ETSI EN 319 411-2 eIDAS QTSP supervision workflow

Start each supervision review by naming the exact qualified certificate service: natural-person certificate, legal-person certificate, QSCD-backed certificate, or qualified website authentication certificate. Record the issuing TSP, CA hierarchy, certificate policy identifier, CP/CPS versions, subscriber terms, repository location, and certificate population in scope.

This boundary matters because EN 319 411-2 builds on EN 319 411-1 and EN 319 401. A supervision pack should not mix non-qualified CA evidence with qualified certificate evidence unless it shows which inherited Part 1 or EN 319 401 requirement is being reused.

Run this gate before any material change to qualified certificate issuance, certificate profiles, CA hierarchy, QSCD handling, revocation/status services, repository publication, subcontracted service components, or termination planning. EN 319 401 maps eIDAS supervision to changes in qualified trust-service provision and to intentions to cease those activities.

The review should decide whether the change is only a CP/CPS maintenance item, an assessment item, a subscriber or relying-party notice item, or a matter for supervisory-body contact. When the source does not define the exact national filing channel, leave the channel blank and route it to the qualified-service compliance owner instead of inventing one.

When a security breach or loss of integrity may significantly affect the qualified certificate service or personal data maintained in it, open an incident evidence pack immediately. EN 319 411-2 maps eIDAS Article 19 incident notification to certificate-service security clauses, and EN 319 401 points incident reporting toward supervisory authorities and other relevant bodies.

Do not treat the incident review as a generic security ticket. The pack should identify the trust service affected, certificates or repositories affected, relying-party impact, personal-data impact, known start time, awareness time, containment status, notification decision, and whether subscribers or affected persons also need notice.

Before assessment or supervisory review, confirm that relying-party evidence is current. EN 319 411-2 says relying-party notices should explain that the trust anchor for relying on a certificate as an EU qualified certificate is the service digital identifier in an appropriate EU trusted-list entry for the QTSP.

Also verify continuity evidence. EN 319 411-2 includes requirements for revocation status information beyond certificate validity and maps eIDAS qualified-provider requirements to record retention, certificate databases, revocation publication, and termination planning. A termination or status-service gap should block the workflow until the responsible owner documents the corrective action.

The workflow is complete only when the reviewer can hand the assessor or supervisory liaison a compact evidence set. EN 319 411-2 points to ETSI TR 119 411-4 for a conformity assessment checklist, so keep requirement identifiers visible rather than replacing them with informal task names.

Close the record with the decision, source clauses used, evidence files, gaps, owner, next review trigger, and whether a supervisory-body contact, conformity-assessment follow-up, subscriber notice, relying-party notice, or CP/CPS publication update remains open.