A practical evidence workflow for trust service providers that use subcontractors, outsourcers, suppliers, cloud providers, or providers.
Based on ETSI EN 319 401 V3.1.1 clauses on policies, supplier relationships, records, and supply-chain responsibility. Use it as implementation guidance and validate it against the applicable service policy, assessment scheme, contracts, and law.
Use this workflow when another party provides part of a trust service or supplies a product, ICT service, cloud service, or that supports it. ETSI EN 319 401 V3.1.1 distinguishes general supplier risk controls from the additional agreement and retained-responsibility duties that apply to , outsourcing, and other third-party service arrangements. Classify the relationship first, then collect the matching evidence. For the qualified signature/seal certificate reference route in Implementing Regulation (EU) 2025/1943, retain the cited EN 319 401 V3.1.1 and the applicable adaptations. Publication of V3.2.1 does not replace that legally cited edition.
First classify what the other party provides. Clauses 7.14.1 and 7.14.2 address products and services supplied to the TSP, including the ICT supply chain and cloud services. Clause 7.14.3 adds duties when service provision involves , outsourcing, another third-party arrangement, or a supplied by another party.
When another party provides part of the TSP's service, REQ-7.14.3-01X keeps overall responsibility with the TSP for conformance with its supply chain policy, information security policy, and applicable requirements. The contract may allocate tasks and liability, but it does not transfer that stated responsibility.
Use a branch record rather than one supplier label. An ordinary product or service supplier follows the acquisition and supplier-risk controls. An ICT or cloud dependency also follows ICT supply-chain, cloud-risk, component, and downstream requirement controls where applicable. A party providing part of the trust service also needs the clause 7.14.3 responsibility, agreement, monitoring, and register evidence. A separately provided needs interface and policy-conformance evidence as well.
Sources (1)
REQ-6.1-04 requires the practice statement to identify external-organization obligations; clauses 7.14.1 through 7.14.3 distinguish supplier, ICT supply-chain, cloud, component, and outsourced-service controls and retain stated responsibility with the TSP.
This EN 319 401 workflow is a shared checklist for supplier scope, agreements, SLAs, monitoring reviews, supplier registers, and retained records.
Convert supplier and subcontractor requirements into accountable tasks, evidence requests, and review milestones.
Use cited ETSI source material to resolve scope, applicability, supplier evidence, and assessment questions before implementation.
Review supplier scope, agreement evidence, monitoring checkpoints, and next compliance actions with Sorena.
Before relying on a supplier or subcontractor, show how the selection and contracting decision applied EN 319 401 criteria. The record should address the supplier's ability to meet the TSP's cybersecurity specifications and the risk and classification levels of what is being delivered.
For , outsourcing, or another third-party service arrangement, keep the documented agreement and contractual relationship that makes both parties' information security obligations clear. Also record the outsourcer's liability, controls required by the TSP, and the controls required when use starts and ends. Do not present an internal preference as a standards duty unless it maps to a requirement.
The approval record should identify the supported service, information and asset classification, critical components, locations where TSP information is managed or archived, downstream providers, control owner, evidence-review method, incident contact, change-notice route, commencement conditions, exit conditions, and residual gaps accepted by the TSP.
Sources (1)
REQ-7.14-04X and REQ-7.14.3-02X through REQ-7.14.3-04X cover selection criteria, documented agreements, outsourcer liability, required controls, and commencement and termination controls.
Operational evidence should show that supplier controls continue after onboarding. EN 319 401 requires monitoring, review, evaluation, and change management for supplier information security practices and service delivery, including planned reviews and review after incidents related to supplier-provided services.
For ICT suppliers, the workflow should also preserve evidence that security requirements are propagated through subcontracted ICT services, that supplier product or service components critical to functionality are identified, and that the TSP has acceptable methods for validating that ICT products and services conform to stated cybersecurity requirements.
Sources (1)
Clauses 7.14.2 and 7.14.3 require downstream ICT controls, component evidence, active supplier monitoring, SLA or auditing mechanisms, and a validated supplier-agreement register.
Use these five steps to assign evidence collection and record the decision before moving to the next stage.
1. Service owner: collect supplier scope note, supported trust service, and component/service description. Review question: Does this relationship provide or support part of the TSP service?
2. Procurement and security: collect selection criteria, risk/classification fit, and supplier due-diligence record. Review question: Can the supplier meet the TSP's cybersecurity specifications and risk requirements?
3. Legal and control owner: collect agreement, liability terms, required controls, SLA or auditing mechanism, and start/exit controls. Review question: Are both parties' information security obligations clear enough to rely on?
4. Operations and assurance: collect monitoring reviews, change records, incident-triggered reassessments, updates, and retained operational records. Review question: Is the supplier evidence still valid for the current service boundary?
5. Change or exit: service, security, and records owners collect termination approval, access and asset actions, information-location update, evidence handover, register update, and replacement or continuity decision. Review question: Can the TSP end or change the relationship without losing service control or required evidence?
