A practical guide to EN 319 401 V3.1.1 clause 5 risk assessment, risk treatment, operational procedures, recurring review, and residual-risk approval.
This page maps V3.1.1. ETSI published V3.2.1 in January 2026. Confirm the required edition and treat the eIDAS references as informative mapping context, not a current legal conclusion.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this page to turn ETSI EN 319 401 V3.1.1 clause 5 into reviewable risk work: identify, analyse, and evaluate trust-service risks; select treatment measures; document the resulting security requirements and procedures; review the assessment; and obtain management approval and residual-risk acceptance. ETSI published V3.2.1 in January 2026, so record which edition controls.
Clause 5 starts with the trust service, not with a generic enterprise risk register. REQ-5-01 requires the TSP to carry out a risk assessment that identifies, analyses, and evaluates trust service risks while taking business and technical issues into account.
The boundary is the service being provided and the operational practices that support it. V3.1.1 defines trust services for this edition to include creation, verification, and validation of digital signatures and related certificates; time-stamps and related certificates; registered delivery and related certificates; website-authentication certificates; and preservation of digital signatures or certificates related to those services. Do not treat that edition-specific list as a complete statement of the amended eIDAS trust-service definition.
REQ-5-02 connects to the assessment results. The TSP has to select appropriate risk treatment measures, and those measures have to make the level of security commensurate with the degree of risk.
The standard does not prescribe a single risk method in clause 5. It points users to ISO/IEC 27005:2022 for guidance on information security risk management as part of an information security management system, but the enforceable EN 319 401 work remains the selected treatment measures and the evidence that they follow from the assessed trust service risks.
REQ-5-03 turns treatment choices into operational documentation. The TSP has to determine the security requirements and operational procedures needed to implement the chosen treatment measures, and those have to be documented in the information security policy and the trust service practice statement.
A risk register alone is not enough when treatment changes service operation, personnel duties, access controls, network segmentation, incident handling, continuity, or supplier controls. Update the policy and practice-statement material that EN 319 401 requires to document those security requirements and procedures.
REQ-5-04 requires the risk assessment to be regularly reviewed and revised. EN 319 401 does not set a universal review interval in clause 5, so implementation guidance should not invent one. The defensible action is to define the review cadence in the TSP's evidence set and add change triggers where other clauses show risk-dependent controls.
Other V3.1.1 clauses show why change-triggered review is practical: asset classification depends on the risk assessment and business value, network segmentation depends on risk assessment, backups follow the risk assessment and business continuity plan, and supplier security measures align with the TSP's risk assessment. The examples below are implementation triggers derived from those dependencies; clause 5 itself sets no universal interval or fixed trigger list.
REQ-5-05 makes residual-risk acceptance a management decision. The TSP's management has to approve the risk assessment and accept the residual risk identified.
For implementation, that means evidence should show more than a completed spreadsheet. It should show the assessment version, treatment decisions, remaining risk, approval authority, date, and any conditions attached to acceptance. If a treatment is delayed or a vulnerability is judged not to require remediation under another EN 319 401 process, the basis for that decision should remain connected to the residual-risk evidence.
V3.1.1 Annex B informatively maps the eIDAS Article 19.1 text reproduced in that edition to clause 5, clause 6.3, and clauses 7.2 through 7.12. The mapping links risk assessment to appropriate technical and organisational measures whose security level is commensurate with risk.
Use that historical edition mapping to trace controls, not to state current EU law. Regulation (EU) 2024/1183 amended eIDAS, and current obligations can also depend on NIS2, implementing rules, service status, Member State implementation, and supervisory context.
This guide helps assign owners, treatment measures, policy updates, review triggers, and management approvals for EN 319 401 clause 5.
Convert EN 319 401 risk assessment, treatment, review, and residual-risk approval into accountable controls.
Use cited ETSI source material to check risk scope, treatment evidence, Article 19 mapping, and review triggers before implementation.
Walk through risk assessment, treatment decisions, policy updates, and residual-risk approval evidence with Sorena.
"Clauses 5, 6.3, 7.2 to 7.12"