We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideGLOBALETSI EN 319 401

ETSI EN 319 401 Conformity assessment bodies and TSP evidence scope

A focused answer on how to read references in ETSI EN 319 401 without overstating what the standard covers.

Based on ETSI EN 319 401 V3.2.1 and the current consolidated eIDAS Regulation. Assessment scope, accreditation, the applicable scheme, and the supervisory body's decision remain separate.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
4 sections2 primary sources
Overview

ETSI EN 319 401 V3.2.1 tells a trust service provider what general policies and operating controls to maintain; it does not set the 's method, competence, accreditation, or evidence-access rules. For an EU qualified trust service, eIDAS defines the conformity assessment body as an accredited body competent to assess qualified TSPs and their qualified services. Use EN 319 403-1 and the applicable assessment scheme for the assessor's requirements, and keep the supervisory body's qualified-status decision separate from the CAB report.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

What does EN 319 401 say about conformity assessment bodies?

EN 319 401 V3.2.1 sets service-independent policy requirements for TSP operation and management. Its scope expressly excludes the independent assessment method, information that must be made available to assessors, and requirements imposed on those assessors.

A TSP therefore cannot use EN 319 401 alone to prove that a CAB is accredited, competent for the service, or following the required scheme. For EU qualified services, check the CAB's accreditation and scope, the scheme used, the services and locations covered by the report, and the supervisory body's qualified-status decision.

  • Use EN 319 401 to define the TSP policy, practice, security, recordkeeping, continuity, compliance, and supplier evidence that may be reviewed.
  • Do not treat EN 319 401 as the source for CAB accreditation, independence, sampling, audit-method, or assessor-competence rules.
  • When a customer asks for CAB status, separate the TSP's conformance evidence from the assessor's own authority, scope, and conformity assessment scheme.
Question 2

What evidence can a TSP prepare for assessor review?

EN 319 401 identifies TSP evidence even though it does not prescribe the CAB process. Start with the assessment scope, applicable trust service policy, practice statement, management approvals, risk assessment and treatment plan, policy set, supplier controls, incident and continuity records, and public documentation needed to demonstrate conformance.

The terms and conditions must state, for each supported trust service policy, whether the service has been assessed as conformant and, if so, through which scheme. Keep that statement aligned with the actual CAB report. Do not extend it to a different service, policy, site, supplier, or period.

  • Map the assessed service to the trust service policy being applied and the practices used to address that policy.
  • Keep management approval, publication, review responsibilities, and change-notice decisions traceable to the practice statement.
  • For customer-facing claims, ensure the terms and conditions identify whether conformity has been assessed and the conformity assessment scheme used, when such an assessment exists.
  • Avoid disclosing sensitive implementation details publicly; EN 319 401 allows relevant documentation to demonstrate conformance without requiring disclosure of sensitive aspects.
Recommended next step

Prepare TSP evidence without overstating CAB coverage

This guidance helps separate EN 319 401 evidence preparation from CAB accreditation, assessor methodology, and scheme-specific requirements.

Assessment workflow
Build the evidence map

Connect EN 319 401 requirements to practice statements, terms, records, supplier controls, and review triggers.

Explore next step
Research workflow
Resolve scope questions

Check whether a claim belongs in EN 319 401 evidence, an assessment scheme, or CAB-specific requirements.

Explore next step
Talk to Sorena
Talk through implementation

Review assessment scope, evidence gaps, owners, and customer-facing claims with Sorena.

Explore next step
Question 3

What should not be claimed from EN 319 401 alone?

For EU qualified trust services, eIDAS requires an audit at the qualified TSP's expense at least every 24 months. The TSP must submit the CAB report to the supervisory body within three working days of receipt and inform that body at least one month before a planned audit. Those legal rules do not make every EN 319 401 assessment an eIDAS qualified-service audit.

A CAB report also does not itself grant qualified status. Under eIDAS, the supervisory body verifies compliance and grants the provider and service qualified status; the service may begin as qualified after that status appears on the trusted list. Check the current trusted-list entry as well as the report.

  • Verify CAB accreditation, competence, assessment scheme, report date, covered service, policy, sites, and exclusions outside EN 319 401.
  • Do not imply that an assessment covers all services unless the trust service policy, assessment scope, and scheme say so.
  • For outsourced service parts, keep the TSP's retained responsibility, agreements, supplier security requirements, monitoring evidence, and inclusion or exclusion from the CAB scope explicit.
  • Review the evidence package after practice-statement changes, information security policy changes, supplier changes, incidents, or changes to service provision.
Question 4

Questions and answers

Does ETSI EN 319 401 define how a CAB performs the assessment?

No. EN 319 401 defines general TSP policy and operating requirements but excludes the independent assessment method, assessor evidence-access requirements, and assessor requirements. Use EN 319 403-1, the CAB's accreditation scope, and the applicable conformity assessment scheme for those questions.

Does a CAB report make a trust service qualified under eIDAS?

No. A provider intending to start a qualified trust service submits a CAB report to the supervisory body. The supervisory body verifies compliance, grants qualified status to the provider and service, and updates the trusted list; the provider may begin offering the service as qualified only after the status appears there.

How often is an EU qualified TSP audited?

eIDAS requires a qualified TSP to be audited at its own expense at least every 24 months. It must notify the supervisory body at least one month before a planned audit and submit the resulting CAB report within three working days of receipt. The supervisory body may also audit or request an assessment at any time.

