ETSI EN 319 401 Subcontractor Controls

The first control decision is whether the outside party provides any part of the trust service through subcontracting, outsourcing, or another third-party arrangement. If it does, EN 319 401 clause 7.14.3 keeps overall responsibility with the TSP for conformance with the supply chain policy, information security policy, and trust service policy requirements.

The subcontractor file is assurance evidence as well as procurement paperwork. It should name the outsourced service part, affected trust service policy requirements, supplier-owned activities, TSP-owned controls, and evidence that those controls were communicated and monitored.

EN 319 401 treats supplier selection as a security control. Clause 7.14 requires processes for security risks associated with supplier products and services, and the supply chain policy has to define criteria for selecting and contracting suppliers or service providers.

A complete supplier-selection record covers more than the vendor name. V3.1.1 requires criteria addressing the supplier's ability to meet the cybersecurity specifications, risks, and classification levels of the affected TSP services, systems, or products; the TSP's ability to diversify supply and limit vendor lock-in; and coordinated security risk assessment results for critical supply chains.

When service provisioning involves subcontracting, outsourcing, or other third-party arrangements, EN 319 401 calls for a documented agreement and contractual relationship so both parties understand their obligations to fulfil relevant information security requirements.

The agreement evidence should connect directly to the TSP's risk assessment and policies. It should define the outsourcer's liability, bind the outsourcer to implement controls required by the TSP at service commencement and termination, include applicable TSP security policies and requirements in contracts with direct suppliers or service providers, and use service level agreements and/or auditing mechanisms for direct suppliers and service providers, including cloud providers.

Subcontractor approval should not be treated as permanent. EN 319 401 requires planned or incident-triggered review of the supply chain policy and changes in the cybersecurity practices of direct suppliers or service providers related to the provision of services.

The standard also expects a register of suppliers and agreements that tracks where TSP information is managed or archived. That register should be regularly reviewed, validated, and updated so agreements remain valid, fit for purpose, and include the relevant information security clauses.

A useful evidence pack should let an assessor, security reviewer, procurement lead, or product owner understand the outsourced boundary without interviewing the whole team. It should show what the outside party does, why the TSP still owns conformance, what controls are contractually required, how those controls are checked, and which event or planned interval triggers another review.

Also include the adjacent EN 319 401 controls that can affect subcontractors: staff and subcontractor competence, contractor incident reporting procedures, return of TSP assets when external personnel or third parties change or terminate, and termination of subcontractor authorization before the TSP terminates services where subcontractors act for functions related to issuing trust service tokens.

The common failure pattern is treating the supplier as outside the trust service boundary. Under EN 319 401, if the supplier provides part of the service or manages relevant TSP information, the subcontractor controls need to be visible in the TSP's policies, agreements, monitoring, and evidence records.

Another weak pattern is citing a generic security questionnaire without connecting it to EN 319 401. A defensible review names the supplier arrangement, the applicable TSP policies, the trust service policy requirements, the risk assessment connection, the agreement clauses, and the evidence that the arrangement is still current.