NL-P-W full text

Converted text

This is the text of NL-P-W, converted automatically from the PDF so you can read and search it here. The PDF is authoritative. Tables with merged cells can be flattened, and text inside diagrams is only in the images.

NL-P-W

NL EUDI Wallet Certification System Wallet Provider Certification Scheme

RC1.1

2026.10.31

Document reference	NL-P-W
Version	RC1.1
Status	Release Candidate
Date	31/10/2026
Document type	Certification Scheme Scheme Specification (EN ISO/IEC 17067)
Parent framework	NL-SYS-01, NL-SYS-02, NL-SYS-03, NL-SYS-04, NL-SYS-05
Scheme Owner	Kingdom of the Netherlands Minister of Economic Affairs
Certification target	European Digital Identity Wallet Providers (and the Wallet Solutions provided)
Primary audience	Scheme Owners, CABs, EUDI Wallet providers
Secondary audience	EUDI Wallet ecosystem stakeholders
Assurance level <identity proofing CIR 2015/1502> and <evaluation, EU Regulation 2019/881>	High/High
Subsidiary Documents	NL-P-01, NL-P-02, NL-P-03, NL-P-W04

Version	Change	State	Date
RC1.0	First Consolidated Version following European Collaboration and Refinement Discussion with BZK- Policy Department and Legal.	Release Candidate	2026-10-27
RC1.1	Release Candidate for publication following review round NL Certification System Mngt Board round NL Certification System Mngt Board	Release Candidate	2026-10-31

1 Foreword

• 1 This document (NL-P-W) presents the specification for the Wallet Provider Certification Scheme, one of Certification Schemes within the NL EUDI Wallet Certification System. It defines the Certification Scheme - in the sense of ISO/IEC 17067 - that accredited Certification Bodies (CABs) shall apply when certifying Wallet Providers.
• 2 This document should be read in conjunction with the NL Certification System overarching documents, notably NL-SYS-01 which clarifies that next to the certification described in this document, a Wallet Provider additionally has to acquire a top-level certificate. This NL Top Level Certification reflects that and the Wallet Provider has an active Wallet Provider Certificate and that the PID provider that issues a PID to their wallet also has an active certificate and that the Wallet provider meets the national admission conditions to be allowed to connect to the National eID System.
• 3 NL-P-W is primarily addressed to CABs conducting certification activities under the NL Certification System. Wallet Providers subject to certification should read this document in conjunction with the applicable NL-P-* subsidiary documents, which specify the substantive requirements they shall meet.
• 4 This document is part of the NL-P-*, which operates within the NL Certification System (Governance). It should especially be read in conjunction with NL-SYS-01 (NL EUDI Wallet Certification System) and NL-SYS-03 (Organization and support for the owner of the national EUDI certification system).

2 Scope

• 5 The document specifies the Certification Scheme for the Wallet Providers that are to be certified and which seek to be admitted to the Dutch National eID Scheme ("Stelsel").
• 6 The object of certification under NL-P-W encompasses services that consists of provision and operation of wallet solutions and of the electronic identification schemes under which they are provided.
• 7 NL-P-W establishes the service requirements (see requirements in the subsidiary documents), the evaluation methodology (by reference to normative Annex B and subsidiary documents), and the conformity assessment procedures that accredited CABs shall apply when certifying the eID system and the service providers operating within the NL National eID scheme ("Stelsel"). It is intended to be read in conjunction with NL-SYS-05, which specifies the accreditation requirements on the certification bodies themselves.
• 8 In the context of this certification scheme, the object of certification is the wallet provider, comprising the organizational arrangements and processes of the Wallet Provider that deliver the wallet related services to individuals (in conjunction with the PID Provider).

3 Legal Basis

• 9 The Certification Scheme defined in this document is established pursuant to the following legal instruments:
• 1. Regulation (EU) 910/2014, in particular Articles 5a and 5c.
• 2. Commission Implementing Regulation (EU) 2024/2981 of 28 November 2024 on the certification of European Digital Identity Wallets, in particular Articles 3-5, 8, 12-14 and 19 and Annexes I-VII.
• 3. Commission Implementing Regulation (EU) 2024/2979 of 28 November 2024 on the integrity and core functionalities of European Digital Identity Wallets.
• 4. Commission Implementing Regulation (EU) 2024/2977 of 28 November 2024 on person identification data issued to European Digital Identity Wallets.
• 5. Commission Implementing Regulation (EU) 2015/1502 of 8 September 2015 on assurance levels for electronic identification means, the Annex, Section 2.4.
• 6. Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 on cybersecurity risk-management measures.
• 7. Commission Implementing Regulation (EU) 2026/798 of 7 April 2026 laying down rules for the application of Regulation (EU) 910/2014 of the European Parliament and of the Council as regards reference standards and specifications for the remote onboarding of users to the European Digital Identity Wallets by electronic identification means conforming to assurance level substantial in conjunction with additional remote onboarding procedures where the combination meets the requirements of assurance level high
• 8. Regulation (EU) 765/2008 on accreditation and market surveillance, in particular Articles 4 and 5.
• 10 In addition, the EUDI Wallet Certification Scheme will comply with:
• 9. [Placeholder for references to NL national law when available]

4 References

4.1 Standards and technical specifications

11	ISO/IEC 17065, Conformity assessment - Requirements for bodies certifying products, processes and services	ISO/IEC 17065, Conformity assessment - Requirements for bodies certifying products, processes and services
12	ISO/IEC 17067, Conformity assessment - Fundamentals of product certification and guidelines for product certification schemes	ISO/IEC 17067, Conformity assessment - Fundamentals of product certification and guidelines for product certification schemes
4.2	Parent documents	Parent documents
13	NL-SYS-01. NL EUDI Wallet certification system	NL-SYS-01. NL EUDI Wallet certification system
14	NL-SYS-02. Vocabulary	NL-SYS-02. Vocabulary
15	NL-SYS-03. Organization and support for the owner of the national EUDI certification system	NL-SYS-03. Organization and support for the owner of the national EUDI certification system
16	NL-SYS-04. Developing and maintaining the risk register for EUDI Wallet implementation and certification	NL-SYS-04. Developing and maintaining the risk register for EUDI Wallet implementation and certification
17	NL-SYS-05. Accreditation requirements for CABs	NL-SYS-05. Accreditation requirements for CABs
4.3	Peer documents	Peer documents
18	NL-FS. EUDI Wallet Functional Certification Scheme	NL-FS. EUDI Wallet Functional Certification Scheme
19	NL-CS. EUDI Wallet Cybersecurity Certification Scheme	NL-CS. EUDI Wallet Cybersecurity Certification Scheme
4.4	Subsidiary Documents	Subsidiary Documents
20	NL-P-01	Org. and Techn. requirements for Wallet & PID providers
21	NL-P-02	Essential Entity Requirements
22	NL-P-03	Development & Vulnerability Mngt Requirements
23	NL-P-W04	Wallet Onboarding & Lifecycle Mngt Requirements
24	NL-P-W04b	Fraud Mngt Requirements

5 Terms and Definitions

• 25 For the purposes of this document, all terms and definitions are provided in NL-SYS02. Vocabulary.

6 Certification Scheme Structure

6.1 Object of Certification

• 26 The object of certification under this scheme is the Provider the electronic identification system under which of European Digital Identity Wallets are provided, as referred to in Article 5c(1) of Regulation (EU) 2024/1183. The certification covers both the scheme-level governance arrangements and the operational services provided by EUDI Wallet Provider and PID Provider.
• 27 The CAB shall assess the conformity of the object of certification against the set of requirements established in the subsidiary documents, as allocated in Table 1 below.
• 28 NOTE: In the context of NL-P-W certification scheme only a certification body is considered as a CAB.

