{ "id": "ishare-issuer-qualification-framework", "title": "iSHARE Issuer Qualification Framework", "subtitle": "Digitised Assessment Framework for Certified Parties (Qualified Issuers)", "version": "3.0-draft.5", "status": "draft for discussion", "date": "2026-09-07", "basedOn": [ "iSHARE Assessment Framework for Certified Parties (Excel, Trust Framework 2.x) - 36 controls, mirrors Commission Implementing Regulation (EU) 2015/1502 (eIDAS assurance levels)", "iSHARE Trust Framework operational processes: Admission, Withdrawal or Downgrade, Warnings/Suspension/Exclusion, Service levels for Certified Parties", "iSHARE VC membership model (inpreparation.ishare.vc/membership.html)", "GLEIF vLEI Issuer Qualification Program (Qualification Checklist, Technical Qualification, Annual Qualification, 90-day offboarding grace period)", "EBSI Trusted Issuers Registry (Verifiable Accreditation to Attest), ETSI TS 119 612 / 119 602 trusted lists, ToIP Trust Registry Query Protocol v2.0" ], "terminology": { "programme": "iSHARE Issuer Qualification", "candidate": "Candidate Issuer", "qualified": "Qualified Issuer (public status: 'iSHARE Qualified Issuer'; legal role in the Accession Agreement: 'Certified Party')", "registry": "iSHARE Trusted Issuers Registry", "proof": "Issuer Accreditation (registry entry + Accreditation Credential + Assessment Report)", "note": "'Qualified' is used in the GLEIF sense (Qualified vLEI Issuer). It is not the eIDAS legal term 'qualified trust service provider'. Public copy must avoid implying eIDAS qualified status." }, "roles": [ { "id": "PCI", "name": "Participant Credential Issuer", "legacyRole": "Participant Registry (Satellite)", "issues": [ "ParticipantCredential", "ComplianceCredential", "DataspaceParticipantCredential" ], "description": "Acts as Participant Registry: validates legal-entity identity, registers participants and issues credentials confirming iSHARE adherence and data space membership. All four sections of the Assessment Framework apply, plus domain 5." }, { "id": "DRC", "name": "Data Rights Controller", "legacyRole": "Authorisation Registry", "issues": [ "DataRightsCredential" ], "description": "Issues Data Rights Credentials on behalf of Data Rightsholders, carrying an iSHARE Licence." }, { "id": "ICI", "name": "Identity Credential Issuer", "legacyRole": "Identity Provider / Identity Broker", "issues": [ "IdentityCredential" ], "description": "Identifies and authenticates natural persons acting on behalf of an organisation (H2M, EUDI-wallet ready)." }, { "id": "PR", "name": "Participant Registry operator", "legacyRole": "Participant Registry (Satellite)", "issues": [ "ParticipantCredential" ], "description": "Operates a data space participant registry and its status lists; a PCI operating for a Data Space Authority." } ], "answerTypes": { "yesno": { "options": [ "Yes", "No" ], "rule": "Mandatory: 'No' blocks accreditation unless a remediation plan is accepted as a condition." }, "loa": { "options": [ "Low", "Substantial", "High" ], "rule": "Determines the Level of Assurance. The issuer's LoA is the lowest LoA achieved on any applicable LoA control." }, "attack": { "options": [ "Enhanced basic", "Moderate", "High" ], "rule": "Attack potential per ISO/IEC 18045. Maps to LoA Low / Substantial / High." } }, "verdicts": [ "Met", "Partially met", "Not met", "Not applicable" ], "evidenceTypes": [ { "id": "policy", "label": "Policy or procedure document", "description": "Approved internal document; version, owner and approval date visible." }, { "id": "register-extract", "label": "Authoritative register extract", "description": "Chamber of Commerce / business register extract, or LEI record.", "defaultValidityMonths": 3 }, { "id": "certificate", "label": "Certificate", "description": "ISO/IEC 27001 certificate, eIDAS qualified certificate, insurance certificate.", "expires": true }, { "id": "report", "label": "Report", "description": "Audit report, penetration test, conformance test report, risk analysis." }, { "id": "attestation", "label": "Signed attestation", "description": "Statement signed by the Designated Authorised Representative, generated by the portal." }, { "id": "demonstration", "label": "Demonstration / log", "description": "Dry-run logs, screenshots, monitoring output from the test network." }, { "id": "third-party-credential", "label": "Third-party Verifiable Credential", "description": "Machine-verifiable attestation (e.g. ISO 27001 credential, eIDAS qualified certificate) presented as evidence." }, { "id": "url", "label": "Public URL", "description": "Publicly accessible page (service definition, terms, privacy policy, status list, metadata)." } ], "fastTracks": [ { "id": "iso27001", "name": "ISO/IEC 27001 fast track", "condition": "Valid ISO/IEC 27001 certificate whose scope covers the issuing service, plus the Statement of Applicability.", "effect": "Controls 24-36 are pre-filled as 'covered by certificate'. Candidate only confirms scope and uploads certificate + SoA. Control 36 scores High (independent external audit).", "evidence": [ "certificate", "third-party-credential" ] }, { "id": "eidas-notified", "name": "eIDAS fast track", "condition": "The identification means is a notified eID scheme at Substantial/High, or the candidate is a qualified trust service provider on an EU trusted list.", "effect": "Controls 4-15 inherit the notified assurance level (Regulation 2015/1502, section 2.1.2 (4)). Controls 24-35 may be covered by ETSI EN 319 401 conformity assessment.", "evidence": [ "certificate", "url" ] }, { "id": "gleif-qvi", "name": "GLEIF QVI recognition", "condition": "vLEI Issuer Qualification Agreement in force (Qualified vLEI Issuer).", "effect": "Governance and security evidence already reviewed by GLEIF (controls 16-20, 24-36) is accepted on presentation of the GLEIF qualification confirmation; iSHARE reviews only the delta (controls 21-23 and domain 5). Indicative; requires Foundation decision on mutual recognition.", "evidence": [ "attestation", "third-party-credential" ] }, { "id": "existing-certified-party", "name": "Existing Certified Party (framework 2.x) migration", "condition": "Accession Agreement for Certified Parties in force and last assessment less than 24 months old.", "effect": "Controls 1-36 carried over; delta assessment on domain 5 (credential issuance operations) only.", "evidence": [ "attestation" ] } ], "domains": [ { "id": "1", "title": "Enrolment", "eidas": "2015/1502 section 2.1", "subsections": [ { "id": "1.1", "title": "Application and registration" }, { "id": "1.2", "title": "Identity proofing and verification" } ] }, { "id": "2", "title": "Electronic identification means management", "eidas": "2015/1502 section 2.2", "subsections": [ { "id": "2.1", "title": "Characteristics and design" }, { "id": "2.2", "title": "Issuance, delivery and activation" }, { "id": "2.3", "title": "Suspension, revocation and reactivation" }, { "id": "2.4", "title": "Renewal and replacement" } ] }, { "id": "3", "title": "Authentication", "eidas": "2015/1502 section 2.3", "subsections": [ { "id": "3.1", "title": "Authentication mechanism" } ] }, { "id": "4", "title": "Management and organisation", "eidas": "2015/1502 section 2.4", "subsections": [ { "id": "4.1", "title": "General provisions" }, { "id": "4.2", "title": "Published notices and user information" }, { "id": "4.3", "title": "Information security management" }, { "id": "4.4", "title": "Record keeping" }, { "id": "4.5", "title": "Facilities and staff" }, { "id": "4.6", "title": "Technical controls" }, { "id": "4.7", "title": "Compliance and audit" } ] }, { "id": "5", "title": "Credential issuance operations", "eidas": "new in 3.0 (GLEIF technical qualification, iSHARE VC profile)", "proposed": true, "subsections": [ { "id": "5.1", "title": "Issuer identity and keys" }, { "id": "5.2", "title": "Issuance and status" }, { "id": "5.3", "title": "Operations and reporting" }, { "id": "5.4", "title": "Data rights verification (Data Rights Controllers)" } ] } ], "controls": [ { "id": "C01", "no": 1, "domain": "1", "subsection": "1.1", "roles": [ "ICI", "PR", "PCI" ], "question": "Are terms and conditions for the use of the electronic identification means (or credential) shared with the applicant?", "guidance": "The applicant receives the required information in written form and explicitly accepts the terms and conditions.", "examples": "Describe the procedure how the terms and conditions are shared.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Enrolment procedure incl. acceptance step" }, { "type": "url", "label": "Public terms and conditions" } ], "mappings": { "eidas1502": "2.1.1 (1)", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 1", "section": "1. Enrolment", "subsectionTitle": "1.1 Application and registration", "applicability": "IDP, Participant Registry", "questionVerbatim": "1. Are terms and conditions for the use of the electronic identification means shared with the applicant?", "explanation": "•\tThe applicant gets the required information in written form\n•\tThe applicant explicitly accepts the terms and conditions", "answerCategory": "Yes/No", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C02", "no": 2, "domain": "1", "subsection": "1.1", "roles": [ "ICI", "PR", "PCI" ], "question": "Is the applicant made aware of recommended security precautions related to the electronic identification means (or wallet / credential)?", "guidance": "During enrolment the issuer makes the user aware of security precautions, e.g. via video, flyer or other awareness activities: safely storing possession-based means, not handing the means to another person, informing the issuer when the means is compromised.", "examples": "Describe how the applicant is made informed.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Awareness material / enrolment communication" } ], "mappings": { "eidas1502": "2.1.1 (2)", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 2", "section": "1. Enrolment", "subsectionTitle": "1.1 Application and registration", "applicability": "IDP, Participant Registry", "questionVerbatim": "2. Is the applicant made aware of recommended security precautions related to the electronic identification means?", "explanation": "During enrolment, certified party can make user aware of security precautions via movie, flyer or other awareness activities. Recommended security precautions include:\n• Safely storing possession based electronic identification means\n• Not handing over their electronic identification means to another person.