IdenTrust: Full Incident Report for bug 2016585 was not published within 14 days of discovering the issue
IdenTrust reported that it did not publish a Full Incident Report within 14 days of the incident’s initial disclosure, as required by CCADB Incident Reporting Guidelines version 3.2. The issue related to an open bug, Bug 2016585, where IdenTrust posted the final incident report 14 days after the preliminary report disclosure, but CCADB’s interpretation of “initial incident disclosure” was the date IdenTrust became aware of the issue. IdenTrust stated that the non-compliance period was from 2026-02-24 to 2026-02-26, with the issue identified on 2026-03-21. IdenTrust said there was no customer certificate impact and characterized the incident as an incident reporting process issue. As remediation, IdenTrust standardized and documented its final incident disclosure process and introduced automated reminders (incident tracker with automated email alerts) to notify of approaching reporting deadlines. The bug was marked RESOLVED with resolution FIXED, and IdenTrust requested closure after completing the action items.
- IdenTrust’s incident reporting process was non-compliant with the 14-day Full Incident Report requirement.
- The non-compliance period ended.
- IdenTrust identified the issue and later provided public follow-up noting the 14-day requirement was not met.
- IdenTrust posted the Full Incident Report and updated documentation action items.
- The incident report was scheduled to be closed (final call for comments).
- IdenTrust Services, LLC — IdenTrust opened a preliminary incident report stating the Full Incident Report for Bug 2016585 was not published within 14 days of notification, as required by CCADB policy.
- IdenTrust Services, LLC — IdenTrust said it would provide the full incident report by Friday April 3rd.
- IdenTrust Services, LLC — IdenTrust posted the Full Incident Report, including the timeline, root cause analysis, and action items.
- IdenTrust Services, LLC — IdenTrust reported work continuing on introducing reminders for reporting milestones.
- IdenTrust Services, LLC — IdenTrust reported that the reminders action item was complete, describing an incident tracker with automated email alerts.
- IdenTrust Services, LLC — IdenTrust stated all action items were completed and it would submit a closure report by end of the week.
- IdenTrust Services, LLC — IdenTrust submitted a report closure summary requesting closure and describing remediation and completion of action items.
- CCADB representative — CCADB issued a final call for comments and stated the report would be closed on approximately 2026-05-18.