Table 1 Allocation of requirements documents to roles

Document	Title
NL-P-01	Organisational and technical requirements for Wallet & PID providers
NL-P-02	Essential Entity Cyber Resilience Requirements
NL-P-03	Development & Vulnerability Mngt Requirements
NL-P-W04	Wallet Onboarding & Lifecycle Mngt Requirements
NL-P-W04b	Fraud Mngt Requirements

29 NOTE: Whilst the Wallet Provider is assessed as per above requirements, it should be noted that procured wallet solutions should be certified also against correct functional and cybersecure integration with the PID-provider with regard to the PID issuance to the respective wallet units as defined in NL-SYS-01.

6.2 Roles and Responsibilities

6.2.1 Overview of the scheme stakeholders

• 30 The overview of the roles and responsibilities is presented in Table 2.

Table 2 Overview of Roles and Responsibilities

Role	Responsibilities	Normative basis
Scheme Owner	Owns and supervises the scheme; authorises CABs; maintains certificate register; monitors the scheme.	ISO/IEC 17067
CAB	Plans, performs and documents the evaluation; issues the certification decision and certificate of conformity; manages surveillance and recertification activities.	ISO/IEC 17065; NL-SYS- 05
Applicant / Certificate Holder	Submits the eID scheme for certification; provides evaluation evidence; complies with post-certification obligations including surveillance cooperation and change notification.	NL-P-W
National Accreditation Body (NAB)	Accredits CABs in accordance with ISO/IEC 17065 for the relevant scope under this scheme.	Regulation (EC) No 765/2008
Market Surveillance Authorities	Oversight of certified services in the market. This role will be performed by the NL-TL Scheme Owner.	ISO/IEC 17067; NL-TL

6.2.2 Accreditation of CABs

• 31 CABs operating under this scheme shall be accredited by the National Accreditation Body in accordance with ISO/IEC 17065 with a scope covering the NL-P-W and subsidiary documents. The required competences and other accreditation requirements are specified in NL-SYS-05.
• 32 General provisions on CAB accreditation, including requirements for accreditation scope and recognition of accreditation granted by other national accreditation bodies within the EU, are set out in NL-SYS-01 and NL-SYS-05.

6.3 Mechanisms to ensure impartiality

• 33 The CAB is obliged to implement mechanisms to ensure impartiality in accordance with ISO/IEC 17065. General provisions on impartiality requirements are set out in NL-SYS-05.

6.4 Relationship to NL-FS and NL-CS

• 34 NL-P-W is one of the Certification Schemes within the NL-SYS-01 EUDI Wallet Certification System. The NL-FS (EUDI Wallet Functional Certification Scheme) addresses the functional conformity of the wallet application; the Nl-CS (EUDI Wallet Cybersecurity Certification Scheme) addresses the cybersecurity certification of the wallet solution, both considered as a product. These certification schemes define requirements that are assessed and certified independently from NL-P-W, but the resulting certificates constitute a necessary condition for certification under NL-P-W.
• 35 The CAB assessing Wallet Provider, shall, as a part of the evaluation, verify that EUDI Wallet Provider holds valid NL-FS and NL-CS certificates covering the wallet solution(s) and related version(s) in the scope of the NL-P-W assessment. The scheme allows the Wallet Provider to submit declarations that appropriate evaluation and certification processes are in place under NL-FS and NL-CS. The above requirement also covers a declaration of conformity regarding correct integration with the NL PID provider services. The CAB shall assess the scope and currency of these certificates or declarations but is not required to re-evaluate the requirements already covered by them.
• 36 Where a NL-FS or NL-CS certificate or a NL-P-W certificate is suspended, withdrawn or expires, the EUDI Wallet Provider shall notify the Scheme Owner and its NL-P-W CAB without undue delay. The implications for the NL-P-W certificates and the NL-TL certificate are addressed in Section 8.11.

6.5 Relationship to NL-P-01/02/03/04 Subsidiary Documents

• 37 The subsidiary documents of NL-P-W (NL-P-01/02/03 and NL-P-W04/W04b) - constitute the normative substance of the eID Certification Scheme. They specify, respectively:
• NL-P-01 Org. and Techn. requirements for Wallet & PID providers, which describes the management and operational requirements for this essential trust anchors of the NL National eID Scheme.
• NL-P-02 Essential Entity Requirements, which describes --in the spirit of NIS2-- the cyber resilience requirements that Wallet and PID Providers need to meet.
• NL-P-03 Development & Vulnerability Mngt Requirements, which describes --in the spirit of the CRA-- which development and vulnerability management practice need to be met.
• NL-P-W04 Wallet Onboarding & Lifecycle Mngt Requirements, which elaborates requirements that need to be met during the wallet onboarding process as well as during lifecycle events as to ensure Wallet stay under control of the correct citizen.
• NL-P-W04b Fraud Mngt Requirements, which elaborates requirements that should additionally be met to ensure the service has resistance against fraud modus operandi.
• 38 NOTE - Annex A of this document provides the normative allocation of legal requirements to subsidiary documents. This allocation confirms which subsidiary document implements each legal requirement derived from the relevant EU instruments.

6.6 Scheme Type

• 39 This certification scheme follows the Type 6 model as defined in EN ISO/IEC 17067, which includes initial testing and evaluation, surveillance of the service delivery, and periodic re-evaluation. The scheme specifies the elements listed in Section 6.5 of ISO/IEC 17067, in accordance with Article 4(3), point (a) of Commission Implementing Regulation (EU) 2024/2981.

6.7 Use of certification and marks of conformity

• 40 Only the NL EUDI Wallet Mark as defined in NL-SYS-03 shall be used as a mark of conformity for certifications issued under this scheme. No additional marks of conformity shall be defined within the NL-P-W Certification Scheme.
• 41 The common requirements for the use of certification and marks of conformity are set out in NL-SYS-01 and NL-SYS-03.
• 42 The CAB shall be responsible for granting, suspending and withdrawing the right to use the mark of conformity in accordance with the certification decisions it takes under this scheme. Where a certificate is suspended or withdrawn, the EUDI Wallet Provider shall cease using the mark of conformity without undue delay.

7 Evaluation Framework

7.1 General

• 43 This section specifies a general evaluation methodology for CABs to apply when evaluating the conformity of the electronic identification system and services related to this system with the requirements specified in the NL-P-01/02/03 and NL-PW04/W04b.
• 44 The evaluation activities shall follow the process requirements set out in NL-SYS-05 (Section 7), and shall be planned, performed and documented in accordance with the procedures established by the CAB. The evaluation activities shall consider the minimum requirements for evaluating the electronic identification scheme set out in Annex VI of Commission Implementing Regulation (EU) 2024/2981, including the assessment of the risk register.

7.2 Scope of Evaluation

• 45 The scope of the evaluation shall encompass services related to provision and operation of the EUDI Wallet solution in conjunction with the national eID scheme. As a minimum, the evaluation shall cover:
• Org. and Techn. requirements for Wallet & PID providers, which describes the management and operational requirements for this essential trust anchors of the NL National eID Scheme as specified in NL-P-01.
• Essential Entity Requirements, which describes --in the spirit of NIS2-- the cyber resilience requirements that Wallet and PID Providers need to meet as specified in NL-P-02.
• Development & Vulnerability Mngt Requirements, which describes --in the spirit of the CRA-- which development and vulnerability management practice need to be met as specified in NL-P-03.
• Wallet Onboarding & Lifecycle Mngt Requirements, which elaborates requirements that need to be met during the wallet onboarding process as well as during lifecycle events as to ensure Wallet stay under control of the correct citizen, as specified in NL-P-W04
• Fraud Mngt Requirements, which elaborates requirements that should additionally be met to ensure the service has resistance against fraud modus operandi, as specified in NL-P-W04b
• The presence of valid NL-FS and NL-CS certificates covering the wallet solution(s) and related version(s) in the scope of the NL-P-W assessment.
• 46 Where the scheme relies on services provided by third parties (outsourced or subcontracted services), the scope of the evaluation shall extend to those services to the extent that they are material to the fulfilment of the certification requirements.
• 47 Where external assurance evidence is available and evaluated as acceptable in accordance with Section 7.6, the CAB may reduce the extent of its own evaluation activities for the requirements covered by that assurance evidence. The scope of the certification shall not be reduced based on external assurance evidence.