\n• Please inform certified party when your e-ID is compromised", "answerCategory": "Yes/No", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C03", "no": 3, "domain": "1", "subsection": "1.1", "roles": [ "ICI", "PR", "PCI" ], "question": "Is the relevant identity data required for identity proofing and verification collected?", "guidance": "For natural persons: first and last name, and a unique identifier assigned to the applicant. For legal persons (PCI): legal name, registered identifier (Chamber of Commerce / EUID / LEI / VAT / EORI), and the identity and authority of the representative.", "examples": "", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Enrolment data specification" } ], "mappings": { "eidas1502": "2.1.1 (3)", "iso27001": null, "gleifQvi": "Identity verification" }, "source": "Excel: Assessment framework, row for question 3", "section": "1. Enrolment", "subsectionTitle": "1.1 Application and registration", "applicability": "IDP, Participant Registry", "questionVerbatim": "3. Is the revelant identity data required for identity proofing and verification collected?", "explanation": "The certified party must collect the first and last name and must assign an unique identifier to the applicant.", "answerCategory": "Yes/No", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C04", "no": 4, "domain": "1", "subsection": "1.2", "roles": [ "ICI", "PR", "PCI" ], "question": "Did the person (or legal entity's representative) provide an identity document and has it been verified?", "guidance": "Low: it can be assumed the person holds evidence recognised by the Member State representing the claimed identity, not expired and appearing genuine, or the identity exists according to an authoritative source. Substantial: verified possession of evidence, determined genuine (security features or authoritative source), steps taken to minimise risk of lost/stolen/revoked evidence, e.g. facial match by a trained employee or video call. Where the means is issued on the basis of a notified eID at Substantial/High, identity proofing need not be repeated. High: photo or biometric evidence checked as valid against an authoritative source and identity confirmed by comparison of physical characteristics with an authoritative source. Note: creating and storing a copy of an identity document is not automatically allowed under Dutch law.", "examples": "•\tLow:\n(1) The person can provide a copy of an identity document such as a passport that matches the claimed identity\n\n•\tSubstantial:\nRequirements from level Low and:\n(1) The person can provide an identity document that matches the claimed identity, either in person or through an online video call\n(4) Indicate the notified electronic identification means that is used\n\n•\tHigh:\nRequirements from level Substantial and:\n(1,2) The physical characteristics of the person have been matched against the photo or biometric evidence in the passport, either by a biometric alghoritm with sufficient hitrate or in person by a trained employee.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Identity proofing procedure" }, { "type": "demonstration", "label": "Walkthrough of a proofing session (redacted)" } ], "mappings": { "eidas1502": "2.1.2 / 2.1.3", "iso27001": null, "gleifQvi": "Identity verification" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 4", "section": "1. Enrolment", "subsectionTitle": "1.2 Identity proofing and verification natural persons", "applicability": "IDP, Participant Registry", "questionVerbatim": "4. Did the person provide an identity document and has it been verified?", "explanation": "Note: Creating and storing a copy of an identity document is not automatically allowed under Dutch law. Verifying the existance and storing the required information is often enough. For more information see https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/identificatie/identiteitsbewijs\n\n• Low:\n(1) It can be assumed that the person has evidence recognised by the Member State that represents the claimed identity and\n(2) that this evidence is not expired and appears to be valid and can be assumed to be genuine, or it exists according to an authoritative source(..) and\n(3) If the claimed identity is known by an authoritative source and that it may be assumed that the person claiming the identity is one and the same.\n\n• Substantial:\nRequirements from level Low and:\n(1) It has been verified that the person is in possession of evidence recognised by the Member State that represents the claimed identity and;\n(2) that this evidence is not expired and it is determined to be genuine based on security features, or to exist according to an authoritative source and;\n(3) steps have been taken to minimise the risk that the person's identity is not the claimed identity, taking into account for instance the risk of lost, stolen, suspended, revoked or expired evidence. There is a procedure to verify that the applicants identity is the same as the claimed identity, for instance by verifying that the facial characteristics are matched by a trained employee\nOR\n(4) Where electronic identification means are issued on the basis of a valid notified electronic identification means having the assurance level substantial or high it is not required to repeat the identity proofing and verification processes.\n\n• High:\nRequirements from level Substantial and:\n(1) if the person is in possession of photo or biometric identification evidence recognised by the Member State in which the application for the electronic identity means is being made and that the evidence represents the claimed identity, the evidence is checked to determine that it is valid according to an authorative source;\n(2) if the claimed identity is identified through comparison of one or more physical characteristic of the person with an authoritative source.", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C05", "no": 5, "domain": "2", "subsection": "2.1", "roles": [ "ICI", "PR", "PCI" ], "question": "What authentication factors does the identification means use?", "guidance": "Low: one factor. Substantial/High: two factors from different categories. Factors: something you know (password, code), something you have (registered phone, token, card), something you are (fingerprint, face, voice, behaviour).", "examples": "Factors are:\n•\tsomething you know (e.g. a password, a code)\n•\tsomething you have (e.g. a registered mobile phone, a token, a card, identifier)\n•\tsomething you are (e.g. fingerprint, iris scan, facial recognition, voice, behaviour)", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Means design description" } ], "mappings": { "eidas1502": "2.2.1 (1)", "iso27001": null, "gleifQvi": "Technology & security" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 5", "section": "2. Electronic identification means management", "subsectionTitle": "2.1. Electronic identification means characteristics and design", "applicability": "IDP, Participant Registry", "questionVerbatim": "5. What authentication factors does the identification means use?", "explanation": "•\tLow: Only 1 factor\n•\tSubstantial/high: Two factors from different categories", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C06", "no": 6, "domain": "2", "subsection": "2.1", "roles": [ "ICI", "PR", "PCI" ], "question": "How well is the identification means designed to ensure that it is used only by its owner?", "guidance": "Low: reasonable steps to check the means is used only under control or possession of its owner. Substantial: it can be assumed to be used only under control or possession of the owner (at least one knowledge-based or inherent factor, e.g. token unlocked with password or fingerprint). High: Substantial plus reliable protection against use by others (private keys in tokens requiring active user involvement, strong static passwords, biometric verification, out-of-band verification, malicious-code checks, guessing mitigation).", "examples": "• Low: Measures taken under section 2.2\n• Substantial: At least one of the factors must be a knowledge-based or an inherent characteristic of the subject. For example: a possession-based token with a password or fingerprint scan to unlock the token.\n• High: Substantial, as well as additional techniques, possible techniques that can be used include:\n1. Protecting private keys in tokens with factors that require active involvement from the user.\n2. Strength of static passwords\n3. Biometric verification\n4. Out of band verification\n5. Checks of the environment against malicious code\n6. Mitigation against guessing, e.g. by ensuring sufficient entropy and limiting or slowing attempts", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Means design and security description" } ], "mappings": { "eidas1502": "2.2.1 (2)", "iso27001": null, "gleifQvi": "Technology & security" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 6", "section": "2. Electronic identification means management", "subsectionTitle": "2.1. Electronic identification means characteristics and design", "applicability": "IDP, Participant Registry", "questionVerbatim": "6. How well is the identification mean designed to ensure that it is used only by its owner?", "explanation": "Low: The issuer takes reasonable steps to check that it is used only under the control or possession of the person to whom it belongs.\nSubstantial: It can be assumed to be used only if under the control or possession of the person to whom it belongs.