Skip to main content

NL-P-P: PID Provider Certification Scheme

NL-P-P: PID Provider Certification Scheme

Download PDF (2.6 MB, 39 pages)Read the full text
Cover page of the document, as printed
Document referenceNL-P-P
VersionRC1.1
StatusRelease Candidate
Date27/10/206 (as printed on the cover)
Document typeCertification Scheme Scheme Specification (EN ISO/IEC 17067)
Parent frameworkNL-SYS-01, NL-SYS-02, NL-SYS-03, NL-SYS-04, NL-SYS-05
Scheme OwnerKingdom of the Netherlands Minister of Economic Affairs
Certification targetEuropean Digital Identity PID Providers (and the Wallet Solutions provided)
Primary audienceScheme Owners, CABs, EUDI PID Providers
Secondary audienceEUDI Wallet ecosystem stakeholders
Assurance levelHigh/High
Subsidiary DocumentsNL-P-01, NL-P-02, NL-P-03, as well as NL-P-P04 and NL-P-P04b
How to read this page

This page summarises the document. Every statement points to the section and page of the authoritative PDF it comes from: click a reference such as §6.1, p. 10 to open that page. If this summary and the PDF differ, the PDF applies.

What this document is​

NL-P-P specifies the PID Provider Certification Scheme, one of the Certification Schemes within the NL EUDI Wallet Certification System, and defines the Certification Scheme (in the sense of ISO/IEC 17067) that the accredited and authorized Certification Body (CAB) shall apply when certifying the NL PID Provider (§1, p. 6). It establishes the evaluation methodology (by reference to normative Annex B), the service requirements (in the subsidiary documents) and the conformity assessment procedures (§2, p. 7). It is primarily addressed to the CAB; the PID Provider should read it with the applicable NL-P-* subsidiary documents, which specify the requirements it shall meet (§1, p. 6).

Scope and object of certification​

  • The scheme is for the PID Provider that is to be certified as the "foundational trust anchor" of the Dutch National eID Scheme ("Stelsel") (§2, p. 7).
  • "The object of certification is the PID Provider, comprising the organizational arrangements and processes of the PID Provider that are related to the issuance and lifecycle management of the PID to certified wallets of respective citizens" (§2, p. 7).
  • The object of certification encompasses all services supporting controlled issuance and lifecycle management of PIDs and "transversal services that support the trust in the overall eID national scheme (like user dashboard and notification in order to combat fraud)" (§2, p. 7).
  • §6.1: the object of certification is "the PID Provider that issue PIDs in the NL National eID scheme (“stelsel”), as referred to in Article 5c(1) of Regulation (EU) 2024/1183"; the certification covers both the scheme-level governance arrangements and the operational services provided by the PID Provider (§6.1, p. 11).
  • Annex B describes the object of certification as "the electronic identification system, elated services and processes" (Annex B, B.2, p. 27) and "The electronic identification system and related services defined by NL-P-P" (Annex B, B.3.2 Table 1, p. 28).
  • Evaluation scope: services related to provision and operation of PID Issuance and Lifecycle Management in the NL national eID scheme; as a minimum NL-P-01, NL-P-02, NL-P-03, NL-P-P04 and NL-P-P04b (the latter including transversal fraud-combating services such as user dashboard and notification) (§7.2, p. 14).
  • Material outsourced or subcontracted services are in scope (§7.2, p. 14); external assurance evidence may reduce the CAB's own evaluation activity but not the certification scope (§7.2, p. 14).

