Skip to main content

NL-SYS-01: NL EUDI Wallet Certification System

NL-SYS-01: NL EUDI Wallet Certification System

Download PDF (3.4 MB, 41 pages)Read the full text
Cover page of the document, as printed
Document referenceNL-SYS-01
VersionRC1.1
StatusRelease Candidate
Date31/10/206 (as printed on the cover)
Document typeFramework document
Parent frameworknone
Scheme OwnerKingdom of the Netherlands Minister of Economic Affairs
Certification targetEuropean Digital Identity Wallets and the electronic identification scheme under which they are provided
Primary audienceSystem/Scheme Owner, CABs, EUDI Wallet providers, PID Provider
Secondary audienceEUDI Wallet ecosystem stakeholders
Assurance levelHigh/High
Subsidiary DocumentsNL Certification System Documents
How to read this page

This page summarises the document. Every statement points to the section and page of the authoritative PDF it comes from: click a reference such as §6.1, p. 10 to open that page. If this summary and the PDF differ, the PDF applies.

What this document is​

NL-SYS-01 is "a high-level framework that explains the EUDI Wallet certification system, ensuring its conformity with related regulations" (§1, p. 5). The certification system is based on the concept and content of the certification system described in ISO/IEC 17067 (§1, p. 5). It aims to provide interested parties with information on top-level certificate issuance for European Digital Identity Wallets and the NL electronic identification scheme under which they are provided, in accordance with Regulation (EU) 2014/910 modified by 2024/1183 Article 5d(1) (§1, p. 5). It gives an overview of how the structure of schemes and its elements are nested and meet the requirements of the relevant standards and regulations, to reach a top-level European Digital Identity Wallet certification (§4.2, p. 15).

Scope and object of certification​

  • The NL EUDI Wallet Certification System addresses the object of certification defined in CIR 2024/2981, art. 3(2) and 3(3) (§4.2, p. 14).
  • It consists of the general approach of assessing the conformity of European Digital Identity Wallets and the electronic identification scheme under which they are provided as defined in CIR 2024/2981 (§4.2, p. 14).
  • The legally required overall certification of "the digital identity wallet and the eID scheme under which the wallet is provided" is defined as one top-level scheme composing certificates from three distinct subordinate certification schemes: the European Digital Identity Wallet Functional Certification Scheme, the European Digital Identity Wallet Cybersecurity Certification Scheme (both labelled "NL-CS series" in the text), and the National eID Scheme Certification Scheme (NL-P-P and NL-P-W series) (§4.2, p. 14-15).
  • The object of certification under CIR 2024/2981 art. 3(3) is mapped to the schemes as follows: software components by NL-FS-series, NL-CS-series (incl. the Wallet Instance FITCEM PP and WSCA PP) and resilience requirements in the NL-P-P/W-series; hardware components by "a Protection Profile for WSCD, certified externally"; processes that support provision and operation of a wallet solution referenced in CIR (EU) 2015/1502 by the NL-P-P/W-series, notably "Wallet Onboarding & LifeCycle Management" and "PID-issuance and lifecycle management" (§7.1, p. 29).
  • Under "Certification System v1" only HSM-based architectures are accepted: the Wallet Instance runs on a mobile platform that meets established conditions and interacts with a Wallet Provider Backend where the HSM-based WSCA/WSCD run; and the Wallet Instance complies with the Wallet Instance FITCEM PP and the WSCA CC PP as defined under the NL-CS-series (§Annex B, p. 39).

