--- title: "ETSI EN 319 401 requirements map" canonical_url: "https://www.sorena.io/artifacts/global/etsi-en-319-401/requirements" source_url: "https://www.sorena.io/artifacts/global/etsi-en-319-401/requirements" author: "Sorena AI" description: "Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "ETSI EN 319 401 requirements" - "TSP requirements" - "trust service provider controls" - "trust service practice statement" - "eIDAS trust services" - "ETSI EN 319 401" - "trust service provider" - "eIDAS" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ETSI EN 319 401 requirements map Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls. *Artifact Guide* *GLOBAL* *ETSI EN 319 401* ## ETSI EN 319 401 requirements map A clause-level map of ETSI EN 319 401 V3.1.1 requirements for trust service provider governance, security, evidence, continuity, and supplier controls. Use it to structure a TSP requirement register and evidence index before an independent review, customer review, or conformity-assessment discussion. ETSI EN 319 401 is the general policy baseline for trust service providers. It does not supersede service-specific ETSI standards, but it gives the common requirements that should be mapped before a provider claims a trust service is governed, secured, monitored, evidenced, and maintained under a defined policy. ## Define the service boundary before mapping requirements Start the register with the trust service, trust service policy, practice statement, trust service tokens, subscriber and relying-party audiences, and every component used to provide the service. EN 319 401 applies across trust services such as certificates, time-stamps, registered delivery, signature validation, preservation, and related service components, while other ETSI standards can refine the requirements for a specific service type. Do not map requirements to a generic compliance program. Map them to the TSP entity, the services it provides, the systems and facilities supporting those services, the external organizations supporting them, and the public statements made to subscribers and relying parties. - Identify the applicable trust service policy and the practice statement used to address it. - Separate customer-visible terms and conditions from internal procedures and security operating records. - List external support organizations, subcontractors, cloud services, and trust service component providers before assigning controls. - Record when a service-specific ETSI standard, conformity-assessment scheme, or legal requirement adds more detail than EN 319 401. Sources for this answer: - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Supports the page scope: EN 319 401 defines general operation and management policy requirements for Trust Service Providers and allows service-specific standards to refine them. - [Regulation (EU) No 910/2014 (eIDAS)](https://eur-lex.europa.eu/eli/reg/2014/910/oj/eng?ref=sorena.io) - Provides the EU legal context for trust services, qualified trust service providers, and the security and incident duties referenced by EN 319 401 Annex B. ## Map clauses 5 and 6 to governance records The first requirement group is governance, not tooling. Clause 5 requires risk assessment, risk treatment, security requirements, operational procedures, regular review, and management approval of residual risk. Clause 6 then turns those decisions into the practice statement, terms and conditions, and information security policy. A useful requirements map should show which document or record proves each obligation: the risk assessment, management approval, trust service practice statement, published terms, notice process for material practice-statement changes, information security policy, asset inventory linkage, and configuration-check interval. - Risk assessment: identify, analyse, evaluate, treat, review, and obtain management acceptance of residual risk. - Practice statement: document how the TSP addresses the applicable trust service policy and external-support obligations. - Terms and conditions: include use limits, subscriber obligations, relying-party information, log retention period, liability limits, legal system, complaints, assessment status, contact information, and availability undertakings. - Information security policy: document, approve, implement, maintain, communicate, and review the policy and related asset inventory. Sources for this answer: - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Grounds the governance mapping in clauses 5 and 6: risk assessment, practice statement, terms and conditions, and information security policy. ## Map clause 7 to operational control families Clause 7 is best handled as a set of control families with owners and evidence, not as one long checklist. The map should cover organization reliability, segregation of duties, human resources, asset inventory, storage media, access control, cryptographic controls, physical security, operational security, and network security. The