A cited guide to preparing EN 319 401 policies, practice statements, terms, records, and evidence for audit or assessor review.
EN 319 401 defines general policy requirements; it does not define the independent assessment method, so assessor scope and scheme claims need separate support.
Use this page to prepare ETSI EN 319 401 V3.1.1 evidence for internal audit, customer review, or a . V3.2.1 was published in January 2026. Select the edition from the applicable law, service policy, contract, and assessment criteria before changing the clause map. For the qualified signature/seal certificate reference route in Implementing Regulation (EU) 2025/1943, retain the cited EN 319 401 V3.1.1 and the applicable adaptations. Publication of V3.2.1 does not replace that legally cited edition. Start by naming the trust service, policy, service-specific standards, assessment scheme, period, and operating boundary. EN 319 401 sets general operation and management requirements; it does not define the independent assessment method or grant qualified status.
ETSI EN 319 401 defines general policy requirements for operation and management independent of the specific trust service type. Other specifications refine and extend those requirements for particular forms of TSP.
The standard explicitly excludes the independent-party assessment method, information to be made available to independent assessors, and assessor requirements from its scope. Its note points to ETSI EN 319 403-1 for body requirements. Keep three records separate: the EN 319 401 clause-to-evidence index, the service-specific requirement set, and the applicable assessment scheme or legal process.
Open the engagement only when the boundary is reviewable. The intake should identify the legal entity, trust service and policy, qualified or non-qualified claim, edition and service-specific standards, systems, facilities, suppliers, exclusions, assessment period, assessment criteria, assessor or customer, evidence-sharing controls, and intended output. If any of those inputs is disputed or missing, record it as a scope issue before testing controls.
Sources (2)
Clause 1 defines the general TSP scope, excludes independent assessment mechanics, and points to EN 319 403-1; clauses 5 through 7 contain the operational evidence requirements.
Example of a service-specific standard that applies the EN 319 401 baseline to TSPs issuing certificates and adds certificate-service requirements.
This guide helps connect EN 319 401 clauses to owners, records, terms, practice statements, and assessment-scope decisions before evidence requests fragment across teams.
Convert EN 319 401 audit preparation into accountable tasks, evidence requests, and review milestones.
Use cited ETSI source material to resolve scope, applicability, evidence, and conformity-assessment boundaries before implementation.
Review trust-service scope, evidence owners, source coverage, and the next audit-readiness actions with Sorena.
A reviewable EN 319 401 audit file connects policies, practice statements, terms, records, and decisions to requirement identifiers. Clause 6 requires the to specify policies and practices for the trust services it provides, obtain management approval, publish and communicate them as relevant, and maintain a review process for the practice statement.
The terms and conditions are especially important because EN 319 401 requires them to identify the trust service policy, limitations on use, subscriber obligations, relying-party information, event-log retention, liability limitations, applicable legal system, complaints and dispute procedures, conformity-assessment status and scheme where applicable, and contact information.
Sources (2)
Clauses 3.4, 6.1, and 6.2 explain requirement identifiers and require the policies, practice statement, management approval, review, availability, terms, and assessment-status disclosures.
Provides certificate-service context for certificate policies, certification practice statements, PKI disclosure statements, and the application of EN 319 401 requirements.
A clause-to-evidence index should let a reviewer inspect the controls without undocumented internal context. At minimum, map risk assessment, information security policy, management and operations, incident management, continuity, termination planning, legal compliance, and supply-chain controls to owners and current evidence.
Clause 7.10 is central for audit readiness because it requires relevant information concerning data issued and received by the to be recorded and kept accessible for an appropriate period, including after TSP activities have ceased, for legal evidence and service continuity purposes. It also requires confidentiality and integrity of current and archived records, disclosed archival practices, availability for evidence of correct operation in legal proceedings, precise timing of significant events, and UTC synchronization for audit-log event times at least once a day.
Sources (2)
Clauses 5 through 7.14 contain the risk, policy, operations, incident, continuity, termination, legal-compliance, supply-chain, and evidence-collection requirements.
Shows how a certificate-service standard builds on EN 319 401 requirement identifiers; it does not replace the applicable conformity assessment scheme.
EN 319 401 Annex B is an informative mapping to selected eIDAS provisions, not a legal conformity decision. The standard was published in June 2024 and retains references to the earlier eIDAS numbering in places. Use the amended consolidated regulation for current legal claims.
For qualified trust services, current eIDAS Article 20 requires an audit at the provider's expense at least every 24 months by a body and submission of the resulting report to the supervisory body within three working days of receipt. The provider must inform the supervisory body no later than one month before a planned audit and allow it to observe on request. The supervisory body may also audit or request a conformity assessment at any time. Article 21 governs initiation of a qualified trust service, and qualified status is tied to the supervisory process and trusted list. These legal steps are separate from preparing EN 319 401 evidence.
