A practical evidence-pack guide for trust service providers applying ETSI EN 319 401 clause 7.10 and its supporting policy, risk, incident, continuity, and supplier controls.
Based on ETSI EN 319 401 V3.1.1 and linked public sources. Use it as implementation guidance, not for legal interpretation.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this outline to show what a trust service provider recorded, how each record was protected and retained, and which service and review period it supports under ETSI EN 319 401 V3.1.1 (2024-06). V3.2.1, published in January 2026, is the current ETSI edition; use this V3.1.1 outline only when that earlier edition is expressly in scope, and otherwise update the clause map and evidence requests to V3.2.1. The pack should let an authorized reviewer trace a requirement to a current control and inspectable record. It supports review; it is not a conformity certificate or qualified-status decision.
Start with clause 7.10. It requires the to record and keep accessible all relevant information concerning data it issued and received for an appropriate period, including after its activities have ceased, for legal evidence and service continuity. The pack therefore extends beyond audit logs: show what was issued or received, how operation records were protected, and how records remain available for the stated retention period.
Use the trust service practice statement, terms and conditions, information security policy, risk assessment, audit logs, incident records, backup tests, termination plan, legal-requirement evidence, and supplier register as the core index. Those artifacts are tied to separate EN 319 401 clauses, but together they explain whether the record set is complete, confidential, integrity-protected, and aligned with disclosed business practices.
The should maintain the source records in their systems of record and appoint a pack maintainer to control the index, evidence cut-off, access, versions, and release history. Do not copy uncontrolled files into a folder and treat the copies as authoritative. Each entry should point to the controlled record or explain how an authorized reviewer can inspect it.
This ETSI EN 319 401 guide is the shared index for clause mapping, evidence owners, retention checks, and audit-readiness reviews.
Convert the audit evidence pack into accountable tasks, evidence requests, and review milestones.
Use cited source material to resolve scope, retention, incident, continuity, and supplier-evidence questions before assessment.
Review scope, records, owners, and the next evidence-pack actions with Sorena.
Do not organize the pack only by department. Use the control areas that show how the operates and preserves evidence: risk assessment, published practices, terms, security policy, personnel and trusted roles, asset inventory, access and configuration control, incident management, continuity, termination, compliance, and supply chain.
The pack should let a reviewer move from claim to proof without private context. For example, a claim that logs are reviewable should point to the logging control, a sample review record, the alerting or monitoring process, the person or trusted role responsible, and the retention rule that protects the log after the review.
The operational record set is often sensitive. EN 319 401 requires confidentiality and integrity for current and archived service-operation records, complete and confidential archiving, availability of records for evidence of correct operation, and UTC synchronization for audit-log event time at least once a day.
Treat logs as evidence, not background telemetry. The pack should show which logs exist, why they matter to the trust service, how they are reviewed, how alerts are escalated, how deletion is prevented during the required period, and how records can be retrieved without exposing sensitive material unnecessarily.
Review this checklist before giving the pack to an assessor, customer, supervisory contact, or independent review board. Every claim should have a clause, a record, a retention rule, an owner, a review period, and a way to verify that the evidence still represents the current trust service.
Do not claim that EN 319 401 itself defines the independent assessment method. The standard states general policy requirements for operation and management; it points readers to ETSI EN 319 403-1 for requirements about conformity assessment bodies assessing TSPs.
Release decisions should name the recipient and purpose. A customer extract may omit sensitive material that remains available under controlled inspection, while an assessor pack may need broader access under the applicable scheme. Record redactions, summaries, withheld items, and the reason for each access decision so absence is not mistaken for missing evidence.
Presentation cannot replace traceability. Tie each record to the trust service boundary, disclosed practices, retention commitments, incident procedures, continuity assumptions, and supplier obligations.
Remove claims that the available evidence cannot support. State the service and period covered, the source requirement, the artifact showing operation, and any open exception.
No. An evidence pack is the 's organized set of policies, records, and control evidence. EN 319 401 does not define the independent assessment method or the assessor's report. A conformity assessment report follows the applicable scheme and legal process; for an EU qualified trust service, current eIDAS Article 20 also governs recurring audits and report submission.
Share enough relevant documentation to meet the applicable policy, terms, contract, and review purpose, but control sensitive information. The note to EN 319 401 REQ-6.1-05X says the need not disclose sensitive aspects in documentation made available to subscribers and relying parties. Keep a full controlled pack and prepare scoped extracts or supervised access where appropriate.