Who it applies to​

  • System Owner — "Top-level governance body of the certification system"; owner: Minister of Economic Affairs (in close concertation with Minister of the Interior) (§3.1.1, p. 9). Responsibilities: define the overall rules of the certification system; define the overall evaluation methods and requirements; maintain and update system documentation and make it available to all relevant stakeholders; ensure the overall system complies with ISO/IEC 17067 and legal requirements; notify the certification system to the EDICG for opinions and recommendations; cooperate with other EU Member States operating an EUDI Wallet certification system "to ensure a level playing field towards a future EU certification system" (§3.1.1, p. 9). Performs periodic reviews of the certification system and the schemes operating under it (§5.11, p. 24).
  • Top-Level Scheme Owner — governance of the Top Level Certification Scheme; owner: Minister of Economic Affairs (in close concertation with Minister of the Interior) (§3.1.2, p. 9). Responsibilities: define elaborate scheme requirements; maintain scheme-specific documentation and make it available; ensure compliance with NL Certification System rules/methods/requirements; supervision of certification activities; compliance of certified services with national and EU legal frameworks; post-certification monitoring, particularly following incidents or vulnerabilities (§3.1.2, p. 9). The roles of System Owner and Top-Level Scheme Owner "can be combined" (§3.1.2, p. 9). Publishes a list of certified EUDI Wallet solutions with the information specified in CIR (EU) 2024/2981 Annex V and keeps it accurate and current (§4.1, p. 14).
  • Subordinate Scheme Owners — governance of subordinate certification schemes for specific products or services (§3.1.3, p. 10). For some subordinate schemes individual CABs may propose their own scheme if legal requirements allow and the scheme fully complies with the NL Certification System, top-level scheme and set requirements; where EUCC is available and mandated, the legal ownership of the EUCC scheme applies (§3.1.3, p. 10). Responsibilities: define practical scheme details and operations; maintain scheme-specific documentation; ensure compliance with the NL Certification System and all overarching schemes; supervision of certification activities; post-certification monitoring (§3.1.3, p. 10).
  • All Scheme Owners (Top-Level and subordinate) — see the obligations in §4.1 listed under Key rules (§4.1, p. 13-14).
  • National Accreditation Body (NAB) — "Ensures trust and competence of Conformity Assessment Bodies (CABs)"; accredits CAB-CB according to ISO/IEC 17065 "or other standards, if required by the scheme"; accredits CAB-ITSEF according to ISO/IEC 17025 in respective certification schemes; verifies competence, impartiality and consistent application of certification rules; acts under Regulation 765/2008 (§3.1.4, p. 10).
  • Conformity Assessment Body (CAB-CB) — "Performs or subcontracts conformity assessment activities"; conducts or subcontracts evaluations, audits or testing; produces or validates test reports, evaluation reports and certification documentation; supports decision-making on conformity findings (§3.1.5, p. 10). Footnote: in EUCC two types of CABs are recognised, CAB-CB (certification bodies) and CAB-ITSEF (testing laboratories) (§4.3, p. 17).
  • Conformity Assessment Body (CAB-ITSEF) — "Performs evaluation or testing activities"; conducts evaluations or testing; produces test reports, evaluation reports and evaluation documentation; supports the CAB-CB decision-making (§3.1.6, p. 11).
  • Applicant / Certificate Holder — an entity seeking certification or possessing the certificate, "Typically, the EUDI Wallet provider, PID provider or their subcontractors and suppliers"; submits the application; provides all required technical, procedural and security documentation; continuously maintains conformity including post-certification obligations (§3.1.7, p. 11). Each applicant/holder is responsible for the costs of the certification process and maintenance of its own certificate (§3.1.7, p. 11).
  • Wallet Provider — must, for the top-level certificate, satisfy the applicable requirements of the scheme, provide the required underlying certificates and demonstrate that it meets the national admission-conditions set in National law (§1, p. 5); when applying for the top-level certificate it submits all relevant certificates and certification reports of the subordinate schemes (§5.2, p. 19).
  • PID Provider — must hold an active certificate for the top-level certificate to be issued (§1, p. 7).
  • European Digital Identity Cooperation Group (EDICG) — EU-level coordination and harmonisation; supports consistent implementation across Member States; facilitates cooperation between national authorities incl. supervision, incident handling and cross-border interoperability; provides guidance for uniform application of certification-related requirements; assists the European Commission in monitoring and improving the functioning of the European Digital Identity ecosystem (§3.1.8, p. 11).
  • Supervisory Authority (SA) — "Supervisory and oversight function, according to EU and national law"; responsibilities: supervision of Trust Framework (see NL-SYS-03); cross-border cooperation and notification processes (§3.1.9, p. 11-12). "SA may not be merged with the System/Scheme Owner role. Different organizational units of the Ministry of Digital Affairs have been assigned to these roles." (§3.1.9, p. 11).
  • Users of an EUDI Wallet — may appeal certification decisions (§5.9, p. 23).

