(title available in French only)
Official Binding
Note
ETSI standard, part 1, setting the requirements applicable to conformity assessment bodies that audit trust service providers (version 2.3.1).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
European standard ETSI EN 319 403-1 (version 2.3.1, June 2020) sets requirements for conformity assessment bodies that assess and certify trust service providers ETSI EN 319 403-1 V2.3.1, § 1 Scope ETSI EN 319 403-1 V2.3.1, History. Its scope begins as follows:
The present document contains requirements for the competence, consistent operation and impartiality of conformity assessment bodies assessing and certifying the conformity of Trust Service Providers (TSPs)
It applies to trust service providers the general requirements of standard ISO/IEC 17065 and also covers the assessment of service components, reusable in the assessment of several providers ETSI EN 319 403-1 V2.3.1, § 1 Scope ISO/IEC 17000, 17011, 17020, 17021-1, 17025, 17029, 17065, 17067.
Who it applies to
- To conformity assessment bodies that wish to take certification decisions under a given conformity assessment scheme Art. 2(1).
- To national accreditation bodies, which accredit them under standard EN ISO/IEC 17011:2017 Art. 2(2).
Key points
- General and structural requirements: contracts, impartiality, liability, confidentiality, organisation ETSI EN 319 403-1 V2.3.1, § 4 General requirements ETSI EN 319 403-1 V2.3.1, § 5 Structural requirements.
- Certification decision: in addition to the requirements of ISO/IEC 17065, the decision is either certified or not certified ETSI EN 319 403-1 V2.3.1, § 7.6 Certification decision.
- Certification documentation: it identifies in particular the trust service policy or the service concerned; the standard recommends that it be published at least in the national language of the body and in English ETSI EN 319 403-1 V2.3.1, § 7.7 Certification documentation.
- Audit time: an informative annex proposes a method for determining it ETSI EN 319 403-1 V2.3.1, Annex B (informative): Procedure to determine audit time.
What the act applies, and how
Implementing Regulation 2025/2162 uses the standard in three places:
- Accreditation: bodies are accredited in accordance with standard EN ISO/IEC 17065:2012, supplemented by ETSI EN 319 403-1 version 2.3.1 Art. 2(1).
- Assessment report: it is considered part of the certification documentation of paragraph 7.7 of the standard Art. 7(2).
- Decision: the report is accompanied by a clear certification decision, taken in accordance with paragraph 7.6 of the standard, stating whether the provider and its qualified services meet Regulation 910/2014 and the risk-management measures of the NIS2 Directive Annex III.
The regulation implements the article of Regulation 910/2014 that provides for standards for the accreditation of bodies and the assessment report, the auditing requirements and the conformity assessment schemes; that article contains no presumption sentence Art. 20(4). Bodies accredited before 17 November 2025 under the former EN 319 403 version 2.2.2 are considered to meet the accreditation requirement until 17 May 2027 Art. 9 ETSI EN 319 403 V2.2.2.
Important clauses
- ETSI EN 319 403-1 V2.3.1, § 1 Scope: scope.
- ETSI EN 319 403-1 V2.3.1, § 7.6 Certification decision: certification decision.
- ETSI EN 319 403-1 V2.3.1, § 7.7 Certification documentation: certification documentation.
- ETSI EN 319 403-1 V2.3.1, § 7.9 Surveillance: surveillance.
Links
- Previous version, ETSI EN 319 403 ETSI EN 319 403 V2.2.2.
- Requirements assessed at providers: ETSI EN 319 401 ETSI EN 319 401 V3.2.1.
- Learning path: step 5, certification and standards.
Consolidation without official value
This summary cites the consolidated version, published on EUR-Lex, of Regulation 910/2014 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024. It serves as documentation: only the text published in the Official Journal is authentic.
ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 403-1 V2.3.1. Written by Asphalia.