Asseco DS / Certum: delayed publication of Full Incident Report after third-party report
This case concerns Certum’s delayed publication of a Full Incident Report after a third-party report in Bugzilla bug 2055775 about incomplete CRL URL disclosures in CCADB. Certum said it had treated the 14-day deadline as starting from the Preliminary Incident Report publication date, but later stated that the deadline should have been counted from 2026-07-15 09:19 UTC, when it first became aware of the issue from a third party. On that basis, Certum said the applicable deadline was 2026-07-29 09:19 UTC and that the Full Incident Report was submitted after that deadline. Certum cited CCADB Policy v2.1 section 6.1 and the CCADB Incident Reporting Guidelines. The bug remains assigned, and the thread provided does not include a final closure or resolution.
- Certum became aware of potentially incomplete CRL URL disclosures after receiving information from a third party.
- The applicable 14-day deadline for the Full Incident Report passed.
- Certum submitted the Full Incident Report after the deadline.
- Assecods representative — Certum explained that the Full Incident Report for incomplete CRL URL disclosures in CCADB was submitted late because the 14-day deadline should have been counted from when Certum first learned of the issue, not from the Preliminary Incident Report publication date.