A workflow for assembling EN 319 411-2 qualified certificate obligations and records into a supervision evidence pack for assessment leads, compliance owners, and supervisory-body liaisons.
Use it to organize operational evidence. Confirm jurisdiction-specific legal, contractual, and policy requirements before implementation; the evidence pack does not prove qualified status by itself.
Structured answer sets in this page tree.
Cited legal and guidance references.
This workflow is relevant when a needs to show how an EU qualified certificate service is controlled, monitored, and ready for assessment or supervisory follow-up. The page focuses on evidence that EN 319 411-2 actually supports: qualified certificate policy identifiers, CP/CPS and disclosure material, inherited EN 319 411-1 controls, QSCD checks, trusted-list reliance, incident escalation, status services, record retention, and termination planning.
Open one evidence pack per qualified certificate service, not one pack for an entire PKI estate. Name the issuing qualified TSP, CA or RA components in scope, certificate policy identifier, CP and CPS versions, PKI disclosure statement, subscriber terms, repository location, and certificate population covered by the review.
EN 319 411-2 defines qualified certificate policies for natural persons, legal persons, QSCD-backed certificates, and qualified website authentication certificates. The supervision file should therefore show exactly which profile is claimed and which EN 319 411-1 baseline controls are inherited.
Use the workflow to assign certificate policy, trusted-list, QSCD, incident, status-service, termination, and assessment evidence before assessor or supervisory review.
Convert QTSP supervision evidence into accountable tasks, evidence requests, and assessment-ready records.
Resolve policy, QSCD, incident, trusted-list, status-service, or termination questions against cited ETSI material.
Review EN 319 411-2 supervision evidence, owners, unresolved gaps, and next actions with Sorena.
Use a trigger log so changes do not disappear into policy edits. A trigger should be opened when the qualified certificate service changes, when the QSCD route changes, when a trusted-list or status-service dependency changes, when a breach or loss of integrity may affect the service, when termination is planned, or when an assessor raises a finding.
The log should separate three decisions: whether the CP/CPS or disclosure material must be updated, whether assessment evidence must be refreshed, and whether the event triggers an eIDAS notification. The amended Article 24 requires at least one month's advance notice before a change in qualified-service provision and at least three months' advance notice before cessation. Commission Implementing Regulation (EU) 2025/2530 identifies significant changes to policies, terms, architecture, hosting, cryptography, registration, governance, termination, financial resources or insurance, trusted-list data, and third-party arrangements. The notice record should contain the change, planned date and time, reasons and supporting evidence where applicable, and updated documents where applicable. Record the national filing channel as a local compliance field.
Treat the supervision pack as a row-level evidence register. Each row should name the claim, source requirement, evidence artifact, owner, review result, and assessor or supervisory relevance. This prevents a CP/CPS statement such as 'qualified certificate' from standing alone without the policy identifier, trusted-list evidence, QSCD route, or status-service proof behind it.
A useful register has enough detail to be reviewed without opening internal systems first. For example, a QSCD-backed QCP-n-qscd row should point to the QSCD certification evidence, key-pair generation evidence, certificate request control, CPS measure for QSCD status changes, and the certificate qcStatement evidence where relevant.
Supervision evidence should include more than normal certificate issuance records. EN 319 411-2 maps eIDAS incident, record-accessibility, certificate-database, revocation, status-information, and termination requirements to standard clauses, while warning that its Annex A is informative and not a definitive legal conformance statement.
For incidents, keep the incident time and awareness time separately, affected service, certificate population, integrity impact, personal-data impact, notification assessment, sent notices, containment result, and post-incident control changes. Current Article 24 measures the 24-hour outer limit from the incident when the significant-impact threshold is met. For retention and termination, Commission Implementing Regulation (EU) 2025/2530 requires a plan for each qualified trust service, review at least every two years and whenever provider or service changes are implemented, coverage of anticipated, unanticipated, partial, and complete termination, and records that remain accessible for legal evidence and validation.
Close the workflow only when each open trigger has a decision and each material claim has evidence. The closeout should be short enough for an assessment lead to use, but specific enough to show which requirement, certificate policy, evidence artifact, and owner support each claim.
EN 319 411-2 references ETSI TR 119 411-4 as a checklist supporting audit of TSPs against EN 319 411-1 or EN 319 411-2. Keep requirement identifiers visible in the evidence register so the assessor can trace from the finding back to the CP/CPS, repository, log, certificate record, or change decision.
"at least three months in case of an intention to cease those activities"
"Changes to the information security policy"
"Policy and security requirements for Trust Service Providers issuing certificates"
"should not be taken as definitive statement of conformance"
"used by the TSP itself to prepare for an assessment"
"within 24 hours of the incident"