A practical workflow for turning EN 319 401 requirements into an audit-ready evidence pack for trust service provider operations.
Use it to organize risk, policy, record, log, continuity, supplier, and legal-compliance evidence. This is implementation guidance, not a conformity certificate; validate it against the applicable service policy, assessment scheme, contracts, and law.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this workflow for ETSI EN 319 401 V3.1.1 (2024-06) without confusing an evidence folder with a conformity decision. V3.2.1, published in January 2026, is the current ETSI edition; use this V3.1.1 workflow only when that earlier edition is expressly in scope, and otherwise update the clause map and evidence requests to V3.2.1. Start with the exact trust service, policy, assessment period, systems, locations, and suppliers in scope. Then collect current records for risk, policies and practices, terms, security operations, incidents, evidence retention, continuity, termination, compliance, and supply chain.
EN 319 401 defines policy requirements for operation and management independent of the specific trust service type. Start the pack by naming the provider, trust service, applicable trust service policy, assessment period, systems, facilities, service components, suppliers, and exclusions. Without that boundary, a reviewer cannot tell which evidence supports which service.
Do not treat the pack as a generic spreadsheet. The standard ties evidence to concrete artifacts: a risk assessment, risk treatment decisions, security requirements, operational procedures, a trust service practice statement, terms and conditions, an information security policy, operational records, continuity planning, termination planning, and supplier controls.
Assign one pack maintainer and one accountable owner for each control family. The maintainer controls the index, versions, access, and review state; control owners attest only to records they own. The final reviewer should be able to distinguish evidence that was inspected, evidence supplied but not tested, accepted exclusions, open findings, and records unavailable for the period.
This workflow helps assign EN 319 401 evidence owners, collect records, and keep policy, continuity, supplier, and audit-log proof reviewable.
Convert the evidence workflow into accountable tasks, evidence requests, and review milestones.
Use cited ETSI source material to resolve scope, evidence, records, continuity, and supplier questions before implementation.
Review trust service scope, required evidence, owners, and next compliance actions with Sorena.
Start with risk evidence. EN 319 401 requires the to identify, analyse, and evaluate trust service risks; select treatment measures; document the necessary security requirements and operational procedures in the information security policy and practice statement; review and revise the assessment; and obtain management approval and residual-risk acceptance.
Next collect the policy evidence. The needs policies and practices appropriate for the trust services it provides, management approval, communication to relevant employees and external parties, a practice statement covering applicable trust service policy requirements, external-organization obligations, and a defined review process for maintaining the practice statement.
Clause 7.10 is the core evidence-pack clause. It requires the to record and keep accessible all relevant information concerning data it issued and received for an appropriate period, including after the TSP's activities have ceased, for legal evidence and continuity of service.
The records pack must show both content and control: which service records exist, how current and archived records retain confidentiality and integrity, how operation records are completely and confidentially archived under disclosed business practices, and how records can be produced when required as evidence of correct service operation in legal proceedings. EN 319 401 does not set one universal retention period; the chosen period must support necessary legal evidence and match the period notified in the terms and conditions.
Use this operating workflow when assigning the pack. Each row should produce a named, versioned artifact for the stated service and review period.
1 | Scope and policy intake | Practice statement owner | Trust service policy list, practice statement, external-organization obligations | Does the pack match the trust service and its declared policies?
2 | Risk and control baseline | Risk and security owners | Risk assessment, risk treatment record, information security policy, operating procedures | Are selected controls tied to approved risk treatment?
3 | Subscriber and relying-party disclosures | Legal/compliance owner | Terms and conditions, limitations, event-log retention statement, relying-party instructions | Are disclosed practices consistent with evidence retention and service operation?
4 | Operational records and logs | Operations/security owner | Service records inventory, archive controls, UTC synchronization evidence, significant event logs | Can the show correct service operation and protect records during retention?
5 | Continuity, termination, and suppliers | Continuity and supplier owners | Continuity plan, backup test results, termination plan, supplier register, agreements and SLAs | Will evidence remain accessible after disaster, service cessation, or supplier change?
6 | Quality review and release | Pack maintainer and independent reviewer | completeness check, exception log, sensitivity label, release record, and approved evidence index | Is the pack ready for its named recipient and purpose, or must it be released with stated gaps?
The pack should not stop at logs. EN 319 401 also requires evidence around continuity planning, backup resources, recovery testing, crisis management, termination, legal compliance, personal-data protection, and supply-chain controls.
Records must stay usable when the service changes, a disaster occurs, the ceases activities, or a supplier manages or archives TSP information. Treat these areas as dependencies for clause 7.10 instead of separate paperwork.
A pack that describes intent but cannot show operation is incomplete. EN 319 401 repeatedly calls for documented, approved, maintained, reviewed, available, archived, tested, or recorded artifacts. If a claim cannot be tied to an artifact and review period, record the gap instead of presenting the claim as proved.
Avoid implying that a public guide, internal checklist, or exported folder is a conformity certificate. EN 319 401 provides the general policy requirements baseline; independent assessment context and assessor requirements are separate.
No. REQ-7.10-07 requires service records to be held for a period appropriate to necessary legal evidence and notified in the 's terms and conditions. Determine the period from the service, applicable law, policy, contracts, and assessment scheme, then keep the public terms and internal retention schedule aligned.
EN 319 401 requires the practice statement and other relevant documentation to be available as necessary to demonstrate conformance to the trust service policy, but the note to REQ-6.1-05X says sensitive aspects need not be disclosed. Keep a controlled assessor version and a suitable subscriber- or relying-party version, and record why information was restricted.