We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideGLOBALETSI EN 319 401

ETSI EN 319 401 Risk assessment and treatment

A practical guide to EN 319 401 V3.1.1 clause 5 risk assessment, , operational procedures, recurring review, and residual-risk approval.

This page maps V3.1.1. ETSI published V3.2.1 in January 2026. Confirm the required edition and treat the eIDAS references as informative mapping context, not a current legal conclusion.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
6 sections4 primary sources
Overview

Use this page to turn ETSI EN 319 401 V3.1.1 clause 5 into reviewable risk work: identify, analyse, and evaluate trust-service risks; select treatment measures; document the resulting security requirements and procedures; review the assessment; and obtain management approval and residual-risk acceptance. ETSI published V3.2.1 in January 2026, so record which edition controls. For the qualified signature/seal certificate reference route in Implementing Regulation (EU) 2025/1943, retain the cited EN 319 401 V3.1.1 and the applicable adaptations. Publication of V3.2.1 does not replace that legally cited edition.

Section 1

What does EN 319 401 require the risk assessment to cover?

Clause 5 starts with the trust service, not with a generic enterprise risk register. REQ-5-01 requires the TSP to carry out a risk assessment that identifies, analyses, and evaluates trust service risks while taking business and technical issues into account.

The boundary is the service being provided and the operational practices that support it. V3.1.1 defines trust services for this edition to include creation, verification, and validation of digital signatures and related certificates; time-stamps and related certificates; registered delivery and related certificates; website-authentication certificates; and preservation of digital signatures or certificates related to those services. Do not treat that edition-specific list as a complete statement of the amended eIDAS trust-service definition.

  • Name the trust service or trust service component before listing risks.
  • Record both business issues and technical issues for each risk so the assessment does not become only a security-tool output.
  • Use EN 319 401 terminology consistently: risk assessment means identification, analysis, and evaluation; means modifying risk.
  • Keep service-specific assumptions visible, especially where another ETSI trust-service standard adds requirements beyond this general baseline.
Section 2

How should risk treatment be selected?

REQ-5-02 connects to the assessment results. The TSP has to select appropriate risk treatment measures, and those measures have to make the level of security commensurate with the degree of risk.

The standard does not prescribe a single risk method in clause 5. It points users to ISO/IEC 27005:2022 for guidance on information security risk management as part of an information security management system, but the enforceable EN 319 401 work remains the selected treatment measures and the evidence that they follow from the assessed trust service risks.

  • Trace each treatment measure back to a specific assessed risk instead of listing controls in isolation.
  • State why the treatment is proportionate to the degree of risk.
  • Separate mandatory EN 319 401 treatment evidence from optional method notes borrowed from ISO/IEC 27005 guidance.
  • Keep rejected or deferred treatments with the residual-risk record so management can approve the real remaining exposure.
Section 3

Where do risk decisions have to appear in TSP documentation?

REQ-5-03 turns treatment choices into operational documentation. The TSP has to determine the security requirements and operational procedures needed to implement the chosen treatment measures, and those have to be documented in the information security policy and the trust service practice statement.

A risk register alone is not enough when treatment changes service operation, personnel duties, access controls, network segmentation, incident handling, continuity, or supplier controls. Update the policy and practice-statement material that EN 319 401 requires to document those security requirements and procedures.

  • For each treatment, identify the policy section or practice-statement section that documents the resulting requirement or procedure.
  • Mark which treatments change customer-facing trust service practices and which remain internal information-security controls.
  • Review policy and practice-statement changes through management approval paths already required by EN 319 401 clause 6.
  • Preserve enough evidence for an assessor or customer reviewer to follow the chain from risk to treatment to documented procedure.
Section 4

When should the risk assessment be reviewed?

REQ-5-04 requires the risk assessment to be regularly reviewed and revised. V3.1.1 does not set a universal review interval in clause 5. Define the review cadence in the TSP's procedures, retain review records, and add change triggers for controls that depend on the assessed risk.

Other V3.1.1 clauses show why change-triggered review is practical: asset classification depends on the risk assessment and business value, network segmentation depends on risk assessment, backups follow the risk assessment and business continuity plan, and supplier security measures align with the TSP's risk assessment. The examples below are implementation triggers derived from those dependencies; clause 5 itself sets no universal interval or fixed trigger list.

  • Document the regular review cadence instead of implying EN 319 401 clause 5 sets a fixed interval.
  • Trigger review when the trust service boundary, asset classification, network zones, backup approach, supplier service, or cloud-service use changes.
  • Record whether the review revised risk identification, analysis, evaluation, treatment selection, procedures, or residual-risk acceptance.
  • Avoid stale evidence by dating the assessment version and linking it to the current policy and practice-statement versions.
Section 5

Who accepts residual risk?