\nHigh: Substantial and the means can be reliably protected by the person to whom it belongs against use by others.", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C07", "no": 7, "domain": "2", "subsection": "2.1", "roles": [ "ICI", "PR", "PCI" ], "question": "Is the electronic identification means protected against duplication and tampering and against attackers with high attack potential?", "guidance": "High: the means is proven resistant to tampering and duplication by specific measures or by certification against relevant technical standards. Possession-based factors: key material in tamper-resistant hardware (secure element, HSM). Inherent factors: liveness detection, trusted environment, low false match rate.", "examples": "Factor-specific examples of protection against tampering and duplication, include:\n•\tPossession-based authentication factors: embed cryptographic key material in tamper-resistant hardware that prevents the key from being extracted outside the device either or manipulated in the device through physical or electronic means, hardware security module\n•\tInherent authentication factors: liveness detection, trusted environment, low false match rate", "answerType": "loa", "evidence": [ { "type": "certificate", "label": "Product / hardware certification" }, { "type": "report", "label": "Security evaluation" } ], "mappings": { "eidas1502": "2.2.1 (3)", "iso27001": "A.10", "gleifQvi": "Technology & security" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 7", "section": "2. Electronic identification means management", "subsectionTitle": "2.1. Electronic identification means characteristics and design", "applicability": "IDP, Participant Registry", "questionVerbatim": "7. Is the electronic identification means protected against duplication and tampering as well as against attackers with high attack potential?", "explanation": "High:\n1. The means has proven to be resistant to tampering and duplication by taking specific measures;\nor;\n2. The means has been proven to be resistant to tampering and duplication by being certified against relevant technical standards", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C08", "no": 8, "domain": "2", "subsection": "2.2", "roles": [ "ICI", "PR", "PCI" ], "question": "Can it be ensured that the means is only delivered into the possession of the intended person?", "guidance": "Low: delivery via a mechanism by which it can be assumed to reach only the intended person (e.g. activation code by post to a verified address or SMS after phone-number verification). Substantial: delivery to the right person and use by that person is assured (in-person handover, registered mail with activation process, separate delivery of means and activation code). High: activation verifies delivery only to the legitimate owner; protected against accidental loss and insider threats such as collusion; registration and issuance never performed by a single person; activation codes valid for a limited period.", "examples": "• Low: In case of a single factor (i.e. password) that is issued online, the activation code could be delivered via regular mail to the verified address of the subject or sent to the mobile phone of the applicant (e.g. via SMS) after having verified that the phone number indeed belongs to the subject (e.g. via call-back).\n\n• Substantial: multiple factor authentication, delivery in person, delivery in registered mail with an activation process in place, separate delivery of the electronic identification means and the activation code via regular mail to the verified address of the subject or delivery of the electronic identification means via regular mail to the address of the applicant. The electronic identification means is handed over after having verified the identity of the applicant.\n\n• High: Examples of processes include;\n> The issuance of the electronic identification means at the registration desk and the delivery of an activation code via regular mail to the verified address of the subject.\n> The delivery of an online-requested electronic identification means via regular mail and the issuance of an activation code to a trusted party (e.g. a nearby post office). The participant has to collect the activation code personally on presentation of an ID-document.\n> The electronic identification means is requested online and is physically handed over by a trusted courier after having verified the identity of the applicant. An activation code is sent separately via regular mail to the verified address of the subject.\nWith registered mail you can securely send a message. Also, right after onboarding a message can be sent with assurance of delivery.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Issuance, delivery and activation procedure" } ], "mappings": { "eidas1502": "2.2.2", "iso27001": null, "gleifQvi": "Business & operational" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 8", "section": "2. Electronic identification means management", "subsectionTitle": "2.2. Issuance, delivery and activation", "applicability": "IDP, Participant Registry", "questionVerbatim": "8. Can it be sure that the means are only delivered into possession of the person intended?", "explanation": "• Low: After issuance, the electronic identification means is delivered via a mechanism by which it can be assumed to reach only the intended person\n\n• Substantial: If you can be sure that the means is delivered to the right person and that it is used by that person\n\n• High: The activation process verifies that the electronic identification means was delivered only into the possession of the person to whom it belongs. This means:\na. The activation process shall ensure that only the legitimate owner can activate the electronic identification means and that the activation process is protected from accidental loss and insider threats such as collusion.\nb. The registration and issuance of electronic identification means shall never be performed by a single person.\nc. Where activation codes are used the applicant has to use it within a specified period of time.", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C09", "no": 9, "domain": "2", "subsection": "2.3", "roles": [ "ICI", "PR", "PCI" ], "question": "Is it possible to suspend and/or revoke an electronic identification means in a timely and efficient manner?", "guidance": "The suspension or revocation method must be publicly accessible for both the owner of the means and the organisation that authorised the person (phone, website, e-mail). Action is taken as soon as possible after a request.", "examples": "Please provide a description of the suspension and/or revocation procedure", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Suspension / revocation procedure" }, { "type": "url", "label": "Public revocation channel" } ], "mappings": { "eidas1502": "2.2.3 (1)", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 9", "section": "2. Electronic identification means management", "subsectionTitle": "2.3. Suspension, revocation and reactivation", "applicability": "IDP, Participant Registry", "questionVerbatim": "9. Is it possible to suspend and/or revoke an electronic identification means in a timely and efficient manner?", "explanation": "Suspension or revocation method should be publically accessible for both the owner of the means and the organsation that has authorised the person. Examples may include, by phone, a website, an e-mail address etc. Where a verifier receives such a request, action should be taken as soon as possible.", "answerCategory": "Yes/No", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C10", "no": 10, "domain": "2", "subsection": "2.3", "roles": [ "ICI", "PR", "PCI" ], "question": "Are measures taken to prevent unauthorised suspension, revocation and/or reactivation?", "guidance": "The requester's authorisation to act is authenticated. It is determined who, besides the user, can authorise suspension or revocation (e.g. relevant public authorities).", "examples": "Please provide a description of who can execute the suspension, revocation and/or reactivation, as well as how the authorised person/party is authenticated.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Authorisation matrix for suspension / revocation" } ], "mappings": { "eidas1502": "2.2.3 (2)", "iso27001": "A.9", "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 10", "section": "2. Electronic identification means management", "subsectionTitle": "2.3. Suspension, revocation and reactivation", "applicability": "IDP, Participant Registry", "questionVerbatim": "10. Are measures taken to prevent unauthorised suspension, revocation and/or reactivation?", "explanation": "This will generally imply authentication of the requester's authorisation to act in that way. It should be determined who can authorise suspension and/or revocation besides the user – for example relevant public authorities.", "answerCategory": "Yes/No", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C11", "no": 11, "domain": "2", "subsection": "2.3", "roles": [ "ICI", "PR", "PCI" ], "question": "If reactivation is possible, can it only be done if the same assurance level is in place as before the suspension?", "guidance": "The reactivation procedure ensures a sufficient level of assurance is reached before reactivating the means.", "examples": "Please provide a description of the reactivation procedure, if present, including how the appropriate level of assurance for the identification means is achieved.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Reactivation procedure" } ], "mappings": { "eidas1502": "2.2.3 (3)", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 11", "section": "2. Electronic identification means management", "subsectionTitle": "2.3. Suspension, revocation and reactivation", "applicability": "IDP, Participant Registry", "questionVerbatim": "11. If reactivation is possible, can it only be done if the same assurance levels are in place as established before the suspension?", "explanation": "If reactivation is possible, the procedure for reactivation should ensure that a sufficient level of assurance is reached before reactivating the identification means.", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C12", "no": 12, "domain": "2", "subsection": "2.4", "roles": [ "ICI", "PR", "PCI" ], "question": "Is it ensured that a renewed or replaced means is delivered to the same person as the previous means?", "guidance": "Low & Substantial: renewal or replacement meets the same assurance requirements as initial identity proofing, or is based on a valid means of the same or higher assurance level. High: where based on a valid means, identity data is verified with an authoritative source. Renewal before expiry is recommended so the previous means can serve as authoritative source.", "examples": "Please provide a description of the renewal and replacement procedure, including how appropriate level of assurance for the identification means is achieved.