NL-P-01 full text
This is the text of NL-P-01, converted automatically from the PDF so you can read and search it here. The PDF is authoritative. Tables with merged cells can be flattened, and text inside diagrams is only in the images. The individual requirements are listed separately.
NL-P-01
NL EUDI Wallet Certification System
Organisational and Security Requirements for Wallet and PID Providers
RC1.0
2026.11.01
| Document reference | NL-P-01 |
|---|---|
| Version | RC1.0 |
| Status | Release Candidate Draft |
| Date | 01/11/2026 |
| Document type | Common requirements specification for Wallet Providers and PID Providers |
| Parent framework | NL-SYS-01 NL-P-P/W |
| Scheme Owner | Kingdom of the Netherlands Minister of Economic Affairs |
| Certification target | Wallet Providers and PID Providers under the NL EUDI Wallet Certification System |
| Primary audience | Wallet Providers, PID Providers, CABs and Scheme Owners |
| Secondary audience | Supervisory bodies, accreditation bodies and EUDI Wallet ecosystem stakeholders |
| Assurance level <identity proofing CIR 2015/1502> and <evaluation, EU Regulation 2019/881> | High/High |
| Related Documents | NL-P-02 NL-P-03 NL-P-P/W04* |
| Version | State | Date | |
|---|---|---|---|
| RC1.0 | Consolidated provider requirements aligned to ETSI EN 319 401 V3.2.1 and the NL EUDI Wallet Certification System. | Release Candidate | 2026-10-31 |
1 Introduction
1.1 Foreword
This document (NL-P-01) specifies common organisational, technical, operational, security and resilience requirements for Wallet Providers and PID Providers participating in the NL EUDI Wallet Certification Scheme ("Stelsel").
The structure of the provider requirements follows ETSI EN 319 401 V3.2.1. References in that standard to a Trust Service Provider or trust service have been adapted to the relevant Wallet Provider, PID Provider and provider service context. This document does not claim that Wallet Providers or PID Providers are trust service providers solely because this structure is used.
This document shall be read with NL-SYS-01 and the applicable provider certification scheme, NL-P-W for Wallet Providers or NL-P-P for PID Providers.
Role-specific lifecycle and fraud-management requirements remain in NL-P-W04* and NL-P-P04*. Productfunctional and product-cybersecurity requirements remain in NL-FS and NL-CS.
1.2 Scope
The document uses the control structure of ETSI EN 319 401 V3.2.1, adapted to the EUDI Wallet Provider and PID Provider context. Other NL-P*-requirement documents contain more specific requirements that apply in addition to this requirements document.
The certified scope includes the provider organisation and the people, processes, information, infrastructure, cloud and hosting services, cryptographic services, interfaces, suppliers and operational controls used to provide wallet or PID services.
For the Wallet Provider, this includes wallet onboarding, activation and wallet-unit lifecycle operations.
For the PID Provider, it includes identity proofing, PID issuance, binding, status, suspension, revocation and lifecycle operations.
In the NL-SYS-01 NL Certification System Framework, certification of Wallet Providers and certification of the PID Provider are separate subordinate certifications. For a Wallet Provider, these certificates form part of the assurance evidence used for the top-level certification and national admission decision. This document does not define that top-level certification decision, admission conditions, product-functional certification or wallet-solution cybersecurity certification.
This document lists the common organisational, policy, security, operational and resilience requirements to be met by an EUDI Wallet Provider and a PID Provider seeking and maintaining certification under the NL EUDI Wallet Certification System. The requirements constitute subsidiary normative requirements for the Wallet Provider Certification Scheme (NL-P-W) and the PID Provider Certification Scheme (NL-P-P).
2 Legal Basis & References
2.1 Legal Basis
The legal basis for these requirements is formed by the Union and applicable national legislation governing European Digital Identity Wallets, electronic identification, cybersecurity risk management and incident reporting.
The following instruments are particularly relevant:
- Regulation (EU) No 910/2014, as amended by Regulation (EU) 2024/1183, establishing the European Digital Identity Framework.
- Commission Implementing Regulation (EU) 2024/2982 on protocols and interfaces supported by the European Digital Identity Framework.
- Commission Implementing Regulation (EU) 2024/2979 on integrity and core functionalities of European Digital Identity Wallets.
- Commission Implementing Regulation (EU) 2024/2977 on person identification data and electronic attestations of attributes.
- Commission Implementing Regulation (EU) 2024/2981 on the certification of European Digital Identity Wallets
- Commission Implementing Regulation (EU) 2024/2690, where the provider or certified service falls within its scope or where its technical and methodological requirements are adopted by the applicable national framework.
- Commission Implementing Regulation (EU) 2015/1502 concerning assurance levels for electronic identification means, including assurance level High.