Sources (2)
Clause 1 sets the assessment boundary and Annex B provides an informative, non-binding mapping to selected eIDAS provisions.
Current legal source for recurring qualified-provider audits, report submission, initiation of a qualified trust service, supervisory verification, and trusted lists.
Audit files fail when the evidence is too broad or detached from the service being assessed. A generic security policy is not enough if it cannot be traced to the trust service practice statement, applicable policy, service records, and disclosed terms.
EN 319 401 supports an evidence model for operation and management. details, conformity assessment body competence, scheme rules, service-specific policies, and qualified-service status must come from the applicable scheme, service-specific standard, and legal or supervisory evidence.
No. EN 319 401 does not grant qualified status. For an EU qualified trust service, the provider needs the applicable report and supervisory process under eIDAS, and qualified status is reflected in the relevant trusted list. The service-specific standards and assessment scheme also need to be identified.
Article 20 of the amended consolidated eIDAS Regulation requires qualified trust service providers to be audited at their own expense at least every 24 months by a body. The provider must notify the supervisory body no later than one month before a planned audit and allow it to observe on request. The resulting conformity assessment report must be submitted to the supervisory body within three working days of receipt. The supervisory body may also audit or request an assessment at any time. These are eIDAS duties, not frequencies or procedures set by EN 319 401 itself.
Under current eIDAS Article 20, the supervisory body requires a remedy within a set time limit where applicable. If the provider does not remedy the failure, the supervisory body shall withdraw the qualified status of the provider or the affected service when justified by the extent, duration, and consequences of the failure. An EN 319 401 evidence pack can support the review and remedy, but it does not determine the supervisory outcome.
Sources (2)
Clause 1 supports the distinction between general TSP policy requirements, service-specific requirements, and independent assessment.
Supports the caution that certificate TSPs need service-specific policy and practice evidence in addition to EN 319 401.
Build an ETSI EN 319 401 audit evidence pack around records, logs, policies, risk assessment, incident handling, continuity, and supplier evidence.
Build an ETSI EN 319 401 audit evidence pack for trust service providers: risk assessment, practice statement, policies, records, logs, continuity, and supplier evidence.
ETSI EN 319 401 compliance guidance for trust service providers covering legal operation, evidence, accessibility, privacy, records, incidents, continuity, and suppliers.
Plain-language ETSI EN 319 401 answers covering TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence.
Build an EN 319 401 incident and continuity evidence workflow for TSP monitoring, response, reporting, records, backup recovery, and crisis review.
Practical ETSI EN 319 401 V3.1.1 guidance for trust service incident response, reporting, evidence retention, business continuity, and termination planning.
Clause-focused EN 319 401 V3.1.1 guide to TSP personnel duties, trusted roles, asset inventories, classification, and access-control evidence.
ETSI EN 319 401 guidance for TSP policy and security requirements covering risk assessment, practice statements, terms, security controls, incidents, and evidence.
Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls.
Clause-cited ETSI EN 319 401 V3.1.1 guidance for trust service risk assessment, risk treatment, residual-risk approval, and evidence planning.
Practical EN 319 401 guidance for TSP subcontractor controls: retained responsibility, agreements, SLAs, supplier registers, monitoring, and audit evidence.
Build an EN 319 401 subcontractor evidence workflow for TSP supplier agreements, SLAs, audit mechanisms, risk reviews, supplier registers, and archived records.
A scoped workflow for deciding when ETSI EN 319 401 applies to a trust service and what TSP policy, risk, terms, operations, and supplier evidence to collect.
Use ETSI EN 319 401 to decide whether a trust service provider activity falls in the standard's type-independent baseline and what service, policy, risk, supplier, and evidence boundaries to document.
Compare ETSI EN 319 401 V3.2.1 with current eIDAS duties for qualified and non-qualified trust service providers, including risk, incidents, audits, records, and termination.
Compare ETSI EN 319 401 V3.2.1 provider controls with EN 319 403-1 V2.3.1 CAB requirements for audit scope, evidence, sampling, reports, corrective action, and reassessment.
How ETSI EN 319 401 frames CA and RA responsibility: TSP practice statements, management approval, role segregation, subcontractor control, and evidence boundaries.
Understand why old EN 319 401 editions mapped eIDAS Article 19, what replaced it, and how V3.2.1 maps current Article 24 duties.
Understand what ETSI EN 319 401 says, and does not say, about conformity assessment bodies, independent assessment, and TSP evidence preparation.
How ETSI EN 319 401 treats practice statements, terms, network and information systems security policy, evidence records, and change review.
How ETSI EN 319 401 treats subcontractors, outsourcing, supplier agreements, SLAs, monitoring, evidence, and retained TSP responsibility.
How ETSI EN 319 401 V3.2.1 expects TSPs to detect, classify, respond to, report, document, test, and review security incidents.
How to scope ETSI EN 319 401 for a trust service provider: service boundaries, trust service policy, practice statement, terms, risks, and third-party components.