Skip to main content

NL-P-01 requirements

This page lists every requirement of NL-P-01 (Wallet and PID Provider Requirements, version RC1.0) as published on 6 November 2026. The PDF is authoritative: each requirement links to the page it is on. You can also read the full text or search all requirements.

102 entries: 102 requirements. Obligation: 102 mandatory.

Legal basis of the document: eIDAS Art. 5a, CIR 2024/2979, CIR 2024/2981 Annex VI, CIR 2024/2690.

4.2 Applicability of conditional requirements​

Read section 4.2 in the full text

REQ-4.2-02​

A determination of non-applicability shall not transfer, waive or obscure a responsibility that remains with the Provider under law, the NL certification system, a certification contract or an outsourcing arrangement.

Requirement · obligation: mandatory · PDF page 9

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

5 Risk management framework and risk assessment​

Read section 5 in the full text

REQ-5-01​

The Provider shall establish, implement, maintain and continually improve a documented risk-management framework covering the certified provider service.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-02​

The framework shall define risk ownership, risk acceptance authority, assessment criteria, treatment options, review frequency and escalation thresholds.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-03​

The Provider shall maintain a current risk assessment addressing threats, vulnerabilities, dependencies and impacts affecting confidentiality, integrity, availability, authenticity, privacy and sole user control.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-04​

The Provider shall map its assessment to the system risk register maintained under NL-SYS-04 and shall identify provider-specific additions, assumptions and residual risks.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-05​

Risk assessment shall cover interfaces and dependencies between the Wallet Provider, PID Provider, wallet solution, WSCA/WSCD, trust services, access-certificate services, registration-certificate services and other material ecosystem components.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-06​

The Provider shall reassess risk following significant change, incident, vulnerability disclosure, material supplier change, threat-intelligence update or change to applicable legal or scheme requirements.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-07​

Risk treatment decisions shall identify responsible owners, target dates, required evidence and residual-risk acceptance.

Requirement · obligation: mandatory · PDF page 10

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-08​

Risks that may affect certificate validity, subordinate assurance evidence, national admission conditions or another provider shall be reported in accordance with NL-SYS-01 and the applicable provider scheme.

Requirement · obligation: mandatory · PDF page 11

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-5-09​

The Wallet Provider shall specifically assess risks arising from wallet onboarding, activation, binding to the user, wallet-unit lifecycle operations and integration with the designated PID Provider.

Requirement · obligation: mandatory · PDF page 11

  • Applies to: Wallet Provider
  • Typical evidence: Document review, interview and operating records

REQ-5-10​

The PID Provider shall specifically assess risks arising from identity proofing, PID issuance, binding to a wallet unit, status services, revocation, fraud detection and dependencies shared by multiple Wallet Providers.

Requirement · obligation: mandatory · PDF page 11

  • Applies to: PID Provider
  • Typical evidence: Document review, interview and operating records

6.1 Provider Practice Statement​

Read section 6.1 in the full text

REQ-6.1-01​

The Provider shall maintain a Provider Practice Statement describing how it implements the requirements applicable to the certified service.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-6.1-02​

The statement shall define the service scope, supported architectures, provider roles, trust dependencies, operational responsibilities, control ownership and applicable policy documents.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-6.1-03​

The statement shall identify material deviations, limitations, assumptions and external services on which conformity depends.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-6.1-04​

The statement shall be approved by accountable management, version-controlled and reviewed at least annually and following material change.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

6.2 Terms and conditions​

Read section 6.2 in the full text

REQ-6.2-01​

The Provider shall publish or otherwise make available clear terms and conditions for users and relevant ecosystem participants before service use.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-6.2-02​

Terms shall describe the service, user obligations, limitations, support channels, complaint routes, suspension and termination conditions, privacy information and relevant liability provisions.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-6.2-03​

The Wallet Provider shall explain wallet eligibility, onboarding, activation, recovery, suspension, termination and consequences of loss or compromise.

Requirement · obligation: mandatory · PDF page 12

  • Applies to: Wallet Provider
  • Typical evidence: Document review, interview and operating records

REQ-6.2-04 — The PID Provider shall explain PID issuance, validity, status, revocation, correction and user redress procedures.​

The PID Provider shall explain PID issuance, validity, status, revocation, correction and user redress procedures.

