NL-CS Part 3 requirements
This page lists every requirement of NL-CS Part 3 (NL-CS Evaluation Instruction for Evaluation Laboratories, version RC1.0) as published on 6 November 2026. The PDF is authoritative: each requirement links to the page it is on. You can also read the full text or search all requirements.
15 entries: 15 evidence items. Obligation: 15 mandatory.
Legal basis of the document: CIR 2024/2981.
3 Evidence checklist
Read section 3 in the full text
E1 — FIT ST (Wallet Security Specification)
Final version, claiming conformance to the Protection Profile; instantiates its operations; mirrors the environmental requirements table; identifies the functional certificate; states the TOE boundary and the architecture variant.
Evidence item · obligation: mandatory · PDF page 7
E2 — Functional certificate and report
The functional certificate or attestation for the same product and exact version, with the functional conformity assessment report where available.
Evidence item · obligation: mandatory · PDF page 7
E3 — Specification of the functionality
At the level of the interfaces and their parameters, including the interfaces with the WSCA-BE, the WSCD and the Wallet Provider backend.
Evidence item · obligation: mandatory · PDF page 7
E4 — Development process documentation
Including vulnerability and patch management.
Evidence item · obligation: mandatory · PDF page 7
E5 — Design documentation
At the level of the modules of the module decomposition of the Protection Profile: wallet core; WSCA/WSCD interface; optional remote signing module; presentation and proximity interface; modules specific to the architecture variant.
Evidence item · obligation: mandatory · PDF page 7
E6 — Security architecture description
Self-protection, secure communication channels, key management, attestation handling (Wallet Instance Attestation, Key Attestation), resilience mechanisms (obfuscation, anti-deobfuscation, integrity, debug and platform state detection, screen protection).
Evidence item · obligation: mandatory · PDF page 7
E7 — Source code
Complete source code of the Wallet Instance, with its build instructions. Failure to provide it counts as an evaluation failure.
Evidence item · obligation: mandatory · PDF page 7
E8 — Setup and User Guide (SUG)
How to install, configure and use the Wallet Instance securely, in the language fixed in the evaluation plan.
Evidence item · obligation: mandatory · PDF page 7
E9 — Test samples and access
Installable builds identical to the production release, target devices or access to them, and test accounts or a working backend, including the WSCA-BE and WSCD access needed to operate the TOE.
Evidence item · obligation: mandatory · PDF page 7
E10 — Product identification data
Application identifier, version name, version code, build or release identifier, signing certificate fingerprint, and a cryptographic digest of the delivered package.
Evidence item · obligation: mandatory · PDF page 7
E11 — Third-party components
Libraries and SDKs with versions, as used in the build.
Evidence item · obligation: mandatory · PDF page 7
E12 — Update mechanism description
How updates are produced, signed, distributed and verified, per software component.
Evidence item · obligation: mandatory · PDF page 8
E13 — Risk assessment
The product developer's risk assessment for the specific architecture.
Evidence item · obligation: mandatory · PDF page 8
E14 — Assurance information for components outside the TOE
WSCD certificate and report; WSCA-BE assurance information where outside the TOE.
Evidence item · obligation: mandatory · PDF page 8
E15 — Test to requirement mapping inputs
The product developer's own test evidence, if any, for the Protection Profile requirements.
Evidence item · obligation: mandatory · PDF page 8