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Renewal and replacement procedure" } ], "mappings": { "eidas1502": "2.2.4", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 12", "section": "2. Electronic identification means management", "subsectionTitle": "2.4. Renewal and replacement", "applicability": "IDP, Participant Registry", "questionVerbatim": "12. Is made sure that the new electronic identification means are delivered to the same person as the previous means?", "explanation": "• Low & Substantial: Taking into account the risks of a change in the person identification data, renewal or replacement needs to meet the same assurance requirements as initial identity proofing and verification or be based on a valid electronic identification means of the same, or higher, assurance level\n• High: Where renewal or replacement is based on a valid electronic identification means, the identity data is verified with an authoritative source\n\nNote: Renewal or replacement is recommended before expiration of the previous means. In this situation, the previous means is still valid and can be used as an authoritative source in the activation process.", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C13", "no": 13, "domain": "3", "subsection": "3.1", "roles": [ "ICI", "PR", "PCI" ], "question": "Does the authentication mechanism ensure that no person identification data is released prior to authentication?", "guidance": "Low: release of identification data (incl. pseudonym) is preceded by reliable verification of the means and its validity. Substantial/High: preceded by a dynamic authentication process (one-time code or challenge-response that cannot be tampered with).", "examples": "• Substantial/High: A one-time code or one time challenge-response is used in the authentication process. The code or challenge is generated in a way that can not be tampered with.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Authentication mechanism description" } ], "mappings": { "eidas1502": "2.3.1 (1)", "iso27001": null, "gleifQvi": "Technology & security" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 13", "section": "3. Authentication", "subsectionTitle": "3.1. Authentication mechanism", "applicability": "IDP, Participant Registry", "questionVerbatim": "13. Does the authentication mechanism makes sure that no personal identification data is released prior to the authentication?", "explanation": "• Low: The release of person identification data (incl. pseudonym) is preceded by reliable verification of the electronic identification means and its validity.\n\n• Substantial/High: The release of person identification data is preceded by reliable verification of the electronic identification means and its validity through a dynamic authentication process.", "answerCategory": "Low/Substantial/High", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C14", "no": 14, "domain": "3", "subsection": "3.1", "roles": [], "question": "(Removed) Is stored person identification data secured against loss and compromise, including offline analysis?", "guidance": "Removed in framework 2.x: sufficiently covered by controls 25-26 and 30-35.", "examples": "This section is sufficiently covered in chapters 4.4, 4.5 and 4.6 and does not require additional answering.", "answerType": "yesno", "removed": true, "evidence": [], "mappings": { "eidas1502": "2.3.1 (2)", "iso27001": "A.10, A.12", "gleifQvi": null }, "source": "Excel: Assessment framework, row for question 14", "section": "3. Authentication", "subsectionTitle": "3.1. Authentication mechanism", "applicability": "", "questionVerbatim": "(removed) 14. Is stored person identification data secured against loss and compromise, including analysis offline?", "explanation": "(removed) Where person identification data is stored as part of the authentication mechanism, that information is secured in order to protect against loss and against compromise, including analysis offline. Data is protected by:\n1. Strict access controls\n2. Cryptographic measures such as hashing or encryption, in line with best practices", "answerCategory": "" }, { "id": "C15", "no": 15, "domain": "3", "subsection": "3.1", "roles": [ "ICI", "PR", "PCI" ], "question": "What level of security controls for verifying the electronic identification means are implemented in the authentication mechanism?", "guidance": "Security controls make guessing, eavesdropping, replay or manipulation highly unlikely by an attacker with: Low - enhanced-basic attack potential; Substantial - moderate; High - high attack potential. Attack potential is calculated from elapsed time, expertise, window of opportunity and equipment (ISO/IEC 18045). Threats per ISO/IEC 29115: online/offline guessing, credential duplication, phishing, eavesdropping, replay, session hijacking, man-in-the-middle, credential theft, spoofing and masquerading.", "examples": "A security assessor can judge upon strenght against attacks (ISO 18045).\nThe assessment should take relevant threats into accounts. For example, ISO 29115 mentions: online guessing, offline guessing, credential duplication, phishing, eavesdropping, replay attack, session hijacking, man-in-the-middle, credential theft, spoofing and masquerading.\nDuring assessing attack resistance, the whole authentication mechanism should be taken into account including the risks resulting from verification of the possession of the electronic identification means. A username and password combination is easier to steal un-noticed than a combination of possession and knowledge, where theft of one of the factors will be noticed quicker.", "answerType": "attack", "evidence": [ { "type": "report", "label": "Security assessment / penetration test of the authentication mechanism" } ], "mappings": { "eidas1502": "2.3.1 (3)", "iso27001": "A.14", "gleifQvi": "Technology & security" }, "fastTracks": [ "eidas-notified" ], "source": "Excel: Assessment framework, row for question 15", "section": "3. Authentication", "subsectionTitle": "3.1. Authentication mechanism", "applicability": "IDP, Participant Registry", "questionVerbatim": "15. What level of security controls for verifying the electronic identification means are implemented in the authentication mechanism?", "explanation": "The security controls make it highly unlikely that activities such as guessing, eavesdropping, replay or manipulation of communication takes place by an attacker with:\n• Low: an enhanced-basic attack potential\n• Substantial: A moderate attack potential\n• High: A high attack potential\n\nTo calculate the attack potential, a security evaluator need to look at four aspects:\n> Elapsed Time: How much time is needed to perform the threat\n> Expertise: Level of expertise needed to perform the threat\n> Window of Opportunity: Is the target easily available to an attacker?\n> Equipment: How complex and elaborate is the equipment needed to perform the attack?", "answerCategory": "Enhanced basic/moderate/high", "applicabilityNote": "The framework applies sections 1-3 to the Identity Provider and the Participant Registry. In 3.0 the Participant Credential Issuer (PCI) is the Participant Registry role, so these questions apply to PCI, PR and ICI." }, { "id": "C16", "no": 16, "domain": "4", "subsection": "4.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is there a Chamber of Commerce (business register) registration within the European Union?", "guidance": "The Certified Party is a legal entity established in the EU/EEA. The portal verifies the registration number against the register (KvK API / EUID / LEI record) and checks the signatory's authority.", "examples": "Please provide a recent Chamber of Commerce extract of the participant (max. 3 months old)", "answerType": "yesno", "evidence": [ { "type": "register-extract", "label": "Business register extract", "validityMonths": 3 } ], "mappings": { "eidas1502": "2.4.1 (1)", "iso27001": null, "gleifQvi": "Audits & general governance" }, "fastTracks": [ "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 16", "section": "4. Management and Organisation", "subsectionTitle": "4.1. General provisions", "applicability": "All", "questionVerbatim": "16. Is there a Chamber of Commerce registration within the European Union?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C17", "no": 17, "domain": "4", "subsection": "4.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is there a data retention policy compliant with local law, and a Privacy Officer who manages the policy?", "guidance": "GDPR-compliant retention policy covering enrolment data, issued credentials, logs and evidence.", "examples": "Please provide the data retention policy and the name of the Privacy Officer that manages the policy", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Data retention policy" }, { "type": "attestation", "label": "Privacy Officer named" } ], "mappings": { "eidas1502": "2.4.1 (2)", "iso27001": "A.18.1.4", "gleifQvi": "Compliance & legal" }, "fastTracks": [ "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 17", "section": "4. Management and Organisation", "subsectionTitle": "4.1. General provisions", "applicability": "All", "questionVerbatim": "17. Is there a data retention policy in place that is compliant with local law and a Privacy Officer that manages the policy?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C18", "no": 18, "domain": "4", "subsection": "4.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Does the participant have appropriate insurance coverage (or sufficient financial resources) to continue providing the services and cover liability claims?", "guidance": "Liability insurance or demonstrated financial resources covering claims that may arise from providing the issuing service.", "examples": "Please provide evidence of a liability insurance, or sufficient financial resources, to cover liability claims that may arise from providing the service.", "answerType": "yesno", "evidence": [ { "type": "certificate", "label": "Insurance certificate (annual)", "validityMonths": 12 } ], "mappings": { "eidas1502": "2.4.1 (3)", "iso27001": null, "gleifQvi": "Financial data" }, "fastTracks": [ "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 18", "section": "4. Management and Organisation", "subsectionTitle": "4.1. General provisions", "applicability": "All", "questionVerbatim": "18. Does the participant have appropriate insurance coverage for the operations to continue providing the services?