ETSI EN 319 401 How should teams handle subcontractors under ETSI EN 319 401

EN 319 401 treats subcontracting, outsourcing, and other third-party arrangements as part of the TSP's controlled supply chain. Clause 7.14.3 says that when other parties, including trust service component providers, provide parts of the service, the TSP maintains overall responsibility for conformance with the supply chain policy, information security policy, and trust service policy requirements.

That means the practical control is not just vendor onboarding. The TSP should identify which part of the trust service is performed by the outside party, record the TSP-owned policy requirements that apply, and keep evidence showing that the arrangement is governed by documented responsibilities rather than informal reliance on the supplier.

The agreement evidence should show that the supplier relationship is specific enough to enforce the TSP's information security requirements. EN 319 401 calls for documented agreements and contractual relationships when service provisioning involves subcontracting, outsourcing, or other third-party arrangements, so both parties understand their obligations to fulfil relevant information security requirements.

For evidence review, keep the signed agreement together with the requirement map. The agreement should show the outsourcer's liability, the controls the outsourcer is bound to implement, the TSP security policies and requirements included in contracts, and any service level agreements or auditing mechanisms used to check that direct suppliers and service providers take appropriate security measures aligned with the TSP risk assessment.

Treat subcontractor evidence as living supply chain evidence, not a one-time procurement file. EN 319 401 requires the TSP to monitor, review, evaluate, and manage changes in direct supplier or service provider cybersecurity practices at planned intervals or after an incident related to the services they provide.

The standard also requires a supplier and agreement register that tracks where TSP information is managed or archived, and it requires regular review, validation, and update of that register to confirm agreements remain valid, fit for purpose, and include relevant information security clauses. If a TSP terminates its services, EN 319 401 also calls for terminating all subcontractor authorization to act on behalf of the TSP for functions related to issuing trust service tokens.