Skip to main content

NL-SYS-05: Accreditation requirements for CABs

NL-SYS-05: Accreditation requirements for CABs

Download PDF (2.6 MB, 30 pages)Read the full text
Cover page of the document, as printed
Document referenceNL-SYS-05
VersionRC1.1
StatusRelease Candidate
Date31/10/206 (as printed on the cover)
Document typeFramework document
Parent frameworknone
Scheme OwnerKingdom of the Netherlands Minister of Economic Affairs
Certification targetEuropean Digital Identity Wallets and the electronic identification scheme under which they are provided
Primary audienceSystem/Scheme Owner, CABs, EUDI Wallet providers, PID Provider
Secondary audienceEUDI Wallet ecosystem stakeholders
Assurance levelHigh/High
Subsidiary DocumentsNL-TL, NL-FS-*, NL-CS-*, NL-PW-* and NL-PP-*
How to read this page

This page summarises the document. Every statement points to the section and page of the authoritative PDF it comes from: click a reference such as §6.1, p. 10 to open that page. If this summary and the PDF differ, the PDF applies.

What this document is​

The document is intended to support national accreditation bodies (Regulation (EU) 765/2008) in applying ISO/IEC 17065 "with extensions" for the accreditation of CABs participating in the NL EUDI Wallet Certification Scheme (§Introduction, p. 6). It does not repeat ISO/IEC 17065 requirements but follows its structure, and it incorporates requirements on audit of management systems from ISO/IEC 17021-1 and ISO/IEC 27006-1, with ETSI EN 319 403-1 "also be taken into account" (§Introduction, p. 6). It contains requirements for competence, consistent operation and impartiality of CABs performing evaluation and certification of European Digital Identity Wallets under Regulation (EU) 2024/2981, in addition to ISO/IEC 17065 and ISO/IEC 17025 where relevant (§1, p. 7).

Scope and object of certification​

  • Scope: CABs (CAB-CB and CAB-ITSEF) evaluating and certifying European Digital Identity Wallets (§1, p. 7).
  • Applicability of extensions: extensions to ISO/IEC 17065 apply to all schemes (NL-TL, NL-FS, NL-CS, NL-P-P/W); EUCC-related extensions apply to NL-CS, "with limitation to the general software and network device area of competence"; extensions referring to ETSI EN 319 403-1 apply only to NL-P-P/W; Clause 9 extensions to ISO/IEC 17025 apply to CAB-ITSEF for NL-FS and NL-CS (§1, p. 7).
  • Object of certification per CIR (EU) 2024/2981 art 3(3): the software components (incl. settings and configurations) of the wallet solutions and of the electronic identification scheme; the hardware components and platforms on which they run or rely for critical operations (where provided directly or indirectly and required for the desired level of assurance); and the processes supporting provision and operation of a wallet solution, including user onboarding under Article 5a of Regulation (EU) 2024/1183, covering at least enrolment, electronic means management and organisation per sections 2.1, 2.2 and 2.4 of Annex I to CIR (EU) 2015/1502 (§7.1.1, p. 16).