Where national transposition or sector-specific rules impose more specific or stricter requirements, those requirements prevail. The applicant shall identify the competent authority, applicable reporting obligations and any sector-specific cybersecurity requirements relevant to its certified services.
2.2 Normative references
The following documents contain provisions which, through reference in this document, constitute requirements or criteria for its application. The latest applicable version adopted by the NL EUDI Wallet Certification System shall be used unless a specific version is stated:
- ISO/IEC 17065, Conformity assessment - Requirements for bodies certifying products, processes and services.
- ISO/IEC 17067, Conformity assessment - Fundamentals of product certification and guidelines for product certification schemes.
- ISO/IEC 27001, Information security management systems - Requirements.
- ISO/IEC 27002, Information security controls.
- ISO/IEC 27005, Guidance on managing information security risks.
- ETSI EN 319 401 V3.2.1 (2026-01), used as the baseline for the common provider controls in Chapters 4 to 7
2.3 Parent Documents
- NL-SYS-* , NL EUDI Wallet Certification System.framework NL-P-* Provider certification schemes
2.4 Informative references
- The European Digital Identity Wallet Architecture and Reference Framework
3 Terms & Abbreviations
The key words "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and "cannot" are interpreted in accordance with ETSI drafting rules. "Shall" identifies a mandatory certification requirement. Requirement identifiers are stable references for evaluation plans, evidence records, findings and certificates.
3.1 Terms
PID Provider: the legal entity responsible for identity proofing and issuing and managing PID for EUDI Wallet Units, including the PID-provider obligations allocated by NL-SYS-01 and NL-P-P.
Wallet Provider: the legal entity responsible for providing and operating the EUDI Wallet service and for the walletprovider obligations allocated by NL-SYS-01 and NL-P-W.
Certified scope: the provider role, services, locations, systems, processes, interfaces and outsourced activities covered by the provider certificate.
Provider service: the organisational and technical service, including supporting processes and dependencies, within the certified scope of a Wallet Provider or PID Provider.
provider: a Wallet Provider, a PID Provider, or both, according to the applicability of a requirement.
3.2 Abbreviations
- WSCD - Wallet Secure Cryptographic Device
- WSCA - Wallet Secure Cryptographic Application
- TSP - Trust Service Provider
- RTO - Recovery Time Objective
- RPO - Recovery Point Objective
- PID - Person Identification Data
- ISMS - Information Security Management System
- EUDIW - European Digital Identity Wallet
- CAB - Conformity Assessment Body
3.3 Symbols
No special symbols are defined.
4 Overview
Chapters 4 to 7 transpose the horizontal control domains of ETSI EN 319 401 V3.2.1 to Wallet Providers and PID Providers. Unless marked role-specific or conditional, each requirement applies to both provider roles and to all systems and outsourced services within their certified scope.
4.1 General
Provider conformity is assessed as service certification under the NL EUDI Wallet Certification System.
The Wallet Provider remains responsible for the secure provision and operation of wallet-related services and for maintaining valid assurance evidence for the wallet solution in scope.
The PID Provider remains responsible for controlled PID issuance, status and lifecycle management, and the supporting trust and fraud-management services within its certified scope.
4.2 Applicability of conditional requirements
Requirement
ID
REQ-4.2-01
Normative requirement Applies to Typical evidence
The Provider shall document, for every requirement marked conditional
or role-specific, whether it is applicable and the factual basis for that
determination.
Document review,
interview and
operating records
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-4.2-02 | A determination of non-applicability shall not transfer, waive or obscure a responsibility that remains with the Provider under law, the NL certification system, a certification contract or an outsourcing arrangement. | Both | Document review, interview and operating records |
Requirement
ID
REQ-4.2-03
Normative requirement Applies to Typical evidence
The CAB shall be given sufficient architecture, service-decomposition
and responsibility-allocation information to validate applicability
decisions.