Contents​

No.TitleContentStart page
1IntroductionPurpose, ISO/IEC 17067 basis (Figure 1), set of certificates (Figure 2) and its explanation5
2Legal and normative documentsEU legal acts and standards the system demonstrates compliance with; placeholder for NL law8
3Governance and stakeholder relationshipsRoles and responsibilities of nine stakeholders (3.1.1–3.1.9)9
4Mandatory elements of the scheme definition based on ISO/IEC 17067Scheme ownership duties (4.1), scope and scheme structure with Figure 3 (4.2), ISO/IEC 17067 elements a)–t) with Table 1 (4.3)13
5Scheme life cycle managementCAB participation, certification process rules, external assurance evidence, surveillance, holder obligations, changes (Figure 4), non-conformities, suspension/withdrawal, complaints/appeals, records, periodic review, maintenance19
6Conformity assessments methods, specifications, and reporting overviewRequired method elements, mandatory report elements, scheme template table25
7Conformity analysisArticle-by-article mapping to CIR (EU) 2024/2981 (7.1) and to Cybersecurity Act Art. 54(1) (7.2, Figure 5)28
Annex AConformity assessment methods and techniquesISO/IEC 17000-based terms, evaluation methods, types of attestation37
Annex BDescription of supported Wallet Solution architectures in the Dutch national wallet certification systemHSM-based architecture rule, Figure 6 modular decomposition and module table39

Key points​

Certification system architecture and document hierarchy

  • The system is a layered, modular architecture in which functional, cybersecurity and eID certification schemes "combine to form the overall EUDI Wallet Provider Certificate (which will be issued per Wallet Provider)" (§1, p. 6).
  • Functional certification of the Wallet Solution covers wallet functionality per Regulation (EU) 2014/910 modified by 2024/1183 and Implementing Acts, plus onboarding flow and PID issuance flow requirements; activities "mostly consist of product evaluation with functional testing" (§1, p. 6).
  • Cybersecurity certification of the Wallet Solution consists of at least two external components: 1) the WSCA certificate and the WSCD certificate, both following EUCC, and 2) cybersecurity evaluation of the Wallet Unit (Wallet Instance with WSCA/WSCD) based on a FITCEM evaluation scheme (EN 17640:2022); activities "mostly consist of product evaluation with security testing" (§1, p. 6).
  • Wallet provider certification and PID provider certification cover technical, procedural and organisational requirements for these providers outside the product certifications; activities "mostly consist of process evaluation and auditing" (§1, p. 6).
  • The NL Top Level Certification is "the certificate The Netherlands needs to provide to Europe for each combination of wallet and eID-scheme (PID-provider)"; it "can only be issued if and the PID Provider has an activate certificate and the Wallet Provider has an active certificate and the Wallet provider demonstrates that it meets the national admission-conditions as set in National law" (§1, p. 7).
  • All underlying certificates and underlying certification schemes "shall comply with ISO/IEC 17067 and ISO/IEC 17065" (§1, p. 5).
  • Document hierarchy per Figure 3 (§4.2, p. 15):
    • System Framework: NL-SYS-01 Certification system; NL-SYS-02 Vocabulary; NL-SYS-03 Organization and support for the owner of the national EUDI certification scheme; NL-SYS-04 Developing and maintaining the risk register for EUDI Wallet implementation and certification; NL-SYS-05 Accreditation requirements for CABs.
    • TL Certification Scheme: NL-TL – National Top-Level EUDIW Scheme.
    • Subordinate Schemes: EUDI Wallet Solution Functional Certification Scheme (NL-FS); EUDI Wallet Solution Cybersecurity Certification Scheme (NL-CS); eID Scheme Certification Scheme Wallet Provider (NL-P-W); eID Scheme Certification Scheme PID Provider (NL-P-P).
    • Scheme requirements: under NL-FS: NL-FS-PP Issuance Requirements, NL-FS-Wallet Presentation Requirements; under NL-CS: NL-CS-WSCA NL WSCA CC Protection Profile, NL-CS-WI NL Wallet Instance FITCEM Protect.Profile; shared by NL-P-W and NL-P-P: NL-P-01 Organisational and technical requirements for Wallet & PID providers, NL-P-02 Essential Entity Requirements, NL-P-03 Development & Vulnerability Mngt Requirements; NL-P-W04 Wallet Onboarding & Lifecycle Mngt Requirements (NL-P-W); NL-P-P04 PID Issuance & Lifecycle Mngt Requirements (NL-P-P).
  • The structure is divided into (a) the Top-Level Scheme, (b) the sub-schemes for Wallet Solution functional certification, Wallet Solution cybersecurity certification and conformity with the National eID scheme rules, and (c) the subordinate specific requirements for each sub-scheme (§4.2, p. 16).
  • ISO/IEC 17067 scheme types: Functional Certification Scheme Type 5; Cybersecurity Certification Scheme Type 5; National eID Scheme Certification Scheme Type 6 (§4.2, p. 15). NL-SYS-01 also states that "the certification scheme is a type 6 scheme for the top-level certificate (NL-TL)" (§7.1, p. 30).
  • NL-FS establishes "one certificate /declaration of conformity for a specific wallet solution as provided by a wallet provider" (§4.2, p. 15); the eID Certification Scheme (NL-P-P/NL-P-W) "will reuse some of the results obtained after performing the respective wallet solution certification (cybersecurity and functional certification)" (§4.2, p. 16).
  • Terms "declaration of conformity, certificate, certificate of conformity" are synonyms in the context of the EUDI Wallet certification scheme; "EUDI wallet" and "European Digital Identity Wallet" are synonyms; "scheme" and "program" are synonyms (ISO/IEC 17000) (§4.3, p. 17; §1, p. 5).