Who it applies to​

  • Scheme Owner: owns and supervises the scheme, authorises CABs, maintains the certificate register and monitors the scheme (ISO/IEC 17067) (§6.2.1 Table 2, p. 11). Attends the kick-off meeting (§8.3.1, p. 18); is notified of issued certificates and of suspension, termination or withdrawal and updates the Certificate Register (§8.7, p. 20; §8.10, p. 22); decides on suspension extensions (§8.10, p. 22); may impose contractual arrangements (§8.13, p. 22; §9.2, p. 24).
  • CAB: plans, performs and documents the evaluation; issues the certification decision and certificate; manages surveillance and recertification (ISO/IEC 17065; NL-SYS-05) (§6.2.1 Table 2, p. 11). Accredited by the National Accreditation Body under ISO/IEC 17065 with a scope covering NL-P-P and subsidiary documents (§6.2.2, p. 12). "In the context of NL-P-P certification scheme only a certification body that is accredited and also authorized under Dutch law is eligible as CAB" (§6.1, p. 11). Implements impartiality mechanisms per ISO/IEC 17065 (§6.3, p. 12).
  • Applicant / Certificate Holder: submits the eID scheme for certification, provides evidence, complies with post-certification obligations including surveillance cooperation and change notification (normative basis NL-P-P) (§6.2.1 Table 2, p. 11).
  • PID Provider: shall document its rationale in a comprehensive manner where it considers a CIR 2024/2690 "where appropriate/applicable/to the extent feasible" requirement not appropriate, applicable or feasible (§7.5, p. 16); may request termination of the certificate (§8.10, p. 22).
  • National Accreditation Body (NAB): accredits CABs under ISO/IEC 17065 (Regulation (EC) No 765/2008) (§6.2.1 Table 2, p. 11).
  • Market Surveillance Authorities: oversight of certified services; "This role will be performed by the NL-TL Scheme Owner" (§6.2.1 Table 2, p. 11).
  • Wallet Providers: certified under NL-P-W, co-exist in the same National eID Scheme and rely on the PID provider to provide a PID to their certified and admitted wallets (§6.4, p. 12). A suspension or revocation of the NL-P-P certificate has an immediate effect on their top-level certificates (§6.7, p. 13; §8.11, p. 22).
  • Audit roles (Annex B): Audit Team, Audit Team Leader, Technical Expert, with "Provider" defined as "PID Provider" (Annex B, B.3.2 Table 1, p. 28).

Contents​

  • 1 Foreword — positions NL-P-P in the NL EUDI Wallet Certification System (p.6).
  • 2 Scope — the PID Provider as foundational trust anchor and object of certification (p.7).
  • 3 Legal Basis — EU legal instruments and placeholder for NL law (p.8).
  • 4 References — standards, parent, peer and subsidiary documents (p.9).
  • 5 Terms and Definitions — refers to NL-SYS-02 Vocabulary (p.10).
  • 6 Certification Scheme Structure — object, roles, impartiality, relationship to NL-P-W and to subsidiary documents, scheme type, marks of conformity (p.11).
  • 7 Evaluation Framework — scope, methods, evidence, proportionality, re-use of assurance evidence, evaluation criteria (p.14).
  • 8 Certification Process — phases, efforts, certificate, surveillance, recertification, suspension/withdrawal, implications of NL-P-P certificate changes, and sections 8.12-8.14 on national legislation, contracts and costs (p.18).
  • 9 Final provisions — national legislation, certification contracts, costs (p.24).
  • Annex A (Normative) — Allocation of legal requirements to subsidiary documents (p.25). Read
  • Annex B (Normative) — Audit framework (p.27). Read
  • Annex C (Normative) — Minimum contents of an audit plan (p.37). Read
  • Annex D (Normative) — Minimum contents of an audit evidence record (p.38). Read
  • Annex E (Normative) — Evaluation results matrix (p.39).