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C19", "no": 19, "domain": "4", "subsection": "4.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is there an outsourcing policy making clear that responsibility for outsourced activities remains with the participant?", "guidance": "The participant remains responsible for all obligations it has outsourced (e.g. wallet or issuer software as a service, hosting, identity proofing vendors) and for compliance with the scheme, as if it performed the tasks itself.", "examples": "Please indicate if the participant is aware that it is responsible for all obligations that they have outsourced to other entities and for complying with the scheme policy, in the same way as when they performed these tasks themselves.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Outsourcing policy + sub-processor list" } ], "mappings": { "eidas1502": "2.4.1 (4)", "iso27001": "A.15", "gleifQvi": "Audits & general governance" }, "fastTracks": [ "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 19", "section": "4. Management and Organisation", "subsectionTitle": "4.1. General provisions", "applicability": "All", "questionVerbatim": "19. Is there an outsourcing policy in which it is clear that responsibility for the outsourced activities remains with the participant?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C20", "no": 20, "domain": "4", "subsection": "4.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is there an effective termination (exit) plan in place?", "guidance": "Exit plan with timelines, how users and relying parties are informed, and protection, retention and destruction of data. Under 3.0 this plan is the basis of the withdrawal plan required on offboarding (6-month notice, 90-day holder grace period).", "examples": "Please provide an exit plan including timelines and a plan for how relevant users and parties will be informed, as well as a plan for the protection, retention and destruction of data in compliance with the policy.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Termination / exit plan" } ], "mappings": { "eidas1502": "2.4.1 (5)", "iso27001": "A.17", "gleifQvi": "Audits & general governance" }, "fastTracks": [ "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 20", "section": "4. Management and Organisation", "subsectionTitle": "4.1. General provisions", "applicability": "All", "questionVerbatim": "20.Is there an effective termination plan in place?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C21", "no": 21, "domain": "4", "subsection": "4.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is relevant service information provided to customers in publicly accessible documents?", "guidance": "Service definition including applicable terms, conditions, fees, limitations of use and a privacy policy.", "examples": "Please provide (the location of, or process of providing it to your customers) the service definition, including applicable terms, conditions, fees, limitations of its usage and a privacy policy.", "answerType": "yesno", "evidence": [ { "type": "url", "label": "Public service definition, terms, fees, privacy policy" } ], "mappings": { "eidas1502": "2.4.2 (1)", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 21", "section": "4. Management and Organisation", "subsectionTitle": "4.2. Published notices and user information", "applicability": "All", "questionVerbatim": "21. Is relevant information, related to service definition, provided to customers in publically accessible documents?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C22", "no": 22, "domain": "4", "subsection": "4.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "When services change, are there policies and procedures to notify users timely and reliably?", "guidance": "Change notification policy for holders, verifiers and the Foundation (incl. changes of keys, endpoints and credential types).", "examples": "Please provide the policy and procedures", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Change notification policy" } ], "mappings": { "eidas1502": "2.4.2 (2)", "iso27001": "A.12.1.2", "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 22", "section": "4. Management and Organisation", "subsectionTitle": "4.2. Published notices and user information", "applicability": "All", "questionVerbatim": "22. In case services are changed, are there policies and procedures to notify users timely and reliably?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C23", "no": 23, "domain": "4", "subsection": "4.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are there appropriate policies and procedures to respond fully and correctly to questions?", "guidance": "A public communication channel (phone number, e-mail) is available. Under the service levels for Certified Parties: receipt confirmed within 1 working day, substantive answer within 5 working days.", "examples": "A communication channel is available to answer questions, e.g. phone number or email adress that is publicly available on the website.", "answerType": "yesno", "evidence": [ { "type": "url", "label": "Public support channel" } ], "mappings": { "eidas1502": "2.4.2 (3)", "iso27001": null, "gleifQvi": "Business & operational" }, "source": "Excel: Assessment framework, row for question 23", "section": "4. Management and Organisation", "subsectionTitle": "4.2. Published notices and user information", "applicability": "All", "questionVerbatim": "23. Are there appropriate policies and procedures to respond fully and correctly to questions?", "explanation": "", "answerCategory": "Yes/No" }, { "id": "C24", "no": 24, "domain": "4", "subsection": "4.3", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is there an effective information security management system (ISMS) for the management and control of information security risks concerning the service?", "guidance": "Low: an effective ISMS. Substantial and High: the ISMS adheres to proven standards and principles such as ISO/IEC 27001, COBIT or NIST.", "examples": "Proven standards and principles such as ISO27001, COBIT or NIST.", "answerType": "loa", "evidence": [ { "type": "certificate", "label": "ISO/IEC 27001 certificate + SoA", "validityMonths": 36 }, { "type": "policy", "label": "ISMS description (if not certified)" } ], "mappings": { "eidas1502": "2.4.3", "iso27001": "clause 4-10", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "eidas-notified", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 24", "section": "4. Management and Organisation", "subsectionTitle": "4.3. Information security management", "applicability": "All", "questionVerbatim": "24. Is there an effective information security management system(ISMS) in place for the management and control of information security risks concerning the service?", "explanation": "Low: If you have an effective ISMS\nSubstantial and High: If it adheres to proven standards and principles", "answerCategory": "Low/Substantial/High" }, { "id": "C25", "no": 25, "domain": "4", "subsection": "4.4", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is there an effective record-management system in place that takes into account applicable legislation and good practice on data protection and retention?", "guidance": "ISO/IEC 27001: A.12 Operational security (A.12.4 logging and monitoring) with A.18 Compliance.", "examples": "Please provide a description of the information that is received, as well as how the data is protected, processed, stored and removed.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Record management / logging policy" } ], "mappings": { "eidas1502": "2.4.4 (1)", "iso27001": "A.12.4, A.18", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 25", "section": "4. Management and Organisation", "subsectionTitle": "4.4. Record keeping", "applicability": "All", "questionVerbatim": "25. Is there an effective record-management system in place, that takes into account applicable legislation and good practices in relation to data protection and data retention?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls A.12 ‘Operational security’ in combination with A.18 ‘Compliance’ (especially A.12.4 Logging and monitoring).", "answerCategory": "Yes/No" }, { "id": "C26", "no": 26, "domain": "4", "subsection": "4.4", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are records kept as long as needed for auditing or legal requirements and securely destroyed afterwards?", "guidance": "ISO/IEC 27001 A.18.1.3. Retention criteria, integrity of records over time, secure destruction.", "examples": "Describe how records long records are kept and destroyed while ensuring compliance with legal, regulatory, and contractual requirements. Describe the criteria for retention periods and how record integrity is maintained over time.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Retention schedule" } ], "mappings": { "eidas1502": "2.4.4 (2)", "iso27001": "A.18.1.3", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 26", "section": "4. Management and Organisation", "subsectionTitle": "4.4. Record keeping", "applicability": "All", "questionVerbatim": "26. Are records kept as long as needed for the purpose of auditing or legal requirements, and securely destroyed afterwards?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of controls A.18 ‘Compliance’ (cf. A.18.1.3).", "answerCategory": "Yes/No" }, { "id": "C27", "no": 27, "domain": "4", "subsection": "4.5", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are there procedures ensuring staff and subcontractors are sufficiently trained, qualified and experienced for their roles?", "guidance": "ISO/IEC 27001 A.7 Human resource security (A.7.2.2).", "examples": "Please provide a description of the procedures.