Sources (1)
Clauses 3.4, 6.1, 7.10, and 7.14 ground the workflow, explain the X change indicator, and connect external-party obligations, supplier agreements, monitoring, registers, and retained records.
Retain the supplier file within the TSP's broader record model. EN 319 401 requires relevant information concerning data issued and received by the TSP to remain accessible for an appropriate period, including after the TSP's activities have ceased, for legal evidence and continuity purposes.
Review checkpoints should therefore cover both supplier relationship evidence and operational service evidence. The evidence pack is weak if it only contains the original contract and omits updated supplier reviews, incident follow-up, validation, or records showing where TSP information is managed or archived.
Sources (1)
REQ-7.10-01 and REQ-7.10-07 cover accessible records and disclosed retention; REQ-7.14.3-10X through REQ-7.14.3-12X cover incident-triggered reviews and supplier-register validation.
Common gaps are concrete: the supplier is named but the service boundary is not; the contract exists but the required security controls are not traceable; the exists but does not show where TSP information is managed or archived.
Before presenting the pack to a customer, assessor, or governance forum, remove unsupported claims. EN 319 401 requires evidence for responsibility, agreements, monitoring, registers, and records. The contract and workflow do not prove that a supplier, service, or TSP conforms without implementation and assessment evidence.
No. Clauses 7.14.1 and 7.14.2 apply broadly to supplied products and services, including ICT and cloud services. Clause 7.14.3 addresses responsibility and agreements when service provision involves , outsourcing, other third-party arrangements, direct suppliers or service providers, or a separately provided . Record which relationship and requirements apply instead of using the labels interchangeably.
Not for the responsibility stated in REQ-7.14.3-01X. When another party provides part of the service, the TSP retains overall responsibility for conformance with its supply chain policy, information security policy, and applicable requirements. The agreement should allocate controls and liability clearly, but it does not erase the TSP's stated responsibility.
Sources (1)
Clauses 7.14.2 and 7.14.3 support the gap checks for supplier monitoring, cloud-service risk policy, downstream security requirements, component controls, and supplier-register maintenance.
How to prepare ETSI EN 319 401 evidence for audit and conformity assessment without overstating what the standard itself assesses.
Build an ETSI EN 319 401 audit evidence pack around records, logs, policies, risk assessment, incident handling, continuity, and supplier evidence.
Build an ETSI EN 319 401 audit evidence pack for trust service providers: risk assessment, practice statement, policies, records, logs, continuity, and supplier evidence.
ETSI EN 319 401 compliance guidance for trust service providers covering legal operation, evidence, accessibility, privacy, records, incidents, continuity, and suppliers.
Plain-language ETSI EN 319 401 answers covering TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence.
Build an EN 319 401 incident and continuity evidence workflow for TSP monitoring, response, reporting, records, backup recovery, and crisis review.
Practical ETSI EN 319 401 V3.1.1 guidance for trust service incident response, reporting, evidence retention, business continuity, and termination planning.
Clause-focused EN 319 401 V3.1.1 guide to TSP personnel duties, trusted roles, asset inventories, classification, and access-control evidence.
ETSI EN 319 401 guidance for TSP policy and security requirements covering risk assessment, practice statements, terms, security controls, incidents, and evidence.
Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls.
Clause-cited ETSI EN 319 401 V3.1.1 guidance for trust service risk assessment, risk treatment, residual-risk approval, and evidence planning.
Practical EN 319 401 guidance for TSP subcontractor controls: retained responsibility, agreements, SLAs, supplier registers, monitoring, and audit evidence.
A scoped workflow for deciding when ETSI EN 319 401 applies to a trust service and what TSP policy, risk, terms, operations, and supplier evidence to collect.
Use ETSI EN 319 401 to decide whether a trust service provider activity falls in the standard's type-independent baseline and what service, policy, risk, supplier, and evidence boundaries to document.
Compare ETSI EN 319 401 V3.2.1 with current eIDAS duties for qualified and non-qualified trust service providers, including risk, incidents, audits, records, and termination.
Compare ETSI EN 319 401 V3.2.1 provider controls with EN 319 403-1 V2.3.1 CAB requirements for audit scope, evidence, sampling, reports, corrective action, and reassessment.
How ETSI EN 319 401 frames CA and RA responsibility: TSP practice statements, management approval, role segregation, subcontractor control, and evidence boundaries.
Understand why old EN 319 401 editions mapped eIDAS Article 19, what replaced it, and how V3.2.1 maps current Article 24 duties.
Understand what ETSI EN 319 401 says, and does not say, about conformity assessment bodies, independent assessment, and TSP evidence preparation.
How ETSI EN 319 401 treats practice statements, terms, network and information systems security policy, evidence records, and change review.
How ETSI EN 319 401 treats subcontractors, outsourcing, supplier agreements, SLAs, monitoring, evidence, and retained TSP responsibility.
How ETSI EN 319 401 V3.2.1 expects TSPs to detect, classify, respond to, report, document, test, and review security incidents.
How to scope ETSI EN 319 401 for a trust service provider: service boundaries, trust service policy, practice statement, terms, risks, and third-party components.