Incident Response
When a security incident affects the service, EC contains it, investigates the cause, informs the customer's named contacts and records the lessons learned. Incidents are handled under the support priorities in Service Level Agreements, with a suspected CA key compromise always treated as P1 – Critical.
In the event of a suspected CA key compromise, EC revokes the affected CA certificate, publishes an updated CRL so relying parties stop trusting it, and works with the customer to build a replacement CA and re-issue the affected certificates.