Microsoft PKI Services: Failure to publish Full Incident Report within 14 days of initial disclosure
This case concerns Microsoft PKI Services (CA Owner CCADB unique ID A002577) exceeding the CCADB mandatory 14-day timeline for publishing a Full Incident Report (FIR) associated with Bugzilla 2021175. The Preliminary Incident Report was posted for Bugzilla 2021175, but the Full Incident Report was published on 2026-03-18 at 21:19 PST, which the thread states exceeded the required 14-day deadline by 4 hours and 31 minutes. Microsoft PKI Services opened this bug to track the failure to publish the FIR within 14 days. In its Full Incident Report, Microsoft attributed the delay to an incorrect internal interpretation of the due date, where timelines expressed in days were tracked as calendar days rather than elapsed 24-hour periods from the initial disclosure timestamp. Microsoft states it completed remediation actions, including updating governance procedures to standardize deadline calculations based on elapsed time from the incident disclosure timestamp and conducting regular training for personnel. The bug is marked RESOLVED with resolution FIXED, and Microsoft requested closure of the incident report after completing action items.
- Bugzilla 2021175 was opened to track the incident, and the Preliminary Incident Report was posted.
- The Full Incident Report for Bugzilla 2021175 was published, exceeding the mandatory 14-day timeline by 4 hours and 31 minutes.
- Bug 2026452 was opened to track Microsoft PKI Services’ failure to publish the Full Incident Report within 14 days.
- The case was resolved as FIXED.
- Microsoft Corporation — Posted a Preliminary Incident Report stating the Full Incident Report for Bugzilla 2021175 was published 4 hours and 31 minutes after the mandatory 14-day deadline.
- Microsoft Corporation — Posted the Full Incident Report with a timeline and root cause analysis, stating the delay was due to an incorrect calendar-day interpretation of the due date.
- Microsoft Corporation — Reported completion of Action Item #1 to update governance procedures for timestamp-based deadline calculations.
- Microsoft Corporation — Provided a Report Closure Summary stating remediation was completed, governance procedures were updated, and training would be conducted; requested closure.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed around 2026-04-21 if no comments were received.