REQ-5-05 makes residual-risk acceptance a management decision. The TSP's management has to approve the risk assessment and accept the residual risk identified.

For implementation, that means evidence should show more than a completed spreadsheet. It should show the assessment version, treatment decisions, remaining risk, approval authority, date, and any conditions attached to acceptance. If a treatment is delayed or a vulnerability is judged not to require remediation under another EN 319 401 process, the basis for that decision should remain connected to the residual-risk evidence.

  • Identify the management body or management role that approves the risk assessment.
  • Keep residual risk distinct from untreated risk, accepted exceptions, and open remediation items.
  • Attach approval to a dated assessment version and the trust service scope it covers.
  • Re-open acceptance when reviews materially revise risk results or treatment choices.
Section 6

How does this connect to eIDAS Article 19?

V3.1.1 Annex B informatively maps the eIDAS Article 19.1 text reproduced in that edition to clause 5, clause 6.3, and clauses 7.2 through 7.12. The mapping links risk assessment to appropriate technical and organisational measures whose security level is commensurate with risk.

Use that historical edition mapping to trace controls, not to state current EU law. Regulation (EU) 2024/1183 amended eIDAS, and current obligations can also depend on NIS2, implementing rules, service status, Member State implementation, and supervisory context.

  • Use EN 319 401 clause 5 as the risk-assessment anchor for tracing the V3.1.1 Annex B Article 19 mapping.
  • Use clause 6.3 and clauses 7.2 through 7.12 to test whether treatment measures have become operational controls.
  • Avoid claiming legal compliance from this page alone; preserve the actual eIDAS applicability analysis separately.
  • When the service is qualified, check the relevant service-specific ETSI standard and supervisory expectations before treating this general baseline as complete.
Recommended next step

Operationalize risk assessment and treatment

This guide helps assign owners, treatment measures, policy updates, review triggers, and management approvals for EN 319 401 clause 5.

Assessment workflow
Build the evidence plan

Convert EN 319 401 risk assessment, treatment, review, and residual-risk approval into accountable controls.

Explore next step
Research workflow
Resolve a source question

Use cited ETSI source material to check risk scope, treatment evidence, applicable eIDAS provisions, and review triggers before implementation.

Explore next step
Talk to Sorena
Review implementation

Walk through risk assessment, treatment decisions, policy updates, and residual-risk approval evidence with Sorena.

Explore next step
Primary sources

References and citations

ETSI EN 319 401 V3.1.1 general policy requirements for TSPs
etsi.org7 citations
Referenced sections
  • Primary ETSI source for trust service provider risk assessment, risk treatment, policy and practice-statement linkage, review, residual-risk approval, and Annex B eIDAS Article 19 mapping.
  • Primary source for clause 5 risk assessment and for EN 319 401 definitions of trust service, risk assessment, risk management, and risk treatment.
  • Primary source for REQ-5-02 and the note pointing to ISO/IEC 27005:2022 as risk-management guidance.
Show 4 more
  • Primary source for REQ-5-03 and clause 6 documentation links to information security policy and trust service practice statement.
  • Primary source for REQ-5-04 and for risk-assessment dependencies in asset classification, network security, backup, and supplier controls.
  • Primary source for REQ-5-05 management approval and residual-risk acceptance.
  • Primary source for Annex B mapping of eIDAS Article 19.1 to EN 319 401 clauses 5, 6.3, and 7.2 through 7.12.
"Risk Assessment"
More quoted passages
"identify, analyse and evaluate trust service risks"
"commensurate to the degree of risk"
"information security policy and the trust service practice statement"
"regularly reviewed and revised"
"accept the residual risk identified"
"Clauses 5, 6.3, 7.2 to 7.12"
Consolidated Regulation (EU) No 910/2014 (eIDAS)
eur-lex.europa.eu2 citations
Referenced sections
  • Current consolidated legal text used to distinguish V3.1.1's informative historical mapping from current eIDAS obligations.
  • Current consolidated eIDAS text used to qualify the historical Article 19 mapping in V3.1.1.
Commission Implementing Regulation (EU) 2025/1943
eur-lex.europa.eu
Referenced sections
  • Article 1 and the Annex specify the adapted qualified signature/seal certificate reference route, including EN 319 401 V3.1.1. Recital 3 preserves other practices for demonstrating compliance; the reference route does not itself grant qualified status.