Who it applies to​

  • National accreditation bodies — the document supports them in accrediting CABs (§Introduction, p. 6); both CAB types "shall be accredited by a national accreditation body appointed pursuant to Regulation (EC) No 765/2008" (§1, p. 7). During the accreditation process, CAB activities are performed under the supervision of the NAB and the Scheme Owner and “should be witnessed by the NAB” (§10, p. 26).
  • CAB-CB — accredited to ISO/IEC 17065 for the relevant schemes (§1, p. 7); subject to the extensions in §4–§8 and Annex A (§4–8, p. 11-24; Annex A, p. 27-30).
  • CAB-ITSEF — accredited to ISO/IEC 17025 "in specific schemes" (§1, p. 7); for NL-FS and NL-CS within the scope resulting from the characteristics of the object of certification (§9, p. 25).
  • Top-level CAB-CB — responsible for granting, suspending and withdrawing the right to use the mark of conformity (§4.1.3, p. 11).
  • Applicant / Certificate Holder — must, upon request, make all information and documentation demonstrating continued compliance available to the CAB-CB, the System Owner or the Supervisory Authority "without delay" (§4.1.2, p. 11); must be aware of and accept the risk that a CAB in transition may not ultimately be accredited (§10, p. 26).
  • Scheme Owner — informed of outsourced evaluation activities (§6.2.2, p. 15); notified of certificate issuance, termination, suspension and withdrawal (§7.8, p. 20); receives unresolved complaints and appeals (§7.13, p. 23); supervises CABs during accreditation (§10, p. 26).
  • NL National eID Certification System Owner and NL-TL Scheme Owner — receive certification reports; the System Owner ensures custody over all certification-related evidence (§4.5, p. 12).
  • Supervisory Authority — notified of certificate issuance, termination, suspension and withdrawal (§7.8, p. 20); ensures that a Wallet Provider's top-level certificate is notified to the European Commission under Article 5d of Regulation (EU) 2024/1183 (§7.1.3, p. 17).
  • Wallet Providers — must hold a valid top-level certificate to be active in the national EUDI scheme (§7.1.3, p. 17).
  • Each actor within a scheme — must hold valid certification for its role, and for each product or service where it performs multiple roles (§7.1.3, p. 18).

Contents​

No.TitleContentStart page
—IntroductionPurpose and relation to ISO/IEC 17065, 17021-1, 27006-1, ETSI EN 319 403-16
1ScopeCAB types, accreditation standards and applicability of extensions per scheme7
2ReferencesLegal basis, normative references, peer documents, subsidiary documents8
3Terms and DefinitionsReference to NL-SYS-02 and five specific terms10
4General requirementsLegal/contractual matters, impartiality, liability, non-discrimination, confidentiality, public information11
5Structural requirementsISO/IEC 17065 5.1 and 5.2 apply13
6Resource requirementsPersonnel competence (6.1) and internal/external resources for evaluation (6.2)14
7Process requirementsObject of certification, framework (Table 1), hierarchy (Figure 1), scheme process, application to complaints (7.1–7.13)16
8Management system requirementsISO/IEC 17065 8.1–8.8 apply24
9Additional provisions regarding accreditation requirements for CAB-ITSEFISO/IEC 17025 accreditation and extensions for NL-FS and NL-CS25
10TransitionCAB activity during the accreditation process26
Annex ACompetence requirements for the EUDI Wallet CertificationFoundational principles (A.1) and competence framework A.2.1–A.2.1027

Key points​

Accreditation per CAB type and scheme

  • CAB-CB: accredited in accordance with ISO/IEC 17065 for the relevant certification schemes (§1, p. 7).
  • CAB-ITSEF: in specific schemes, accredited in accordance with ISO/IEC 17025 (§1, p. 7); "In NL-FS and NL-CS, CAB-ITSEF accredited to ISO/IEC 17025 are required" (§6.2.2, p. 15).
  • Accrediting body: a national accreditation body appointed pursuant to Regulation (EC) No 765/2008 (§1, p. 7).
  • NL-CS: EUCC-related extensions of ISO/IEC 17065 apply to the CAB-CB, and of ISO/IEC 17025 to the CAB-ITSEF, limited to "the general software and network device area of competence" (§6.1.2, p. 14; §9, p. 25).
  • NL-TL and NL-P-P/W: additional requirements from ETSI EN 319 403-1, 6.1.2 on the audit process and competences apply (§6.1.2, p. 14); requirements of ETSI EN 319 403-1 sections 6.2.1.1–6.2.1.7 and 6.2.1.9 are adopted or adapted, with "TSP"/"trust services" replaced by EUDI Wallet Provider, PID Provider, "EUDI Wallet solution related services" or ISMS terms; 6.2.1.6 applies unchanged (§6.2.1, p. 14-15).
  • The schemes, per Table 1 "Certification system framework": Providing of the EUDI Wallet solution (Service) — NL-TL & NL-WP — Audit — NL-P-P/W-* specifications — EUDI Wallet Provider; The issuing of PIDs to Wallet end users (Service) — NL-PP — Audit — NL-P-P-* specifications — PID Provider; Wallet solution cybersecurity (Product) — NL-CS — IT security evaluation — NL-CS-* specifications — EUDI Wallet Provider; Wallet solution functional (Product) — NL-FS — Testing — NL-FS-* specifications — EUDI Wallet Provider (§7.1.2, p. 17). All schemes are based on ISO/IEC 17065 (§7.1.2, p. 16).
  • For each element of the object of certification the CAB-CB operates a scheme consistent with a Type 5 product certification scheme or a Type 6 service certification (ISO/IEC 17067) (§7.1.4, p. 18).