Key points​

  • Scheme type: Type 6 model of EN ISO/IEC 17067, in accordance with Article 4(3)(a) of CIR (EU) 2024/2981 (§6.6, p. 13).
  • Applicable requirement documents (Table 1): NL-P-01 Organisational and technical requirements for Wallet & PID providers; NL-P-02 Essential Entity Cyber Resilience Requirements; NL-P-03 Development & Vulnerability Mngt Requirements; NL-P-P04 PID Issuance & Lifecycle Mngt Requirements; NL-P-P04b Fraud Mngt Requirements (§6.1 Table 1, p. 11). They "constitute the normative substance of the eID Certification Scheme" (§6.5, p. 12).
  • How each applies: NL-P-01 management and operational requirements; NL-P-02 cyber resilience "in the spirit of NIS2"; NL-P-03 development and vulnerability management "in the spirit of the CRA"; NL-P-P04 requirements during PID issuance and lifecycle events "to ensure PIDs are issued and remain under control of the correct citizen"; NL-P-P04b fraud resistance of the service and the overall NL national eID scheme (§6.5, p. 12).
  • Marks: "The PID provider will not carry any mark of conformity. But any suspension or revocation will have an immediate effect on the top-level certificates of all Wallet Providers in the NL national eID scheme" (§6.7, p. 13).
  • Evaluation methods: document review, interview, observation, technical testing, sampling (§7.3, p. 15).
  • Evidence includes server-side audit trails and logs from the live operational environment (back-end systems for PID and attestation issuance and revocation, event logging, interfaces) and "valid certificates for the (Qualified) eSealing services it uses and/or QeSCDs it operates" (§7.4, p. 15).
  • Proportionality: CIR 2015/1502 Section 2.4 requirements are commensurate to risks at assurance level High; CIR 2024/2690 requirements are applied according to the PID Provider's risk exposure (Article 2(2)) (§7.5, p. 16). The CAB considers the risk register (NL-SYS-04) when determining depth and focus (§7.5, p. 16).
  • Accepted external assurance evidence: ISO/IEC 27001 certificates (ISO/IEC 17021-1 accredited body, Dutch Accreditation Body); ETSI EN 319 411-1/-2 certificates; certificates or reports under European or national cybersecurity schemes (such as EUCC); other recognised reports meeting §7.7 (§7.6, p. 16). Criteria: issuer competence and impartiality, scope adequacy, timeliness, rigor and depth, findings and exceptions; ISO/IEC 27001 alone is not sufficient for the specific controls (§7.7, p. 16-17).
  • Audit model: initial and re-assessment audits "should normally comprise Stage 1 and Stage 2" (Annex B, B.11.1, p. 33); Stage 1 documentation and readiness review; Stage 2 implementation and operational effectiveness (Annex B, B.11.2-B.11.3, p. 33-34); the sequence may be adapted where justified and permitted by NL-SYS-05 and the audit plan (Annex B, B.11.1, p. 33); Stage 1 results shall be documented and used to finalise the Stage 2 plan, and potential nonconformities identified during Stage 1 shall be treated as areas of concern until supported by sufficient evidence (Annex B, B.11.2, p. 33); surveillance and special audits "can use a targeted, risk-based sequence rather than the full Stage 1 and Stage 2 model" (Annex B, B.11.4, p. 34).
  • Sampling shall be risk-based and documented (Annex B, B.8.2, p. 31); multi-site sampling only under common control and management framework (Annex B, B.8.3, p. 31).
  • Applicability: each requirement in the assessment matrix is determined Applicable or Not applicable (rationale for exclusion documented and accepted); a not-applicable requirement is not assigned a conformity assessment result (Annex B, B.12.1, p. 34).
  • Requirement-level results (Annex B, B.12.2 Table 3, p. 34):
    • Conforming: sufficient and appropriate objective evidence demonstrates fulfilment of the specified requirement.
    • Major nonconformity: a non-fulfilment of a specified requirement that has a substantial security impact and/or a substantial impact on the ability of the object of certification to achieve the intended service or process outcome.
    • Minor nonconformity: a non-fulfilment that does not have any substantial security impact and does not have any substantial impact on the ability of the object of certification to achieve the intended service or process outcome.
    • Not concluded - insufficient evidence: sufficient and appropriate evidence was not available to determine conformity; "shall not be treated as conformity and shall be resolved before a positive audit recommendation is issued in relation to the applicable scope".
  • Observations (positive or negative) may be recorded in addition; an observation "may not replace a conformity assessment result and shall not, by itself, constitute a failure to meet a requirement" (Annex B, B.12.3, p. 35). The Audit Team shall not issue the certification decision; it is made by the CAB (Annex B, B.12.4, p. 35).
  • Major nonconformities shall be corrected and closure verified before a positive certification recommendation or decision; minor nonconformity timeframes are agreed per NL-P-P, "G-SYS-05" and CAB procedure; the framework "does not establish an independent fixed deadline" (Annex B, B.14, p. 35). For each nonconformity the Applicant or Certificate Holder shall provide correction, root-cause analysis, corrective action, responsible owner, target date and evidence of completion, as appropriate to its significance; the CAB evaluates the adequacy of proposed corrective actions and determines the verification activities required for closure (Annex B, B.14, p. 35).
  • Special audits shall be initiated by the CAB in case of significant changes, security incidents, complaints, failure to implement corrective actions or other information relevant to continued conformity (Annex B, B.15, p. 36).
  • Certification process phases: preparation and application phase, evaluation phase, certification phase (§8.1, p. 18).
  • Time limits: kick-off no later than 10 working days after a complete application (§8.3.1, p. 18); certification decision and informing the Applicant within 5 working days; certificate issued no later than 14 working days after a positive decision (§8.4, p. 19); complaint against a negative decision within 14 working days, final CAB decision within 14 working days of receipt (§8.4, p. 19); Scheme Owner notified of issued certificate within five working days (§8.7, p. 20).
  • Planned CAB effort (initial certification; maximum and planned, changeable by agreement with the Scheme Owner): Evaluation 30 working days; Certification 15 working days (§8.5 Table 3, p. 19).
  • Certificate valid for four years from issuance (§8.6, p. 19); certificate states validity "not to exceed four years" (§8.7, p. 20).
  • Certificate content: object of certification; scope with explicit reference to each NL-P-P subsidiary document; name of the PID Provider; "the version(s) of the wallet solutions in scope"; validity period; conditions, limitations or exceptions (§8.7, p. 20).
  • Surveillance: annual throughout the validity of the certificate, including at a minimum review of material changes to the PID issuance & lifecycle management services and/or NL national eID scheme fraud detection measures, its components or organisational arrangements as notified to the CAB; review of incidents or security breaches as notified to the CAB; review of updates to NL-P-P and subsidiary documents and their implications; targeted evaluation activities determined by the CAB based on the risk register and intelligence gathered; follow-up on non-conformities, observations or conditions previously identified (§8.8, p. 20).
  • Vulnerability assessment at initial evaluation, each recertification and at least every two years during surveillance; additional activities such as penetration testing where the risk level increases or new threats emerge; full evaluation of the object of conformity assessment in the initial evaluation and each recertification evaluation (§8.8, p. 20).
  • Each surveillance within 12 months of issuance and then within 12 months of the previous; recertification within 12 months after the last surveillance activity (§8.8, p. 21).
  • 4-year life cycle (Table 4): Year 0 initial certification (full evaluation of the provisioning of the PID Issuance & Lifecycle Management services and National eID scheme fraud prevention services, including vulnerability assessment; evaluation of the maintenance processes excluding their operating effectiveness; granting of certification and start of the 4-year cycle); Year 1 surveillance (operating effectiveness of the maintenance processes; changes impacting security); Year 2 surveillance (vulnerability assessment of the full solution; operating effectiveness of the maintenance processes; changes impacting security); Year 3 re-certification (full re-evaluation including vulnerability assessment; simplified evaluation for unchanged features/processes; maintenance processes including operating effectiveness; granting a new certification) (§8.8 Table 4, p. 21).
  • Recertification: initiated before expiry, follows the initial process, may rely on surveillance evidence; also required on a major change (including wallet solution version not covered, organisational change, or material change to the NL-SYS-03 Trust Framework); Applicant notifies the CAB no later than six months before expiry (§8.9, p. 21).
  • Suspension grounds: corrective actions not implemented in agreed time after a surveillance nonconformity; notified significant incident or breach that can impact conformity (pending impact assessment); failure to cooperate with or give access for surveillance (§8.10, p. 21-22). Corrective-action timeframe agreed in writing and documented in the Surveillance Report (§8.10, p. 22).
  • Suspension period shall not exceed 45 days; extension subject to Scheme Owner decision, "may not exceed one 90 days"; suspension does not affect validity (§8.10, p. 22).
  • Withdrawal: failure to remedy suspension conditions in time; confirmed nonconformity not remediable in reasonable time. Termination on request of the PID Provider. In all cases of suspension, termination or withdrawal the CAB shall notify the Scheme Owner without undue delay (§8.10, p. 22).
  • Implications: "Any suspension or revocation of the NL-P-P will have an immediate effect on the top-level certificate of active wallet providers in the NL eID scheme, as per consequence of the composition of certificates in the NL Certification System" (§8.11, p. 22).
  • Information exchange CAB-Applicant secured with state-of-the-art cryptographic mechanisms approved by the Scheme Owner (list maintained per NL-SYS-03 Section 9.2.2) (§8.6, p. 19).
  • Appeals and complaints follow NL-SYS-01 (§8.4, p. 19). Costs are based on actual certification efforts (§8.14, p. 23; §9.3, p. 24).