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Training and competence procedure" } ], "mappings": { "eidas1502": "2.4.5 (1)", "iso27001": "A.7.2.2", "gleifQvi": "Audits & general governance" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 27", "section": "4. Management and Organisation", "subsectionTitle": "4.5. Facilities and staff", "applicability": "All", "questionVerbatim": "27. Are there procedures that ensure that staff and subcontractors are sufficiently trained, qualified and experienced in the skills needed to execute the roles they fulfil?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of controls A.7 ‘Human resource security’ (cf. in particular A.7.2.2)", "answerCategory": "Yes/No" }, { "id": "C28", "no": 28, "domain": "4", "subsection": "4.5", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are sufficient staff and subcontractors available to adequately operate and resource the service according to the data space or ecosystem policies?", "guidance": "ISO/IEC 27001 A.12.1.2 Capacity management, including human resources.", "examples": "Please provide a description of how the required skills are fulfilled", "answerType": "yesno", "evidence": [ { "type": "attestation", "label": "Staffing statement" } ], "mappings": { "eidas1502": "2.4.5 (2)", "iso27001": "A.12.1.2", "gleifQvi": "Audits & general governance" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 28", "section": "4. Management and Organisation", "subsectionTitle": "4.5. Facilities and staff", "applicability": "All", "questionVerbatim": "28. Is there sufficient staff and subcontractors present to adequately operate and resource the service according to the data space or ecosystem policies and procedures?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of controls A.12 ‘Operations security’ (cf. A.12.1.2 ‘Capacity management’) which also addresses the capacity of human resources.", "answerCategory": "Yes/No" }, { "id": "C29", "no": 29, "domain": "4", "subsection": "4.5", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are facilities in place that allow continuous monitoring of the service and protect against environmental events, unauthorised access and other factors affecting security?", "guidance": "ISO/IEC 27001 A.11 Physical and environmental security, A.9 Access control, A.12 Operations security.", "examples": "Please provide a business continuity plan that includes how you handle this.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Business continuity plan" } ], "mappings": { "eidas1502": "2.4.5 (3)", "iso27001": "A.11, A.9, A.12", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 29", "section": "4. Management and Organisation", "subsectionTitle": "4.5. Facilities and staff", "applicability": "All", "questionVerbatim": "29. Are facilities in place that allow the continuous monitoring of the service, and protect against, damage caused by environmental events, unauthorised access and other factors that may impact the security of the service?", "explanation": "For an information system management system according to ISO/IEC 27001:2013, this requirement is covered as part of controls A.11 ‘Physical and environmental security’ and A.9 ‘Access control’. The monitoring mechanisms should be also considered also as part of control A.12 ‘Operations security’.", "answerCategory": "Yes/No" }, { "id": "C30", "no": 30, "domain": "4", "subsection": "4.5", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is access to areas holding or processing personal, cryptographic or other sensitive information limited to authorised staff or subcontractors?", "guidance": "ISO/IEC 27001 A.9 Access control, A.10 Cryptography, A.18.1.5.", "examples": "Please provide the role-based access management policy (CRUD) and the procedures in place to enforce this policy.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Role-based access policy" } ], "mappings": { "eidas1502": "2.4.5 (4)", "iso27001": "A.9, A.10, A.18.1.5", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 30", "section": "4. Management and Organisation", "subsectionTitle": "4.5. Facilities and staff", "applicability": "All", "questionVerbatim": "30. Is access to areas holding or processing personal, cryptographic or other sensitive information limited to authorised staff or subcontractors?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of controls A.9 ‘Access control’, whose objective is particularly to limit access to information and information processing facilities, A.10 ‘Cryptography’ and A.18.1.5 ‘Regulation of cryptographic controls’.", "answerCategory": "Yes/No" }, { "id": "C31", "no": 31, "domain": "4", "subsection": "4.6", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are there proportionate technical controls to manage the risks to the security of the service, protecting confidentiality, integrity and availability?", "guidance": "Required at any assurance level. ISO/IEC 27001 A.10, A.12, A.17, A.18.1.5.", "examples": "Please provide a risk analysis for the service, including the mitigating measures that have been taken, including the risk of hacking and tampering of information.", "answerType": "yesno", "evidence": [ { "type": "report", "label": "Risk analysis of the issuing service" } ], "mappings": { "eidas1502": "2.4.6 (1)", "iso27001": "A.10, A.12, A.17", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 31", "section": "4. Management and Organisation", "subsectionTitle": "4.6. Technical controls", "applicability": "All", "questionVerbatim": "31. Are there proportionate technical controls to manage the risks posed to the security of the service, protecting the confidentiality, integrity and availability of the information processed?", "explanation": "These items must be in place for any eIDAS level of assurance.\n\nFor an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls A.10 ‘Cryptography’, A.12 ‘Operations security’, (relating to availability) A.17 ‘Information security aspects of business continuity management’ and A.18.1.5 ‘Regulation of cryptographic controls’", "answerCategory": "Yes/No" }, { "id": "C32", "no": 32, "domain": "4", "subsection": "4.6", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are electronic communication channels used to exchange personal or sensitive information protected against eavesdropping, manipulation and replay?", "guidance": "ISO/IEC 27001 A.10, A.13, A.18.1.5. TLS 1.2+ with strong ciphers on all issuance, status and metadata endpoints.", "examples": "Please provide the measures taken to provide this protection.", "answerType": "yesno", "evidence": [ { "type": "report", "label": "TLS / transport security configuration (scan result)" } ], "mappings": { "eidas1502": "2.4.6 (2)", "iso27001": "A.10, A.13", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 32", "section": "4. Management and Organisation", "subsectionTitle": "4.6. Technical controls", "applicability": "All", "questionVerbatim": "32. Are electronic communication channels used to exchange personal or sensitive information protected against eavesdropping, manipulation and replay?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls A.10 ‘Cryptography’, A.13 ‘Communications security’ and A.18.1.5 ‘Regulation of cryptographic controls’", "answerCategory": "Yes/No" }, { "id": "C33", "no": 33, "domain": "4", "subsection": "4.6", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Is access to sensitive cryptographic material restricted to the roles and applications strictly requiring access?", "guidance": "Substantial and High: sensitive cryptographic material is also protected from tampering (HSM / QSCD). ISO/IEC 27001 A.9, A.10.", "examples": "Please provide the role-based access management policy (CRUD) and the procedures in place to enforce this policy.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Key management policy" }, { "type": "certificate", "label": "HSM / QSCD certification" } ], "mappings": { "eidas1502": "2.4.6 (3)", "iso27001": "A.9, A.10", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 33", "section": "4. Management and Organisation", "subsectionTitle": "4.6. Technical controls", "applicability": "All", "questionVerbatim": "33. Is access to sensitive cryptographic material restricted to the roles and applications strictly requiring access?", "explanation": "32. Substantial and High: sensitive cryptographic material is also protected from tampering.\n\nFor an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls A.9 ‘Access control’ and A.10 ‘Cryptography’.", "answerCategory": "Low/Substantial/High" }, { "id": "C34", "no": 34, "domain": "4", "subsection": "4.6", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are there procedures to ensure security over time, with the ability to respond to changes in risk levels, incidents and security breaches?", "guidance": "ISO/IEC 27001 A.14 secure development, A.16 incident management. Incident notification to the Foundation immediately on discovery (service levels).", "examples": "", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Incident and vulnerability management procedure" } ], "mappings": { "eidas1502": "2.4.6 (4)", "iso27001": "A.14, A.16", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 34", "section": "4. Management and Organisation", "subsectionTitle": "4.6. Technical controls", "applicability": "All", "questionVerbatim": "34. Are there procedures to ensure security over time, with the ability to respond to changes in risk levels, incidents and security breaches?