ETSI EN 319 401 Policy documentation requirements

EN 319 401 V3.2.1 requires the TSP to specify policies and practices appropriate to the trust services it provides. Management must approve them, and the TSP must publish and communicate them to employees and external parties as relevant.

The core document is the trust service practice statement. EN 319 401 requires it to describe the practices and procedures used to address the applicable trust service policy identified by the TSP, identify obligations of external organizations supporting the service, and be maintained through a defined review process. The standard does not mandate a particular practice-statement structure.

EN 319 401 distinguishes between documentation that demonstrates conformance and sensitive details that do not need to be publicly disclosed. The TSP must make its practice statement and other relevant documentation available to subscribers and relying parties as necessary to demonstrate conformance to the trust service policy, while sensitive aspects can remain undisclosed.

The terms and conditions are a separate public-facing requirement. For each supported trust service policy, they must cover the policy, use limits, subscriber obligations, relying-party information, event-log retention, liability limits, applicable legal system, complaint and dispute procedures, assessment status and scheme if assessed, contact information, and availability undertakings. V3.2.1 also requires precise terms to be presented before contract in a clear, comprehensive, easily accessible manner, both in a publicly accessible space and individually.

V3.2.1 replaces the former information security policy wording with a policy on the security of network and information systems. It must set security objectives, continual-improvement and resource commitments, roles, retained documentation, topic-specific policies, implementation measures, maturity indicators, and the date of formal management approval. The TSP must document, implement, and maintain the policy with the controls and operating procedures for its facilities, systems, and information assets.

The policy and risk documents now have explicit review timing. The network and information systems security policy and the risk assessment results and treatment plan must be reviewed at planned intervals, at least annually, and after significant incidents or significant changes to operations or risks. Practice-statement changes that might affect service acceptance require due notice, and the approved revision must then be made available.