FNMT: Late CCADB incident disclosure for Bug 2049012
This case is about FNMT’s failure to open a preliminary incident report within the 72-hour deadline required by the CCADB Incident Reporting Guidelines. The underlying trigger was a third-party certificate problem report on 2026-06-10 about an incorrect CRL URI recorded in CCADB for AC RAIZ-FNMT RCM G2. FNMT said it evaluated and corrected the CCADB information on 2026-06-11, but the Bugzilla disclosure for the incident was not opened until 2026-06-19. FNMT explained that its incident triage procedure was not rigorous and that the compliance mailbox was not checked by the usual staff during that week. FNMT later updated its incident classification and management procedure, instructed the compliance team to review relevant inboxes, and stated that all action items were complete. The bug was then moved to closure, and CCADB posted a final call for comments saying it would be closed around 2026-08-04 if there were no further questions. The bug itself is now RESOLVED FIXED.
- A third party reported an incorrect CRL URI recorded in CCADB for AC RAIZ-FNMT RCM G2.
- FNMT evaluated the report and updated the CCADB information.
- The 72-hour deadline for opening a preliminary incident report expired.
- FNMT opened the Bugzilla disclosure ticket for the incident.
- FNMT updated its incident classification and management procedure and communicated it to staff.
- FNMT requested closure after stating that all action items were completed.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Submitted a preliminary incident report saying FNMT did not file a preliminary or full incident report within the 72-hour requirement.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Submitted the full incident report with the timeline, root cause analysis, and reference to Bug 2049012.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Reported that the incident classification and management procedure was updated and that the action items were updated to completion.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Stated that the triage procedure was updated, the compliance team was instructed to watch relevant inboxes, all action items were complete, and closure was requested.
- CCADB representative — Posted a final call for comments or questions and said the report would be closed around 2026-08-04 if there were no further questions.