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls A.14 ‘Security in development and support processes’ and A.16 ‘ Information security incident management’.", "answerCategory": "Yes/No" }, { "id": "C35", "no": 35, "domain": "4", "subsection": "4.6", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are all media containing personal, cryptographic or other sensitive information stored, transported and disposed of in a safe and secure manner?", "guidance": "ISO/IEC 27001 A.8 Asset management.", "examples": "", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Asset and media handling policy" } ], "mappings": { "eidas1502": "2.4.6 (5)", "iso27001": "A.8", "gleifQvi": "Technology & security" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 35", "section": "4. Management and Organisation", "subsectionTitle": "4.6. Technical controls", "applicability": "All", "questionVerbatim": "35. Are all media containing personal, cryptographic or other sensitive information stored, transported and disposed in a safe and secure manner?", "explanation": "For an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls in A.8 ‘Asset management’.", "answerCategory": "Yes/No" }, { "id": "C36", "no": 36, "domain": "4", "subsection": "4.7", "roles": [ "PCI", "DRC", "ICI", "PR" ], "question": "Are periodic audits performed covering all parts of the service to ensure compliance with relevant policies?", "guidance": "Low: internal audits. Substantial: independent internal or external audits. High: independent external audits. Audits follow ISO 19011. ISO/IEC 27001 A.18.2.", "examples": "Please provide the latest audit report. Audits should follow best practices guidelines, such as ISO19011", "answerType": "loa", "evidence": [ { "type": "report", "label": "Latest audit report", "validityMonths": 12 } ], "mappings": { "eidas1502": "2.4.7", "iso27001": "A.18.2", "gleifQvi": "Audits & general governance" }, "fastTracks": [ "iso27001", "gleif-qvi" ], "source": "Excel: Assessment framework, row for question 36", "section": "4. Management and Organisation", "subsectionTitle": "4.7. Compliance and audit", "applicability": "All", "questionVerbatim": "36. Are there periodical audits performed that include all parts of providing the service to ensure compliancy with relevant policies?", "explanation": "• Low: If internal audits are performed\n• Substantial: If there are independent internal or external audits\n• High: If you have independant external audits\n\nFor an information security management system according to ISO/IEC 27001:2013, this requirement is covered as part of the controls A.18 ‘Compliance’ (cf. A.18.2 ‘Information security review’).", "answerCategory": "Low/Substantial/High" }, { "id": "P01", "no": 37, "domain": "5", "subsection": "5.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Does the issuer hold an issuer identifier and signing keys that meet the iSHARE VC profile?", "guidance": "An eIDAS qualified certificate for electronic seals (or an equivalent accepted by the Foundation) chained to a CA on the Trusted Issuers Registry, and an issuer identifier per the iSHARE DID method. Substantial: private keys generated and held in an HSM. High: keys in a certified QSCD / HSM (FIPS 140-3 L3 or CC EAL4+), with a documented key ceremony under dual control.", "examples": "Upload the certificate chain and the key ceremony record; the portal validates the chain against the EU trusted list.", "answerType": "loa", "evidence": [ { "type": "certificate", "label": "Qualified eSeal certificate (chain)", "validityMonths": 12 }, { "type": "report", "label": "Key ceremony record / HSM attestation" } ], "mappings": { "eidas1502": "-", "iso27001": "A.10", "gleifQvi": "Technical qualification (key management)", "ebsi": "DID registration" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "An eIDAS qualified certificate for electronic seals (or an equivalent accepted by the Foundation) chained to a CA on the Trusted Issuers Registry, and an issuer identifier per the iSHARE DID method. Substantial: private keys generated and held in an HSM. High: keys in a certified QSCD / HSM (FIPS 140-3 L3 or CC EAL4+), with a documented key ceremony under dual control.", "answerCategory": "Low/Substantial/High" }, { "id": "P02", "no": 38, "domain": "5", "subsection": "5.1", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Are key rotation and key compromise procedures documented and tested?", "guidance": "Planned rotation (before certificate expiry) and emergency rotation on compromise. The Foundation is notified within 24 hours of a suspected compromise; the registry entry is updated; affected credentials are re-issued or revoked via the status list. Rotation is demonstrated in the technical dry run.", "examples": "Provide the procedure and the dry-run rotation log.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Key rotation and compromise procedure" }, { "type": "demonstration", "label": "Dry-run rotation log" } ], "mappings": { "eidas1502": "-", "iso27001": "A.10, A.16", "gleifQvi": "Technical qualification (key rotation)" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Planned rotation (before certificate expiry) and emergency rotation on compromise. The Foundation is notified within 24 hours of a suspected compromise; the registry entry is updated; affected credentials are re-issued or revoked via the status list. Rotation is demonstrated in the technical dry run.", "answerCategory": "Yes/No" }, { "id": "P03", "no": 39, "domain": "5", "subsection": "5.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Do issued credentials conform to the iSHARE schemas and the W3C VC Data Model 2.0?", "guidance": "Credential types issued are limited to those on the accreditation. Each conforms to the published JSON schema at schemas.ishare.eu (v3) and is validated by the conformance test tool.", "examples": "Attach the conformance test report per credential type.", "answerType": "yesno", "evidence": [ { "type": "report", "label": "Conformance test tool report" }, { "type": "report", "label": "CTT test run identifier per version" } ], "mappings": { "eidas1502": "-", "iso27001": null, "gleifQvi": "Technical qualification (issuance)", "ebsi": "Accreditation scope (credential types)" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Credential types issued are limited to those on the accreditation. Each conforms to the published JSON schema at schemas.ishare.eu (v3) and is validated by the conformance test tool.", "answerCategory": "Yes/No" }, { "id": "P04", "no": 40, "domain": "5", "subsection": "5.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Do the issuance and presentation endpoints conform to the iSHARE protocol profiles?", "guidance": "H2M: OpenID for Verifiable Credential Issuance 1.0 and OpenID for Verifiable Presentations 1.0. M2M: Eclipse Decentralized Claims Protocol 1.0. Metadata endpoints are published and resolvable.", "examples": "Attach the conformance test report and the endpoint metadata URLs.", "answerType": "yesno", "evidence": [ { "type": "report", "label": "Conformance test tool report (protocol)" }, { "type": "url", "label": "Issuer metadata endpoint" }, { "type": "report", "label": "CTT test run identifier per version" } ], "mappings": { "eidas1502": "-", "iso27001": null, "gleifQvi": "Technical qualification", "eidas2": "OID4VCI HAIP profile (indicative)" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "H2M: OpenID for Verifiable Credential Issuance 1.0 and OpenID for Verifiable Presentations 1.0. M2M: Eclipse Decentralized Claims Protocol 1.0. Metadata endpoints are published and resolvable.", "answerCategory": "Yes/No" }, { "id": "P05", "no": 41, "domain": "5", "subsection": "5.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Is credential status published via a Bitstring Status List and kept available?", "guidance": "Every issued credential references a status list entry. The list is publicly reachable at 99% availability per calendar month and is updated within 1 working day of a revocation or suspension (immediately on compromise).", "examples": "Provide the status list URL; the portal monitors it continuously.", "answerType": "yesno", "evidence": [ { "type": "url", "label": "Status list URL" }, { "type": "demonstration", "label": "Monitoring output" } ], "mappings": { "eidas1502": "-", "iso27001": "A.17", "gleifQvi": "Technical qualification (revocation)", "ebsi": "Revocation" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Every issued credential references a status list entry. The list is publicly reachable at 99% availability per calendar month and is updated within 1 working day of a revocation or suspension (immediately on compromise).", "answerCategory": "Yes/No" }, { "id": "P06", "no": 42, "domain": "5", "subsection": "5.2", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Is there a procedure for revoking and suspending issued credentials, with authenticated requesters?", "guidance": "Who may request revocation (holder, Data Rightsholder, data space authority, the Foundation), how the requester is authenticated, and the maximum time to publication. Equivalent of controls 9-10 for credentials.", "examples": "Provide the revocation procedure and authorisation matrix.", "answerType": "yesno", "evidence": [ { "type": "policy", "label": "Credential revocation procedure" } ], "mappings": { "eidas1502": "2.2.3 (analogous)", "iso27001": "A.9", "gleifQvi": "Technical qualification (revocation)" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Who may request revocation (holder, Data Rightsholder, data space authority, the Foundation), how the requester is authenticated, and the maximum time to publication. Equivalent of controls 9-10 for credentials.", "answerCategory": "Yes/No" }, { "id": "P07", "no": 43, "domain": "5", "subsection": "5.2", "roles": [ "PCI", "PR" ], "proposed": true, "question": "Is the subject verified against an authoritative source before every issuance?", "guidance": "Participant Credentials: the legal entity is verified against the business register (or LEI), the signed Accession Agreement is checked, and the representative's authority is verified. Equivalent of controls 3-4 for legal persons. Data Rights Controllers: see subsection 5.4.", "examples": "Provide the issuance procedure and a redacted issuance log.", "answerType": "loa", "evidence": [ { "type": "policy", "label": "Issuance verification procedure" }, { "type": "demonstration", "label": "Redacted issuance log" } ], "mappings": { "eidas1502": "2.1.3 (legal persons)", "iso27001": null, "gleifQvi": "Identity verification (LE, OOR/ECR)" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Participant Credentials: the legal entity is verified against the business register (or LEI), the signed Accession Agreement is checked, and the representative's authority is verified. Equivalent of controls 3-4 for legal persons. Data Rights Controllers: see subsection 5.4.", "answerCategory": "Low/Substantial/High" }, { "id": "P08", "no": 44, "domain": "5", "subsection": "5.3", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Are all issuance, revocation and key events logged and reported to the Foundation?", "guidance": "Tamper-evident log of who issued what to whom and when; retained per control 26. Monthly management information (availability, transactions, incidents, party