7.3 Evaluation Methods

• 48 The CAB shall use one or more of the following evaluation methods, as appropriate to the nature of the requirement being evaluated.
• Document review - examination of policies, procedures, records, contracts, risk assessments, and other documented information.
• Interview - structured discussions with relevant personnel of the Provider or Scheme Owner to verify understanding, implementation, and operational effectiveness of the requirements;
• Observation - direct observation of processes, systems, facilities, and operational practices at Provider and any other relevant sites;
• Technical testing - testing of technical controls, including vulnerability assessments, configuration reviews, and security testing, as appropriate to the nature and risk level of the systems under evaluation;
• Sampling - where the complete evaluation of all instances of a recurring process is impracticable, the CAB may employ sampling in accordance with the trust justification requirements. The sampling methodology shall be documented in the evaluation plan.
• 49 The CAB shall determine the appropriate combination of evaluation methods for each evaluation activity, considering the nature of the requirement, the level of risk, the maturity of the Provider's management systems.

7.4 Types of evidence

• 50 The CAB shall obtain sufficient and appropriate evidence to support its evaluation conclusions. Evidence may include, but is not limited to documented policies, procedures and records maintained by the Provider;

• system configurations and technical documentation for the entire product and/or service provided by the Wallet Provider, comprising of the Wallet Instance components operating on the user's device, of the WSCA/WSCDenvironment and of additional related back-end server components managed by the Wallet Provider (including user account management, Wallet Unit and Key Attestation issuance services, wallet validation services and possible communication interfaces with PID Providers and other systems in the National eID eco-system);

• results of technical testing and security assessments;

• audit trails and log records from the server-side infrastructure operated by the Wallet Provider in the live operational environment - that is, systems serving real users in authentic transactions, as distinct from test, pilot, or reference environments - including back-end systems for Wallet Unit activation and management, PID and attestation issuance and revocation, event logging, and interfaces with other EUDI Wallet ecosystem components;

• valid certificates issued under NL-FS and NL-CS covering the wallet solution or the Wallet Provider declaration that evaluation and certification processes under NL-FS and NL-CS are in place.

• external assurance evidence evaluated in accordance with Section 7.6;

• statements, explanations, and demonstrations provided by Wallet Provider, PID Provider and Scheme Owner personnel;

• results of sampling activities;

• reports from previous evaluations or certifications, including any regulatory or supervisory assessments.

• 51 The CAB shall document the evidence obtained and shall retain it in accordance with the record-keeping requirements set out in NL-SYS-01, section 5.10.

7.5 Proportionality

• 52 In the application of the requirements, the following principles of proportionality shall apply:
• I. All requirements derived from Commission Implementing Regulation (EU) 2015/1502, Section 2.4, shall be understood as commensurate to the risks at assurance <identity proofing> level High, in accordance with the introductory provision of that section.
• All requirements derived from Commission Implementing Regulation (EU) 2024/2690 shall be applied taking due account of the degree of Wallet Provider exposure to risks due to the functionalities it supports, accesses/exchanges it enables, attack surface it is exposed to and the likelihood of occurrence of incidents and their severity, in accordance with Article 2(2) of that regulation.
• Where Commission Implementing Regulation (EU) 2024/2690 provides that a technical or methodological requirement shall be applied "where appropriate", "where applicable" or "to the extent feasible", and Wallet Provider considers it not appropriate, not applicable or not feasible, the Wallet Provider shall document its rationale in a comprehensive manner. The CAB shall evaluate the adequacy and substantiation of such rationale.
• 53 The CAB shall consider the risk register content (meeting the minimum content requirements specified in NL-SYS-04) when determining the depth and focus of the evaluation activities, giving particular attention to risks arising from the integration of their Wallet(s) with the NL PID-provider.

7.6 Acceptability and re-use of assurance evidence

• 54 NOTE 1: The rules for acknowledging evidence from external sources are specified in NL-SYS-01, section 5.3.

• 55 In accordance with Article 13(1), point (f) of Commission Implementing Regulation (EU) 2024/2981 and Annex VI thereof, the CAB shall, as part of the evaluation, evaluate the acceptability of assurance evidence provided by the Wallet Provider or the Scheme Owner.

• 56 The CAB decision on acceptability and further re-use of assurance evidence shall be made in compliance with general rules specified in NL-SYS-01, section 5.3 and detailed rules presented below.

• 57 Assurance evidence, if applicable, may be presented to the CAB as evidence of conformity with the requirements of the subsidiary documents, subject to the evaluation criteria below:

• Certificates of conformity issued under ISO/IEC 27001 by a certification body accredited by a Dutch Accreditation Body, in accordance with ISO/IEC 17021-1.

• Certificates of conformity issued under ETSI EN 319 411-1 or EN 319 411-2 for qualified trust service providers, by a conformity assessment body accredited in accordance with ISO/IEC 17065 by a relevant National Accreditation Body.

• Certificates of conformity or evaluation reports issued under European or national cybersecurity certification schemes (such as EUCC, or a scheme based on EN 17640 if legal rules referring to mutual recognition exist).

• Other assurance reports or certificates issued under recognised standards or frameworks, provided they meet the evaluation criteria set out in section 7.7

7.7 Evaluation criteria

• 58 The CAB shall evaluate the acceptability of assurance evidence in accordance with the methodology set out in Annex VI of Commission Implementing Regulation (EU) 2024/2981 and the criteria in Annex II thereof. The evaluation shall address at a minimum the following dimensions:
• Issuer competence and impartiality. The CAB shall verify the professional competence and impartiality of the body or person that issued the assurance report or certificate, according to Section 7.6. For certification bodies, accreditation under the relevant standard (ISO/IEC 17021-1, ISO/IEC 17065, or equivalent) by a national accreditation body appointed pursuant to Regulation (EC) No 765/2008 shall be verified.
• Scope adequacy. The CAB shall verify that the scope of the assurance documentation covers the services, processes, controls, and systems that are relevant to the requirements being evaluated under this certification scheme.

EXAMPLE 1: ISO/IEC 27001 certification attests to the conformity of the information security management system itself (the processes of establishing, implementing, maintaining and continually improving the ISMS); it does not, on its own, provide sufficient assurance that the individual controls selected in the statement of applicability are designed and operating at the level of rigour required by this scheme. The CAB shall therefore perform its own evaluation of the design and operating effectiveness of the specific controls required by the NLP-W subsidiary documents, even where an ISO/IEC 27001 certificate is in place.

• Timeliness. The assurance evidence shall be up to date at the time of evaluation. Certificates shall be within their validity period. Assurance reports shall cover a reporting period that is sufficiently recent to provide confidence that the controls described remain in operation. Where a gap exists between the end of the reporting period and the date of the evaluation, the CAB shall perform its own supplementary evaluation of the period not covered.
• Rigor and depth of evaluation. The degree of confidence provided by the assurance documentation shall be commensurate with the criticality of the requirements it covers. The CAB shall consider the rigor of the evaluation methodology applied, the depth of testing performed, and the nature of the assurance opinion or conclusion expressed.
• Findings and exceptions. The CAB shall review any findings, qualifications, exceptions, or caveats noted in the assurance evidence. Where material findings exist, the CAB shall determine whether they are relevant to the requirements of this scheme and, if so, whether they have been adequately addressed.
• 59 NOTE 1: For the cases specified in Clauses II and III, the CAB shall document the scope and results of any supplementary or alternative testing performed and shall ensure that these are included in the certification records.
• 60 EXAMPLE 2: See the outcome from Example 1. In case of ISO/IEC 27001, the CAB performs its own evaluation of the design and operating effectiveness of the specific controls required by the NL-P-W subsidiary documents, even where an ISO/IEC 27001 certificate is in place.

8 Certification Process

8.1 General

61 The NL-P-W certification process is divided into three main phases: a preparation and application phase, an evaluation phase, and a certification phase. Each phase is described in the subsections below.

62 The evaluation methodology applicable to each phase is set out in Section 7 of this document. The certification process shall be conducted in accordance with the procedures established by the CAB under NL-SYS-01 and NL-SYS-05.