Document review,
interview and
operating records
Both
Both
5 Risk management framework and risk assessment
The Provider shall apply the risk-management framework and risk-assessment principles of ETSI EN 319 401 to the certified provider service, taking account of the NL-SYS-01 allocation of responsibilities, provider dependencies and the system risk register under NL-SYS-04.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-5-01 | The Provider shall establish, implement, maintain and continually improve a documented risk-management framework covering the certified provider service. | Both | Document review, interview and operating records |
| REQ-5-02 | The framework shall define risk ownership, risk acceptance authority, assessment criteria, treatment options, review frequency and escalation thresholds. | Both | Document review, interview and operating records |
| REQ-5-03 | The Provider shall maintain a current risk assessment addressing threats, vulnerabilities, dependencies and impacts affecting confidentiality, integrity, availability, authenticity, privacy and sole user control. | Both | Document review, interview and operating records |
| REQ-5-04 | The Provider shall map its assessment to the system risk register maintained under NL-SYS-04 and shall identify provider-specific additions, assumptions and residual risks. | Both | Document review, interview and operating records |
| REQ-5-05 | Risk assessment shall cover interfaces and dependencies between the Wallet Provider, PID Provider, wallet solution, WSCA/WSCD, trust services, access-certificate services, registration-certificate services and other material ecosystem components. | Both | Document review, interview and operating records |
| REQ-5-06 | The Provider shall reassess risk following significant change, incident, vulnerability disclosure, material supplier change, threat-intelligence update or change to applicable legal or scheme requirements. | Both | Document review, interview and operating records |
| REQ-5-07 | Risk treatment decisions shall identify responsible owners, target dates, required evidence and residual-risk acceptance. | Both | Document review, interview and operating records |
| REQ-5-08 | Risks that may affect certificate validity, subordinate assurance evidence, national admission conditions or another provider shall be reported in accordance with NL-SYS-01 and the applicable provider scheme. | Both | Document review, interview and operating records |
| REQ-5-09 | The Wallet Provider shall specifically assess risks arising from wallet onboarding, activation, binding to the user, wallet-unit lifecycle operations and integration with the designated PID Provider. | Wallet Provider | Document review, interview and operating records |
| REQ-5-10 | The PID Provider shall specifically assess risks arising from identity proofing, PID issuance, binding to a wallet unit, status services, revocation, fraud detection and dependencies shared by multiple Wallet Providers. | PID Provider | Document review, interview and operating records |
6 Policies and practices
The Provider shall establish the policies, practice statements and terms needed to describe and govern its certified service. References in ETSI EN 319 401 to a Trust Service Practice Statement are implemented here as a Provider Practice Statement for the Wallet Provider or PID Provider.
6.1 Provider Practice Statement
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-6.1-01 | The Provider shall maintain a Provider Practice Statement describing how it implements the requirements applicable to the certified service. | Both | Document review, interview and operating records |
| REQ-6.1-02 | The statement shall define the service scope, supported architectures, provider roles, trust dependencies, operational responsibilities, control ownership and applicable policy documents. | Both | Document review, interview and operating records |
| REQ-6.1-03 | The statement shall identify material deviations, limitations, assumptions and external services on which conformity depends. | Both | Document review, interview and operating records |
| REQ-6.1-04 | The statement shall be approved by accountable management, version-controlled and reviewed at least annually and following material change. | Both | Document review, interview and operating records |
6.2 Terms and conditions
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-6.2-01 | The Provider shall publish or otherwise make available clear terms and conditions for users and relevant ecosystem participants before service use. | Both | Document review, interview and operating records |
| REQ-6.2-02 | Terms shall describe the service, user obligations, limitations, support channels, complaint routes, suspension and termination conditions, privacy information and relevant liability provisions. | Both | Document review, interview and operating records |
| REQ-6.2-03 | The Wallet Provider shall explain wallet eligibility, onboarding, activation, recovery, suspension, termination and consequences of loss or compromise. | Wallet Provider | Document review, interview and operating records |
| REQ-6.2-04 | The PID Provider shall explain PID issuance, validity, status, revocation, correction and user redress procedures. | PID Provider | Document review, interview and operating records |
6.3 Information and network security policy
Requirement
ID
REQ-6.3-01
Requirement
ID
Normative requirement Applies to Typical evidence
The Provider shall maintain an information and network security policy
approved by accountable management and aligned with the certified
service risk assessment.
Normative requirement Document review, interview and operating records Applies to Typical evidence
REQ-6.3-02 The policy shall allocate security responsibilities, define governance
and reporting, and require measurable security objectives.
Document review,
interview and
operating records
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-6.3-03 | The Provider shall review the policy at planned intervals and after significant incidents, vulnerabilities or changes. | Both | Document review, interview and operating records |
Requirement
ID
Normative requirement Applies to Typical evidence
REQ-6.3-04 Compliance with the policy shall be monitored and evidenced through
management review, internal audit, metrics and corrective action.
Document review,
interview and
operating records
Both
Both
Both
7 Provider management and operation
The Provider shall implement and operate the management and technical controls in this chapter across its certified scope. The chapter follows the control sequence of clause 7 of ETSI EN 319 401 and applies it to wallet and PID service operations.
7.1 Internal organisation
Both provider roles shall apply the organisational governance, reliability and segregation-of-duties requirements of ETSI EN 319 401 clause 7.1 within their respective certified scope.
