ETSI EN 319 401 Policy documentation requirements

EN 319 401 V3.1.1 requires the TSP to specify the set of policies and practices appropriate for the trust services it provides. Those policies and practices have to be approved by management, published, and communicated to employees and external parties as relevant.

The core document is the trust service practice statement. EN 319 401 requires it to describe the practices and procedures used to address the applicable trust service policy identified by the TSP, identify obligations of external organizations supporting the service, and be maintained through a defined review process. The standard does not mandate a particular practice-statement structure.

EN 319 401 distinguishes between documentation that demonstrates conformance and sensitive details that do not need to be publicly disclosed. The TSP must make its practice statement and other relevant documentation available to subscribers and relying parties as necessary to demonstrate conformance to the trust service policy, while sensitive aspects can remain undisclosed.

The terms and conditions are a separate public-facing requirement. They must be available to subscribers and relying parties and, for each supported trust service policy, cover the policy being applied, use limitations, subscriber obligations, relying-party information, event-log retention, liability limitations, applicable legal system, complaint and dispute procedures, conformity-assessment status and scheme when applicable, contact information, and any availability undertaking.

Policy documentation should be maintained as a governed evidence set. EN 319 401 requires an information security policy approved by management, documented security controls and operating procedures for facilities, systems, and information assets, and communication of applicable policy changes to impacted parties.

Review triggers matter. The information security policy and asset inventory must be reviewed at planned intervals or when significant changes occur, and changes that impact the security level require management-body approval. When a practice-statement change might affect service acceptance by a subject, subscriber, or relying party, the TSP has to give due notice; after approval, the revised practice statement has to be made available.