Search every question across sub-FAQs

Treat CA and RA responsibility as part of the TSP's controlled practice system. EN 319 401 requires appropriate policies and practices, a practice statement addressing the applicable trust service policy, management approval, implementation, and a defined maintenance process.

A Registration Authority mainly identifies and authenticates certificate subjects and may assist with applications or revocation. A Certification Authority creates and assigns certificates, but the term can also describe the technical certificate-generation component used by the issuing TSP.

For CA or RA activities performed by external organizations, the practice statement should not hide the dependency. EN 319 401 requires the trust service practice statement to identify obligations of external organizations supporting the TSP's services, including applicable policies and practices.

ETSI EN 319 411-1 V1.5.1 treats the TSP as the authority trusted by subscribers and relying parties and gives it overall responsibility for certification services. In that standard, CA can also mean the technical component concerned with certificate issuance. An RA mainly identifies and authenticates subjects; the registration service passes verified identity and attribute results to certificate generation.

Do not collapse those service functions into job titles. One organization may perform several functions, or an external party may perform the RA work, but the CPS and internal procedures must show the boundary, approvals, evidence, access, and segregation that apply.

Use a responsibility map that connects every certificate lifecycle activity to the governing policy, CPS section, role, approval, system access, evidence record, and external agreement. EN 319 401 requires policies and practices to be approved, communicated where relevant, maintained, and made available as needed to demonstrate conformance, while allowing sensitive details to remain undisclosed.

For certificate services, keep the public-facing CPS or terms aligned with the private operating evidence. EN 319 411-1 explains that low-level operational procedures can hold specific task and responsibility details that are useful for daily operation and process review, even if they are not publicly disclosed.

EN 319 401 V3.1.1 Annex B reproduced the original 2014 Article 19 and mapped its security and incident duties to clauses 5, 6.3, 7.2 through 7.12, especially 7.9 and 7.11. That table remains evidence of what the 2024 standard mapped, but it does not preserve a deleted legal article.

In the consolidated eIDAS text, Article 19a applies to non-qualified TSPs. It requires appropriate risk policies and measures and notification of significant security breaches or service disruptions without undue delay and no later than 24 hours after awareness. Qualified TSP supervision now sits in Article 20, while NIS2 supplies the wider cybersecurity and significant-incident framework.

V3.2.1 Annex B maps current Article 24(2)(a) to REQ-6.3-04, Article 24(2)(b) to clause 7.2, and Article 24(2)(d) to clause 6.2. The first mapping now includes the binding advance periods: at least one month before a change and three months before planned cessation.

The annex remains selective. Article 24 also contains identity and attribute verification, risk-management, trustworthy-system, record, and termination duties. A qualified certificate issuer also needs the certificate-specific EN 319 411 series; conformance to one ETSI standard does not itself grant qualified status.

Start with the trust service, qualified or non-qualified status, and current legal provision. Then record the EN 319 401 clause used as supporting evidence and the actual artifact proving operation. Keep a separate historical column only when old Article 19 evidence must be migrated.

For a qualified certificate service, add EN 319 411-2 and the assessment scheme. EN 319 411-2 adds requirements for EU qualified certificates but warns that conformance to that standard alone does not imply qualified status under eIDAS.

EN 319 401 V3.2.1 sets service-independent policy requirements for TSP operation and management. Its scope expressly excludes the independent assessment method, information that must be made available to assessors, and requirements imposed on those assessors.

A TSP therefore cannot use EN 319 401 alone to prove that a CAB is accredited, competent for the service, or following the required scheme. For EU qualified services, check the CAB's accreditation and scope, the scheme used, the services and locations covered by the report, and the supervisory body's qualified-status decision.

EN 319 401 identifies TSP evidence even though it does not prescribe the CAB process. Start with the assessment scope, applicable trust service policy, practice statement, management approvals, risk assessment and treatment plan, policy set, supplier controls, incident and continuity records, and public documentation needed to demonstrate conformance.