Competence

  • CAB-CB personnel must have knowledge of the relevant wallet and eID scheme architectures, the specific standards, threats and risks, available security solutions per the Annex to CIR (EU) 2015/1502, functional and cybersecurity certification of components, and applicable national schemes (§6.1.2, p. 14).
  • CAB-CB shall operate a competence management system complying with "ISO/IEC 18896-1" (§6.1.2, p. 14); competence management for NL-FS and NL-CS (CAB-ITSEF) shall comply with ISO/IEC 19896-1 (§9, p. 25).
  • Annex A is normative (§6.1.2, p. 14); its requirements apply to both CAB-CB and CAB-ITSEF unless otherwise stated (§Annex A, p. 27). A.1: CAB-CBs shall demonstrate capability "to perform system-level certification based on heterogeneous assurance inputs, without re-certifying components" (not applicable to CAB-ITSEF) (§A.1, p. 27). A.2 covers interpretation of external certifications; composition and assurance integration (evidence integration, dependencies and trust analysis, composition risk management); regulatory mapping and coverage analysis; technical cybersecurity competence (incl. vulnerability assessment, penetration testing, ISMS assessment, cryptography and key management, "high attack potential"); lifecycle and supply chain assurance; ICT services and operational security (ISMS aligned with EN ISO/IEC 27001, NIST CSF 2.0, CIS Critical Security Controls, ETSI standards; NIS2); reporting and justification; impartiality; stakeholder coordination and coordinated vulnerability disclosure; continuous assurance (CAB-CB evaluates residual risks at EUDI Wallet level, not applicable to CAB-ITSEF) (§A.2, p. 27-30).
  • CAB-ITSEF specific: evaluate Security Targets and Protection Profiles; perform vulnerability assessment and devise and perform penetration tests; evaluate cryptographic mechanisms and key management; produce structured, traceable technical reports; cooperate with CAB-CB in post-certification activities (§A.2, p. 27-30).

Certification hierarchy and top-level certificate

  • Certification follows a hierarchy of top-level certification supported by subsidiary scheme-level certifications (Figure 1 "Certificate Composition") (§7.1.3, p. 17).
  • The top-level certificate covers the Wallet Provider Certificate (with the offered Wallet Solutions), the Wallet Provider's compliance with the admission criteria and the PID-provider Certificate (§7.1.3, p. 17).
  • The CAB-CB may rely on scheme-level certifications as assurance information per NL-SYS-01, shall verify their validity and scope "and shall not re-evaluate requirements already covered" (§7.1.3, p. 18).
  • The top-level certificate "shall not be issued or maintained unless all elements of the object of certification specified in section 7.1.1 are covered by valid certificates" (§7.1.3, p. 18).