8.2 Preparation and application phase

63 NOTE: this phase reflects ISO/IEC 17065, 7.2 and 7.3.

64 The following documents and information are required from the Applicant prior to commencement of the evaluation:

• a description of the Wallet Provider's environment and systems, including the governance structure, the scope of services, and the organisational arrangements and if appropriate;
• documentation demonstrating compliance with NL-P-W subsidiary requirement documents, including policies, procedures, risk assessments, and records relevant to the evaluation scope;
• valid certificates issued under NL-FS and NL-CS covering the wallet solution version(s) in scope or declarations if evaluation and certification processes under NL-FS and NL-CS are in place;
• any available external assurance evidence (e.g. ISO/IEC 27001 certificates, audit reports) that the Applicant intends to present for reliance under Section 7.6;
• the completed application form as distributed by the CAB in accordance with its internal procedures.

65 The Applicant may submit the application form under NL-P-W separately, or as a combined application covering multiple certification schemes within the NL EUDI Wallet Certification System, in accordance with NL-SYS-01.

8.3 Evaluation phase

66 NOTE: this phase reflects PN-EN ISO/IEC 17065, 7.4.

8.3.1 Kick-off meeting

67 A kick-off meeting shall be held no later than 10 working days after receipt of a complete application and all required documentation. All parties involved in the evaluation - the Applicant, representatives of the Scheme Owner and the CAB - shall attend the kick-off meeting.

• 68 At the kick-off meeting, the CAB shall agree with the Applicant the evaluation plan, including the scope and schedule of evaluation activities, the reliance determination approach for any external assurance evidence, and the arrangements for on-site visits and interviews.

8.3.2 Evaluation

• 69 The evaluation shall be conducted in accordance with the evaluation methodology specified in Section 7 and the applicable WM-03 audit framework. The CAB shall document all evaluation activities, evidence obtained, and findings in an Evaluation Report.
• 70 Where substantial findings arise during the evaluation that may prevent a positive certification decision, the CAB shall notify the Applicant without undue delay. The Applicant may provide additional information or clarification in response to such findings within the timeframe agreed at the kick-off meeting.
• 71 The Evaluation Report shall contain an overall assessment of conformity with each requirement stemming from the subsidiary documents, the reliance determination for any external assurance evidence used, and a recommendation for the certification decision.

8.4 Certification phase

72 NOTE: This phase reflects ISO/IEC 17065, 7.5 -7.7 and 7.13.

73 After reviewing of the evaluation results, the CAB shall complete the certification decision and inform the Applicant of the outcome within 5 working days. If the certification decision is positive, the certificate of conformity shall be issued no later than 14 working days after the decision.

• 74 Appeals and complaints shall be dealt with in accordance with the general provisions contained in NL-SYS-01.
• 75 If the certification decision is negative, the Applicant has 14 working days to lodge a written complaint with the CAB. The CAB shall process the complaint and issue a final decision within 14 working days of receipt of the objection.
• 76 In case of no objection by the applicant, the publication procedure, if applicable, commences immediately after the declaration.

8.5 Evaluation and certification efforts

• 77 The indicative workload for carrying out the evaluation and certification under NL-P-W is presented in Table 3. These estimates cover the initial certification. Surveillance and recertification activities are specified in Sections 8.8 and 8.9 of this document.
• 78 The values listed in Table 3 are maximum and planned values, and they may be subject to change upon agreement with the Scheme Owner.

Table 3 Planned evaluation and certification efforts

Phase	Planned CAB effort
Evaluation	30 working days
Certification	15 working days

8.6 Additional provisions

• 79 The certificate of conformity is valid for four years from the date of issuance.

• 80 The CAB shall archive all evidence relevant to the certification, in accordance to and for a period specified in NL-SYS-01, section 5.10.

• 81 Exchange of information between the CAB and the Applicant shall be secured using state-of-the-art cryptographic mechanisms approved by the Scheme Owner. The requirements for maintaining and disseminating the list of applicable mechanisms are specified in NL-SYS-93, Section 9.2.2.

8.7 Certificate of conformity

• 82 Upon successful completion of the evaluation, the CAB shall issue a certificate of conformity specifying:
• the object of certification
• the scope of the certification, with explicit reference to each of the NL-P-W subsidary documents;
• name of PID Provider Provider;
• the version(s) of the wallet solutions in scope;
• the validity period of the certificate (not to exceed four years);
• any conditions, limitations or exceptions attached to the certificate.
• 83 The CAB shall notify the Scheme Owner of the issued certificate within five working days of issuance, in accordance with the procedure established in NL-SYS-03.
• 84 Before issuing the certificate of conformity, the CAB shall verify that the applicant holds valid certificates issued under the applicable NL-FS andNL-CS certification schemes covering the wallet solution version(s) subject to the NL-P-W evaluation. The CAB shall not issue a NL-P-W certificate of conformity where any required NL-FS or NL-CS certificate is absent, expired, suspended or withdrawn.

8.8 Surveillance

• 85 NOTE 1: The rules for conducting surveillance activities are specified in NL-SYS-01, section 5.4.
• 86 Throughout the period of validity of the certificate, the CAB shall conduct annual surveillance activities to verify that the certification holder continues to meet the certification requirements. Surveillance shall include, at a minimum:
• review of material changes to the wallet solution, its components, or the organizational arrangements of the Wallet Provider as duly notified towards the CAB.
• review of any incidents or security breaches as duly notified towards the CAB;
• review of any updates to NL-P-W and subsidiary documents and their implications;
• review of the impact of any updates to NL-P-P and subsidiary documents and their implications
• targeted evaluation activities as determined by the CAB, based on the risk register (meeting the minimum content requirements specified in NL-SYS-04) and any intelligence gathered during the surveillance period;
• verification that the wallet solution continues to hold valid certificates under the applicable NL-FS and NL-CS certification schemes pursuant to NL-SYS-01;
• I. follow-up on any non-conformities, observations or conditions previously identified by the CAB-CB, to verify that corrective actions have been implemented effectively.
• 87 NOTE 2- The certification life cycle presented in Table 4 and the surveillance activities are primarily applicable to service certification under the NL-P-W scheme,

the surveillance activities to product certification are specified in the applicable scheme documents (i.e., NL-FS and NL-CS).

• 88 CAB-CB shall conduct surveillance activities throughout the life cycle of certification, including at least the following:
• perform a full evaluation of the object of conformity assessment in the initial evaluation and each recertification evaluation, including any updates to its components;
• conduct a vulnerability assessment during the initial evaluation, each recertification, and at least every two years during surveillance activities. The assessment shall, at a minimum, address changes to the object of certification and the threat environment since the previous assessment;
• perform additional activities such as penetration testing, where the risk level increases or the new threats emerge;

Table 4 4-year certificate life cycle in NL-P-W

Year	Type of activity	Mandatory activities
0	Initial certification	· Full evaluation of the provisioning of the wallet solution(s), including vulnerability assessment · Evaluation of the maintenance processes, excluding their operating effectiveness · Granting of certification and start of the 4-year cycle
1	Surveillance	· Evaluation of the operating effectiveness of the maintenance processes · At least version check, update, vulnerability management · Evaluation of changes impacting the security of the solution(s)
2	Surveillance	· Vulnerability assessment of the full solution · Evaluation of the operating effectiveness of the maintenance processes- At least version control, update, vulnerability management · Evaluation of changes impacting on the security of the solution(s)
3	Re-certification	· Full re-evaluation. · Full evaluation of the object of certification, including vulnerability assessment · Simplified evaluation for features/processes that have not changed including a feature to perform updates on each software component · Evaluation of the maintenance processes, including their operating effectiveness · Granting a new certification

89 Each surveillance activity shall be conducted within 12 months of the issuance of certificate and thereafter within 12 months of the previous surveillance activity. Recertification shall be conducted within 12 months after the last surveillance activity.