Requirement · obligation: mandatory · PDF page 13

  • Applies to: PID Provider
  • Typical evidence: Document review, interview and operating records

6.3 Information and network security policy​

Read section 6.3 in the full text

REQ-6.3-03 — The Provider shall review the policy at planned intervals and after significant incidents, vulnerabilities or changes.​

The Provider shall review the policy at planned intervals and after significant incidents, vulnerabilities or changes.

Requirement · obligation: mandatory · PDF page 13

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.1.1 General​

Read section 7.1.1 in the full text

REQ-7.1-01 — The Provider shall maintain a documented organisational structure with clear accountability for the certified service.​

The Provider shall maintain a documented organisational structure with clear accountability for the certified service.

Requirement · obligation: mandatory · PDF page 14

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.1-02​

Accountable management shall ensure adequate authority, budget, competence and independence for security, privacy, compliance, risk and incident-management functions.

Requirement · obligation: mandatory · PDF page 14

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.1.2 Organisation reliability​

Read section 7.1.2 in the full text

REQ-7.1-03​

The Provider shall identify conflicts of interest and implement controls to preserve trustworthy operation and impartial evidence production.

Requirement · obligation: mandatory · PDF page 14

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.1.3 Segregation of duties​

Read section 7.1.3 in the full text

REQ-7.1-04​

Incompatible duties shall be segregated, including development and production administration, request and approval, key activation and key use, evidence creation and evidence approval.

Requirement · obligation: mandatory · PDF page 14

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.2 Human resources​

Read section 7.2 in the full text

REQ-7.2-01​

Personnel and contractors in trusted roles shall be screened to a level proportionate to their access and responsibilities, subject to applicable law.

Requirement · obligation: mandatory · PDF page 14

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.2-02 — Role profiles shall define competence, authority, security responsibilities and required training.​

Role profiles shall define competence, authority, security responsibilities and required training.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.2-03​

Personnel shall receive introduction and recurring training covering security, privacy, fraud, incident reporting, social engineering and role-specific procedures.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.2-04​

Access and responsibilities shall be reviewed when employment or assignment changes and revoked promptly upon termination.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.2-05​

The Provider shall maintain sufficient staffing and succession arrangements for critical operations, incident response and crisis management.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.3.1 General requirements​

Read section 7.3.1 in the full text

REQ-7.3-01​

The Provider shall maintain an inventory of information, software, hardware, cryptographic assets, services, data flows, interfaces and suppliers in the certified scope.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.3.2 Assets classification​

Read section 7.3.2 in the full text

REQ-7.3-02​

Assets shall have assigned owners and be classified according to confidentiality, integrity, availability, authenticity and privacy needs.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.3.3 Storage media and asset handling​

Read section 7.3.3 in the full text

REQ-7.3-03​

Rules shall govern acceptable use, secure handling, storage, transfer, return, sanitisation and disposal of assets and media.

Requirement · obligation: mandatory · PDF page 15

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.3-04​

Production datasets, identity evidence, PID data, wallet-unit identifiers, attestation material and security logs shall be protected against unauthorised access and inappropriate reuse.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.4.1 General​

Read section 7.4.1 in the full text

REQ-7.4-01 — Access shall be based on least privilege, need-to-know, role separation and explicit authorisation.​

Access shall be based on least privilege, need-to-know, role separation and explicit authorisation.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.4.2 Privileged and system administration accounts​

Read section 7.4.2 in the full text

REQ-7.4-02 — User and privileged access rights shall be approved, uniquely attributable, periodically reviewed and promptly revoked.​

User and privileged access rights shall be approved, uniquely attributable, periodically reviewed and promptly revoked.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.4-03​

Privileged and system administration shall use dedicated accounts, controlled administration paths and enhanced monitoring.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.4.3 Administration systems​

Read section 7.4.3 in the full text

REQ-7.4-04​

Administrative systems shall be isolated from ordinary user environments and protected against direct Internet exposure unless specifically justified and controlled.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.4.4 Identification​

Read section 7.4.4 in the full text

REQ-7.4-05 — Identities used for operational access shall be verified before credentials are issued.​

Identities used for operational access shall be verified before credentials are issued.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.4.5 Authentication​

Read section 7.4.5 in the full text

REQ-7.4-06 — Multi-factor authentication shall protect remote access, privileged access and access to security-critical systems.​

Multi-factor authentication shall protect remote access, privileged access and access to security-critical systems.