Process extensions

  • Marks: "Only the mark of conformity defined in NL-TL applies. No additional marks of conformity shall be used under NL-FS, NL-CS or NL-P-P/W certification schemes" (§4.1.3, p. 11).
  • Application review: CAB-CB verifies existence, validity and scope of required certificates from other schemes; if NL-FS/NL-CS processes are in progress it determines, based on the Applicant declaration, whether this restricts starting the process under NL-PW, and if NL-WP/NL-PP processes are in progress whether this restricts starting NL-TL, recording the basis for its determination (§7.3, p. 18-19).
  • Outsourcing: CAB-CB may outsource evaluation activities provided that subcontractors comply, where applicable and appropriate, with ISO/IEC 17025 (conformity testing and IT security evaluations) or ISO/IEC 17021-1 (auditing); full responsibility is retained; appropriate measures are in place under the CAB-CB accreditation, including reliance on CAB-ITSEF accreditation in NL-FS and NL-CS; and procedures are established for the timing and method of informing the Scheme Owners of outsourced evaluation activities (§6.2.2, p. 15).
  • Certification documentation must contain, among others, a unique identification code, name and version of the object, name of the eID scheme and Member State, applicant details and website link, CAB-CB details, name of the Scheme Owner, references to Regulation (EU) 910/2014 and "Regulation (EU) 2024/2981", reference to the public certification report, standards and versions used, scope incl. limitations, name of the provider, and the assurance level; a new document after changes retains the original expiry date (§7.7, p. 19-20).
  • Surveillance includes verification of holder compliance and continued conformity, uses information from NABs, market surveillance authorities, audits and complaints, and may include special evaluations limited to the triggering issue (§7.9, p. 20-21).
  • Changes: the CAB-CB re-evaluates after scheme revisions or new standards/specifications, and after other changes such as adding/removing a provider, changes in provider identity or legal status, material architecture or enrolment/identity-proofing changes, significant security incidents, suspension or withdrawal of associated component certificates, or material changes to the scheme risk register (§7.10, p. 21).
  • Suspension and withdrawal: suspend "without undue delay" once a reported security breach or compromise affects compliance; withdraw a suspended certificate if corrective actions are not completed in an appropriate timeframe; withdraw if a vulnerability is not resolved in a timely manner; suspension or withdrawal of NL-FS, NL-CS or NL-PP/WP certification with no alternative certified wallet solution, or the Scheme Owner being unable to demonstrate continued compliance with NL-SYS-01 and/or NL-TL governance requirements, are also grounds (§7.11, p. 22).
  • Records are retained in accordance with NL-SYS-01, section 5.10 (§7.12, p. 22); unresolved complaints or appeals are forwarded to the Scheme Owner (§7.13, p. 23).
  • CAB-ITSEF confidentiality: ISMS certification covering laboratory activities is "considered sufficient" (§9, p. 25).
  • Transition: in the context of an accreditation process a CAB-CB or CAB-ITSEF may engage in the required activities under the supervision of the NAB and the Scheme Owner, which “should be witnessed by the NAB”; issuing certificates requires that the CAB-CB is accredited (§10, p. 26).

Specific terms (§3.2, p. 10)

  • competence; assurance continuity ("an approach implemented in the certification system to maintain an assurance baseline in a certified object"); assurance baseline; major change ("change that affect assurance baseline of the EUDI Wallet Solution"); minor change ("change that does not affect assurance baseline of the EUDI Wallet Solution").

Process​

The certification process to be operated by the CAB-CB for each element of the object of certification; §7.1.4 lists items II–VI, and §7.2–7.3 cover application and application review (§7.1.4, p. 18; §7.2–7.3, p. 18-19):

  1. Application (ISO/IEC 17065 7.2) and application review (ISO/IEC 17065 7.3), including verification of the existence, validity and scope of certificates required under other schemes (Applicant, CAB-CB) (§7.2–7.3, p. 18-19).
  2. II. Determination of characteristics, through testing and audit (CAB-CB) (§7.1.4, p. 18; §7.4, p. 19).
  3. III. Review of the information and result of the evaluation (CAB-CB) (§7.1.4, p. 18; §7.5, p. 19).
  4. IV. Decisions on certification, granting, maintaining, extending, reducing, suspending and withdrawing certification (CAB-CB) (§7.1.4, p. 18; §7.6, p. 19).
  5. V. Attestation, licensing, issuing a certificate and granting the right to use certificates and marks (CAB-CB); notification of issuance to the Scheme Owner and Supervisory Authority (CAB-CB) (§7.1.4, p. 18; §7.7–7.8, p. 19-20).
  6. VI. Surveillance, evaluation of the operation of the process and audit of the management system (CAB-CB) (§7.1.4, p. 18; §7.9, p. 20-21).