evidence needs to match the control family. For example, trusted roles require appointment and acceptance records; assets require inventory fields such as owner, location, classification, version or patch state, and end of life; privileged access requires review records; network security requires segmentation, zone rules, vulnerability-scan evidence, malware update evidence, and significant-change penetration-test evidence. - People and roles: maintain job descriptions, trusted-role appointments, segregation of duties, least-privilege access, security training, and remote-working conditions where remote work is allowed. - Assets and media: maintain classified asset inventories, acceptable-use and handling rules, storage-media lifecycle procedures, and return-of-assets procedures for staff or third-party changes. - Systems and access: document privileged accounts, strong authentication, access-right reviews, change control, patch decisions, configuration monitoring, and protection against malicious software. - Networks and facilities: maintain protected security perimeters, zones based on risk, rule-set reviews, separate administration networks, trusted channels, vulnerability scans, and penetration tests after significant changes. Sources for this answer: - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Supports the control-family grouping from clause 7, including personnel, assets, access control, cryptography, physical security, operations, and network security. ## Treat incidents, evidence, continuity, and termination as mapped requirements EN 319 401 places incident handling and audit evidence inside the requirement set. The map should therefore include continuous monitoring and logging, incident response, reporting, event classification, post-incident review, evidence collection, business continuity, backup, crisis management, and termination planning. This part of the map should be concrete because it is often inspected after a problem. Include log categories, alert follow-up roles, reporting paths, documented incident records, root-cause reviews, UTC time synchronization for audit logs, record retention tied to terms and conditions, backup integrity checks, recovery-test results, crisis-management reviews, and termination steps for subscribers, relying parties, authorities, subcontractors, private keys, and evidence transfer. - Incident map: connect monitoring, alarms, response procedures, escalation, reporting, event reassessment, post-incident review, and critical-vulnerability handling. - Evidence map: retain records for legal evidence and continuity, protect confidentiality and integrity, synchronize audit-log time with UTC, and retain records for the period disclosed in terms and conditions. - Continuity map: define disaster recovery delays, backup locations and integrity checks, recovery testing, crisis roles, authority communications, and use of National CSIRT or competent-authority information where applicable. - Termination map: keep an up-to-date termination plan covering notifications, public termination information, subcontractor authorization, evidence maintenance or transfer, private-key destruction or withdrawal, service transfer where possible, and funding arrangements. Sources for this answer: - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Grounds the incident, evidence, continuity, and termination mapping in clauses 7.9 through 7.12. - [Regulation (EU) No 910/2014 (eIDAS)](https://eur-lex.europa.eu/eli/reg/2014/910/oj/eng?ref=sorena.io) - Supports the EU trust-service incident context reflected in EN 319 401 Annex B, including notification of significant breaches of security or loss of integrity. *Recommended next step* *Placement: after requirements map* ## Operationalize the requirements map Use the EN 319 401 map to assign owners, collect clause-level evidence, and separate standard-backed requirements from service-specific or customer-specific additions. - [Open Assessment Autopilot for ETSI EN 319 401](/solutions/assessment.md): Convert EN 319 401 clauses into accountable tasks, evidence requests, and review milestones. - [Research ETSI EN 319 401 source questions](/solutions/research-copilot.md): Resolve scope, applicability, evidence, and service-specific extension questions against cited source material. - [Talk through implementation](/contact.md): Review the service boundary, requirement register, evidence gaps, and next assessment steps with Sorena. ## Add compliance and supply-chain requirements to the same register The register is incomplete if it stops at internal systems. Clause 7.13 requires evidence of applicable legal requirements, feasible accessibility for trust services and end-user products, and personal-data protection measures. Clause 7.14 adds supplier, ICT supply-chain, cloud-service, outsourcing, subcontractor, SLA, monitoring, and supplier-register requirements. For supplier-dependent services, keep the TSP accountable in the map. EN 319 401 says a TSP using other parties