Requirement · obligation: mandatory · PDF page 16

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.4-07​

Service-to-service access shall use mutually authenticated, authorised and cryptographically protected mechanisms with controlled credential lifecycles.

Requirement · obligation: mandatory · PDF page 17

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.5 Cryptographic controls​

Read section 7.5 in the full text

REQ-7.5-01​

The Provider shall maintain a cryptographic policy covering approved algorithms, protocols, key lengths, key ownership, key lifecycle, certificate management and cryptographic agility.

Requirement · obligation: mandatory · PDF page 17

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.5-02​

Cryptographic keys shall be generated, stored, used, rotated, backed up, recovered, archived and destroyed under documented controls proportionate to their purpose.

Requirement · obligation: mandatory · PDF page 17

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.5-03​

Access to high-impact keys shall require strong authentication, separation of duties and tamper-resistant protection appropriate to the assessed risk.

Requirement · obligation: mandatory · PDF page 17

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.5-04​

The Provider shall monitor deprecation of algorithms, protocols and cryptographic products and maintain a transition plan.

Requirement · obligation: mandatory · PDF page 17

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.5-05​

The PID Provider shall protect PID signing or sealing keys and associated status-service keys in accordance with applicable trust-service and scheme requirements.

Requirement · obligation: mandatory · PDF page 17

  • Applies to: PID Provider
  • Typical evidence: Document review, interview and operating records

7.6 Physical and environmental security​

Read section 7.6 in the full text

REQ-7.6-01​

Facilities hosting critical systems shall use layered physical access controls, monitoring, visitor management and access logging.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.6-02​

Environmental controls shall address power, fire, water, temperature, communications failure and other site-specific hazards.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.6-03 — Physical access rights shall be approved, reviewed and revoked, and anomalies shall be investigated.​

Physical access rights shall be approved, reviewed and revoked, and anomalies shall be investigated.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.6-04​

Where cloud or colocation facilities are used, the Provider shall obtain and assess evidence that physical and environmental requirements are met.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.7 Operation security​

Read section 7.7 in the full text

REQ-7.7-01​

The Provider shall maintain documented, approved and tested operating procedures for security-critical and service-critical activities.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-02 — Changes shall be risk-assessed, authorised, tested, traceable and supported by rollback or recovery arrangements.​

Changes shall be risk-assessed, authorised, tested, traceable and supported by rollback or recovery arrangements.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-03 — Development, test, acceptance and production environments shall be appropriately separated.​

Development, test, acceptance and production environments shall be appropriately separated.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-04 — Secure configuration baselines shall be defined, deployed, monitored and reviewed for deviation.​

Secure configuration baselines shall be defined, deployed, monitored and reviewed for deviation.

Requirement · obligation: mandatory · PDF page 18

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-05​

Malware protection, endpoint controls, patching and vulnerability remediation shall be implemented according to risk and defined target times.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-06 — Capacity, availability, performance and security-relevant service health shall be monitored against defined thresholds.​

Capacity, availability, performance and security-relevant service health shall be monitored against defined thresholds.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-07 — Backup and restoration procedures shall be tested and shall preserve confidentiality, integrity and recoverability.​

Backup and restoration procedures shall be tested and shall preserve confidentiality, integrity and recoverability.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.7-08 — The Provider shall control production access by developers and shall record and review exceptional access.​

The Provider shall control production access by developers and shall record and review exceptional access.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.8 Network security​

Read section 7.8 in the full text

REQ-7.8-01 — Networks shall be architected and segmented according to trust level, data sensitivity and service criticality.​

Networks shall be architected and segmented according to trust level, data sensitivity and service criticality.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.8-02 — Security boundaries shall enforce authenticated and authorised communications and minimise exposed services.​

Security boundaries shall enforce authenticated and authorised communications and minimise exposed services.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.8-03 — External and inter-provider interfaces shall be inventoried, threat-modelled, protected and monitored.​

External and inter-provider interfaces shall be inventoried, threat-modelled, protected and monitored.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.8-04​

Network changes, firewall rules, routes, certificates and service endpoints shall be subject to controlled change management and periodic review.