Process​

  1. Applicant: submits, before evaluation, a description of the PID Provider's environment and systems; documentation of compliance with NL-P-P subsidiary documents; valid certificates for any (Qualified) eSealing services it has and/or QeSCDs it operates to e-seal PIDs; any external assurance evidence; the completed CAB application form. The application may be separate or combined with other schemes per NL-SYS-01 (§8.2, p. 18).
  2. CAB, Applicant and Scheme Owner representatives: kick-off meeting no later than 10 working days after a complete application; CAB agrees the evaluation plan with the Applicant (§8.3.1, p. 18).
  3. CAB (Audit Team): evaluation per §7 and Annex B (Stage 1, Stage 2), documented in an Evaluation Report (§8.3.2, p. 18-19; Annex B, B.11, p. 33). CAB notifies substantial findings without undue delay; Applicant may respond within the agreed timeframe (§8.3.2, p. 19).
  4. Applicant / CAB: nonconformity correction; major nonconformities closed before a positive decision (Annex B, B.14, p. 35).
  5. CAB: decision and informing the Applicant within 5 working days; certificate no later than 14 working days after a positive decision (§8.4, p. 19).
  6. Applicant / CAB: complaint within 14 working days of a negative decision; CAB final decision within 14 working days (§8.4, p. 19).
  7. CAB: notifies the Scheme Owner within five working days of issuance (§8.7, p. 20).
  8. CAB: annual surveillance (§8.8, p. 20-21).
  9. Applicant / CAB: recertification, notified at least six months before expiry (§8.9, p. 21).
  10. CAB / Scheme Owner: suspension, withdrawal or termination; Scheme Owner updates the Certificate Register (§8.10, p. 22).

