Skip to main content

The certification process

A Wallet Provider ends up with a top-level certificate that depends on the certificates of three subordinate schemes. This page describes how each of those certifications works and how the top-level certificate is built on them. What happens after certification is on the life of a certificate.

What the top-level certificate depends on, following NL-SYS-01 §1 (NL-SYS-01 §1, p. 7) and the evidence categories of NL-TL Annex A (NL-TL Annex A, p. 29).

Functional certification (NL-FS)​

NL-FS certifies "the functional behaviour of the wallet solution or the PID issuance service". It checks that the wallet solution or service correctly implements the protocols, interfaces, data formats and other functional requirements of the implementing acts and the technical specifications they reference (NL-FS §1.1, p. 6). Wallet providers are certified for their wallet solution and PID providers for their PID issuance services (NL-FS §1.1, p. 6). The requirements are listed in NL-FS-W for wallet solutions and NL-FS-P for PID issuance services. If a wallet solution includes wallet units for several OS versions (for example iOS and Android), the certification body treats them as separate objects of certification (NL-FS §9.1.1, p. 21).

The process (NL-FS §6.1, p. 13):

  1. Preparation, before any certification: the certification body derives test objectives and test cases from the functional requirements. It can do so directly or by reference to an existing test standard, such as the European Commission's Functional Conformance Assessment Framework (FCAF). It also develops or references the ICS templates (NL-FS §6.1, p. 13). The test cases are preferably implemented in an automated conformance test tool (NL-FS §6.1, p. 14). The certification body may decide to reference the FCAF, but this is not mandatory (NL-FS §9.2, p. 22).
  2. The developer completes the Implementation Conformance Statement (ICS) of NL-FS-W or NL-FS-P, plus the ICS of each supported technical specification. The ICS declares which features are implemented, which determines the tests that apply (NL-FS §6.1, p. 14).
  3. Testing: the applicable test cases are executed (NL-FS §6.1, p. 14). Execution should be performed by the certification body, directly or through a qualified outsourced partner, but may also be done by the developer using a tool qualified by the certification body (NL-FS §9.1.3, p. 21). Testing takes place in a controlled test framework, so that it is impartial and reproducible (NL-FS §9.1.1, p. 21).
  4. Evaluation and decision: the certification body evaluates the evidence. The decision is Pass or Fail, taken according to the common process of NL-SYS-01 (NL-FS §6.1–6.2, p. 14).
  5. Certificate: the expiry date is at most 5 years after the issuance date (NL-FS §8.4, p. 20).

NL-FS and NL-CS are assessed and certified independently of each other; neither replaces the other (NL-FS §5.3, p. 12). An NL-FS certificate is internal assurance information within the certification hierarchy. It does not by itself give the right to use the EU Digital Identity Wallet Trust Mark (NL-FS §5.5, p. 12).

Cybersecurity certification (NL-CS)​

The cybersecurity certification has at least two parts (NL-SYS-01 §1, p. 6):

  • The WSCA and WSCD are certified under the EUCC scheme. NL-CS-WSCA is the Common Criteria protection profile for a WSCA in a remote HSM architecture. It comes with conditions for the platform underneath (NL-CS-WSCA conditions).
  • The Wallet Instance is evaluated under a national FITCEM scheme (EN 17640:2022), described in NL-CS Part 1 (scheme specification) and Part 2 (procedures). The requirements are in the protection profile NL-CS-WI and the conditions on the mobile platform (NL-CS-WI conditions). Part 3 instructs the evaluation laboratories, and Part 4 is the audit instruction for the developer's operational processes.

The assurance level is high, and this is mandatory: substantial is not sufficient (NL-CS Part 1 §1.1, p. 5). Under the current draft protection profile, the Wallet Instance is a standalone target of evaluation. The WSCA backend and the WSCD are part of its operational environment (NL-CS Part 1 §2.1, p. 8). Only the remote WSCA-WSCD architecture is admitted. Embedded secure element and eSIM variants require a protection profile before certification. A variant without a dedicated secure element is not admitted at assurance level high (NL-CS Part 1 §2.3, p. 8).

The phases of the Wallet Instance certification (NL-CS Part 1 §6.1, p. 17):

  1. Application: the product developer selects an authorised certification body (CB). It submits the FIT Security Target, a risk assessment, a proposed evaluation plan, the functional certificate and the prerequisite documentation. Only providers referred to in Article 5a(2) of eIDAS are eligible to be issued a certificate (NL-CS Part 2 §2.1, p. 9).
  2. Evaluation planning: the CB reviews the application. It prepares the evaluation plan with the developer and the evaluation laboratory, and approves it in writing before the evaluation starts (NL-CS Part 2 §3.1, p. 11).
  3. FITCEM evaluation: the evaluation laboratory performs the evaluation tasks of EN 17640:2022 within a fixed time budget, under the responsibility of the CB (NL-CS Part 1 §6.1, p. 17). The effort is fixed rather than scaled to functionality (NL-CS Part 1 §5.2–5.3, p. 15).
  4. Process audit: the CB performs an initial audit of the developer's operational processes, according to the audit instruction (NL-CS Part 4) (NL-CS Part 1 §6.1, p. 17).
  5. Evaluation review meeting (optional) (NL-CS Part 1 §6.1, p. 17).
  6. Certification decision: the CB's certifying function reviews the evaluation technical report and the audit reports. It takes the decision and issues the certificate of conformity and the certification report (NL-CS Part 1 §6.1, p. 17).