Requirement · obligation: mandatory · PDF page 19

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.8-05​

The Provider shall deploy measures to detect and mitigate denial-of-service, anomalous traffic, lateral movement and data exfiltration.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.9.1 Monitoring and logging​

Read section 7.9.1 in the full text

REQ-7.9-01​

The Provider shall collect, protect, correlate and review security logs sufficient for detection, investigation, certification evidence and legal obligations.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.9-02 — Time sources shall be synchronised and protected to support reliable event correlation.​

Time sources shall be synchronised and protected to support reliable event correlation.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.9.2 Incident response​

Read section 7.9.2 in the full text

REQ-7.9-03​

The Provider shall maintain documented incident response procedures with classification, escalation, containment, eradication, recovery and communication steps.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.9.3 Reporting​

Read section 7.9.3 in the full text

REQ-7.9-04​

Incidents and vulnerabilities that may affect certified conformity, users, another provider or the trust framework shall be reported to the CAB, Scheme Owner and competent authorities within applicable deadlines.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.9-05​

The Provider shall operate a vulnerability intake and coordinated disclosure process covering its own components and material suppliers.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.9.4 Event assessment and classification​

Read section 7.9.4 in the full text

REQ-7.9-06​

Events shall be assessed consistently for severity, affected assets, user impact, certificate impact, exploitation status and cross-provider consequences.

Requirement · obligation: mandatory · PDF page 20

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.9.5 Post-incident reviews​

Read section 7.9.5 in the full text

REQ-7.9-08 — The PID Provider shall assess systemic impact where an incident may affect multiple Wallet Providers or issued PIDs.​

The PID Provider shall assess systemic impact where an incident may affect multiple Wallet Providers or issued PIDs.

Requirement · obligation: mandatory · PDF page 21

  • Applies to: PID Provider
  • Typical evidence: Document review, interview and operating records

7.10 Collection of evidence​

Read section 7.10 in the full text

REQ-7.10-01​

The Provider shall identify evidence required to demonstrate conformity for initial certification, surveillance, special evaluation and recertification.

Requirement · obligation: mandatory · PDF page 21

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.11.1 4.1 General​

Read section 7.11.1 in the full text

REQ-7.11-01​

The Provider shall maintain business continuity and disaster recovery arrangements covering the complete certified service and material dependencies.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.11-02​

Business impact analysis shall define maximum tolerable disruption, recovery priorities, RTOs and RPOs for critical services and data.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.11-03​

Continuity plans shall address loss of staff, facilities, infrastructure, supplier service, cryptographic capability and communications.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.11.2 Back up​

Read section 7.11.2 in the full text

REQ-7.11-04​

Backups shall be protected, geographically or logically separated as appropriate, and restoration shall be tested at planned intervals.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.11.3 Crisis management​

Read section 7.11.3 in the full text

REQ-7.11-05​

Crisis-management arrangements shall define command, decision rights, communications, stakeholder notification and transition back to normal operation.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.11-06​

Continuity and crisis exercises shall include scenarios involving compromise or unavailability of a counterpart Wallet Provider or PID Provider.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.12 Provider termination and termination plans​

Read section 7.12 in the full text

REQ-7.12-01​

The Provider shall maintain a termination plan that supports an orderly cessation, transfer or replacement of the certified service.

Requirement · obligation: mandatory · PDF page 22

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.12-02​

The plan shall address user notification, data portability or lawful disposal, record retention, key and certificate status, supplier exit, continued status information and cooperation with the Scheme Owner and CAB.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.12-03​

The Wallet Provider plan shall address wallet suspension or migration, user access to records, and consequences for active wallet units.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Wallet Provider
  • Typical evidence: Document review, interview and operating records

REQ-7.12-04​

The PID Provider plan shall address continuity of PID validity status, revocation information, evidence retention and effects on all dependent wallets.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: PID Provider
  • Typical evidence: Document review, interview and operating records

REQ-7.12-05​

The termination plan shall be reviewed and exercised at planned intervals and after material architectural or supplier changes.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.13 Compliance​

Read section 7.13 in the full text

REQ-7.13-01​

The Provider shall identify and maintain an inventory of legal, regulatory, contractual, certification-scheme and policy obligations applicable to the certified service.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.13-02​

The Provider shall conduct planned internal audits covering all requirements of this document and the applicable provider scheme.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.13-03​

Management shall review conformity, risks, incidents, vulnerabilities, audit results, supplier performance, complaints, objectives and corrective actions at planned intervals.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.13-04 — Nonconformities shall be recorded, root-caused, corrected and verified for effectiveness within risk-based timescales.​

Nonconformities shall be recorded, root-caused, corrected and verified for effectiveness within risk-based timescales.

