A practical evidence workflow for trust service providers that use subcontractors, outsourcers, suppliers, cloud providers, or trust service component providers.
Based on ETSI EN 319 401 V3.1.1 clauses on policies, supplier relationships, records, and supply-chain responsibility. Use it as implementation guidance and validate it against the applicable service policy, assessment scheme, contracts, and law.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this workflow when another party provides part of a trust service or supplies a product, ICT service, cloud service, or that supports it. ETSI EN 319 401 V3.1.1 distinguishes general supplier risk controls from the additional agreement and retained-responsibility duties that apply to , outsourcing, and other third-party service arrangements. Classify the relationship first, then collect the matching evidence.
First classify what the other party provides. Clauses 7.14.1 and 7.14.2 address products and services supplied to the TSP, including the ICT supply chain and cloud services. Clause 7.14.3 adds duties when service provision involves , outsourcing, another third-party arrangement, or a supplied by another party.
When another party provides part of the TSP's service, REQ-7.14.3-01X keeps overall responsibility with the TSP for conformance with its supply chain policy, information security policy, and applicable requirements. The contract may allocate tasks and liability, but it does not transfer that stated responsibility.
Use a branch record rather than one supplier label. An ordinary product or service supplier follows the acquisition and supplier-risk controls. An ICT or cloud dependency also follows ICT supply-chain, cloud-risk, component, and downstream requirement controls where applicable. A party providing part of the trust service also needs the clause 7.14.3 responsibility, agreement, monitoring, and register evidence. A separately provided needs interface and policy-conformance evidence as well.
This EN 319 401 workflow is a shared checklist for supplier scope, agreements, SLAs, monitoring reviews, supplier registers, and retained records.
Convert supplier and subcontractor requirements into accountable tasks, evidence requests, and review milestones.
Use cited ETSI source material to resolve scope, applicability, supplier evidence, and assessment questions before implementation.
Review supplier scope, agreement evidence, monitoring checkpoints, and next compliance actions with Sorena.
Before relying on a supplier or subcontractor, show how the selection and contracting decision applied EN 319 401 criteria. The record should address the supplier's ability to meet the TSP's cybersecurity specifications and the risk and classification levels of what is being delivered.
For , outsourcing, or another third-party service arrangement, keep the documented agreement and contractual relationship that makes both parties' information security obligations clear. Also record the outsourcer's liability, controls required by the TSP, and the controls required when use starts and ends. Do not present an internal preference as a standards duty unless it maps to a requirement.
The approval record should identify the supported service, information and asset classification, critical components, locations where TSP information is managed or archived, downstream providers, control owner, evidence-review method, incident contact, change-notice route, commencement conditions, exit conditions, and residual gaps accepted by the TSP.
Operational evidence should show that supplier controls continue after onboarding. EN 319 401 requires monitoring, review, evaluation, and change management for supplier information security practices and service delivery, including planned reviews and review after incidents related to supplier-provided services.
For ICT suppliers, the workflow should also preserve evidence that security requirements are propagated through subcontracted ICT services, that supplier product or service components critical to functionality are identified, and that the TSP has acceptable methods for validating that ICT products and services conform to stated cybersecurity requirements.
This workflow is the operating table for a subcontractor evidence pack: Step | Owner | Evidence | Decision.
1 | Service owner | Supplier scope note, supported trust service, and component/service description | Does this relationship provide or support part of the TSP service?
2 | Procurement and security | Selection criteria, risk/classification fit, and supplier due-diligence record | Can the supplier meet the TSP's cybersecurity specifications and risk requirements?
3 | Legal and control owner | Agreement, liability terms, required controls, SLA or auditing mechanism, and start/exit controls | Are both parties' information security obligations clear enough to rely on?
4 | Operations and assurance | Monitoring reviews, change records, incident-triggered reassessments, updates, and retained operational records | Is the supplier evidence still valid for the current service boundary?
5. Change or exit | Service, security, and records owners | termination approval, access and asset actions, information-location update, evidence handover, register update, and replacement or continuity decision | Can the TSP end or change the relationship without losing service control or required evidence?
Retain the supplier file within the TSP's broader record model. EN 319 401 requires relevant information concerning data issued and received by the TSP to remain accessible for an appropriate period, including after the TSP's activities have ceased, for legal evidence and continuity purposes.
Review checkpoints should therefore cover both supplier relationship evidence and operational service evidence. The evidence pack is weak if it only contains the original contract and omits updated supplier reviews, incident follow-up, validation, or records showing where TSP information is managed or archived.
Common gaps are concrete: the supplier is named but the service boundary is not; the contract exists but the required security controls are not traceable; the exists but does not show where TSP information is managed or archived.
Before presenting the pack to a customer, assessor, or governance forum, remove unsupported claims. EN 319 401 requires evidence for responsibility, agreements, monitoring, registers, and records. The contract and workflow do not prove that a supplier, service, or TSP conforms without implementation and assessment evidence.
No. Clauses 7.14.1 and 7.14.2 apply broadly to supplied products and services, including ICT and cloud services. Clause 7.14.3 addresses responsibility and agreements when service provision involves , outsourcing, other third-party arrangements, direct suppliers or service providers, or a separately provided . Record which relationship and requirements apply instead of using the labels interchangeably.
Not for the responsibility stated in REQ-7.14.3-01X. When another party provides part of the service, the TSP retains overall responsibility for conformance with its supply chain policy, information security policy, and applicable requirements. The agreement should allocate controls and liability clearly, but it does not erase the TSP's stated responsibility.