7.1.1 General
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.1-01 | The Provider shall maintain a documented organisational structure with clear accountability for the certified service. | Both | Document review, interview and operating records |
| REQ-7.1-02 | Accountable management shall ensure adequate authority, budget, competence and independence for security, privacy, compliance, risk and incident-management functions. | Both | Document review, interview and operating records |
7.1.2 Organisation reliability
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.1-03 | The Provider shall identify conflicts of interest and implement controls to preserve trustworthy operation and impartial evidence production. | Both | Document review, interview and operating records |
7.1.3 Segregation of duties
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.1-04 | Incompatible duties shall be segregated, including development and production administration, request and approval, key activation and key use, evidence creation and evidence approval. | Both | Document review, interview and operating records |
7.2 Human resources
Both provider roles shall apply every personnel-security requirement of ETSI EN 319 401 clause 7.2 to employees, contractors, trusted roles and relevant supplier personnel supporting their respective certified scope.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.2-01 | Personnel and contractors in trusted roles shall be screened to a level proportionate to their access and responsibilities, subject to applicable law. | Both | Document review, interview and operating records |
| REQ-7.2-02 | Role profiles shall define competence, authority, security responsibilities and required training. | Both | Document review, interview and operating records |
| REQ-7.2-03 | Personnel shall receive introduction and recurring training covering security, privacy, fraud, incident reporting, social engineering and role-specific procedures. | Both | Document review, interview and operating records |
| REQ-7.2-04 | Access and responsibilities shall be reviewed when employment or assignment changes and revoked promptly upon termination. | Both | Document review, interview and operating records |
| REQ-7.2-05 | The Provider shall maintain sufficient staffing and succession arrangements for critical operations, incident response and crisis management. | Both | Document review, interview and operating records |
7.3 Asset management
Both provider roles shall apply every asset-management requirement of ETSI EN 319 401 clause 7.3 to information, software, hardware, cryptographic material, media, services and supplier-managed assets in their respective certified scope.
7.3.1 General requirements
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.3-01 | The Provider shall maintain an inventory of information, software, hardware, cryptographic assets, services, data flows, interfaces and suppliers in the certified scope. | Both | Document review, interview and operating records |
7.3.2 Assets classification
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.3-02 | Assets shall have assigned owners and be classified according to confidentiality, integrity, availability, authenticity and privacy needs. | Both | Document review, interview and operating records |
7.3.3 Storage media and asset handling
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.3-03 | Rules shall govern acceptable use, secure handling, storage, transfer, return, sanitisation and disposal of assets and media. | Both | Document review, interview and operating records |
| REQ-7.3-04 | Production datasets, identity evidence, PID data, wallet-unit identifiers, attestation material and security logs shall be protected against unauthorised access and inappropriate reuse. | Both | Document review, interview and operating records |
7.4 Access control
Both provider roles shall apply every access-control requirement of ETSI EN 319 401 clause 7.4 to human, system, service and privileged access in their respective certified scope.
7.4.1 General
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.4-01 | Access shall be based on least privilege, need-to-know, role separation and explicit authorisation. | Both | Document review, interview and operating records |
7.4.2 Privileged and system administration accounts
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.4-02 | User and privileged access rights shall be approved, uniquely attributable, periodically reviewed and promptly revoked. | Both | Document review, interview and operating records |
| REQ-7.4-03 | Privileged and system administration shall use dedicated accounts, controlled administration paths and enhanced monitoring. | Both | Document review, interview and operating records |
7.4.3 Administration systems
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.4-04 | Administrative systems shall be isolated from ordinary user environments and protected against direct Internet exposure unless specifically justified and controlled. | Both | Document review, interview and operating records |
7.4.4 Identification
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.4-05 | Identities used for operational access shall be verified before credentials are issued. | Both | Document review, interview and operating records |
7.4.5 Authentication
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.4-06 | Multi-factor authentication shall protect remote access, privileged access and access to security-critical systems. | Both | Document review, interview and operating records |
| REQ-7.4-07 | Service-to-service access shall use mutually authenticated, authorised and cryptographically protected mechanisms with controlled credential lifecycles. | Both | Document review, interview and operating records |
7.5 Cryptographic controls
Both provider roles shall apply every cryptographic-control requirement of ETSI EN 319 401 clause 7.5. The Wallet Provider shall apply these controls to wallet-service and wallet-unit-related cryptographic assets under its control. The PID Provider shall apply them to PID issuance, signing or sealing, binding and status-service cryptographic assets under its control.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.5-01 | The Provider shall maintain a cryptographic policy covering approved algorithms, protocols, key lengths, key ownership, key lifecycle, certificate management and cryptographic agility. | Both | Document review, interview and operating records |
| REQ-7.5-02 | Cryptographic keys shall be generated, stored, used, rotated, backed up, recovered, archived and destroyed under documented controls proportionate to their purpose. | Both | Document review, interview and operating records |
| REQ-7.5-03 | Access to high-impact keys shall require strong authentication, separation of duties and tamper-resistant protection appropriate to the assessed risk. | Both | Document review, interview and operating records |