Primary sources

References and citations

ETSI EN 319 401 V3.2.1 (2026-01)
etsi.org4 citations
Referenced sections
  • Primary ETSI source for EN 319 401 scope, TSP policy requirements, assessor boundary language, terms-and-conditions assessment disclosure, records, compliance evidence, and supplier controls.
  • Clause 1 excludes independent assessment methods, assessor evidence requirements, and assessor requirements from EN 319 401 and points to EN 319 403-1.
  • Clauses 6.1 and 6.2 require the practice statement, controlled disclosures, and the terms-and-conditions statement about assessment status and scheme.
Show 1 more
  • Supports the assessment boundary and retained TSP responsibility for outsourced or subcontracted service parts.
"General Policy Requirements for Trust Service Providers"
More quoted passages
"does not specify how the requirements identified can be assessed"
"whether the TSP's trust service has been assessed"
"maintain overall responsibility for conformance"
Consolidated eIDAS Regulation (EU) No 910/2014
eur-lex.europa.eu3 citations
Referenced sections
  • Binding EU source for the CAB definition, qualified-TSP audit cycle, report submission, planned-audit notice, supervisory decision, and trusted-list status.
  • Article 3(18) defines a CAB for qualified trust services by accreditation and competence; Articles 20 and 21 distinguish the CAB report from supervision and the grant of qualified status.
  • Articles 20 and 21 establish the qualified-service audit interval, report-submission timing, advance audit notice, supervisory verification, grant of qualified status, and trusted-list condition.

Related guides

CA and RA responsibilities under ETSI EN 319 401

How ETSI EN 319 401 frames CA and RA responsibility: TSP practice statements, management approval, role segregation, subcontractor control, and evidence boundaries.

eIDAS Articles 19 and 24: current ETSI mapping

Understand why old EN 319 401 editions mapped eIDAS Article 19, what replaced it, and how V3.2.1 maps current Article 24 duties.

ETSI EN 319 401 policy documentation: what is required?

How ETSI EN 319 401 treats practice statements, terms, network and information systems security policy, evidence records, and change review.

ETSI EN 319 401 Subcontractor Requirements FAQ

How ETSI EN 319 401 treats subcontractors, outsourcing, supplier agreements, SLAs, monitoring, evidence, and retained TSP responsibility.

Security Incidents in ETSI EN 319 401

How ETSI EN 319 401 V3.2.1 expects TSPs to detect, classify, respond to, report, document, test, and review security incidents.

Trust service provider scope under ETSI EN 319 401

How to scope ETSI EN 319 401 for a trust service provider: service boundaries, trust service policy, practice statement, terms, risks, and third-party components.

Show all related guides (23)

ETSI EN 319 401 Audit and Conformity Assessment Evidence

How to prepare ETSI EN 319 401 evidence for audit and conformity assessment without overstating what the standard itself assesses.

ETSI EN 319 401 Audit Evidence Pack

Build an ETSI EN 319 401 audit evidence pack around records, logs, policies, risk assessment, incident handling, continuity, and supplier evidence.

ETSI EN 319 401 Audit Evidence Pack Workflow

Build an ETSI EN 319 401 audit evidence pack for trust service providers: risk assessment, practice statement, policies, records, logs, continuity, and supplier evidence.

ETSI EN 319 401 compliance duties for TSPs

ETSI EN 319 401 compliance guidance for trust service providers covering legal operation, evidence, accessibility, privacy, records, incidents, continuity, and suppliers.

ETSI EN 319 401 FAQ for trust service providers

Plain-language ETSI EN 319 401 answers covering TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence.

ETSI EN 319 401 Incident and Continuity Workflow

Build an EN 319 401 incident and continuity evidence workflow for TSP monitoring, response, reporting, records, backup recovery, and crisis review.

ETSI EN 319 401 Incident Reporting and Continuity Duties

Practical ETSI EN 319 401 V3.1.1 guidance for trust service incident response, reporting, evidence retention, business continuity, and termination planning.

ETSI EN 319 401 Personnel, Asset, and Access Controls

Clause-focused EN 319 401 V3.1.1 guide to TSP personnel duties, trusted roles, asset inventories, classification, and access-control evidence.

ETSI EN 319 401 policy and security requirements

ETSI EN 319 401 guidance for TSP policy and security requirements covering risk assessment, practice statements, terms, security controls, incidents, and evidence.

ETSI EN 319 401 requirements map

Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls.

ETSI EN 319 401 Risk Assessment and Treatment

Clause-cited ETSI EN 319 401 V3.1.1 guidance for trust service risk assessment, risk treatment, residual-risk approval, and evidence planning.

ETSI EN 319 401 Subcontractor Controls

Practical EN 319 401 guidance for TSP subcontractor controls: retained responsibility, agreements, SLAs, supplier registers, monitoring, and audit evidence.

ETSI EN 319 401 Subcontractor Evidence Workflow

Build an EN 319 401 subcontractor evidence workflow for TSP supplier agreements, SLAs, audit mechanisms, risk reviews, supplier registers, and archived records.

ETSI EN 319 401 Trust Service Applicability Workflow

A scoped workflow for deciding when ETSI EN 319 401 applies to a trust service and what TSP policy, risk, terms, operations, and supplier evidence to collect.

ETSI EN 319 401 Trust Service Provider Applicability

Use ETSI EN 319 401 to decide whether a trust service provider activity falls in the standard's type-independent baseline and what service, policy, risk, supplier, and evidence boundaries to document.

ETSI EN 319 401 vs eIDAS: Controls and Legal Duties

Compare ETSI EN 319 401 V3.2.1 with current eIDAS duties for qualified and non-qualified trust service providers, including risk, incidents, audits, records, and termination.

ETSI EN 319 401 vs EN 319 403-1: TSP Policy vs CAB Assessment

Compare ETSI EN 319 401 V3.2.1 provider controls with EN 319 403-1 V2.3.1 CAB requirements for audit scope, evidence, sampling, reports, corrective action, and reassessment.