust submitted a preliminary incident report stating the Full Incident Report for Bug 2014609 was not published within 14 days of notification and cited the CCADB 14-day requirement.
- IdenTrust Services, LLC — IdenTrust said it would provide the full incident report by no later than Friday April 3.
- IdenTrust Services, LLC — IdenTrust posted the full incident report, including timeline details, impact statement (no customer impact where identified), root cause analysis, and action items.
- IdenTrust Services, LLC — IdenTrust reported continued work on the action item to introduce reminders for reporting milestones and requested the next-update field be set to 2026-04-30.
- IdenTrust Services, LLC — IdenTrust updated the reminders action item status to Complete, stating an incident tracker with automated email alerts was implemented.
- IdenTrust Services, LLC — IdenTrust stated all action items were completed and that it would submit a closure report by end of the week.
- IdenTrust Services, LLC — IdenTrust submitted a report closure summary, reiterating the root cause and remediation, and requested closure.
- CCADB representative — CCADB issued a final call for comments or questions and stated the incident report would be closed on approximately 2026-05-18.