Requirements in this document​

No requirement identifiers in a scheme-wide format. Paragraphs are numbered 1–131. Extensions to ISO/IEC 17065 carry sub-clause numbers mirroring ISO/IEC 17065 clauses; 37 such numbered extension clauses appear: 4.1.2.1; 4.1.3.2; 6.1.2.1–6.1.2.4; 6.2.1.1–6.2.1.7 and 6.2.1.9; 6.2.2.1; 7.7.2; 7.8.1; 7.9.1–7.9.5; 7.10.1–7.10.8; 7.11.1–7.11.5; 7.12.1; 7.13.1 (§4–7, p. 11-23). Annex A competence requirements are grouped as A.1 and A.2.1–A.2.10 (with sub-items such as A.2.2.1) (§Annex A, p. 27-30). Clauses 4.1.1, 4.3, 4.4, 4.6, 5.1–5.2, 6.1.1, 6.1.3, 7.2, 7.6 and 8.1–8.8 state only that the ISO/IEC 17065 requirements apply (§4–8, p. 11-24).

Notes on this draft​

  • Cover date reads "31/10/206" (§cover, p. 2).
  • §2.2 reads "For dated references, only the edition cited applies, the latest edition of the referenced documents (including any amendments) applies" (undated-reference clause missing) (§2.2, p. 8).
  • §2.3 lists "NL-SYS-01. PL EUDI Wallet Certification system" (§2.3, p. 8).
  • §6.1.2.2 requires compliance with "ISO/IEC 18896-1" (§6.1.2, p. 14), while §2.2 and §9 reference ISO/IEC 19896-1 (§2.2, p. 8; §9, p. 25).
  • §6.2.1 skips 6.2.1.8 and contains "sections 6.2.1.7 and 6.1.8" and "sections 6.2,1.9" (§6.2.1, p. 15).
  • Table 1 footnote: "For full list of specifications – see NL-SYS-NL" (§7.1.2, p. 17); no such document is listed.
  • Scheme names vary: NL-WP, NL-PW, NL-PP, NL-PP/WP, NL-P-P/W, NL-TS (§4.5, p. 12; §7.1.2, p. 17; §7.3, p. 18-19; §7.11, p. 22).
  • §7.1.4 list starts at "II." (no item I) (§7.1.4, p. 18); §7.7 list skips items g) and l) and ends with an unlettered bullet "the assurance level." (§7.7, p. 19-20).
  • §7.7 refers to "WZ-03-01, Section 5.1.4, and WZ-03-03, Section 5.1.4" and to "each GP-series document" (§7.7, p. 19-20); these documents are not among the NL documents listed in §2.
  • §7.7 i) cites "Regulation (EU) 2024/2981" (elsewhere a Commission Implementing Regulation) (§7.7, p. 19).
  • §7.10.1 (changes) refers to ETSI EN 319 403-1 sections 7.4.0–7.4.7 (§7.10, p. 21).
  • §7.10.4 refers to "NL-SYS-03, Section 8.11" (§7.10, p. 21); NL-SYS-03 section 8 ("Complaint Handling") has no subsections (cross-reference: (NL-SYS-03 §8, p. 18)).
  • §4.1.3 states that the mark of conformity is "defined in NL-TL" (§4.1.3, p. 11); NL-TL states that the mark is defined in NL-SYS-03 (cross-reference: (NL-TL §6.6, p. 12)).
  • §7.1.3 paragraph 63 contains "the conformity of and the Digital Identity Wallets and the and the electronic identification scheme" (§7.1.3, p. 17-18); paragraph 66 reads "if their valid certification is lacking" (§7.1.3, p. 18).
  • §6.1.2 introduces a list with "CAB-CB shall ensure and verify that they have knowledge of: detailed and technical knowledge of…" (§6.1.2, p. 14).
  • Figure 1 "Certificate Composition" (p.17) is the "NL Certification System – v1" diagram also used as Figure 2 in NL-SYS-01: functional, cybersecurity, Wallet Provider and PID Provider certification boxes, an "Admission / Authorization" box enclosing the Wallet Provider box, and arrows up to "NL-TL – NL Top Level EUDIW Cert Scheme" (§7.1.3, p. 17) (cross-reference: (NL-SYS-01 §1, p. 6)).
  • Annex A A.2.6.1 reads "Asses the evaluation of operational environments" (§A.2.6.1, p. 29).

Sources​