The required test set is built on OWASP MAS: the MASVS, MASWE and MASTG, the testing profiles L2 + R + P, and the OWASP MAS EUDI Wallet profile on top. NL-CS Part 1 describes that profile as a draft that is not yet normative (NL-CS Part 1 §4.4, p. 14).

A valid functional certificate for the same product, with the same version, is a precondition. No certificate of conformity is issued under the scheme without one (NL-CS Part 1 §6.2, p. 17). The maximum certificate validity is five years (NL-CS Part 1 §6.3, p. 18).

Wallet Provider and PID Provider certification (NL-P)​

NL-P-W (Wallet Provider) and NL-P-P (PID Provider) certify the providers and the services they operate. The main evaluation activity is audit, and the certification bodies are accredited to ISO/IEC 17065 augmented by ETSI EN 319 403-1 V2.3.1 (NL-SYS-01 §4.3, p. 16). The requirements are in NL-P-01 (both providers), NL-P-02 (both), NL-P-03 (both), NL-P-04W (Wallet Provider) and NL-P-04P (PID Provider) (NL-SYS-01 §4.2, p. 15). According to NL-SYS-01, the validity of the Wallet Provider and PID Provider certificates is four years (NL-SYS-01 §5.10, p. 23).

The NL-P-W certification process has three phases: preparation and application, evaluation, and certification (NL-P-W §8.1, p. 17). For a Wallet Provider:

  1. Application: the applicant provides (NL-P-W §8.2, p. 17):

    • a description of its environment and systems;
    • documentation that demonstrates compliance with the NL-P-W requirement documents;
    • valid NL-FS and NL-CS certificates for the wallet solution versions in scope, or declarations that those certification processes are in place;
    • any external assurance evidence it wants the CAB to rely on, such as ISO/IEC 27001 certificates or audit reports;
    • the completed application form.

    The application can be combined with applications under other schemes of the system (NL-P-W §8.2, p. 17).

  2. Kick-off: a kick-off meeting is held no later than 10 working days after a complete application has been received. The applicant, representatives of the Scheme Owner and the CAB attend, and the CAB agrees the evaluation plan with the applicant (NL-P-W §8.3.1, p. 17).

  3. Evaluation: the CAB evaluates against the requirement documents and records the results in an Evaluation Report. The report gives an overall assessment of conformity with each requirement and a recommendation for the decision (NL-P-W §8.3.2, p. 18). Initial and re-assessment audits should normally comprise a Stage 1 and a Stage 2 (NL-P-W Annex B, p. 32). Each applicable requirement's result is Conforming, Major nonconformity, Minor nonconformity or Not concluded (NL-P-W Annex B, p. 33).

  4. Decision: after reviewing the evaluation results, the CAB completes the decision and informs the applicant within 5 working days. After a positive decision, the certificate is issued no later than 14 working days later. After a negative decision, the applicant has 14 working days to lodge a written complaint. The CAB issues a final decision within 14 working days of receiving it (NL-P-W §8.4, p. 18).

  5. Certificate: before issuing the certificate, the CAB verifies that the applicant holds valid NL-FS and NL-CS certificates for the wallet solution versions concerned. It does not issue the certificate if any of them is absent, expired, suspended or withdrawn (NL-P-W §8.7, p. 19). The certificate is valid for four years from the date of issuance (NL-P-W §8.6, p. 18). The CAB notifies the Scheme Owner within five working days of issuance (NL-P-W §8.7, p. 19).

The indicative CAB effort for an initial certification is 30 working days for evaluation and 15 working days for certification. These are maximum and planned values that may change upon agreement with the Scheme Owner (NL-P-W §8.5, p. 18).

The certification process of the PID Provider scheme is summarised, with its own page references, on the NL-P-P page.

Top-level certification (NL-TL)​

NL-TL is the scheme for Wallet Providers that seek a top-level certificate and admission to the national eID scheme (NL-TL §2, p. 7). The object of certification covers both (NL-TL §2, p. 7):

  • the Wallet Provider: it satisfies the requirements of the scheme, holds the required underlying certificates and meets the national admission conditions in national law;
  • the government-assigned PID Provider that the Wallet Provider is linked to: it also satisfies the requirements and holds the required certificates.

Only a certification body that is accredited and also authorised under Dutch law is eligible as CAB (NL-TL §6.1, p. 11). The same CAB may perform the top-level certification and one or more subordinate certifications, provided impartiality, separation of review and decision, and the competence requirements are maintained (NL-TL §8.1, p. 21).

The process comprises application review, evaluation, review, certification decision, issuance, surveillance, change handling, suspension or withdrawal where applicable, and recertification (NL-TL §8.1, p. 21).