| REQ-7.5-04 | The Provider shall monitor deprecation of algorithms, protocols and cryptographic products and maintain a transition plan. | Both | Document review, interview and operating records |
| REQ-7.5-05 | The PID Provider shall protect PID signing or sealing keys and associated status-service keys in accordance with applicable trust-service and scheme requirements. | PID Provider | Document review, interview and operating records |
7.6 Physical and environmental security
Both provider roles shall apply every physical and environmental security requirement of ETSI EN 319 401 clause 7.6 to locations and facilities used directly or through cloud, hosting or colocation suppliers.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.6-01 | Facilities hosting critical systems shall use layered physical access controls, monitoring, visitor management and access logging. | Both | Document review, interview and operating records |
| REQ-7.6-02 | Environmental controls shall address power, fire, water, temperature, communications failure and other site-specific hazards. | Both | Document review, interview and operating records |
| REQ-7.6-03 | Physical access rights shall be approved, reviewed and revoked, and anomalies shall be investigated. | Both | Document review, interview and operating records |
| REQ-7.6-04 | Where cloud or colocation facilities are used, the Provider shall obtain and assess evidence that physical and environmental requirements are met. | Both | Document review, interview and operating records |
7.7 Operation security
Both provider roles shall apply every operational-security requirement of ETSI EN 319 401 clause 7.7 to acquisition, development, configuration, change, testing, patching and operation of systems in their respective certified scope.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.7-01 | The Provider shall maintain documented, approved and tested operating procedures for security-critical and service-critical activities. | Both | Document review, interview and operating records |
| REQ-7.7-02 | Changes shall be risk-assessed, authorised, tested, traceable and supported by rollback or recovery arrangements. | Both | Document review, interview and operating records |
| REQ-7.7-03 | Development, test, acceptance and production environments shall be appropriately separated. | Both | Document review, interview and operating records |
| REQ-7.7-04 | Secure configuration baselines shall be defined, deployed, monitored and reviewed for deviation. | Both | Document review, interview and operating records |
| REQ-7.7-05 | Malware protection, endpoint controls, patching and vulnerability remediation shall be implemented according to risk and defined target times. | Both | Document review, interview and operating records |
| REQ-7.7-06 | Capacity, availability, performance and security-relevant service health shall be monitored against defined thresholds. | Both | Document review, interview and operating records |
| REQ-7.7-07 | Backup and restoration procedures shall be tested and shall preserve confidentiality, integrity and recoverability. | Both | Document review, interview and operating records |
| REQ-7.7-08 | The Provider shall control production access by developers and shall record and review exceptional access. | Both | Document review, interview and operating records |
7.8 Network security
Both provider roles shall apply every network-security requirement of ETSI EN 319 401 clause 7.8 to internal, external and inter-provider networks, interfaces and administration channels in their respective certified scope.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.8-01 | Networks shall be architected and segmented according to trust level, data sensitivity and service criticality. | Both | Document review, interview and operating records |
| REQ-7.8-02 | Security boundaries shall enforce authenticated and authorised communications and minimise exposed services. | Both | Document review, interview and operating records |
| REQ-7.8-03 | External and inter-provider interfaces shall be inventoried, threat-modelled, protected and monitored. | Both | Document review, interview and operating records |
| REQ-7.8-04 | Network changes, firewall rules, routes, certificates and service endpoints shall be subject to controlled change management and periodic review. | Both | Document review, interview and operating records |
| REQ-7.8-05 | The Provider shall deploy measures to detect and mitigate denial-of-service, anomalous traffic, lateral movement and data exfiltration. | Both | Document review, interview and operating records |
7.9 Vulnerabilities and incident management
Both provider roles shall apply every vulnerability, monitoring, logging, incident-response, reporting, eventclassification and post-incident requirement of ETSI EN 319 401 clause 7.9. Each Provider shall additionally assess effects on the counterpart provider and the national trust framework.
7.9.1 Monitoring and logging
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.9-01 | The Provider shall collect, protect, correlate and review security logs sufficient for detection, investigation, certification evidence and legal obligations. | Both | Document review, interview and operating records |
| REQ-7.9-02 | Time sources shall be synchronised and protected to support reliable event correlation. | Both | Document review, interview and operating records |
7.9.2 Incident response
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.9-03 | The Provider shall maintain documented incident response procedures with classification, escalation, containment, eradication, recovery and communication steps. | Both | Document review, interview and operating records |
7.9.3 Reporting
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.9-04 | Incidents and vulnerabilities that may affect certified conformity, users, another provider or the trust framework shall be reported to the CAB, Scheme Owner and competent authorities within applicable deadlines. | Both | Document review, interview and operating records |
| REQ-7.9-05 | The Provider shall operate a vulnerability intake and coordinated disclosure process covering its own components and material suppliers. | Both | Document review, interview and operating records |
7.9.4 Event assessment and classification
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.9-06 | Events shall be assessed consistently for severity, affected assets, user impact, certificate impact, exploitation status and cross-provider consequences. | Both | Document review, interview and operating records |
7.9.5 Post-incident reviews
Requirement
ID
REQ-7.9-07
Normative requirement Applies to Typical evidence
Post-incident reviews shall identify root causes, control failures,
corrective actions, responsible owners and lessons to be shared with
relevant parties.
