ETSI EN 319 411-1 CP vs CPS under ETSI EN 319 411-1
A focused FAQ for certification authorities separating Certificate Policy commitments from Certification Practice Statement implementation evidence under ETSI EN 319 411-1.
Use it to align certificate policy identifiers, subscriber-facing documentation, CPS ownership, and audit evidence without exposing confidential operating procedures.
Under ETSI EN 319 411-1 V1.5.1 (April 2025), a (CP) describes what certificate requirements and applicability rules are being adhered to; a (CPS) describes how the certificate-issuing TSP implements those requirements in its organization, procedures, facilities, and systems. Edit the CP when the policy claim or applicability changes. Edit the CPS when implementation changes. A combined CP/CPS is allowed, but the two functions still need to be distinguishable. EN 319 411-1 is a technical standard. A conformity-assessment scheme, contract, browser program, or applicable law can make a policy operative and add stricter requirements.
Side-by-side comparison
Certificate Policy vs Certification Practice Statement
Compare CP and CPS responsibilities under ETSI EN 319 411-1 by purpose, ownership, publication, certificate linkage, evidence, and update triggers.
States how the CA operates its service to meet those policy requirements, including implementation practices for issuing, managing, revoking, renewing, or re-keying certificates.
A CP review or update is triggered when the claim changes: the policy OID, applicability rules, certificate profile requirements, assurance level, adopted ETSI policy basis, or the subscriber and relying-party community described in the CP.
A CPS review or update is triggered when the TSP changes how it implements the CP: registration procedures, identity validation methods, revocation handling, repository practices, key-management controls, external support arrangements, or any practice relying parties or subscribers depend on.
Distinguish between a policy change (edit CP) and an implementation change (edit CPS). When a CP change affects applicability, EN 319 411-1 says the should change.
Can reference lower-level operational procedures, while the published CPS can omit confidential internal details not useful to subscribers or relying parties.
Review when operational practices change, including registration, revocation, repository availability, key management, RA delegation, external support, or security controls.
A CP can be defined by the TSP or by another policy-setting body. The TSP identifies the policies it supports and communicates the applicable policy through subscriber and relying-party documentation and, where used, the identifier.
The TSP management body has final authority to approve the practice statement. EN 319 411-1 requires the CPS to be disclosed online on a 24x7 basis, while allowing sensitive details to remain confidential. Changes that may affect service acceptance require due notice under EN 319 401.
Apply the approval process belonging to the CP's actual owner; separately confirm TSP management approval, publication, maintenance responsibility, and change notice for the CPS.
The CP and CPS both need controlled identification so readers and assessors can tell which policy and implementation versions apply. A CP may be standalone or included in the CPS or terms and conditions.
The CPS should remain consistent with the supported CP, certificate profiles, RA scope, and certificate lifecycle controls. EN 319 411-1 says the CPS should follow the IETF RFC 3647 structure, but it does not impose that structure on every CP.
Edit the CP when the claim itself changes: the policy OID, the applicability rules, the certificate profile requirements, the assurance level, the use restrictions, or the adopted ETSI policy basis such as LCP, NCP, DVCP, OVCP, IVCP, or EVCP.
Edit the CPS when the CA changes how it implements the CP: registration procedure, identity validation method, revocation handling, repository publication practice, key management control, external support arrangement, management approval process, or any practice that subscribers or relying parties depend on.
States how the CA operates its service to meet those policy requirements, including implementation practices for issuing, managing, revoking, renewing, or re-keying certificates.
A CP review or update is triggered when the claim changes: the policy OID, applicability rules, certificate profile requirements, assurance level, adopted ETSI policy basis, or the subscriber and relying-party community described in the CP.
A CPS review or update is triggered when the TSP changes how it implements the CP: registration procedures, identity validation methods, revocation handling, repository practices, key-management controls, external support arrangements, or any practice relying parties or subscribers depend on.
Distinguish between a policy change (edit CP) and an implementation change (edit CPS). When a CP change affects applicability, EN 319 411-1 says the should change.
Can reference lower-level operational procedures, while the published CPS can omit confidential internal details not useful to subscribers or relying parties.
Review when operational practices change, including registration, revocation, repository availability, key management, RA delegation, external support, or security controls.
A CP can be defined by the TSP or by another policy-setting body. The TSP identifies the policies it supports and communicates the applicable policy through subscriber and relying-party documentation and, where used, the identifier.
The TSP management body has final authority to approve the practice statement. EN 319 411-1 requires the CPS to be disclosed online on a 24x7 basis, while allowing sensitive details to remain confidential. Changes that may affect service acceptance require due notice under EN 319 401.
Apply the approval process belonging to the CP's actual owner; separately confirm TSP management approval, publication, maintenance responsibility, and change notice for the CPS.
The CP and CPS both need controlled identification so readers and assessors can tell which policy and implementation versions apply. A CP may be standalone or included in the CPS or terms and conditions.
The CPS should remain consistent with the supported CP, certificate profiles, RA scope, and certificate lifecycle controls. EN 319 411-1 says the CPS should follow the IETF RFC 3647 structure, but it does not impose that structure on every CP.
