ETSI EN 319 401 Security incident handling

Clause 7.9 of ETSI EN 319 401 V3.1.1 is the core incident-management clause. It covers monitoring and logging, incident response, reporting, event assessment and classification, and post-incident reviews. The practical implication is that incident handling should be documented from detection through follow-up, with evidence that the process actually operates.

The standard defines incident handling as actions and procedures to prevent, detect, analyse, contain, respond to, and recover from an incident. It also defines an information security incident as related and identified information security events that can harm assets or compromise operations, so the incident process should connect event intake, severity assessment, response, and lessons learned.

EN 319 401 expects incident handling to have assigned roles and communication paths. The TSP should maintain communication plans that include incident categorisation, escalation procedures, and standardised reporting protocols. Personnel also need the competencies to detect and respond to security incidents.

For alerts of potentially critical security events, the standard calls for trusted role personnel to follow up and make sure relevant incidents are reported in line with the TSP's procedures. The incident function should also have clear interfaces with business continuity management so response and service restoration do not run as disconnected workstreams.

EN 319 401 does not let teams replace legal analysis with a generic notification rule. It says the TSP shall comply with reporting obligations mandated by relevant legislative frameworks for network and information security incidents, including supervisory authorities and CSIRTs.

For a breach of security or loss of integrity with significant impact on the trust service provided and on the personal data maintained in it, clause 7.9.3 requires procedures to notify appropriate parties in line with applicable regulatory rules within 24 hours of the breach being identified. The ETSI note says TSPs operating within the European Union can contact the appropriate supervisory body or other competent authorities for guidance on notification procedures under eIDAS Article 19.2.

A useful EN 319 401 incident file should show the full chain: event source, severity assessment, classification changes, response actions, stakeholder communication, vulnerability handling, continuity coordination, and post-incident review. This keeps the page focused on evidence that a trust service provider can maintain and show to assessors or customers.

Post-incident work should not stop at closure notes. Clause 7.9.5 requires the TSP to keep informed about technical vulnerabilities, evaluate its exposure, take appropriate measures, identify incident root cause, conduct post-incident reviews, and ensure each past incident led to a post-incident review.