Amazon Trust Services self-reports CP/CPS omission of CCADB Policy adherence language; closure pending
Amazon Trust Services self-reported that its CP/CPS Section 1.1 did not explicitly state adherence to the CCADB Policy, as required by Chrome Root Program Policy v1.8 Section 1.1.3. The issue affected CP/CPS versions v2.4 through v2.6 and was limited to the wording of the document; ATS stated that its operational practices already conformed to the policy and that no certificates were affected. ATS published CP/CPS v2.7 on 2026-08-19 to add the missing CCADB Policy adherence statement. ATS later explained that the omission came from a task-creation defect in its change-detection process, and it fixed that process on 2026-08-24. ATS also said it verified the updated document, reviewed recent checklist entries for similar omissions, and had no commitments beyond the completed action items. CCADB asked ATS to revise the closure summary to better explain the affected document, root cause, remediation, verification, and any ongoing commitments, and then issued a final call for comments. The bug is now resolved as FIXED, with the incident report closure process having been advanced in the thread.
- Chrome Root Program Policy v1.8 Section 1.1.3 became effective, requiring explicit CP/CPS adherence language for both the Chrome Root Program Policy and the CCADB Policy.
- ATS identified that its CP/CPS lacked the required explicit CCADB Policy adherence statement.
- ATS published CP/CPS v2.7 with the missing CCADB Policy adherence language added.
- ATS modified its change-detection procedure to require one tracked task per action in a multi-action requirement statement.
- ATS reviewed recent checklist entries for other multi-action requirement statements and confirmed no additional omissions.
- Amazon representative — ATS opened a preliminary incident report and said it was self-reporting the CP/CPS gap and would publish a full incident report within 14 days.
- Amazon representative — ATS said it had published CP/CPS v2.7 and was preparing the final report within the stated timeframe.
- Amazon Trust Services — ATS filed the full incident report, described the root cause as a task-creation defect, said the task creation process was fixed, and requested closure.
- CCADB representative — CCADB said the closure summary still needed a clearer explanation of what failed, why it failed, what changed, and any ongoing commitments.
- Amazon Trust Services — ATS posted a revised closure summary describing the affected CP/CPS versions, the root cause, the remediation steps, verification, and that there were no commitments beyond the completed action items.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident would be closed around 2026-09-21 if there were no further issues.