Edit the CP when the claim itself changes: the policy OID, the applicability rules, the certificate profile requirements, the assurance level, the use restrictions, or the adopted ETSI policy basis such as LCP, NCP, DVCP, OVCP, IVCP, or EVCP.
Edit the CPS when the CA changes how it implements the CP: registration procedure, identity validation method, revocation handling, repository publication practice, key management control, external support arrangement, management approval process, or any practice that subscribers or relying parties depend on.
How should a CA decide whether to edit the CP or the CPS?
Edit the CP when the claim changes: applicability, certificate profile, assurance level, use restriction, or adopted ETSI policy basis. Change the when the CP change affects applicability.
Edit the CPS when the CA implementation changes: procedure, control, repository practice, validation method, revocation handling, external support arrangement, approval, or publication practice.
Review both documents after new certificate profiles, RA delegation changes, CA key lifecycle changes, external support changes, or audit findings that affect either the policy or its implementation.
Keep the CP and CPS traceable to each other by version: the CPS should name the CP it implements, and each CP clause should map to a CPS clause or an internal procedure reference.
What is the practical difference between a CP and a CPS?
The CP is the policy layer. It identifies the , quality level, profile, applicability, and requirements that apply to a certificate service or certificate community. ETSI EN 319 411-1 notes that a CP can be defined by the TSP, ETSI, a government, customers, or another community, and that it can be standalone or included within practice statements or terms and conditions.
The is the implementation layer. It is owned by the TSP issuing certificates and explains how that TSP operates the service, including the technical, organizational, and procedural practices used to meet the CP. The CPS can point to lower-level operating procedures, but those detailed procedures may remain confidential when they are internal and proprietary.
Use the CP to state the being followed, including policy identifiers, applicability, certificate profile expectations, and any adopted ETSI policy such as LCP, NCP, NCP+, DVCP, OVCP, IVCP, or EVCP where relevant.
Use the CPS to explain how the CA implements the CP through registration, issuance, revocation, repository, key-management, security, and records practices.
Keep subscriber and relying-party documentation clear enough to show which CP applies and where the CPS, terms, or disclosure statement explain implementation details.
Defines the CP/CPS relationship for certification authorities: CP states what certificate policy requirements apply, while the CPS states how the TSP implements and maintains them.
Supports the trust-service practice statement obligations for approval, availability, maintenance responsibilities, external supporting organizations, and change notice.
Question 2
How should a CA keep CP and CPS evidence aligned?
Start with a traceability map from each applicable CP requirement to the CPS clause, operating record, or confidential procedure that implements it. This is especially important where certificates carry a CP identifier, because relying parties may use that identifier to judge certificate suitability and trustworthiness.
Do not publish sensitive operating details just to prove alignment. ETSI EN 319 411-1 allows low-level operational procedures to remain internal; the public CPS can be limited to information useful for subscribers, subjects, and relying parties, with confidential evidence available for process review.
Record the CP identifier, certificate type, target subscribers or subjects, relying-party use, and certificate profile assumptions.
Link each CP commitment to the CPS clause that explains the CA practice and to the evidence record that proves the practice operated during the review period.
Separate public CPS wording from internal procedures such as access lists, location details, task assignments, HSM handling steps, and audit logs.
Defines the CP/CPS relationship for certification authorities: CP states what certificate policy requirements apply, while the CPS states how the TSP implements and maintains them.
Update the CP when the policy itself changes: certificate applicability, certificate profile requirements, assurance level, adopted ETSI policy basis, or the community rules that subscribers and relying parties rely on. EN 319 411-1 says the should change when a CP change affects applicability; it does not say that every editorial CP revision requires a new OID. Update the CPS when the TSP changes how it implements the policy, such as identity validation processes, revocation handling, repository availability, RA arrangements, CA key controls, or supporting organizations.
ETSI EN 319 401 also expects a management body to approve the practice statement, responsibilities for maintaining it to be defined, and revised practice statements to be made available after approval. If a CPS change may affect acceptance of the service by subjects, subscribers, or relying parties, notice is part of the governance work.
Treat CP changes as policy-governance changes that may affect certificate claims, policy identifiers, subscriber terms, relying-party expectations, and audit scope.
Treat CPS changes as operational-governance changes that need approval, version control, publication handling, and evidence that the changed practice is actually in use.
Review CP/CPS alignment after new certificate profiles, RA delegation changes, revocation-process changes, CA key lifecycle changes, external support changes, or audit findings.
Defines the CP/CPS relationship for certification authorities: CP states what certificate policy requirements apply, while the CPS states how the TSP implements and maintains them.
Supports the trust-service practice statement obligations for approval, availability, maintenance responsibilities, external supporting organizations, and change notice.
Supports the trust-service practice statement obligations for approval, availability, maintenance responsibilities, external supporting organizations, and change notice.
Defines the CP/CPS relationship for certification authorities: CP states what certificate policy requirements apply, while the CPS states how the TSP implements and maintains them.