Requirements in this document​

  • The subsidiary documents "constitute the normative substance of the eID Certification Scheme" (§6.5, p. 12); requirements applicable specifically to the PID Provider "are located in the subsidiary documents and are not separately listed in this Annex" (Annex A, p. 25).
  • Annex A allocates legal requirements using identifiers REQ-910-01 to -06 (Regulation (EU) 2024/1183, 6), REQ-1502-2.1 to -2.4.7 (CIR 2015/1502, 9), REQ-2977-3 and -5 (CIR 2024/2977, 2), REQ-2979-3,4 / -6,7 / -9,13 (CIR 2024/2979, 3), REQ-2981-4 / -5 / -8(3)(g) / -19 (CIR 2024/2981, 4), REQ-2690-Annex (CIR 2024/2690, 1) (Annex A, p. 25-26).
  • Annex E results codes: C / Major NC / Minor NC / N/E / OBS; applicability Applicable / N/A; reliance Full / Partial / None (Annex E, p. 39).

Notes on this draft​

  • Cover date reads "27/10/206" while the title page reads 2026.10.31 and version RC1.1 is dated 2026-10-31 in the history (cover, p. 2; p. 1; history, p. 3).
  • Certification target reads "European Digital Identity PID Providers (and the Wallet Solutions provided)" (cover, p. 2).
  • Placeholder: "[Placeholder for references to NL national law when available]" (§3, p. 8).
  • Sections 8.12 National legislation, 8.13 Certification contracts and 8.14 Costs duplicate the text of 9.1, 9.2 and 9.3 (§8.12-8.14, p. 22-23; §9, p. 24).
  • §6.5 refers to "NL-P-P04/W04b" and ends "his/her walle.." (§6.5, p. 12).
  • Text referring to wallets, or repeating "PID Provider": certificate content includes "the version(s) of the wallet solutions in scope" (§8.7, p. 20); recertification triggers include "a change of wallet solution version" (§8.9, p. 21); risk-register focus is on "risks arising from the integration of their Wallet(s) with the NL PID-provider" (§7.5, p. 16); evidence list says "PID Provider, PID Provider and Scheme Owner personnel" (§7.4, p. 15).
  • Surveillance list contains two near-identical items on updates to NL-P-P and subsidiary documents (§8.8, p. 20).
  • Annex A contains repeated allocation text ("NL-P-P04 / NL-P-P04B and NL-P-P04 / NL-P-P04B" for REQ-910-03 and REQ-910-05) and the references "NL-W-P04B" (REQ-910-04) and "NS-FS" (REQ-910-01, -02, -03, -05) (Annex A, p. 25).
  • §7.7 NOTE 1 refers to "Clauses II and III"; the document has no clauses numbered II or III (§7.7, p. 17; table of contents, p. 4-5).
  • Annex B refers to "Criteria-specific WM-03-0x documents" and "G-SYS-05", which are not listed in the references of §4 or B.3.1 (Annex B, B.10.1, p. 33; B.14, p. 35; §4, p. 9; B.3.1, p. 27); paragraph 140 in B.7 ends with the incomplete sentence "Criteria-specific" (Annex B, B.7, p. 30); paragraph number 189 is printed beside the word "matters.", which completes the sentence of paragraph 188 (Annex B, B.11.5, p. 34).
  • The term "CAB-CB" is used in §8.8 and §8.10 alongside "CAB" (§8.8, p. 20; §8.10, p. 22).
  • Suspension extension wording: "may not exceed one 90 days" (§8.10, p. 22).
  • Validity is four years while Table 4 places re-certification in Year 3 (§8.6, p. 19; §8.8 Table 4, p. 21).

Sources​