to provide parts of its service maintains overall responsibility for conformance with the supply-chain policy, information security policy, and trust service policy requirements. - Compliance evidence: link legal-requirement evidence, accessibility considerations, and personal-data safeguards to the service boundary. - Supplier selection: map cybersecurity specifications, risk and classification levels, source diversification, vendor lock-in limits, and critical-supply-chain risk assessments. - ICT acquisition: request software-component information, implemented security functions, secure configuration requirements, validation methods, critical-component identification, origin traceability, and assurance that delivered products function as expected. - Third-party operation: keep agreements, liability terms, SLAs or audit mechanisms, security clauses, supplier monitoring, incident-driven reviews, and a current supplier-and-agreement register. Sources for this answer: - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Supports the compliance and supply-chain mapping from clauses 7.13 and 7.14, including supplier selection, ICT acquisition, cloud services, outsourcing, SLAs, and supplier registers. ## Quality checks for an EN 319 401 requirements map Before using the map in an assessment or procurement response, test whether every row can be understood without hidden context. Each row should identify the clause or requirement, service boundary, applicability decision, owner, control, evidence artifact, review trigger, and source. Flag gaps instead of filling them with broad compliance claims. A TSP may need service-specific ETSI requirements, an eIDAS qualification context, a conformity-assessment scheme, or customer contract terms before a requirement can be interpreted precisely. - No orphan controls: every control should trace to an EN 319 401 clause, a service-specific requirement, or a documented internal risk decision. - No generic evidence: name the actual artifact, such as a practice statement, terms page, risk acceptance, access review, vulnerability-scan report, incident record, UTC clock log, backup recovery test, termination plan, supplier agreement, or supplier register. - No unsupported status claims: do not say the service is qualified, assessed, certified, or conformant unless the evidence names the scope, scheme, assessor, date, and service boundary. - No stale assumptions: review the map after material changes to the trust service, practice statement, supplier set, cloud environment, key management, network zones, incident process, or legal context. Sources for this answer: - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Supports the validation criteria by tying requirement rows to the standard's clause structure, requirement identifiers, evidence duties, and review obligations. ## Primary sources - [ETSI EN 319 401 V3.1.1 general policy requirements for TSPs](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - Primary source for EN 319 401 scope, requirement identifiers, TSP policy requirements, operational control families, evidence retention, continuity, termination, compliance, and supply-chain requirements. - Quote: "General Policy Requirements for Trust Service Providers" - [Regulation (EU) No 910/2014 (eIDAS)](https://eur-lex.europa.eu/eli/reg/2014/910/oj/eng?ref=sorena.io) - Primary EU legal context for trust services and qualified trust service providers, including the trust-service security and incident-notification context reflected in EN 319 401 Annex B. - Quote: "electronic identification and trust services" ## Related Topic Guides - [CA and RA responsibilities under ETSI EN 319 401](/artifacts/global/etsi-en-319-401/faq/ca-and-ra-responsibilities.md): How ETSI EN 319 401 frames CA and RA responsibility: TSP practice statements, management approval, role segregation, subcontractor control, and evidence boundaries. - [eIDAS Articles 19 and 24 in ETSI EN 319 401](/artifacts/global/etsi-en-319-401/faq/eidas-articles-19-and-24.md): See how ETSI EN 319 401 V3.1.1 Annex B maps eIDAS Article 19 security duties and selected Article 24 qualified trust service duties to concrete policy evidence. - [ETSI EN 319 401 Audit and Conformity Assessment Evidence](/artifacts/global/etsi-en-319-401/audit-and-conformity-assessment.md): How to prepare ETSI EN 319 401 evidence for audit and conformity assessment without overstating what the standard itself assesses. - [ETSI EN 319 401 Audit Evidence Pack](/artifacts/global/etsi-en-319-401/audit-evidence-pack.md): Build an ETSI EN 319 401 audit evidence pack around records, logs, policies, risk assessment, incident handling, continuity, and supplier evidence. - [ETSI EN 319 401 Audit Evidence Pack Workflow](/artifacts/global/etsi-en-319-401/audit-evidence-pack-workflow.md): Build an ETSI EN 319 401 audit evidence pack for trust service providers: risk assessment, practice statement, policies, records, logs, continuity, and supplier evidence. - [ETSI EN 319 401 