Microsoft PKI Services: Failure to report Bugzilla 2026452 within 72 hrs
Microsoft PKI Services reported a non-compliance with CCADB incident reporting requirements related to the Full Incident Report for Bugzilla 2021175. The thread states that on 2026-03-18 Microsoft PKI Services became aware that the Full Incident Report had not been published within the required timeframe, but Microsoft did not open a corresponding Bugzilla incident within 72 hours of becoming aware of the reporting failure. The bug describes this delay as a non-compliance with the CCADB Incident Reporting Guidelines, including the requirement that initial incident reports be created within 72 hours of becoming aware of an incident. The case includes a timeline showing the due time for the Full Incident Report and when Bugzilla 2026452 and 2026453 were opened to track the reporting failures. Microsoft’s remediation included updating governance procedures to calculate mandatory reporting deadlines based on timestamps/elapsed time rather than calendar-day tracking, and conducting regular training for personnel on CCADB incident reporting guidelines. The bug is marked RESOLVED with resolution FIXED, and Microsoft states that all action items were completed and a closure report was requested.
- Microsoft PKI Services became aware that the Full Incident Report for Bugzilla 2021175 had not been published within the required timeframe.
- Bugzilla 2026453 was opened to track Microsoft PKI Services’ failure to report the delayed Full Incident Report within 72 hours of becoming aware.
- Microsoft posted a report closure summary stating remediation actions were completed and requested closure.
- Microsoft Corporation — Posted a preliminary incident report stating Microsoft did not open a corresponding Bugzilla incident within 72 hours after discovering the reporting failure, which it described as non-compliance.
- Microsoft Corporation — Posted the full incident report with a timeline and root cause analysis, stating the delay was due to internal governance procedures interpreting reporting timelines as calendar-day obligations rather than elapsed time from the disclosure timestamp.
- Microsoft Corporation — Provided a weekly status update that Action Item #1 in Bugzilla 2026452 was completed and that closure reporting would follow.
- Microsoft Corporation — Submitted a report closure summary stating the Full Incident Report was published late and that governance procedures were updated and training would be conducted; requested closure.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed on approximately 2026-04-21 if no further comments were received.