Document review,
interview and
operating records
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.9-08 | The PID Provider shall assess systemic impact where an incident may affect multiple Wallet Providers or issued PIDs. | PID Provider | Document review, interview and operating records |
7.10 Collection of evidence
Both provider roles shall apply every evidence-collection and record-retention requirement of ETSI EN 319 401 clause 7.10 to operational, security, legal and certification evidence in their respective certified scope.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.10-01 | The Provider shall identify evidence required to demonstrate conformity for initial certification, surveillance, special evaluation and recertification. | Both | Document review, interview and operating records |
Requirement
ID
Normative requirement Applies to Typical evidence
REQ-7.10-02 Evidence shall be attributable, complete, protected against alteration,
Requirement
ID
retained for the prescribed period and retrievable without undue delay. Both
Normative requirement Document review, interview and operating records Applies to Typical evidence
REQ-7.10-03 Collection and handling of forensic evidence shall preserve integrity,
Requirement
ID
REQ-7.10-04
chain of custody and legal admissibility where relevant.
Normative requirement Document review, interview and operating records Applies to Typical evidence
The Provider shall maintain traceability from each requirement to
implemented control, evidence source, owner, assessment result and
open finding.
7.11 Business continuity management
Both provider roles shall apply every business-continuity, backup, redundancy, recovery and crisis-management requirement of ETSI EN 319 401 clause 7.11, including dependencies on the counterpart provider.
Document review,
interview and
operating records
Both
Both
Both
7.11.1 4.1 General
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.11-01 | The Provider shall maintain business continuity and disaster recovery arrangements covering the complete certified service and material dependencies. | Both | Document review, interview and operating records |
| REQ-7.11-02 | Business impact analysis shall define maximum tolerable disruption, recovery priorities, RTOs and RPOs for critical services and data. | Both | Document review, interview and operating records |
| REQ-7.11-03 | Continuity plans shall address loss of staff, facilities, infrastructure, supplier service, cryptographic capability and communications. | Both | Document review, interview and operating records |
7.11.2 Back up
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.11-04 | Backups shall be protected, geographically or logically separated as appropriate, and restoration shall be tested at planned intervals. | Both | Document review, interview and operating records |
7.11.3 Crisis management
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.11-05 | Crisis-management arrangements shall define command, decision rights, communications, stakeholder notification and transition back to normal operation. | Both | Document review, interview and operating records |
| REQ-7.11-06 | Continuity and crisis exercises shall include scenarios involving compromise or unavailability of a counterpart Wallet Provider or PID Provider. | Both | Document review, interview and operating records |
7.12 Provider termination and termination plans
Both provider roles shall apply every termination-planning requirement of ETSI EN 319 401 clause 7.12. The Wallet Provider shall address wallet-unit continuity or orderly cessation; the PID Provider shall address PID validity, status, revocation and evidence continuity.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.12-01 | The Provider shall maintain a termination plan that supports an orderly cessation, transfer or replacement of the certified service. | Both | Document review, interview and operating records |
| REQ-7.12-02 | The plan shall address user notification, data portability or lawful disposal, record retention, key and certificate status, supplier exit, continued status information and cooperation with the Scheme Owner and CAB. | Both | Document review, interview and operating records |
| REQ-7.12-03 | The Wallet Provider plan shall address wallet suspension or migration, user access to records, and consequences for active wallet units. | Wallet Provider | Document review, interview and operating records |
| REQ-7.12-04 | The PID Provider plan shall address continuity of PID validity status, revocation information, evidence retention and effects on all dependent wallets. | PID Provider | Document review, interview and operating records |
| REQ-7.12-05 | The termination plan shall be reviewed and exercised at planned intervals and after material architectural or supplier changes. | Both | Document review, interview and operating records |
7.13 Compliance
Both provider roles shall apply every compliance requirement of ETSI EN 319 401 clause 7.13, including legal evidence, accessibility, personal-data protection and management reporting.
