ETSI EN 319 401 eIDAS Articles 19 and 24 evidence mapping

Annex B of ETSI EN 319 401 V3.1.1 maps eIDAS Article 19.1 to clauses 5, 6.3, and 7.2 through 7.12. In practical terms, the file should show how the TSP identifies and evaluates trust service risks, selects risk treatment measures, documents the information security policy and practice statement, manages personnel and operations, handles incidents, and maintains continuity and termination arrangements.

Annex B also maps Article 19.1's requirement to prevent and minimize incident impact and inform stakeholders to clauses 7.9 and 7.11. The directly useful evidence is therefore incident monitoring, response, stakeholder communication, continuity coordination, and post-incident review evidence, not just a generic security policy.

EN 319 401 Annex B does not turn the standard into a complete Article 24 checklist. It gives selected mappings for qualified trust service provider duties. The grounded examples are Article 24.2(a) to REQ-6.3-04X for informing the supervisory body about changes in qualified trust services or an intention to cease them, Article 24.2(b) to clause 7.2 for personnel and subcontractor competence, and Article 24.2(d) to clause 6.2 for precise terms and conditions before a contractual relationship.

The Annex B excerpt also identifies Article 24.2(h) on keeping relevant issued and received information accessible for an appropriate period, including after cessation, and Article 24.2(i) on having an up-to-date termination plan. EN 319 401 clause 7.12 separately requires an up-to-date termination plan and continuity-oriented arrangements when a TSP ceases services.

Start with the trust service and legal posture, then map only the applicable Article 19 and Article 24 duties to the ETSI clauses that the grounding actually supports. A qualified certificate issuer should not treat EN 319 401 alone as the full evidence basis: EN 319 411-2 states that it incorporates EN 319 411-1 and adds requirements for EU qualified certificates, while also warning that conformance to EN 319 411-2 alone does not imply qualified status under eIDAS.

A useful evidence file separates three layers: the eIDAS duty being discussed, the EN 319 401 requirement or clause used as supporting evidence, and the actual artifact proving current operation. That structure avoids unsupported claims such as 'EN 319 401 certifies Article 24 compliance' and makes gaps visible before audit or customer review.