Accreditation (Table 1) (§4.3, p. 16)

  • Main evaluation activities: NL-FS Testing; NL-CS Testing; NL-P-P/W Audit.
  • Accreditation standard for CAB-CB: NL-FS ISO/IEC 17065; NL-CS ISO/IEC 17065 augmented by EUCC program, where applicable; NL-P-P/W ISO/IEC 17065 augmented by ETSI EN 319 403-1 V2.3.1.
  • Accreditation standard for CAB-ITSEF: NL-FS ISO/IEC 17025; NL-CS ISO/IEC 17025 augmented by EUCC program, where applicable; NL-P-P/W "not relevant".
  • Certification shall be performed in compliance with ISO/IEC 17065 (CIR 2024/2981 Art. 9(1)); evaluation techniques include audit, inspection, demonstration and test (§4.3, p. 16).
  • Any CAB must pass an accreditation process within the scope of the relevant scheme and inform the Scheme Owner of its accreditation status and any change without undue delay; in duly justified cases a CAB may start evaluation or certification services according to NL-SYS-05, Section 10 (§5.1, p. 19).

Scheme Owner obligations

  • Under CIR 2024/2981 Art. 3(1) Member States assign a Scheme Owner for each national certification system; the owner of the top-level scheme is the Minister of Economic Affairs (in close concertation with the Minister of the Interior) (§4.1, p. 13).
  • The Top-Level Scheme Owner and subordinate Scheme Owners “need to”, among other things: take on full responsibility for the objectives, content and integrity of the scheme; maintain the scheme and provide guidance when required; set up a structure for its operation and management; document its content; ensure it is developed by people competent in technical and conformity assessment aspects; plan to protect the confidentiality of information provided by the parties involved; "operate and maintain the risk register defined in CIR (EU) 2024/2981"; manage risks/liabilities; approve the scope of subcontracting by the certification body (§4.1, p. 13).
  • Scheme Owners may subcontract a defined part of their tasks to a third party; they shall set out the duties and responsibilities of all parties by contract and shall remain responsible for all subcontracted activities (§4.1, p. 13).
  • Scheme Owners shall monitor the compliance of CAB-CBs with their obligations and shall perform this monitoring, if applicable, at least based on information from CAB-CBs, CAB-ITSEFs, national accreditation bodies and relevant market surveillance authorities (if applicable), their own or another authority’s audits and investigations, and complaints and appeals received (§4.1, p. 13).
  • Scheme Owners inform the NL Certification System / NL-Top-Level Scheme Owner of scheme revisions; where applicable, the latter notifies changes to the EDICG (§4.1, p. 14).

