Sectigo failed to report completion of an incident action item within the required timeframe

Sectigo reported that it completed an action item from bug 2069636 by the due date, but did not announce completion within three days as required by the CCADB Incident Reporting Guidelines. The issue was first disclosed by Sectigo as a preliminary incident report, and later expanded into a full incident report. Sectigo said a community member pointed out the lapse in bug 2069636, and it identified the non-compliance period as 2026-09-29 through 2026-10-01. The company explained that its tracker did not treat action-item completion announcements as a distinct event type, which caused the missed update. In its closure summary, Sectigo said it added announcement of Action Item delivery as a separate tracked event type and requested closure.

1. 2026-09-25 Sectigo completed the action item from bug 2069636 by the due date.
2. 2026-09-28 The deadline to report completion of the action item under CCADB policy passed.
3. 2026-09-30 A community member pointed out that the reporting deadline had passed.
4. 2026-10-01 Sectigo posted the update reporting completion of the action item.

1. 2026-10-02 Sectigo — Sectigo filed a preliminary incident report saying it met the action item but failed to report completion within three days as required by CCADB Incident Reporting Guidelines.
2. 2026-10-12 Sectigo — Sectigo filed a full incident report with the timeline, related incidents, and root cause analysis.
3. 2026-10-19 Sectigo — Sectigo posted a closure summary saying it added action-item completion announcements as a separate tracked event type and requested closure.