Search every question across sub-FAQs

The most useful scope evidence is not a generic statement that a provider follows EN 319 401. Clause 6 points to specific documents: the TSP must specify policies and practices appropriate for the trust services it provides, maintain a practice statement addressing applicable trust service policy requirements, and make relevant documentation available to subscribers and relying parties as needed to demonstrate conformance.

The terms and conditions also carry scope information. EN 319 401 says they should specify the trust service policy applied, limitations on use, subscriber obligations, information for relying parties, event-log retention period, liability limits, applicable legal system, complaint and dispute procedures, any conformity assessment scheme, contact information, and any availability undertaking.

A credible EN 319 401 scope review should answer operational questions that the standard itself makes relevant: which services are provided, which risks were assessed, which policies and practice statements were approved, which evidence is retained, and which outside organizations or components support the service.

Do not use EN 319 401 alone to claim that a specific trust service has passed an independent assessment. The standard explicitly says it does not specify how its requirements can be assessed by an independent party, and it points to ETSI EN 319 403-1 for conformity assessment body requirements.