Certification process rules

  • Top-Level Certification of the EUDI Wallet Provider is performed under NL-TL, building on certificates or declarations of conformity from NL-TL, NL-FS, NL-CS, NL-P-P/W (§5.2, p. 19).
  • The CAB-CB shall assess scope and validity of the submitted subordinate certificates and verify that the applicant meets the conditions to be recognised/admitted as a wallet provider under the NL Wallet eID-scheme before issuing a top-level certificate (§5.2, p. 19).
  • External assurance evidence: the CAB-CB records Full, Partial or No reliance per piece of evidence; with partial reliance it performs supplementary evaluation; with no reliance it evaluates the requirement in full; the CAB-CB "remains fully responsible for the certification decision" (§5.3, p. 19-20). Acceptance may not contradict ISO/IEC 17065, 7.4.5 (§5.3, p. 20).
  • The top-level certificate is subject to annual surveillance by the CAB-CB (§5.4, p. 20).
  • Validity period of the top-level certificate and of wallet provider and PID-provider certificates: four years (see NL-TL, NL-P-P/W) (§5.10, p. 23).
  • The retention period of certification records “shall be defined according to relevant legal requirements”, which will include provisions so that records related to NL-TL, NL-P-P/W and NL-FS/CS certification are, in addition to local backups, also given in custody at the Certification System Owner; NOTE 1 recommends a retention period of not less than five years after the certification validity has expired (§5.10, p. 24).

Certificate holder obligations (§5.5, p. 20-21)

  • Comply with European and national legislation incl. CIR 2024/2981; maintain communication channels with CAB-CBs, CAB-ITSEFs and the Scheme/System Owner; make essential information on secure use, certification and updates available to end users; run continual vulnerability identification and handling and cooperate with the CAB-CB and Scheme Owner; publish or reference publicly known vulnerabilities (identifying the vulnerability, affected versions and mitigations, without exploitable details); use the mark of conformity according to NL-SYS-03.

Changes, non-conformities, suspension, appeals

  • Changes affecting the top-level certificate are handled under the CAB-CB's regular change management process; if initiated by the Certificate Holder, the CAB-CB obtains an Impact Analysis Report (IAR); changes resulting from a security incident or vulnerability are handled with respect to the assurance continuity principle (§5.6, p. 21-22).
  • On holder non-compliance the CAB-CB formally notifies the holder, requests clarification and, if insufficient, sets a maximum period "which may not exceed thirty (30) calendar days" to propose corrective measures; on failure the CAB-CB enters the suspension procedure (§5.7, p. 22).
  • Withdrawal or termination on request of the holder is final; withdrawal of the top-level certificate does not automatically invalidate component certificates that remain compliant; a suspended certificate may be reinstated through a formal certification process (§5.8, p. 23).
  • Expiry of one Wallet Provider's or Wallet Solution's top-level certificate has no impact on other certificates under the system (§5.8, p. 23).
  • Any certification decision may be appealed by a relevant stakeholder or by a user of an EUDI Wallet; appeals are handled by the CAB-CB under its public procedures; "The Scheme Owner may not alter CAB decisions"; any stakeholder may submit a complaint to the Scheme Owner about any aspect of the system (§5.9, p. 23).
  • The certification schemes shall contain provisions that all complaints and appeals not resolved by the CAB-CB are sent to the Scheme Owner for assessment and resolution (§4.1, p. 14).

Marks

  • §7.1 cites Requirement 4(4)(b) of CIR 2024/2981 (“National certification schemes shall ensure that only the Trust Mark is used as mark of conformity”) and states as conformity that NL-SYS-03 defines the characteristics of the national mark and the terms and conditions of its use; "The Trust Mark as defined in Commission Implementing Regulation 2024/2981 will be used only for the top-level certificate" (§7.1, p. 30).

Governance and change of the system

  • Periodic review by the NL Certification System Owner (procedures in NL-SYS-03); when reviews (internal or peer review) identify non-compliances, the Scheme Owner initiates the scheme maintenance process (described in NL-SYS-03) (§5.11–5.12, p. 24).
  • New or revised requirements are made available to all stakeholders by the System Owner or Scheme Owner; the CAB-CB communicates changes to its clients and verifies implementation (§5.12, p. 24).

Conformity assessment methods and reports

  • Each method shall define competence requirements, outsourcing conditions ("As a rule, outsourcing is not permitted unless explicitly allowed") and pass/fail criteria (§6.2, p. 25).
  • Mandatory report elements are listed for test reports (ISO/IEC 17025), management system audit reports (ISO/IEC 17021-1) and product/service/process certification documentation (ISO/IEC 17065) (§6.3, p. 25-26).