8.9 Recertification

• 90 Recertification shall be initiated before the expiry of the current certificate and shall follow the process for initial certification set out in Section 8. Recertification can rely on assurance evidence from the surveillance activities conducted during the validity

period, and the CAB may reduce the scope of its evaluation activities accordingly, in accordance with Section 7.6.

• 91 Recertification is also required where a major change occurs to the electronic identification scheme, including a change of wallet solution version where the new version is not covered by the existing certificate; a change to the organisational structure of Provider or a material change to the Trust Framework established under NL-SYS-03.
• 92 All relevant activities related to recertification shall be undertaken by the Wallet Provider and the relevant CABs in a timely manner. The Applicant shall notify the CAB of the need for recertification no later than six months before the expiry of the current certificate.

8.10 Suspension, Termination or Withdrawal of certificate

93 General provisions included in NL-SYS-01 sections 5.7 and 5.8 apply.

• 94 The CAB shall suspend a NL-P-W certificate in the following circumstances:
• The Wallet Provider fails to implement corrective actions within the agreed time following a non-conformity identified during surveillance;
• The Wallet Provider's prerequisite NL-FS or NL-CS certificate is suspended or revoked
• A significant incident or security breach is notified that can impact conformity, pending the outcome of an impact assessment;
• I. The Wallet Provider fails to cooperate with or provide access for surveillance activities.
• 95 NOTE - The timeframe for implementing corrective actions referred to in the first suspension ground shall be agreed in writing between the CAB and Wallet Provider at the time the non-conformity is notified. The CAB shall determine an appropriate timeframe considering the nature and severity of the non-conformity, in accordance with the provisions of NL-SYS-05. The CAB shall document the agreed timeframe in the Surveillance Report.
• 96 The suspension period shall not exceed 45 days. Any extension shall be subject to the Scheme Owner decision but in any case, may not exceed one 90 days. The suspension period does not affect the validity period of the certificate.
• 97 The CAB shall withdraw a NL-P-W certificate in the following circumstances:
• The Wallet Provider fails to remedy the conditions leading to suspension within the time specified by the CAB;
• A confirmed non-conformity is established that cannot be remedied within a reasonable time;
• 98 CAB-CB shall terminate the certificate on request of Wallet Provider.
• 99 In all cases of suspension, termination or withdrawal, the CAB shall notify the Scheme Owner without undue delay. The Scheme Owner shall update the Certificate Register in accordance with the obligations specified in NL-SYS-03.

8.11 Implications of NL-FS / NL-CS Certificate Changes

• 100 Where a Wallet Provider's Wallet Solution NL-FS or NL-CS certificate is suspended or revoked, the NL-P-W CAB shall:

• initiate an impact assessment to determine in what degree the suspension affects the conformity of the certified eID scheme with the WZ-03 and WP-03 requirements of the Wallet Provider (which might have other still un-suspended wallet solutions);

• where the impact assessment concludes that conformity is materially affected, suspend the NL-P-W certificate of the Wallet Provider with regards to the Wallet Solution affected, pending resolution;

• where the impact assessment concludes that conformity is not materially affected, document the reasoning and continue monitoring.

• where a Wallet Provider's Wallet Solution NL-FS or NL-CS certificate is withdrawn, the NL-P-W certificate shall be suspended immediately as with regards to the revoked Wallet Solution related services, pending recertification following restoration of the NL-FS or NL-CS certificate of that Wallet Solution.

9 Final provisions

9.1 National legislation

101 The NL-P-W Certification Scheme is established pursuant to national legislation implementing the eIDAS Regulation in The Netherlands, in accordance with the legal instruments listed in Section 3 of this document.

9.2 Certification contracts

• 102 The CAB shall conclude a certification contract with the Applicant based on the provisions of NL-P-W. Contractual arrangements may be imposed by the Scheme Owner.
• 103 The certification contract shall not contain provisions that would obstruct the correct conduct of the certification or the transfer of information relevant to the certification decision between the Applicant and the CAB.

9.3 Costs

104 All costs shall be based on actual certification efforts.

Annex A (Normative) - Allocation of Requirements to Subsidiary Documents

105 NOTE: This Annex provides the normative allocation of legal requirements - derived from the instruments listed in Section 3 - to the subsidiary documents of NL-P-W. This allocation is the basis for the evaluation scope defined in Section 7.2 of this document. Requirements applicable specifically to Wallet Provider are located in the subsidiary documents and are not separately listed in this Annex; they are derived from the same legal instruments referenced below.

A.1 Requirements from Regulation (EU) 2024/1183

Identifier Requirement
REQ-910-01 EUDIW shall enable users to securely manage PID and EAAs under sole user control. [Art. 5a(4)(a)] → NS-FS and NL-CS as-well-as NL-P-W04 / NL-P-W04B
REQ-910-02 EUDIW shall enable users to download their data and configurations. [Art. 5a(4)(f)] → NS- FS and NL-CS
REQ-910-03 EUDIW shall meet P-01 AND NL-P-02 AND NL-P-03 as-well-as NL-P-P04 / NL-P-P04B and NL-P-W04 / NL-P- W04B
REQ-910-04 PID shall uniquely represent the natural person. [Art. 5a(5)(f)] → NL-P-W04 / NL-W-P04B
REQ-910-05 Personal data of as-well-as NL-P-01 AND NL-P-02 AND NL-P-03 as-well-as NL-P-P04 / NL-P-P04B and NL-P- W04 / NL-P-W04B
REQ-910-06 Users onboarded using assurance level High eID means. [Art. 5a(24)] → NL-P-P04 / NL-P- P04B

A.2 Requirements from CIR (EU) 2015/1502

Identifier	Requirement
REQ-1502-2.1	Enrolment requirements at assurance level High. [Annex 2.1] → NL-P-P04 / NL-P-P04B
REQ-1502-2.2	eID means management at assurance level High. [Annex 2.2] → NL-P-P04 / NL-P-P04B as-well-as NL-P-W04 / NL-P-W04B
REQ-1502-2.4.1	Legal status, financial capacity, outsourcing. [Annex 2.4.1] → NL-P-01 AND NL-P-02 AND NL-P-03 as-well-as admission criteria
REQ-1502-2.4.2	Published notices and user information. [Annex 2.4.2] → NL-P-01 and NL-P-03
REQ-1502-2.4.3	Information security management system. [Annex 2.4.3] → NL-P-01 AND NL-P-02 AND NL- P-03
REQ-1502-2.4.4	Record keeping. [Annex 2.4.4] → NL-P-01 AND NL-P-02 AND NL-P-03
REQ-1502-2.4.5	Facilities and staff. [Annex 2.4.5] → NL-P-01 AND NL-P-02
REQ-1502-2.4.6	Technical controls. [Annex 2.4.6] → NL-P-01 AND NL-P-02
REQ-1502-2.4.7	Compliance and audit. [Annex 2.4.7] → NL-P-01 AND NL-P-02 AND NL-P-03

A.3 Requirements from CIR (EU) 2024/2977

Identifier	Requirement
REQ-2977-3	PID issuance technical requirements. [Art. 3] → NL-P-P04 / NL-P-P04B
REQ-2977-5	PID validity status management and revocation. [Art. 5] → NL-P-P04 / NL-P-P04B

A.4 Requirements from CIR (EU) 2024/2979

Identifier	Requirement
REQ-2979-3,4	Wallet unit attestation issuance. [Art. 3, 4] → NL-FS and NL-CS as-well-as NL-P-W04 / NL- P-W04B
REQ-2979-6,7	Wallet provider obligations - user information, revocation. [Art. 6, 7] → NL-P-W04 / NL-P- W04B
REQ-2979-9,13	Logging and data portability. [Art. 9, 13] → NL-P-W04 / NL-P-W04B

A.5 Requirements from CIR (EU) 2024/2981

Identifier	Requirement
REQ-2981-4	Risk assessment and security criteria. [Art. 4, 8] → NL-CS, NL-P-01 AND NL-P-02 AND NL- P-03
REQ-2981-5	Incident and vulnerability management. [Art. 5] → NL-P-01 AND NL-P-02 AND NL-P-03
REQ-2981-8(3)(g)	Use of currently certified wallet solution version. [Art. 8(3)(g)] → NL-CS and NL-P-W04 / NL-P-W04B
REQ-2981-19	Record retention. [Art. 19] → NL-P-01 AND NL-P-02 AND NL-P-03

A.6 Requirements from CIR (EU) 2024/2690

Identifier	Requirement
REQ-2690-Annex	Technical and methodological cybersecurity requirements. [Annex, Sections 1-13] → NL-CS as-well-as NL-P-01 AND NL-P-02 AND NL-P-03

Annex B (Normative) ⎯ Audit framework

B.1 Purpose

• 106 This annex sets out common framework for planning, conducting and documenting cybersecurity audits performed by a Conformity Assessment Body under the NL-P-W eID Certification Scheme thus creating evaluation methodology for the scheme
• 107 The annex maps the audit-related approach of ETSI EN 319 403-1 into the structure of the NL EUDI Wallet Certification System and provides a consistent basis for CAB elaborated audit frameworks
• 108 The document specifies universal audit principles, methods, sampling, competence, evidence gathering, reporting and corrective action follow-up. It does not define how individual requirements from technical specifications, including ETSI EN 319 401, implementing acts or other criteria are to be tested.