compliance duties for TSPs](/artifacts/global/etsi-en-319-401/compliance.md): ETSI EN 319 401 compliance guidance for trust service providers covering legal operation, evidence, accessibility, privacy, records, incidents, continuity, and suppliers. - [ETSI EN 319 401 conformity assessment bodies: what is covered?](/artifacts/global/etsi-en-319-401/faq/conformity-assessment-bodies.md): Understand what ETSI EN 319 401 says, and does not say, about conformity assessment bodies, independent assessment, and TSP evidence preparation. - [ETSI EN 319 401 FAQ for trust service providers](/artifacts/global/etsi-en-319-401/faq.md): Plain-language ETSI EN 319 401 answers covering TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence. - [ETSI EN 319 401 Incident Evidence Workflow](/artifacts/global/etsi-en-319-401/incident-and-continuity-evidence-workflow.md): Build an EN 319 401 incident and continuity evidence workflow for TSP monitoring, response, reporting, records, backup recovery, and crisis review. - [ETSI EN 319 401 Incident Reporting and Continuity Duties](/artifacts/global/etsi-en-319-401/incident-and-continuity-duties.md): Practical ETSI EN 319 401 V3.1.1 guidance for trust service incident response, reporting, evidence retention, business continuity, and termination planning. - [ETSI EN 319 401 Personnel, Asset, and Access Controls](/artifacts/global/etsi-en-319-401/personnel-asset-and-access-controls.md): Clause-focused EN 319 401 V3.1.1 guide to TSP personnel duties, trusted roles, asset inventories, classification, and access-control evidence. - [ETSI EN 319 401 policy and security requirements](/artifacts/global/etsi-en-319-401/policy-and-security-requirements.md): ETSI EN 319 401 guidance for TSP policy and security requirements covering risk assessment, practice statements, terms, security controls, incidents, and evidence. - [ETSI EN 319 401 policy documentation: what is required?](/artifacts/global/etsi-en-319-401/faq/policy-documentation.md): How ETSI EN 319 401 treats policy documentation: practice statements, terms and conditions, information security policy, evidence records, and change review. - [ETSI EN 319 401 Risk Assessment and Treatment](/artifacts/global/etsi-en-319-401/risk-management.md): Clause-cited ETSI EN 319 401 V3.1.1 guidance for trust service risk assessment, risk treatment, residual-risk approval, and evidence planning. - [ETSI EN 319 401 Subcontractor Controls](/artifacts/global/etsi-en-319-401/subcontractor-controls.md): Practical EN 319 401 guidance for TSP subcontractor controls: retained responsibility, agreements, SLAs, supplier registers, monitoring, and audit evidence. - [ETSI EN 319 401 Subcontractor Evidence Workflow](/artifacts/global/etsi-en-319-401/subcontractor-evidence-workflow.md): Build an EN 319 401 subcontractor evidence workflow for TSP supplier agreements, SLAs, audit mechanisms, risk reviews, supplier registers, and archived records. - [ETSI EN 319 401 Subcontractor Requirements FAQ](/artifacts/global/etsi-en-319-401/faq/subcontractors.md): How ETSI EN 319 401 treats subcontractors, outsourcing, supplier agreements, SLAs, monitoring, evidence, and retained TSP responsibility. - [ETSI EN 319 401 Trust Service Applicability Workflow](/artifacts/global/etsi-en-319-401/trust-service-applicability-workflow.md): A scoped workflow for deciding when ETSI EN 319 401 applies to a trust service and what TSP policy, risk, terms, operations, and supplier evidence to collect. - [ETSI EN 319 401 Trust Service Provider Applicability](/artifacts/global/etsi-en-319-401/trust-service-provider-applicability.md): Use ETSI EN 319 401 to decide whether a trust service provider activity falls in the standard's type-independent baseline and what service, policy, risk, supplier, and evidence boundaries to document. - [ETSI EN 319 401 vs eIDAS Articles 19 and 24](/artifacts/global/etsi-en-319-401/etsi-en-319-401-vs-eidas.md): Compare ETSI EN 319 401 V3.1.1 with the eIDAS provisions mapped in Annex B: trust service risk management, incident handling, records, staff, terms, and termination planning. - [ETSI EN 319 401 vs EN 319 403-1: TSP Policy vs CAB Assessment](/artifacts/global/etsi-en-319-401/etsi-en-319-401-vs-en-319-403-1.md): Compare ETSI EN 319 401 and ETSI EN 319 403-1 for trust service providers: TSP operating controls, conformity assessment context, evidence boundaries, and reuse limits. - [Security Incidents in ETSI EN 319 401](/artifacts/global/etsi-en-319-401/faq/security-incidents.md): How ETSI EN 319 401 V3.1.1 expects trust service providers to detect, respond to, report, classify, document, and review security incidents. - [Trust service provider scope under ETSI EN 319 401](/artifacts/global/etsi-en-319-401/faq/trust-service-provider-scope.md): How to scope ETSI EN 319 401 for a trust service provider: service boundaries, trust service policy, practice statement, terms, risks, and third-party components. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/etsi-en-319-401/requirements.md