Relation to eIDAS and CIR 2024/2981 / Cybersecurity Act

  • Section 7.1 maps Articles 1–20 of CIR (EU) 2024/2981 to the NL documents (e.g. Art. 2 → NL-SYS-02; Art. 3(4)/(5) architecture → Annex B; Art. 7 Scheme Owner → §4.1; Art. 9 CAB accreditation → NL-SYS-05; Art. 13–14, 18 → NL-TL, NL-FS, NL-CS, NL-P-P/W; Art. 15 complaints and appeals → "subject to national law") (§7.1, p. 28-34).
  • Section 7.2 states NL-CS is designed to comply with Article 54(1) of the Cybersecurity Act: CC/CEM:2022 release 1 (ISO/IEC 15408:2022/18045:2022) for EUCC parts and EN 17640:2022 for the national part; assurance AVA_VAN.5 for EUCC certifications and "high" (Regulation (EU) 2019/881) for the FITCEM part; self-assessment "is not permitted" (§7.2, p. 34-35). EUCC parts are subject to automatic EU-wide mutual recognition; the national cybersecurity part is "subject to further discussion among Member States" (§7.2, p. 36).

Figures

  • Figure 1 "Certification system concept applied to the national EUDI Wallet schemes" (p.5): ISO 17067-sourced diagram of a "Product certification system" box (rules, procedures, management) containing "Product certification scheme A" and "B" (application of system to particular sets of specified requirements), annotated "Rules & Procedures", "Organisational & Technical Requirements", "Different Schemes possible under the same system" and "Note: Product are linked to Services they provide and vice-versa" (§1, p. 5).
  • Figure 2 "Set of certificates/declarations of conformity resulting from implementation of the national EUDI Wallet certification system" (p.6): titled "NL Certification System – v1"; four boxes — "Wallet Sol Functional Certif. Scheme" (NL-FS – EUDIW Sol. Funct.Cert Framework; items NL 3.1–Scheme v1, NL 3.2–WalletSol.Req, TR 3.3–PID Prov Req, TR3.x), "Wallet Sol CyberSec" (NL-CS – EUDIW Sol. CyberSec.Cert Framework; NL 4.1–Scheme v1 (FITCEM+EUCC) wrt supported architecture; NL 4.2–WI FITCEM PP containing NL 4.3–WSCA CC PP and WSCD), "Wallet Prov Certif." (NL-PW – Provider Cert Framework; NL 5.1–Scheme v1, NL 5.2–OrgReq, TRY.x–Vuln. Mngt, NL 5.3–CyberSec/NIS2, NL 5.4–Wallet Lifecycle, NL 5.x Validatie/Verif., NL 5.x addition. services) and "PID Prov Certif." (NL-PP – Provider Cert Framework; NL 5.1–Scheme v1 (based on NOID PID-issuance), NL 5.2–OrgReq, TRY.x–Vuln. Mngt, NL 5.3–CyberSec/NIS2, NL 5.4–PID Lifecycle, NL 5.x Validatie/Verif., NL5.x status-register). Arrows run from the functional box to an "Admission / Authorization" box that encloses the Wallet Provider box (red items "TRY.x – GDPR-compliance", "Sovereignty Requirements", "Ownership / Financiale stabiliteit"), from the cybersecurity box and (grey) from the PID Provider box to the Wallet Provider box, and from the Wallet Provider box and the PID Provider box up to "NL-TL – NL Top Level EUDIW Cert Scheme", topped by "NL-translation of system to NL-scheme >>" (§1, p. 6).
  • Figure 3 "Structured view of NL EUDI Wallet certification system" (p.15): table of System Framework, TL Certification Scheme, Subordinate Schemes and Scheme requirements as listed above (§4.2, p. 15).
  • Figure 4 "Change management process implemented in the certification system" (p.21): swimlanes EUDI Wallet Provider / CAB / System Owner–Scheme Owner; deployed services → incident/vulnerability or new development → Impact Analysis Report → CAB decision "Re-evaluation required?"; YES → "Assurance Continuity for EUDI Wallet solution or part of it"; NO → "Build + internal testing"; the CAB path "Certificate maintenance" → "Issuing Maintenance report", sent to the System/Scheme Owner (§5.6, p. 21).
  • Figure 5 "TOE concept for NL-CS" (p.35): remote "Wallet provider back-end services" connected via interfaces to a Composite TOE containing Wallet Instance (user mobile device; "FITCEM Assurance level 'high' (National scheme)"), WSCA and WSCD (remote applications and devices; each "CC EAL4/AVA.VAN.5 (EUCC)"); the Composite TOE is evaluated under "FITCEM AMD1 Assurance level 'high' (Composite TOE) (National scheme)" (§7.2, p. 35).
  • Figure 6 "Modular decomposition (independent of exact deployment – eg partially processing at WP-backend)" (p.39): module groups User Interface, Wallet Onboarding, Acquisition/Activation, Capture, Credential Generator, Resilience, Core, Local User Authentication, Verification/Validation, Data, Authentication/Confirmation, Wallet Attestations/Authentication, Presentation and Request Verification modules, over Mobile Device Functions, Mobile Device Secure Element HW and NFC interface; the table on p.39–41 maps 34 modules to the functional decomposition (§Annex B, p. 39-41).