The terms and conditions must state, for each supported trust service policy, whether the service has been assessed as conformant and, if so, through which scheme. Keep that statement aligned with the actual CAB report. Do not extend it to a different service, policy, site, supplier, or period.

For EU qualified trust services, eIDAS requires an audit at the qualified TSP's expense at least every 24 months. The TSP must submit the CAB report to the supervisory body within three working days of receipt and inform that body at least one month before a planned audit. Those legal rules do not make every EN 319 401 assessment an eIDAS qualified-service audit.

A CAB report also does not itself grant qualified status. Under eIDAS, the supervisory body verifies compliance and grants the provider and service qualified status; the service may begin as qualified after that status appears on the trusted list. Check the current trusted-list entry as well as the report.

EN 319 401 V3.2.1 requires the TSP to specify policies and practices appropriate to the trust services it provides. Management must approve them, and the TSP must publish and communicate them to employees and external parties as relevant.

The core document is the trust service practice statement. EN 319 401 requires it to describe the practices and procedures used to address the applicable trust service policy identified by the TSP, identify obligations of external organizations supporting the service, and be maintained through a defined review process. The standard does not mandate a particular practice-statement structure.

EN 319 401 distinguishes between documentation that demonstrates conformance and sensitive details that do not need to be publicly disclosed. The TSP must make its practice statement and other relevant documentation available to subscribers and relying parties as necessary to demonstrate conformance to the trust service policy, while sensitive aspects can remain undisclosed.

The terms and conditions are a separate public-facing requirement. For each supported trust service policy, they must cover the policy, use limits, subscriber obligations, relying-party information, event-log retention, liability limits, applicable legal system, complaint and dispute procedures, assessment status and scheme if assessed, contact information, and availability undertakings. V3.2.1 also requires precise terms to be presented before contract in a clear, comprehensive, easily accessible manner, both in a publicly accessible space and individually.

V3.2.1 replaces the former information security policy wording with a policy on the security of network and information systems. It must set security objectives, continual-improvement and resource commitments, roles, retained documentation, topic-specific policies, implementation measures, maturity indicators, and the date of formal management approval. The TSP must document, implement, and maintain the policy with the controls and operating procedures for its facilities, systems, and information assets.

The policy and risk documents now have explicit review timing. The network and information systems security policy and the risk assessment results and treatment plan must be reviewed at planned intervals, at least annually, and after significant incidents or significant changes to operations or risks. Practice-statement changes that might affect service acceptance require due notice, and the approved revision must then be made available.

EN 319 401 V3.2.1 treats subcontracting, outsourcing, cloud use, and other third-party arrangements as part of the controlled supply chain. When another party, including a trust service component provider, supplies part of the service, the TSP keeps overall responsibility for the supply-chain policy, its network and information systems security policy, and the trust service policy requirements.

Supplier control extends beyond onboarding. The TSP should identify which part of the trust service the outside party performs, record the TSP-owned policy requirements that apply, and keep evidence of the documented responsibilities.

The agreement evidence should show that the supplier relationship is specific enough to enforce the TSP's information security requirements. EN 319 401 calls for documented agreements and contractual relationships when service provisioning involves subcontracting, outsourcing, or other third-party arrangements, so both parties understand their obligations to fulfil relevant information security requirements.

Keep the signed agreement with a requirement map and evidence of supplier acceptance. V3.2.1 says contracts must address, where appropriate, cybersecurity requirements; staff awareness, skills, training, and certifications; background verification; prompt supplier notice of incidents that risk the TSP's systems; audit rights or audit reports; vulnerability handling; subcontracting controls; and information retrieval or disposal at termination.

V3.2.1 requires the TSP to review its supply-chain policy and monitor, review, evaluate, and manage changes in direct-supplier cybersecurity practices at planned intervals, at least annually, or after an incident related to the supplier's services.

Maintain both views required by the standard: a register of suppliers and agreements showing where TSP information is managed or archived, and an up-to-date register of direct suppliers and service providers with contact points and the ICT products, services, and processes each provides. Review agreements for validity, fitness for purpose, and current security clauses. On TSP service termination, end subcontractor authority to act for trust-service-token issuance functions.