Firmaprofesional: delayed publication of 2026 Audit Attestation Letters; incident report complete and closure requested
Autoridad de Certificacion Firmaprofesional self-reported a CCADB Policy compliance issue involving the late public availability of its 2026 Audit Attestation Letters. The case concerns the Standard, TLS Baseline Requirements, and TLS Extended Validation Guidelines AALs for the audit period ending 2026-03-27. Firmaprofesional said the CCADB Policy Section 5.2 deadline was 2026-06-27, but the AALs were not uploaded by then and no signed explanatory letter had been publicly provided by the deadline. The CA later confirmed the non-compliance, stated that the final AALs were entered in CCADB Case 00003334, and noted that the signed explanatory letter was published in Bug 2055439. The Full Incident Report says the non-compliance ended when CCADB confirmed submission of Case 00003334 on 2026-07-16. Firmaprofesional reported that both remediation action items have now been completed: the audit-disclosure register was implemented and the mandatory pre-deadline decision gate was added. On 2026-09-03, Firmaprofesional submitted a closure summary stating that all action items are complete and requesting closure, and CCADB posted a final call for comments saying the bug would be closed on approximately 2026-09-10 if there were no further comments. The bug is now resolved.
- Audit period ended for Firmaprofesional’s 2026 audit disclosures.
- CCADB Policy Section 5.2 deadline for uploading final AALs or a signed explanatory letter expired.
- Firmaprofesional formally confirmed the missed audit-disclosure deadline while preparing the CCADB submission.
- CCADB confirmed submission of Case 00003334 containing the three authoritative AAL disclosures.
- Firmaprofesional published the Full Incident Report and listed two remediation action items.
- Firmaprofesional completed the first remediation action item by implementing the audit-disclosure register.
- Firmaprofesional completed the second remediation action item by implementing the mandatory pre-deadline decision gate.
- Firmaprofesional submitted a closure summary requesting closure after stating all action items were complete.
- Autoridad de Certificacion Firmaprofesional — Posted a preliminary incident report describing the missed CCADB Section 5.2 deadline and noting that the final AALs were entered in CCADB Case 00003334 and the signed explanatory letter was published in Bug 2055439.
- Autoridad de Certificacion Firmaprofesional — Said the investigation and Full Incident Report preparation were still in progress and that the incident remained open.
- Autoridad de Certificacion Firmaprofesional — Published the Full Incident Report, confirmed the non-compliance, and listed two remediation action items with August due dates.
- Autoridad de Certificacion Firmaprofesional — Reported no material change and requested that the next update date be set to 2026-08-21.
- Autoridad de Certificacion Firmaprofesional — Reported that the first open action item was completed, the audit-disclosure register was implemented, and the second action item remained ongoing.
- Autoridad de Certificacion Firmaprofesional — Reported that the second and final action item was completed and that all action items disclosed in the Full Incident Report are now complete.
- Autoridad de Certificacion Firmaprofesional — Submitted a closure summary stating that the incident root causes and remediation were documented, all action items were complete, and closure was requested.
- CCADB representative — Posted a final call for comments or questions and said the incident would be closed on approximately 2026-09-10 if there were no further comments.