B.2 Scope

• 109 This framework applies to cybersecurity audits conducted within the NL-P-W evaluation phase. The object of certification is the electronic identification system, elated services and processes.
• 110 The framework is applicable to :
• ⎯ initial evaluation audits;
• ⎯ annual surveillance audits;
• ⎯ re-evaluation audits;
• ⎯ special audits triggered by significant changes, incidents, complaints or other substantiated information; or by audits of outsourced services, subcontracted processes or separately evaluated components to the extent material to the certification requirements.
• 111 The framework shall be applied to the extent appropriate to the nature, risk and scope of the evaluation activity.
• 112 The scope of evaluation shall not be reduced solely because external assurance evidence is available. External evidence may reduce the extent of the CAB's own audit activities only after a documented determination of reliance.

B.3 References, terms and roles

B.3.1 References

• 113 ISO/IEC 17065 - Conformity assessment - Requirements for bodies certifying products, processes and services;
• 114 ETSI EN 319 403-1 - Trust Service Provider Conformity Assessment - Requirements for conformity assessment bodies assessing Trust Service Providers;
• 115 NL-SYS-01 NL EUDI Wallet Certification System;
• 116 NL-SYS-05 Accreditation requirements for CABs;
• 117 NL-P-W Certification Scheme;
• 118 NL-P-W applicable subsidiary requirement documents

B.3.2 Roles and responsibilities

• 119 Relevant roles and responsibilities are presented in Table 1 in this annex.

Table 1 Roles and responsibilities in the cybersecurity audit framework

Role	Responsibilities
CAB	The certification body accredited and authorised to perform NL-P-W conformity assessment and certification activities.
Applicant / Certificate Holder	The entity that applies for or holds NL-P-W certification.
Provider	EUDI Wallet Provider
Object of certification	The electronic identification system and related services defined by NL-P-W.
Audit Team	One or more auditors appointed by the CAB or its subcontractor, supported by technical experts, if necessary.
Audit Team Leader	The auditor responsible for managing the audit and reporting findings to the CAB.
Technical Expert	A person providing specialist knowledge to the Audit Team who does not act independently as an auditor.

B.3.3 Terms specific to cybersecurity audit framework

• 120 The terms and their definitions presented in Table 2 apply.

Table 2 Terms and definitions

Term	Definition
Audit criteria	The applicable requirements from NL-SYS-, NL-P-, legal acts, standards and specifications.
Objective evidence	Verifiable information supporting the fulfilment or non-fulfilment of an audit criterion.
External assurance evidence	A certificate, report, evaluation result or other evidence produced outside the current NL-P-W evaluation and submitted for possible reliance.

B.4 General audit principles

• 121 Audits shall be planned and conducted in a way that ensures impartiality and consistency and protects confidential information.
• 122 Audit conclusions shall be based on sufficient and appropriate objective evidence.
• 123 The depth and scope of audit activities shall be proportionate to risk, the criticality of the requirement, the maturity of the relevant controls and the results of previous audits.
• 124 Audit Team shall not prescribe a particular implementation or documentation format unless explicitly required by the audit criteria.
• 125 Statements and explanations shall be corroborated by records, observations, interviews, testing results or other objective evidence where necessary.
• 126 Audit Team shall assess the design and operational effectiveness of controls where the applicable requirement concerns both their existence and their functioning.
• 127 The audit shall consider the risk register maintained by the EUDI Wallet Provider or by the Scheme Owner and other risk information relevant to the object of certification

when selecting audit trails, samples, sites and technical focus areas.

B.5 Audit objectives, scope and time

B.5.1 Audit objectives

• 128 For each audit, the CAB shall define objectives appropriate to the evaluation activity.
• 129 NOTE: Objectives may include:
• ⎯ Assess conformity with the requirements applicable to the approved scope;
• ⎯ check whether controls are implemented, and operate effectively;
• ⎯ confirming continued conformity during surveillance;
• ⎯ evaluating the impact of a significant change or incident;
• ⎯ tracking resolutions of previously detected nonconformities;
• ⎯ obtaining evidence required for re-assessment, extension, reduction or another scheme decision.

B.5.2 Audit scope

• 130 The audit scope shall include, as applicable:
• ⎯ the part of the electronic identification system and related services to be evaluated;
• ⎯ the Applicant organisations and organisational units included in the audit;
• ⎯ the NL-P-W subsidiary requirements and versions included in the audit criteria;
• ⎯ processes, systems, components, interfaces, data flows and operational environments;
• ⎯ physical and logical sites;
• ⎯ outsourced and subcontracted activities;
• ⎯ the period from which records and samples are to be selected;
• ⎯ any accepted limitations or exclusions and their justification.
• 131 The scope and boundaries shall be clear enough to avoid ambiguity regarding the organisations, services, processes, systems and sites subject to audit.
• 132 Where outsourced or subcontracted services are material to fulfilment of the certification requirements, the audit scope shall extend to those services or shall obtain sufficient equivalent assurance concerning them.

B.5.3 Audit time

• 133 The CAB shall allocate sufficient time for preparation, evidence review, audit activities, reporting and follow-up. To specify audit time the CAB shall consider at least:
• ⎯ the number and complexity of applicable requirements;
• ⎯ the size and complexity of the object of certification and the participating Provider organisations;
• ⎯ the number of sites, systems, interfaces and outsourced services;
• ⎯ the diversity and volume of transactions or recurring processes;
• ⎯ the use of automation, cryptography, biometrics, remote onboarding or other specialist technologies;
• ⎯ results of previous evaluations, incidents and changes;
• ⎯ the availability and acceptability of external assurance evidence;
• ⎯ the need for specialist technical expertise;
• ⎯ the use of on-site and remote techniques.
• 134 The CAB shall document specification and justification of audit time.
• 135 NOTE: Guidelines for determining audit time for management system audits are provided in the standard ISO/IEC 27006-1 "Requirements for bodies providing audit

and certification of information security management systems - Part 1: General", Annex D.

• 136 Commercial or scheduling constraints shall not reduce audit time below the level necessary to obtain sufficient and appropriate evidence.

B.6 Audit planning and kick-off

• 137 The CAB shall prepare an audit plan based on the objectives, scope, risk, available evidence and competence requirements.
• 138 The audit plan shall specify at least:
• ⎯ audit objectives, scope and criteria;
• ⎯ Audit Team members and roles;
• ⎯ dates, locations, timetable and mode of audit activities;
• ⎯ planned audit trails and principal samples;
• ⎯ interviews, observations and technical activities;
• ⎯ use of remote techniques and security arrangements;
• ⎯ arrangements for opening, progress and closing meetings;
• ⎯ reporting and communication arrangements.
• 139 The audit plan shall be agreed with the Applicant or Certificate Holder without transferring responsibility for audit design to the audited parties.
• 140 A kick-off or opening meeting shall confirm the scope, timetable, responsibilities, communication channels, access arrangements, reliance approach and handling of substantial findings.
• 141 Changes to the plan during the audit shall be documented and communicated to the relevant parties.