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.13-01 | The Provider shall identify and maintain an inventory of legal, regulatory, contractual, certification-scheme and policy obligations applicable to the certified service. | Both | Document review, interview and operating records |
| REQ-7.13-02 | The Provider shall conduct planned internal audits covering all requirements of this document and the applicable provider scheme. | Both | Document review, interview and operating records |
| REQ-7.13-03 | Management shall review conformity, risks, incidents, vulnerabilities, audit results, supplier performance, complaints, objectives and corrective actions at planned intervals. | Both | Document review, interview and operating records |
| REQ-7.13-04 | Nonconformities shall be recorded, root-caused, corrected and verified for effectiveness within risk-based timescales. | Both | Document review, interview and operating records |
| REQ-7.13-05 | The Provider shall notify material changes affecting the certified object, assurance evidence or certificate scope before implementation where required by the applicable scheme. | Both | Document review, interview and operating records |
7.14 Supply chain
Both provider roles shall apply every supply-chain requirement of ETSI EN 319 401 clause 7.14 to direct suppliers, service providers, cloud services, subcontractors, ICT products and critical components in their respective certified scope.
7.14.1 Supply chain policy
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.14-01 | The Provider shall maintain a supply-chain security policy covering selection, due diligence, contracting, onboarding, monitoring, change and exit. | Both | Document review, interview and operating records |
| REQ-7.14-02 | Suppliers shall be classified by criticality, access, data handled, substitutability and potential impact on certificate validity or service continuity. | Both | Document review, interview and operating records |
7.14.2 Supply chain procedures and processes
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.14-03 | Supplier risk assessments shall cover ownership, jurisdiction, financial stability, personnel, security posture, vulnerabilities, concentration risk and subcontracting. | Both | Document review, interview and operating records |
| REQ-7.14-04 | Contracts shall define security, privacy, availability, incident notification, vulnerability handling, audit rights, evidence access, change notification, data location, return or deletion and termination assistance. | Both | Document review, interview and operating records |
7.14.3 Responsibility, third-party agreements and SLA
| Requirement ID | Normative requirement | Applies to | Typical evidence |
|---|---|---|---|
| REQ-7.14-05 | The Provider shall remain accountable for outsourced activities and shall ensure that the CAB and competent authorities can obtain necessary evidence. | Both | Document review, interview and operating records |
| REQ-7.14-06 | Supplier performance and assurance evidence shall be reviewed at planned intervals and after material events. | Both | Document review, interview and operating records |
| REQ-7.14-07 | The Provider shall maintain exit and substitution plans for suppliers whose failure could materially affect the certified service. | Both | Document review, interview and operating records |
Annex A (informative) Mapping to the eIDAS Regulation
A.1 Purpose
This annex identifies how the provider-control domains support the legal and operational obligations applicable to EUDI Wallet Providers and PID Providers under Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183.
It is an aid to assessment and does not replace the legal text, the applicable implementing acts or the allocation of responsibilities in NL-SYS-01.
- Governance, risk and policy controls in Chapters 4 to 6 support demonstrable control of the provider service and its risks.
- Access control, cryptographic controls, operations, network security and incident management in Chapter 7 support protection of wallet and PID services and their evidence.
- Business continuity, termination and supply-chain controls support continued availability, orderly cessation and accountability for outsourced activities.
- Role-specific wallet-onboarding, wallet-lifecycle, identity-proofing and PID-lifecycle obligations remain governed by NL-P-W, NL-P-P and their subsidiary documents.
A.2 Mapping
The mapping below supports traceability between Regulation (EU) No 910/2014, as amended by Regulation (EU) 2024/1183, and the provider controls in this document. It does not establish legal compliance by itself and does not replace the applicable provider scheme, implementing acts or legal assessment.
