Auditing framework for TSPs : guidelines for trust service providers

In order to remove barriers for cross-border trust services and having regard to results from successful European projects like STORK, which have shown that technical issues of interoperability can be overcome, the European Parliament and the Council of the European Union adopted on 27 July 2014 the Regulation on electronic identification and trusted services for electronic transactions in the internal market that replaced the Directive 1999/93/EC on a community framework for electronic signatures, which provided for the legal recognition of electronic signatures. The Regulation strengthens the provisions for interoperability and mutual recognition of electronic identification schemes across borders, enhances current rules for electronic signatures and provides a legal framework for other types of trust services (electronic seals, electronic delivery services, electronic documents, time stamping services and web site authentication). Trust Services - as the name suggests - require a trustful provision of the corresponding service. The word trustful has to be defined in this context as highly reliable for the user, that the service promised is being delivered strictly according to: Terms and conditions of the Trust Service Provider, Standards (like ETSI/CEN/ISO), Legal requirements as well as according to State of technology (like cryptographic algorithms and parameter sets). In order to support Trust Service Providers (TSPs) in providing information on how audits typically are carrie dout , ENISA has compiled this auditing framework for TSP services. This report provides an overview of the dedicated means of auditing for TSPs. It discusses specifically the following areas: Obligations, warranties and liability of TSPs ; Standards applicable to TSPs and Conformity Assessment Bodies (auditors) ; Methodology of auditing TSPs (off- and on-site) ; TSPs documentation (plans, policies and procedures) ; Implementation of TSPs services.