Requirement · obligation: mandatory · PDF page 23

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.13-05​

The Provider shall notify material changes affecting the certified object, assurance evidence or certificate scope before implementation where required by the applicable scheme.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.14.1 Supply chain policy​

Read section 7.14.1 in the full text

REQ-7.14-01​

The Provider shall maintain a supply-chain security policy covering selection, due diligence, contracting, onboarding, monitoring, change and exit.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.14-02​

Suppliers shall be classified by criticality, access, data handled, substitutability and potential impact on certificate validity or service continuity.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.14.2 Supply chain procedures and processes​

Read section 7.14.2 in the full text

REQ-7.14-03​

Supplier risk assessments shall cover ownership, jurisdiction, financial stability, personnel, security posture, vulnerabilities, concentration risk and subcontracting.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.14-04​

Contracts shall define security, privacy, availability, incident notification, vulnerability handling, audit rights, evidence access, change notification, data location, return or deletion and termination assistance.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.14.3 Responsibility, third-party agreements and SLA​

Read section 7.14.3 in the full text

REQ-7.14-05​

The Provider shall remain accountable for outsourced activities and shall ensure that the CAB and competent authorities can obtain necessary evidence.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.14-06 — Supplier performance and assurance evidence shall be reviewed at planned intervals and after material events.​

Supplier performance and assurance evidence shall be reviewed at planned intervals and after material events.

Requirement · obligation: mandatory · PDF page 24

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.14-07​

The Provider shall maintain exit and substitution plans for suppliers whose failure could materially affect the certified service.

Requirement · obligation: mandatory · PDF page 25

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

4.2 Applicability of conditional requirements​

Read section 4.2 in the full text

REQ-4.2-01​

The Provider shall document, for every requirement marked conditional or role-specific, whether it is applicable and the factual basis for that determination.

Requirement · obligation: mandatory · PDF page 9

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-4.2-03​

The CAB shall be given sufficient architecture, service-decomposition and responsibility-allocation information to validate applicability decisions.

Requirement · obligation: mandatory · PDF page 9

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

6.3 Information and network security policy​

Read section 6.3 in the full text

REQ-6.3-01​

The Provider shall maintain an information and network security policy approved by accountable management and aligned with the certified service risk assessment.

Requirement · obligation: mandatory · PDF page 13

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.9.5 Post-incident reviews​

Read section 7.9.5 in the full text

REQ-7.9-07​

Post-incident reviews shall identify root causes, control failures, corrective actions, responsible owners and lessons to be shared with relevant parties.

Requirement · obligation: mandatory · PDF page 21

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.10 Collection of evidence​

Read section 7.10 in the full text

REQ-7.10-03​

Collection and handling of forensic evidence shall preserve integrity, chain of custody and legal admissibility where relevant.

Requirement · obligation: mandatory · PDF page 21

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-7.10-04​

The Provider shall maintain traceability from each requirement to implemented control, evidence source, owner, assessment result and open finding.

Requirement · obligation: mandatory · PDF page 21

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

6.3 Information and network security policy​

Read section 6.3 in the full text

REQ-6.3-02​

The policy shall allocate security responsibilities, define governance and reporting, and require measurable security objectives.

Requirement · obligation: mandatory · PDF page 13

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

REQ-6.3-04​

Compliance with the policy shall be monitored and evidenced through management review, internal audit, metrics and corrective action.

Requirement · obligation: mandatory · PDF page 13

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records

7.10 Collection of evidence​

Read section 7.10 in the full text

REQ-7.10-02​

Evidence shall be attributable, complete, protected against alteration, retained for the prescribed period and retrievable without undue delay.

Requirement · obligation: mandatory · PDF page 21

  • Applies to: Both
  • Typical evidence: Document review, interview and operating records