Process​

Top-level certification (as described in NL-SYS-01; details are delegated to NL-TL):

  1. CAB obtains accreditation in the scope of the relevant scheme and informs the Scheme Owner (CAB) (§5.1, p. 19).
  2. Wallet Provider submits the application for the top-level certificate with all relevant subordinate certificates and certification reports (Wallet Provider) (§5.2, p. 19).
  3. CAB-CB assesses scope and validity of those certificates, determines reliance on external assurance evidence (full/partial/none) and verifies the admission conditions under the NL Wallet eID-scheme before issuing a top-level certificate (CAB-CB) (§5.2–5.3, p. 19-20).
  4. Top-Level Scheme Owner publishes the list of certified EUDI Wallet solutions (CIR 2024/2981 Annex V) (Top-Level Scheme Owner) (§4.1, p. 14).
  5. Annual surveillance of the top-level certificate (CAB-CB) (§5.4, p. 20).
  6. Changes: holder notifies CAB-CB with an IAR; CAB-CB decides on re-evaluation; maintenance report sent to the System/Scheme Owner (Certificate Holder, CAB-CB) (§5.6, p. 21).
  7. Non-compliance: CAB-CB notification, clarification, corrective-measure period of at most 30 calendar days, then suspension procedure (CAB-CB) (§5.7, p. 22).
  8. Expiry: CAB informs the Certificate Holder, System Owner and top-level scheme owner of the expiration date and takes action toward re-certification (CAB) (§5.8, p. 23).

Requirements in this document​

No requirement identifiers. Paragraphs are numbered consecutively 1–258 (Annex A uses 239–258); ISO/IEC 17067 elements in §4.3 are lettered a)–t) and Cybersecurity Act elements in §7.2 b)–v) (§4.3, p. 16-18; §7.2, p. 34-36).

  • NL-SYS-02: vocabulary; said to incorporate all definitions from Art. 2 of CIR (EU) 2024/2981 (§7.1.1, p. 28).
  • NL-SYS-03: marks and conditions of use, notification of evaluation and surveillance results, technical vulnerability handling, complaint/appeal cases handled by the Scheme Owner, periodic review and scheme maintenance procedures, Trust Framework supervision (§4.3, p. 17; §5.6, p. 22; §5.9, p. 23; §5.11–5.12, p. 24; §3.1.9, p. 12).
  • NL-SYS-04: methodology for developing and maintaining the risk register (§7.1, p. 29); listed in Figure 3 (§4.2, p. 15).
  • NL-SYS-05: accreditation requirements and competence for CABs; Section 10 start-up rules (§4.3, p. 17; §5.1, p. 19).
  • NL-TL, NL-FS, NL-CS, NL-P-P/W: scheme-specific evaluation methods, certificate content, non-conformity handling, surveillance, contracts, lifecycle and record retention (§4.3, p. 17-18).
  • Standards: ISO/IEC 17067, ISO/IEC 17065 (incl. 7.4.5, 10.1.3), ISO/IEC 17025, ISO/IEC 17021-1, ISO/IEC 17000:2020, ISO/IEC 17029, ISO/IEC 17007, EN 17640:2022 (FITCEM), ETSI EN 319 403-1 V2.3.1, CC/CEM:2022 (ISO/IEC 15408:2022, ISO/IEC 18045:2022), ISO 18013-5 (Offline Presentation module), OID4VP (§1, p. 5; §2, p. 8; §4.2, p. 15; §4.3, p. 16; §5.3, p. 20; §5.12, p. 24; §6.3, p. 25-26; §7.2, p. 34; Annex A, p. 37-38; Annex B, p. 41).
  • EU legal acts: Regulation (EU) 2014/910 modified by 2024/1183 (Art. 5a, 5c, 5d(1), 8, 8(3)); CIR (EU) 2024/2977, 2024/2979, 2024/2982 (functional framework); CIR (EU) 2024/2981 (certification rules); CIR (EU) 2024/482 (EUCC); Regulation (EU) 2019/881 (Cybersecurity Act Art. 54, 55); CIR (EU) 2015/1502; Regulation (EC) 765/2008 (Art. 4 and 5) (§1, p. 5; §2, p. 8; §7, p. 28-36).
  • National law: "[Placeholder for references to NL national law when available]" (§2, p. 8); responsibilities and legal action for fraudulent use of certification are "subject to a dedicated Dutch National Regulation establishing NL EUDI Wallet Certification system" (§7.1, p. 30); "The scheme owner will be designated in a Dutch National Regulation that establishes NL EUDI Wallet Certification System" (§7.1, p. 32).

