ETSI EN 319 401 Conformity assessment bodies and TSP evidence scope

EN 319 401 V3.1.1 sets baseline policy requirements for the operation and management practices of Trust Service Providers, independent of the type of trust service. Its scope statement draws a clear boundary: the standard does not define how the requirements can be assessed by an independent party, the information that has to be made available to independent assessors, or the requirements imposed on those assessors.

The practical consequence is that a TSP should not cite EN 319 401 alone as proof that a conformity assessment body is qualified or that a particular audit method is prescribed. EN 319 401 can support the evidence package, while the conformity assessment body's requirements belong in ETSI EN 319 403-1 and the applicable assessment scheme.

Even though EN 319 401 does not prescribe the CAB's process, it does identify evidence areas that matter when a TSP needs to demonstrate how its trust service policy is implemented. The strongest assessor-facing package starts with the trust service practice statement, the policies and practices approved by management, and the public documentation made available to subscribers and relying parties where necessary to demonstrate conformance.

The terms and conditions are also important because EN 319 401 requires them to state, for each supported trust service policy, whether the service has been assessed as conformant and, if so, through which conformity assessment scheme. That makes the assessment claim itself a controlled piece of public-facing evidence.

Do not use EN 319 401 by itself to claim that a specific CAB is accredited, that a specific CAB procedure is mandatory, or that an assessment result covers products, services, suppliers, or locations outside the actual assessment scope. The available EN 319 401 grounding only supports the standard's own boundary statement and the TSP evidence requirements inside the standard.

Where a TSP relies on suppliers, outsourcing, cloud services, or trust service components provided by another party, EN 319 401 keeps overall conformance responsibility with the TSP under the stated conditions. The evidence should therefore include supplier agreements, security requirements, monitoring, change review, and the supplier register where those requirements apply.