IdenTrust: Full Incident Report for bug 2014610 was not published within 14 days of discovering the issue
IdenTrust reported that it did not publish a Full Incident Report for Bug 2014610 within the 14-day deadline required by the CCADB Incident Reporting Guidelines version 3.2. The issue was that IdenTrust’s understanding of “initial incident disclosure” treated the posting of the Preliminary Incident Report as the initial disclosure, but CCADB’s interpretation is that initial disclosure is when the CA becomes aware of the issue. IdenTrust stated that it posted the final incident report 14 days after the preliminary report disclosure, and that no customer certificate impact occurred where identified. In response, IdenTrust standardized and documented its final incident disclosure process and introduced automated reminders/alerts for reporting milestones. IdenTrust reported that the action items were completed and requested closure, and CCADB issued a final call for comments before closing the bug on approximately 2026-05-18. The bug is marked RESOLVED with resolution FIXED.
- Non-compliance with the CCADB 14-day Full Incident Report posting requirement began for the incident tied to Bug 2014610.
- Non-compliance period ended for the incident tied to Bug 2014610.
- IdenTrust identified the issue and the initial disclosure source was referenced in public follow-up for Bug 2014610.
- IdenTrust posted the Full Incident Report for the 14-day requirement violation and reported completion of one documentation action item.
- Automated incident-tracking reminders with email alerts were reported as implemented and marked complete.
- CCADB closed the bug after the final call for comments period.
- IdenTrust Services, LLC — IdenTrust opened a preliminary incident report stating the Full Incident Report for Bug 2014610 was not published within 14 days of notification, as required by CCADB policy.
- IdenTrust Services, LLC — IdenTrust said it would provide the full incident report by no later than Friday April 3rd.
- IdenTrust Services, LLC — IdenTrust posted the Full Incident Report, including timeline, impact statement (no customer certificate impact), root cause analysis, and action items.
- IdenTrust Services, LLC — IdenTrust corrected the action items table, marking the documentation update as complete.
- IdenTrust Services, LLC — IdenTrust reported work continuing on introducing reminders for reporting milestones and requested the next-update field be set to 2026-04-30.
- IdenTrust Services, LLC — IdenTrust reported the reminders implementation (incident tracker with automated email alerts) as complete.
- IdenTrust Services, LLC — IdenTrust stated all action items were completed and it would submit a closure report by end of the week.
- IdenTrust Services, LLC — IdenTrust submitted a report closure summary, reiterating the root cause, remediation, and requesting closure.
- CCADB representative — CCADB issued a final call for comments and stated the bug would be closed on approximately 2026-05-18.