Skip to main content

External sources

The Dutch scheme documents build on standards, frameworks and requirement sets published by others. This page lists them, shows where the documents use them, and links to the official sources. Most ISO, CEN and ETSI standards are paid. For those, the link goes to the publisher's catalogue page.

The editions are the ones cited in the documents. Where the publisher has since replaced an edition, this is noted, as shown on the publisher's page on 9 November 2026. For the EU regulations, see legal basis.

Cybersecurity of the Wallet Solution (NL-CS)​

OWASP Mobile Application Security (MAS)​

The required test set of the cybersecurity certification is built on OWASP MAS. The documents name OWASP MASVS v2.1.0, MASWE v1.0, MASTG, the MAS testing profiles (baseline L2 + R + P) and the OWASP MAS EUDI Wallet profile (NL-CS Part 1 §4.4, p. 14).

FITCEM: EN 17640:2022​

The fixed-time evaluation methodology of the cybersecurity scheme for the Wallet Instance (NL-CS Part 1 §1.2, p. 5).

Common Criteria: ISO/IEC 15408 and ISO/IEC 18045​

The Wallet Instance evaluation is augmented with Common Criteria methodology (ISO/IEC 15408) (NL-CS Part 1 §1.1, p. 5). The WSCA protection profile NL-CS-WSCA is a Common Criteria protection profile for evaluation under the EUCC scheme.

SESIP: EN 17927:2023​

An accepted alternative evaluation methodology, and the source of the assurance component semantics used by the cybersecurity scheme (NL-CS Part 1 §1.2, p. 5).

ECCG Agreed Cryptographic Mechanisms​

The Wallet Instance and the WSCA must use cryptographic mechanisms in accordance with the ECCG Agreed Cryptographic Mechanisms (NL-CS-WI RSR_KEY_MNG, RSR_CRPTO, p. 45) (NL-CS-WSCA OSP.CRYPTO_STANDARDS, p. 25). A mechanism that is not yet included is subject to a security assessment and a documented justification.

CEN EN 419 221-5​

The WSCD-HSM in the WSCA's environment must be an HSM following CEN EN 419 221-5, or another protection profile with at least equivalent functionality and assurance (NL-CS-WSCA §1.2.5.1, p. 11).

Vulnerability handling: ISO/IEC 30111 and the Cyber Resilience Act​

The product developer maintains a vulnerability management policy that takes ISO/IEC 30111 into account. Under Implementing Regulation (EU) 2024/2981, that policy must meet Annex I of the Cyber Resilience Act (NL-CS Part 2 §8.2, p. 21).

Wallet Provider and PID Provider (NL-P)​

CyberFundamentals (CyFun)​

NL-P-02 sets the cybersecurity requirements for Wallet Providers and PID Providers. For this, the providers are treated as NIS2 essential entities (NL-P-02 §1.1, p. 6). Its control set covers at least the NIS2 Article 21 domains (NL-P-02 §3.1, p. 10). It is organised along the six functions of the CyberFundamentals Framework of the Centre for Cybersecurity Belgium (CCB): Govern, Identify, Protect, Detect, Respond and Recover (NL-P-02 §3.2, p. 11). Among its references is the CyberFundamentals Framework at the Essential assurance level (NL-P-02 §2.2, p. 8).

NL-P-02 states that it is an adaptation:

  • It uses the CyberFundamentals control structure and selected content, and acknowledges the CCB as the source.
  • Its NL-specific adaptations are not official CCB interpretations or an official CCB certification scheme.
  • Services under it cannot be used for a presumption of conformity with the NIS2 Directive and its Belgian transposition (NL-P-02 §3.3, p. 11).

Certification under the Dutch scheme also does not by itself constitute a regulatory determination of compliance with NIS2 (NL-P-02 §1.1, p. 6).

Other provider references​

Functional conformance (NL-FS)​

ETSI TS 119 472​

Several ICS items of NL-FS-W give these ETSI specifications as their legal reference. Examples are PID and attestation issuance (part 3) and remote presentation (part 2) (NL-FS-W §6.3, p. 11) (NL-FS-W §6.3, p. 12).

These links are the latest versions published by ETSI. The documents do not state which version applies.

ISO/IEC 18013-5 and 18013-7, OpenID4VCI and OpenID4VP​

ICS items of NL-FS-W cover presentation using ISO/IEC 18013-7 and OpenID4VP, and issuance using OpenID4VCI (NL-FS-W §6.3, p. 11) (NL-FS-W §6.3, p. 12). Proximity presentations use ISO/IEC 18013-5. For those, the wallet provider completes the ICS in ISO/IEC 18013-6 (NL-FS §6.3, p. 15).

Functional Conformance Assessment Framework (FCAF)​

The certification body may use the European Commission's FCAF as an existing test standard for its test cases, but this is not mandatory (NL-FS §6.1, p. 13) (NL-FS §9.2, p. 22).

Accreditation and certification bodies​

The accreditation standards for the certification bodies and laboratories are set out per scheme in Table 1 of NL-SYS-01 (NL-SYS-01 §4.3, p. 16):

  • CAB-CB: ISO/IEC 17065 in all schemes. In NL-CS it is augmented by the EUCC program where applicable, and in NL-P-P/W by ETSI EN 319 403-1 V2.3.1.
  • CAB-ITSEF: ISO/IEC 17025 in NL-FS and NL-CS.

The schemes are built on ISO/IEC 17067 (NL-SYS-01 §1, p. 5). The accreditation requirements themselves are in NL-SYS-05.

Architecture and vocabulary​