ANF AC: 2026 Audit Report Finding 1 out of 3 — Business continuity plan not updated after CAB transition
This case concerns an ETSI EN 319 401 audit finding for ANF AC. The business continuity plan and disaster recovery (OID 1.3.6.1.4.1.18332.13.1.1), version 2.5, still referenced the previous conformity assessment body (CAB) CSQA Certificazioni instead of the current CAB DEKRA Testing and Certification. The finding was treated as non-conformity against ETSI EN 319 401, Section 7.11.1, REQ-7.11.1-01X, because the continuity plan had not been maintained up to date following the CAB transition. ANF AC stated the impact was exclusively documentary and did not affect any issued certificates, OCSP responses, or CRLs. ANF AC updated and approved the business continuity plan on 2026-02-23 to replace the CAB reference, and on 2026-04-17 updated its internal document review procedure to verify external third-party references when organizational, contractual, or audit-related changes occur. A participant also commented that the CCADB incident-report timeline did not meet expectations for when preliminary and full reports should be posted.
- ANF AC changed its CAB from CSQA Certificazioni to DEKRA Testing and Certification.
- ANF AC performed the annual review of its business continuity plan and approved version 2.5 without detecting the outdated CAB reference.
- During the annual ETSI EN 319 401 audit, the auditor identified the non-conformity regarding the outdated CAB reference.
- ANF AC updated and approved the business continuity plan to replace CSQA Certificazioni with DEKRA Testing and Certification.
- ANF AC updated its internal document review procedure to require verification of external third-party references after relevant changes.
- yulier.nunez@anf.es — Posted the full incident report describing the audit finding, the outdated CAB reference in the business continuity plan, the stated documentary-only impact, and the remediation timeline.
- dean.f.reed@protonmail.com — Commented that the CCADB incident-report timeline did not meet expectations for preliminary/full report posting dates and referenced good practice about closure summaries.