1. Application​

The applicant identifies the precise object and scope of the top-level certification. The application includes at least (NL-TL §8.2, p. 21):

  • the legal identity and contact details of the Wallet Provider;
  • the Wallet Solution and each version, configuration and deployment model in scope;
  • the government-assigned PID Provider, and the relationship through which PID issuance is provided to the Wallet Solution;
  • a complete inventory of mandatory subordinate certificates and declarations of conformity, with identifiers, issuing CABs, objects, scopes, versions, validity periods and status;
  • evidence that the Wallet Provider satisfies the national admission conditions;
  • the organisational, technical and contractual dependencies and interfaces between the Wallet Provider, the Wallet Solution, the PID Provider and the national eID scheme;
  • known changes, limitations, exclusions, open findings, suspensions, incidents or other circumstances that may affect the certification;
  • other assurance evidence for which the applicant requests reliance;
  • the application and contractual information the CAB requires.

The CAB reviews the application for completeness and does not start the evaluation until the object, the certificate set, the admission conditions and the relevant interfaces are sufficiently defined (NL-TL §8.2, p. 22).

2. Evaluation plan​

The CAB prepares an evaluation plan, proportionate to the composite nature and the risk of the object. The plan distinguishes:

  • the aspects accepted on the basis of subordinate certificates;
  • the certificate checks the CAB itself performs;
  • the admission conditions it verifies directly;
  • the dependencies and interfaces it evaluates;
  • the gaps that need supplementary evaluation.

This is set out in (NL-TL §8.3, p. 22). Annex C lists the minimum contents of the plan (NL-TL Annex C, p. 32).

3. Evaluation​

  • Subordinate certificates: for every mandatory subordinate certificate or result, the CAB verifies authenticity, the competence and accreditation of the issuing body, the object, scope, versions, validity, status, conditions, limitations and continuing applicability (NL-TL §8.4.1, p. 22).
  • Collective coverage and interfaces: the CAB evaluates whether the subordinate results together cover the complete top-level object, including the link between the Wallet Provider and the PID Provider (NL-TL §8.4.2, p. 22).
  • National admission conditions: the CAB verifies each applicable admission condition. Where national law reserves the admission decision to a competent authority, the CAB verifies that authority's determination and does not substitute its own decision (NL-TL §8.4.3, p. 22).
  • Supplementary evaluation: where the evidence is incomplete, the CAB performs or requires supplementary evaluation, limited to the uncovered matter. Supplementary evaluation cannot replace a mandatory subordinate certificate (NL-TL §8.4.4, p. 23).

For each aspect, reliance is recorded as Full, Partial or None (NL-TL Annex B.3, p. 30). In the evaluation results matrix, each requirement's result is Conforming, Major nonconformity, Minor nonconformity or Not concluded (NL-TL Annex E, p. 34).

4. Report, review and decision​

A positive recommendation cannot be made while a mandatory certificate is absent, expired, suspended, withdrawn or insufficient in scope. The same applies while a material top-level gap or an unresolved major nonconformity remains (NL-TL §8.5, p. 23). A person or function not involved in the evaluation reviews the evaluation information. The decision is made by the CAB and is not delegated to an external body (NL-TL §8.6, p. 23).

A positive decision requires all of the following (NL-TL §8.6, p. 23):

  • all mandatory subordinate certificates are authentic, valid, in force, applicable and sufficient in scope;
  • all applicable national admission conditions are fulfilled;
  • collective coverage of the Wallet Provider, Wallet Solution and linked PID Provider is demonstrated;
  • material dependencies and interfaces have been evaluated;
  • any supplementary evaluation has been completed;
  • no unresolved major nonconformity or evidence gap prevents a conformity conclusion;
  • the proposed certificate scope accurately reflects the demonstrated conformity.

After a negative decision, the CAB informs the applicant of the reasons and of the complaint and appeal arrangements (NL-TL §8.6, p. 23).

5. The top-level certificate​

The certificate identifies, among other things:

  • the certificate holder;
  • the Wallet Solution and its versions;
  • the linked government-assigned PID Provider;
  • the scope;
  • NL-TL and its version;
  • the subordinate certificates it depends on;
  • its decision, issue and expiry dates, and the issuing CAB.

It also states that its validity depends on the continuing validity of those subordinate certificates and on the admission conditions (NL-TL §8.7, p. 24). Annex F lists the minimum contents (NL-TL Annex F, p. 35). The CAB provides the certificate information to the Scheme Owner for the register (NL-TL §8.7, p. 24).

Only the NL EUDI Wallet Mark, as defined in NL-SYS-03, is used as mark of conformity under NL-TL (NL-TL §6.6, p. 12). According to NL-SYS-01, the Trust Mark as defined in Implementing Regulation (EU) 2024/2981 will be used only for the top-level certificate (NL-SYS-01 §7.1.1, p. 30).

The CAB concludes an enforceable certification agreement with the applicant (NL-TL §10.2, p. 28). NL-SYS-01 and applicable law prevail where NL-TL conflicts with them (NL-TL §10.5, p. 28).