B.7 Audit methods and techniques

• 142 The CAB shall select an appropriate combination of methods for each evaluation activity. Criteria-specific

B.7.1 Documentation review

• 143 NOTE: Documentation review may cover policies, procedures, practice statements, contracts, risk assessments, architectural descriptions, technical specifications, configurations, records, logs, internal audit reports, management reviews, test reports and prior evaluation evidence.
• 144 Documentation review shall be used to understand the design of the audited arrangements and to prepare subsequent audit trails.

B.7.2 Interviews

• 145 Interviews shall be conducted with personnel whose roles and responsibilities are relevant to the audit scope. Questions shall seek to establish actual practice, responsibility, competence and awareness and shall be corroborated where appropriate.

B.7.3 Observation and inspection

• 146 NOTE: Observation can include processes, facilities, security controls, system operation, administrative activities and technical demonstrations. Inspection can be performed on-site or through controlled remote access.

• 147 The Audit Team shall agree access, recording, screenshot, copying and confidentiality arrangements before inspection activities begin.

• 148 Audit activities shall avoid unnecessary disruption and not introduce unacceptable risk to production services or personal data.

B.7.4 Analysis of records, logs and transactions

• 149 NOTE: The Audit Team may analyse logs, audit trails, transaction records, change records, incident records and other operational evidence to confirm execution, authorisation, traceability, integrity and effectiveness of the relevant processes.

B.7.5 Testing and technical verification

• 150 NOTE: Technical verification can include controlled demonstrations, configuration review, test-case execution, re-performance, interface verification or review of specialist security testing.
• 151 Intrusive testing shall be separately authorised and performed by competent personnel under controlled conditions.

B.7.6 Remote audit techniques

• 152 NOTE: Remote techniques may be used where they provide evidence of sufficient reliability and completeness and are permitted by the applicable scheme and criteria.
• 153 The plan shall define the tools, authentication, transmission security, recording rules and contingency arrangements used for remote audit activities.
• 154 Where remote techniques do not provide sufficient evidence, the Audit Team shall perform additional on-site or alternative activities.

B.8 Audit evidence and sampling

B.8.1 Sufficiency and appropriateness

• 155 The Audit Team shall obtain sufficient and appropriate evidence to support each audit conclusion.
• 156 Evidence shall be relevant to the requirement, reliable in origin and method, sufficiently current and traceable to the audited scope.
• 157 The absence of a particular document shall not in itself establish nonconformity unless the criterion requires that document. Conversely, the existence of documentation alone shall not establish operational effectiveness.

B.8.2 Sampling

• 158 Sampling may be used where examination of every instance is impracticable.
• Sampling shall be risk-based, documented and appropriate to the objective of the audit.
• 159 NOTE: Sample selection should consider:
• ⎯ high-risk and critical processes;
• ⎯ different process variants and technologies;
• ⎯ successful, failed, rejected, exceptional and escalated cases;
• ⎯ incidents, complaints, anomalies and fraud indicators;
• ⎯ different periods, sites, systems, providers and operational teams;
• ⎯ recent changes and software or configuration versions;
• ⎯ both selective and non-selective elements.
• 160 The CAB shall document the population, selection method, sample size, items selected and limitations of the sample.

B.8.3 Multiple sites

• 161 A sample-based multi-site approach may be used only where the relevant sites operate under common control and a common management and review framework.

• 162 Site selection shall consider differences in size, activity, technology, risk, legal requirements, working practices, subcontracting and interaction with critical or sensitive systems.

• 163 Sites presenting significant risk or material differences shall be included in the audit programme.

• 164 A finding at one site shall be assessed for possible systemic impact on other sites.

B.9 External assurance evidence

• 165 External assurance evidence may be used to reduce duplicate evaluation activity, but only after a documented assessment in accordance with NL-P-W. The CAB remains fully responsible for its evaluation conclusions and certification decision.

B.9.1 Acceptability assessment

• 166 For each item of external assurance evidence, the Audit Team shall assess at least:
• ⎯ issuer competence, independence and accreditation where applicable;
• ⎯ scope adequacy and correspondence with the current object of certification;
• ⎯ timeliness and continued validity;
• ⎯ rigour and depth of the method applied;
• ⎯ findings, qualifications, exceptions and limitations;
• ⎯ the period, versions, sites, systems and controls covered;
• ⎯ the need for supplementary audit activity.

B.9.2 Use of external assurance evidence in audit planning and execution

• 167 The Audit Team shall assess the extent to which external assurance evidence supports the applicable audit criteria and shall identify any requirements, aspects or periods not sufficiently covered by that evidence.
• 168 Based on this assessment, the Audit Team shall identify the supplementary audit activities necessary to obtain sufficient and appropriate evidence.
• 169 The Audit Team shall document its assessment of the external assurance evidence, identified limitations and proposed supplementary activities in the audit records and Audit Report.
• 170 The formal determination of full reliance, partial reliance or no reliance shall be made by the CAB in accordance with NL-SYS-01, Section 5.3, and Sections 7.6 and 7.7 of NL-P-W and is not determined by the Audit Team under provisions specified in this document.

B.10 Audit Team competence, independence and outsourcing

B.10.1 Collective competence

• 171 The Audit Team shall collectively possess competence appropriate to the scope, including as applicable:

• ⎯ the PL EUDI Wallet Certification System and NL-P-W;

• ⎯ applicable legal, regulatory, normative and scheme requirements;

• ⎯ information security management, cybersecurity and network security;

• ⎯ risk assessment and risk management;

• ⎯ electronic identification, PID, EUDI Wallet and authentication processes;

• ⎯ cryptography, PKI, secure components and protocols;

• ⎯ identity proofing, remote onboarding, biometrics and fraud prevention;

• ⎯ audit principles, methods, sampling, evidence evaluation and reporting;

• ⎯ the technologies and operational processes included in the audit scope.

• 172 Criteria-specific WM-03-0x documents shall identify any additional specialist competence required for their application.

B.10.2 Audit Team Leader and technical experts

• 173 The Audit Team Leader shall have sufficient audit experience and knowledge of the applicable criteria to manage the audit and consolidate the findings.
• 174 Technical experts may advise auditors on specialist matters but shall not act as the sole evaluator of conformity or take the certification decision.

B.10.3 Outsourcing of audit activities

• 175 Audit activities may be outsourced only where permitted by NL-SYS-01, NL-SYS-05, NL-P-W and the applicable normative framework.
• 176 The CAB shall define the scope of outsourcing, competence requirements, confidentiality, reporting obligations and access to records.
• 177 The CAB shall retain responsibility for the audit, evaluation conclusions and certification decision.
• 178 The CAB shall review and accept outsourced outputs before using them as evaluation evidence.

B.11 Audit process

• 179 NOTE: The audit forms part of the NL-P-W evaluation phase. The process below does not replace the preparation and application or certification phases defined in NL-P-W.

B.11.1 Initial and re-assessment audits

• 180 NOTE: Initial and re-assessment audits should normally comprise Stage 1 and Stage 2. The sequence may be adapted where justified and permitted by NL-SYS-05 and the audit plan.

B.11.2 Stage 1 - documentation and readiness review

• 181 NOTE: Stage 1 is intended to understand the object of certification, confirm audit readiness and plan Stage 2. It should cover, as applicable:
• ⎯ scope, governance and organisational responsibilities;
• ⎯ architecture, systems, services, processes, interfaces and outsourced activities;
• ⎯ applicable policies, procedures and practice statements;
• ⎯ risk assessment, risk treatment and the relevant risk register;
• ⎯ internal audits, management reviews, previous findings and external assurance evidence;
• ⎯ availability of records, samples, systems, sites and personnel;
• ⎯ areas of concern and additional competence or time required for Stage 2.
• 182 Stage 1 results shall be documented and used to finalise the Stage 2 plan.
• 183 Potential nonconformities identified during Stage 1 shall be treated as areas of concern until supported by sufficient evidence.