| eIDAS provision | Provider applicability | Corresponding requirements in this document |
|---|---|---|
| Article 5a - provision, security and operation of European Digital Identity Wallets | Wallet Provider; PID Provider where its service supports PID availability, binding, status or lifecycle | Chapters 4-6; 7.1, 7.3-7.11, 7.13 and 7.14. Role-specific wallet and PID lifecycle requirements remain in NL-P-W and NL-P-P. |
| Article 5a - user control, security, privacy and transaction transparency | Wallet Provider; PID Provider for PID processing and disclosure under its control | 7.3-7.10 and 7.13, supplemented by the applicable functional and cybersecurity requirements. |
| Article 5c - certification of European Digital Identity Wallets | Wallet Provider; PID Provider where its subordinate certificate or evidence supports the certified wallet solution | 7.10 and 7.13; traceability and evidence are used under NL-SYS-01 and the applicable provider scheme. |
| Article 5d - publication of a list of certified European Digital Identity Wallets | Wallet Provider, with system-level publication responsibilities governed by NL-SYS-01 | 7.10, 7.12 and 7.13 support accurate certificate evidence, change notification and termination information. |
| Article 5e - security breach of European Digital Identity Wallets | Wallet Provider; PID Provider where the breach affects PID issuance, status, binding or dependent wallets | 7.9, 7.11 and 7.12 support detection, reporting, containment, recovery, continuity and orderly restriction or cessation. |
| Article 10a - security breach concerning electronic identification schemes | Both where the certified provider service forms part of, or materially supports, the notified scheme | 7.9 and 7.11, together with reporting and coordination duties in NL-SYS-01. |
| Article 13(2) - limitations on use and liability | Both, where limitations are stated for the provider service | 6.2 and 7.13 support clear terms, limitations, liability information and evidence of legal compliance. |
| Article 15 - accessibility for persons with disabilities | Both | 6.2 and 7.13 support understandable terms, accessibility controls and consideration of applicable accessibility standards. |
| Articles 19a and 24(2)(fb) - security and incident obligations for trust service providers | PID Provider only where it also acts as a trust service provider; otherwise informative for both provider roles | Chapters 5-7, especially 7.9 and 7.11. Applicability depends on the provider's legal role and certified service. |
| Article 24(2)(a) - notification of changes or intended cessation by a qualified trust service provider | PID Provider only where it is a qualified trust service provider; provider-scheme change notification applies separately to both | 7.12 and 7.13; scheme-specific notifications remain governed by NL-SYS-01, NL-P-W and NL-P-P. |
| Article 24(2)(b) - competent and reliable personnel and standardised procedures | PID Provider where acting as a qualified trust service provider; substantively relevant to both | 7.1, 7.2 and 7.7. |
| Article 24(2)(c) - financial resources or liability insurance | PID Provider where acting as a qualified trust service provider; otherwise subject to applicable national and scheme rules | 7.1 and 7.13. |
| Article 24(2)(d) - pre-contractual information on precise terms and limitations | PID Provider where acting as a qualified trust service provider; clear provider terms apply to both | 6.2. |
| Article 24(2)(e)-(g) - trustworthy systems, protected data and measures against forgery or theft | PID Provider where acting as a qualified trust service provider; substantively relevant to both | 5, 6.3 and 7.3-7.9. |
| Article 24(2)(h) - recording and retention of relevant information | PID Provider where acting as a qualified trust service provider; evidence-retention controls apply to both | 7.10 and 7.12. |
| Article 24(2)(i) - up-to-date termination plan | PID Provider where acting as a qualified trust service provider; termination planning applies to both | 7.12. |
Annex B (informative) Mapping to CIR 2024/2690
B.1 Introduction
This annex explains how the requirements in Chapters 4 to 7 support assessment against Commission Implementing Regulation (EU) 2024/2690 where that Regulation applies to a Wallet Provider, PID Provider or supporting service within the certified scope. It is an assessment aid: it neither determines whether a Provider falls within the Regulation nor replaces the legal text, competent-authority supervision or a required conformity assessment.
Chapters 4 and 5 establish the control boundary and risk basis. Chapter 4 requires documented applicability decisions and responsibility allocation. Chapter 5 requires a maintained risk-management framework, current risk assessment, treatment and residual-risk decisions, reassessment after material events, and coverage of provider, ecosystem and supplier dependencies.
Chapter 6 establishes the governing documentation. The Provider Practice Statement describes the certified service, architecture, responsibilities, dependencies and implemented controls. Terms and conditions communicate relevant service conditions, while the information and network security policy establishes management-approved security governance, objectives, review and monitoring.
Chapter 7 provides the operational and technical control set. It covers organisation and personnel; assets and access; cryptography; physical, operational and network security; vulnerability and incident management; evidence; continuity and crisis management; termination; compliance; and supply-chain security. The requirement tables identify the applicable provider role and the typical evidence expected for assessment.
For assessment, the Provider and CAB should maintain one traceability matrix linking each applicable provision of Regulation (EU) 2024/2690 to the relevant Chapters 4 to 7 requirement identifiers, provider-scheme requirements, implemented controls, accountable owners and evidence. Evidence may be reused where it demonstrates both scheme conformity and regulatory implementation, but gaps in legal scope, role allocation or regulatory detail shall be assessed separately.
B.2 Mapping
The mapping is intended to help avoid duplicate control implementation and duplicate evidence collection. It does not alter the scope of Regulation (EU) 2024/2690, determine whether a Provider is in scope, or replace an assessment required by competent authorities.
- Risk analysis and information-system security: Chapters 4, 5 and 6.
- Incident handling and reporting: Chapter 7.9.
- Business continuity and crisis management: Chapter 7.11.
- Supply-chain security: Chapter 7.14.
- Security in acquisition, development, maintenance and change: Chapters 7.3, 7.7 and 7.14.
- Assessment of effectiveness of controls and compliance: Chapters 7.10 and 7.13.
- Cyber-hygiene, personnel security and access control: Chapters 7.2 and 7.4.
- Cryptography and communications security: Chapters 7.5 and 7.8.
- Asset management and physical security: Chapters 7.3 and 7.6.