Related guides

ETSI EN 319 401 Audit and Conformity Assessment Evidence

How to prepare ETSI EN 319 401 evidence for audit and conformity assessment without overstating what the standard itself assesses.

ETSI EN 319 401 Audit Evidence Pack

Build an ETSI EN 319 401 audit evidence pack around records, logs, policies, risk assessment, incident handling, continuity, and supplier evidence.

ETSI EN 319 401 Audit Evidence Pack Workflow

Build an ETSI EN 319 401 audit evidence pack for trust service providers: risk assessment, practice statement, policies, records, logs, continuity, and supplier evidence.

ETSI EN 319 401 compliance duties for TSPs

ETSI EN 319 401 compliance guidance for trust service providers covering legal operation, evidence, accessibility, privacy, records, incidents, continuity, and suppliers.

ETSI EN 319 401 FAQ for trust service providers

Plain-language ETSI EN 319 401 answers covering TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence.

ETSI EN 319 401 Incident and Continuity Workflow

Build an EN 319 401 incident and continuity evidence workflow for TSP monitoring, response, reporting, records, backup recovery, and crisis review.

Show all related guides (23)

ETSI EN 319 401 Incident Reporting and Continuity Duties

Practical ETSI EN 319 401 V3.1.1 guidance for trust service incident response, reporting, evidence retention, business continuity, and termination planning.

ETSI EN 319 401 Personnel, Asset, and Access Controls

Clause-focused EN 319 401 V3.1.1 guide to TSP personnel duties, trusted roles, asset inventories, classification, and access-control evidence.

ETSI EN 319 401 policy and security requirements

ETSI EN 319 401 guidance for TSP policy and security requirements covering risk assessment, practice statements, terms, security controls, incidents, and evidence.

ETSI EN 319 401 requirements map

Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls.

ETSI EN 319 401 Subcontractor Controls

Practical EN 319 401 guidance for TSP subcontractor controls: retained responsibility, agreements, SLAs, supplier registers, monitoring, and audit evidence.

ETSI EN 319 401 Subcontractor Evidence Workflow

Build an EN 319 401 subcontractor evidence workflow for TSP supplier agreements, SLAs, audit mechanisms, risk reviews, supplier registers, and archived records.

ETSI EN 319 401 Trust Service Applicability Workflow

A scoped workflow for deciding when ETSI EN 319 401 applies to a trust service and what TSP policy, risk, terms, operations, and supplier evidence to collect.

ETSI EN 319 401 Trust Service Provider Applicability

Use ETSI EN 319 401 to decide whether a trust service provider activity falls in the standard's type-independent baseline and what service, policy, risk, supplier, and evidence boundaries to document.

ETSI EN 319 401 vs eIDAS: Controls and Legal Duties

Compare ETSI EN 319 401 V3.2.1 with current eIDAS duties for qualified and non-qualified trust service providers, including risk, incidents, audits, records, and termination.

ETSI EN 319 401 vs EN 319 403-1: TSP Policy vs CAB Assessment

Compare ETSI EN 319 401 V3.2.1 provider controls with EN 319 403-1 V2.3.1 CAB requirements for audit scope, evidence, sampling, reports, corrective action, and reassessment.

CA and RA responsibilities under ETSI EN 319 401

How ETSI EN 319 401 frames CA and RA responsibility: TSP practice statements, management approval, role segregation, subcontractor control, and evidence boundaries.

eIDAS Articles 19 and 24: current ETSI mapping

Understand why old EN 319 401 editions mapped eIDAS Article 19, what replaced it, and how V3.2.1 maps current Article 24 duties.

ETSI EN 319 401 conformity assessment bodies: what is covered?

Understand what ETSI EN 319 401 says, and does not say, about conformity assessment bodies, independent assessment, and TSP evidence preparation.

ETSI EN 319 401 policy documentation: what is required?

How ETSI EN 319 401 treats practice statements, terms, network and information systems security policy, evidence records, and change review.

ETSI EN 319 401 Subcontractor Requirements FAQ

How ETSI EN 319 401 treats subcontractors, outsourcing, supplier agreements, SLAs, monitoring, evidence, and retained TSP responsibility.

Security Incidents in ETSI EN 319 401

How ETSI EN 319 401 V3.2.1 expects TSPs to detect, classify, respond to, report, document, test, and review security incidents.

Trust service provider scope under ETSI EN 319 401

How to scope ETSI EN 319 401 for a trust service provider: service boundaries, trust service policy, practice statement, terms, risks, and third-party components.