B.11.3 Stage 2 - implementation and operational effectiveness

• 184 Stage 2 shall collect objective evidence that applicable requirements are implemented and operate effectively.
• 185 NOTE: Stage 2 can include documentation review, interviews, observation, inspection, sampling, transaction review, log analysis and technical verification.
• 186 Stage 2 shall include relevant sites and operational environments unless sufficient equivalent evidence is obtained and the use of remote or external assurance evidence is justified.

B.11.4 Surveillance and special audits

• 187 Surveillance and special audits can use a targeted, risk-based sequence rather than the full Stage 1 and Stage 2 model. The CAB shall nevertheless define scope, criteria, methods, samples, evidence and reporting sufficient for the audit objective.

B.11.5 Meetings and communication

• 188 The Audit Team shall conduct an opening or kick-off meeting appropriate to the audit.
• 189 Substantial findings that influence a certification decision shall be communicated without undue delay in accordance with NL-P-W.
• 190 A closing meeting shall present the audit scope, methods, limitations, findings and next steps and shall provide the audited parties with an opportunity to clarify factual
• matters. 191

B.12 Evaluation of findings and pass/fail principles

B.12.1 Applicability

• 192 For each requirement included in the assessment matrix, the Audit Team shall determine its applicability to the approved audit scope.
• 193 The applicability status shall be one of the following:
• 194 Applicable - the requirement applies to the approved audit scope;
• 195 Not applicable - the requirement does not apply to the approved audit scope and the rationale for exclusion has been documented and accepted.
• 196 A requirement classified as not applicable shall not be assigned a conformity assessment result.

B.12.2 Requirement-level assessment results

• 197 For each applicable requirement, the Audit Team shall assign one of the results presented in Table 3.

Table 3 Audit results

Result	Meaning
Conforming	Sufficient and appropriate objective evidence demonstrates fulfilment of the specified requirement.
Major nonconformity	A non-fulfilment of a specified requirement that has a substantial security impact and/or a substantial impact on the ability of the object of certification to achieve the intended service or process outcome.
Minor nonconformity	A non-fulfilment of a specified requirement that does not have any substantial security impact and does not have any substantial impact on the ability of the object of certification to achieve the intended service or process outcome.
Not concluded - insufficient evidence	Sufficient and appropriate evidence was not available to determine conformity. This result shall not be treated as conformity and shall be resolved before a positive audit recommendation is issued in relation to the applicable scope.

B.12.3 Observations

• 198 The Audit Team may record positive or negative observations in addition to requirement-level assessment results.

• 199 NOTE: An observation is an informative audit finding identifying a risk, weakness, positive practice or emerging issue where the available evidence does not demonstrate non-fulfilment of a specified requirement.

• 200 An observation may not replace a conformity assessment result and shall not, by itself, constitute a failure to meet a requirement.

B.12.4 Relationship with the certification decision

• 201 The assessment results and audit findings shall constitute input to the review and certification decision conducted in accordance with NL-P-W and NL-SYS-05.
• 202 The Audit Team shall not issue the certification decision. The formal certification decision shall be made by the CAB in accordance with the applicable certification scheme.

B.13 Audit reporting and interface with the Evaluation Report

B.13.1 Audit report

• 203 The Audit Team Leader shall provide the CAB with an Audit Report with content in accordance with NL-SYS-01, section 6.3.
• 204 The Audit Report shall contain sufficient detail to allow independent review of the audit and its conclusions.

B.13.2 Evaluation Report

• 205 NL-P-W requires an Evaluation Report covering the overall evaluation. The CAB may use the Audit Report as an input or may issue a combined Audit and Evaluation Report where the audit constitutes the complete evaluation activity.
• 206 The Evaluation Report shall contain an overall assessment of conformity with each applicable NL-P-W subsidiary requirements, the reliance determination for external assurance evidence and a recommendation for the certification decision.
• 207 Where several audits, evaluations or external reports contribute to the Evaluation Report, the CAB shall ensure traceability from each requirement to the evidence and conclusion used.

B.14 Corrective actions and follow-up

• 208 For each nonconformity, the Applicant or Certificate Holder shall provide information appropriate to its significance, including correction, root-cause analysis, corrective action, responsible owner, target date and evidence of completion.
• 209 The CAB shall evaluate the adequacy of proposed corrective actions and determine the verification activities required for closure.
• 210 Major nonconformities shall be corrected, and their closure verified before a positive certification recommendation or decision.
• 211 Timeframes for minor nonconformities shall be agreed in accordance with NL-P-W, GSYS-05 and the applicable CAB procedure. This framework does not establish an independent fixed deadline.
• 212 Where a nonconformity can affect multiple sites, systems, processes or Providers, corrective action shall address the full systemic extent and underlying cause.
• 213 NOTE: Verification can be performed by document review, interview, sampling, observation, testing, additional audit or another justified method.

B.15 Surveillance, re-assessment and special audits

• 214 Audit frequency and scope shall follow NL-P-W, including annual surveillance and reassessment before certificate expiry.
• 215 Surveillance audit planning shall consider material changes, incidents, updated scheme documents, risk-register information, intelligence, compliance-monitoring results, external certificates and previous findings.
• 216 NOTE: Re-assessment may make documented use of acceptable evidence from surveillance activities and may reduce duplicate audit work in accordance with the determination of reliance.
• 217 Special audits shall be initiated by the CAB in case of one or more events occurring:
• ⎯ significant changes,
• ⎯ security incidents,
• ⎯ complaints,
• ⎯ failure to implement corrective actions or other information relevant to continued conformity.
• 218 NOTE: This framework does not independently define certificate suspension, withdrawal or recertification decisions; those matters are governed by NL-P-W, NLSYS-01 and NL-SYS-05.

B.16 Records, confidentiality and quality control

• 219 The CAB shall retain audit plans, competence records, evidence records, notes, samples, reliance assessments, reports, corrective-action records and review records in accordance with NL-SYS-01 and NL-SYS-05.
• 220 Access to sensitive evidence, including personal data, security architecture, cryptographic information, vulnerabilities and incident information, shall be restricted to authorised persons in accordance to 'need to know' principle
• 221 Audit evidence shall be transferred, stored and disposed of using controls appropriate to its sensitivity.
• 222 The CAB shall apply review and quality-control arrangements sufficient to ensure consistency of findings, classification and reporting across Audit Teams and subsidiary NL-P-W-documents.
• 223 Interpretation questions that cannot be resolved by the CAB's shall be escalated in accordance with the governance arrangements of the certification scheme.

Annex C (Normative) Minimum contents of an audit plan

• 224 The audit plan shall contain at least the following elements:
• ⎯ audit identification and type;
• ⎯ objectives, scope, boundaries and criteria;
• ⎯ Audit Team and roles;
• ⎯ dates, duration, sites and activity timetable;
• ⎯ Stage 1 and Stage 2 arrangements, where applicable;
• ⎯ methods, principal audit trails and planned samples;
• ⎯ external assurance evidence and intended reliance approach;
• ⎯ remote techniques, access and information-security arrangements;
• ⎯ meetings, communication and reporting arrangements;
• ⎯ known limitations, assumptions and contingency arrangements.

Annex D (Normative)- Minimum contents of an audit evidence record

• 225 The audit evidence record shall contain or reference to at least the following:
• ⎯ requirement or audit criterion;
• ⎯ audit method and audit trail;
• ⎯ documents and records reviewed;
• ⎯ persons interviewed and processes observed;
• ⎯ systems, sites and technical components examined;
• ⎯ sample population, selection method and sampled items;
• ⎯ external assurance evidence and reliance outcome;
• ⎯ objective evidence obtained;
• ⎯ factual conclusion and any limitation;
• ⎯ cross-reference to findings and report sections.

Requirement	Applicability	Method		Evidence sample	/	Reliance	Result	Finding reference
[ID]	Applicable / N/A	Document interview observation sampling / test	/ / /	[evidence sample]	and	Full / Partial / None	C / Major NC / Minor NC / N/E / OBS	[reference]