TURKTRUST audit regarding change management procedures and controls

This bug was opened in response to mistakes found in two certificates issued by TURKTRUST (referencing bug 825022 and a Mozilla security blog post about revoking two TURKTRUST certificates). TURKTRUST stated that it made improvements to its change management procedures and controls to prevent the same type of mistake from recurring. The bug requested an extra “special audit” to review TURKTRUST’s change management procedures and documentation and to provide an auditor statement confirming that preventive measures were put in place. The BSI auditor performed the special audit with a scope including change management, internal audit management, and incident management procedures, and the audit report/public audit statement were expected shortly thereafter. Later, the bug reporter said she received an audit statement dated February 19, 2013 stating the audit was performed in January 2013 to confirm changes and verify specific control measures, but that the statement initially included a clause preventing attachment to the bug. A new statement was requested and an attachment (“Special Audit statement”) was created, and the reporter later confirmed via email that BSI issued the audit letter attached to the bug. The bug is marked RESOLVED with resolution FIXED.

1. 2013-01-28 Bug 835538 was opened requesting a special audit of TURKTRUST change management and related controls following certificate mistakes.
2. 2013-01-29 BSI performed the special audit covering change management, internal audit management, and incident management procedures.
3. 2013-03-01 The reporter stated she received an audit statement dated February 19, 2013 and requested a new attachable statement due to a clause in the original.
4. 2013-03-08 A special audit statement attachment was created for the bug.
5. 2013-03-11 The reporter confirmed BSI issued the audit letter attached to the bug.

1. 2013-01-28 Mozilla representative — Explained the bug was requested due to mistakes in two TURKTRUST-issued certificates and asked for an extra audit plus an auditor statement confirming future prevention measures.
2. 2013-01-29 Community commenter — Reported that the special audit with scope covering change management, internal audit management, and incident management procedures was performed and that the report/statement would be ready soon.
3. 2013-03-01 Soghoian representative — Asked when the audit would be available.
4. 2013-03-01 Mozilla representative — Said she received an audit statement (dated Feb 19, 2013) stating the audit was performed in January 2013, but it contained a clause preventing attachment; requested a new statement that could be attached.
5. 2013-03-08 Mozilla representative — Created an attachment containing the special audit statement.
6. 2013-03-11 Mozilla representative — Confirmed via email with a BSI representative that BSI issued the audit letter attached to the bug.