Notes on this draft​

  • Cover date reads "31/10/206" (§cover, p. 2); the history table dates RC1.1 2026-10-31 (§cover, p. 3).
  • §5.2 ends with an incomplete paragraph 70: "It is" (§5.2, p. 19).
  • §4.2 lists both the functional and cybersecurity schemes as "(NL-CS series)" (§4.2, p. 14); Figure 3 uses NL-FS for the functional scheme (§4.2, p. 15).
  • §4.3 c) lists "NL-TL, NL-FS, NL-FS and NL-P-P/W" (NL-FS repeated, NL-CS missing) as "individual subordinate Certifications Schemes" (§4.3, p. 17).
  • §4.3 d) names the cybersecurity requirement documents "NL-CS-Decomp", "WP-CS-WI" and "WP-CS-WSCA", while Figure 3 names them NL-CS-WSCA and NL-CS-WI (§4.3, p. 17; §4.2, p. 15).
  • Figure 3 labels "NL-FS-PP", "NL-FS-Wallet", "NL-P-W04" and "NL-P-P04" (§4.2, p. 15); Figure 2 uses internal numbering ("NL 3.1", "NL 4.2", "NL 5.x", "TRY.x", "TR 3.3") that does not correspond to document IDs (§1, p. 6).
  • Other inconsistent scheme names: "GP-NLWP/PP Series" (§7.1, p. 28), "NL-WP -series" (§7.1, p. 30), "NL-P-P/W-series03" (§7.1, p. 31), "NLWP/PP" (§7.1, p. 33-34), "NL-CS-02" (§7.2, p. 35), "NL-SYS-and" (§7.2, p. 35), "PN-EN ISO/IEC 17065" (§7.1, p. 33).
  • §5.4 says surveillance follows "the rules specified in NL-SYS-03 certification scheme" (§5.4, p. 20); NL-SYS-03 is listed as a system framework document, not a certification scheme (§4.2, p. 15).
  • Scheme type: §4.2 assigns Type 5/Type 5/Type 6 to the three sub-schemes (§4.2, p. 15), and §7.1 states the scheme "is a type 6 scheme for the top-level certificate (NL-TL)" and that "The certification processes are defined in NL-FS, NL-CS and NL-P-P/W" (§7.1, p. 30).
  • §3.1.9 says different organisational units "of the Ministry of Digital Affairs" are assigned to the SA and System/Scheme Owner roles, while §3.1.1–3.1.2 assign the System Owner and Top-Level Scheme Owner to the Minister of Economic Affairs (§3.1.1–3.1.9, p. 9-11).
  • The validity period (four years) is stated in §5.10 "Retention of records" (§5.10, p. 23); the retention period itself is left to "relevant legal requirements", with five years only "recommended" (§5.10, p. 24).
  • "NOTE23" label (§5.8, p. 23); "NOTE 2" in §5.12 without a NOTE 1 numbered as such (§5.12, p. 24); typos "activate certificate", "iuth", "te National eID scheme" (§1, p. 7; §4.2, p. 16).
  • §7.2 i) reads "along with specific procedures in defines the conditions…" (referenced document missing) (§7.2, p. 35).
  • §7.1 states for CIR Art. 15 (complaints and appeals) only "subject to national law" (§7.1, p. 33).
  • Annex B: the module table lists "SICZ … Obtains and uses Wallet Unit Attestations" and "WUC … Handles Wallet Unit Attestations", while Figure 6 expands SICZ as "Wallet Signature Initialization Component" (§Annex B, p. 39, 41).

Sources​