relations) delivered before 23:59 on the 5th working day, per the service levels for Certified Parties.", "examples": "Provide a log sample and the reporting template.", "answerType": "yesno", "evidence": [ { "type": "demonstration", "label": "Log sample" }, { "type": "policy", "label": "Monthly reporting procedure" } ], "mappings": { "eidas1502": "2.4.4", "iso27001": "A.12.4", "gleifQvi": "Audits & general governance" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Tamper-evident log of who issued what to whom and when; retained per control 26. Monthly management information (availability, transactions, incidents, party relations) delivered before 23:59 on the 5th working day, per the service levels for Certified Parties.", "answerCategory": "Yes/No" }, { "id": "P09", "no": 45, "domain": "5", "subsection": "5.3", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Does the service meet the iSHARE service levels for Certified Parties?", "guidance": "99% availability per calendar month (planned maintenance excluded); 95% of messages within 2 s, 99% within 5 s; at least 100 simultaneous messages; incidents notified to the Foundation immediately with updates as prescribed; support receipt confirmed within 1 working day.", "examples": "Provide the SLA statement and a monitoring report.", "answerType": "yesno", "evidence": [ { "type": "attestation", "label": "SLA acceptance" }, { "type": "report", "label": "Monitoring report" } ], "mappings": { "eidas1502": "-", "iso27001": "A.17", "gleifQvi": "SLA (Appendix 5)" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "99% availability per calendar month (planned maintenance excluded); 95% of messages within 2 s, 99% within 5 s; at least 100 simultaneous messages; incidents notified to the Foundation immediately with updates as prescribed; support receipt confirmed within 1 working day.", "answerCategory": "Yes/No" }, { "id": "P10", "no": 46, "domain": "5", "subsection": "5.3", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Is the issuer metadata for the Trusted Issuers Registry complete and valid?", "guidance": "Legal name, identifiers, public keys / certificate chain, issuer DID, endpoints, credential types, assurance level, contact for incidents, and a link to the accreditation. The portal validates the metadata document and generates the registry entry from it.", "examples": "Complete the metadata form; the portal validates it.", "answerType": "yesno", "evidence": [ { "type": "url", "label": "Issuer metadata document" } ], "mappings": { "eidas1502": "-", "iso27001": null, "gleifQvi": "Contact details (Appendix 4)", "etsi": "TS 119 612 TSP entry" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Legal name, identifiers, public keys / certificate chain, issuer DID, endpoints, credential types, assurance level, contact for incidents, and a link to the accreditation. The portal validates the metadata document and generates the registry entry from it.", "answerCategory": "Yes/No" }, { "id": "P11", "no": 47, "domain": "5", "subsection": "5.3", "roles": [ "PCI", "DRC", "ICI", "PR" ], "proposed": true, "question": "Has the technical dry run on the iSHARE test network been completed successfully?", "guidance": "Witnessed by the assessor: issue, present and verify one credential per accredited type; revoke it and observe the status list; rotate the signing key and re-verify. Mirrors GLEIF's technical qualification playbook.", "examples": "The dry-run playbook is signed off in the portal by the assessor.", "answerType": "yesno", "evidence": [ { "type": "demonstration", "label": "Dry-run playbook signed by assessor" } ], "mappings": { "eidas1502": "-", "iso27001": null, "gleifQvi": "Technical Qualification Playbook" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "Witnessed by the assessor: issue, present and verify one credential per accredited type; revoke it and observe the status list; rotate the signing key and re-verify. Mirrors GLEIF's technical qualification playbook.", "answerCategory": "Yes/No" }, { "id": "P12", "no": 48, "domain": "5", "subsection": "5.4", "roles": [ "DRC" ], "proposed": true, "question": "Is the Data Rightsholder identified as a legal entity, and is the mandate of the person or system that instructs you to issue verified?", "guidance": "The Data Rightsholder (the Entitled Party in the Trust Framework) is identified by a registered identifier (business register, EUID, LEI, VAT, EORI) and, where available, its iSHARE Participant Credential. The authority of the representative or system that instructs the issuance is verified. Low: registered identifier checked against the register; instruction from a named contact. Substantial: mandate signed by an authorised signatory and verified against the register, or the rightsholder presents a valid Participant Credential and every instruction is authenticated (eSeal, or OpenID4VP presentation). High: Substantial, with the mandate and each instruction sealed with a qualified certificate (or presented from a wallet at assurance level High) and re-verified on every issuance. Mirrors questions 3 and 4 for legal persons.", "examples": "Provide the onboarding procedure for Data Rightsholders, the mandate template, and a redacted example of a verified mandate.", "answerType": "loa", "answerCategory": "Low/Substantial/High", "section": "5. Credential issuance operations", "subsectionTitle": "5.4 Data rights verification", "applicability": "Data Rights Controller (Authorisation Registry)", "evidence": [ { "type": "policy", "label": "Rightsholder onboarding and mandate procedure" }, { "type": "demonstration", "label": "Redacted verified mandate" } ], "mappings": { "eidas1502": "2.1.3 (legal persons), analogous", "iso27001": null, "gleifQvi": "Identity verification (Legal Entity, LAR)", "trustFramework": "Entitled Party; delegation evidence" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "The Data Rightsholder (the Entitled Party in the Trust Framework) is identified by a registered identifier (business register, EUID, LEI, VAT, EORI) and, where available, its iSHARE Participant Credential. The authority of the representative or system that instructs the issuance is verified. Low: registered identifier checked against the register; instruction from a named contact. Substantial: mandate signed by an authorised signatory and verified against the register, or the rightsholder presents a valid Participant Credential and every instruction is authenticated (eSeal, or OpenID4VP presentation). High: Substantial, with the mandate and each instruction sealed with a qualified certificate (or presented from a wallet at assurance level High) and re-verified on every issuance. Mirrors questions 3 and 4 for legal persons." }, { "id": "P13", "no": 49, "domain": "5", "subsection": "5.4", "roles": [ "DRC" ], "proposed": true, "question": "Before issuing a Data Rights Credential, do you verify that the Data Rightsholder actually holds the rights to the data at the Service Provider concerned?", "guidance": "A Data Rights Credential grants access to specific data at a Service Provider. Issuing it on a mere claim of ownership is not sufficient: the issuer establishes that the rightsholder is entitled to that data, for the scope requested, as owner, data holder, licensee or by law. Low: the rightsholder declares its entitlement in writing and the declaration is recorded with the credential. Substantial: the entitlement is confirmed by an authoritative source before the first issuance and re-checked whenever the scope changes: confirmation by the Service Provider (data holder) that the rightsholder is the Entitled Party for the data, or documentary evidence of the legal basis (contract, licence, statutory right). High: the confirmation is machine-verifiable and checked at every issuance: a credential or signed statement from the Service Provider, or a registry entry maintained by the data space, binding rightsholder, data (service, attributes) and validity.", "examples": "Describe the entitlement check per scenario (own data; data held by a Service Provider on the rightsholder's behalf; data received under licence) and provide a redacted verification record and, where used, the agreements with Service Providers on entitlement confirmation.", "answerType": "loa", "answerCategory": "Low/Substantial/High", "section": "5. Credential issuance operations", "subsectionTitle": "5.4 Data rights verification", "applicability": "Data Rights Controller (Authorisation Registry)", "evidence": [ { "type": "policy", "label": "Entitlement verification procedure" }, { "type": "demonstration", "label": "Redacted verification record" }, { "type": "policy", "label": "Agreements with Service Providers on entitlement confirmation" } ], "mappings": { "eidas1502": "-", "iso27001": null, "gleifQvi": "-", "trustFramework": "Entitled Party; delegation evidence; Service Provider", "dataAct": "data holder / user, Regulation (EU) 2023/2854" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "A Data Rights Credential grants access to specific data at a Service Provider. Issuing it on a mere claim of ownership is not sufficient: the issuer establishes that the rightsholder is entitled to that data, for the scope requested, as owner, data holder, licensee or by law. Low: the rightsholder declares its entitlement in writing and the declaration is recorded with the credential. Substantial: the entitlement is confirmed by an authoritative source before the first issuance and re-checked whenever the scope changes: confirmation by the Service Provider (data holder) that the rightsholder is the Entitled Party for the data, or documentary evidence of the legal basis (contract, licence, statutory right). High: the confirmation is machine-verifiable and checked at every issuance: a credential or signed statement from the Service Provider, or a registry entry maintained by the data space, binding rightsholder, data (service, attributes) and validity." }, { "id": "P14", "no": 50, "domain": "5", "subsection": "5.4", "roles": [ "DRC" ], "proposed": true, "question": "Is every Data Rights Credential traceable to an explicit, authenticated instruction of the Data Rightsholder, and is it revoked when the entitlement ends?", "guidance": "The scope of the credential (who, which data and attributes, at which Service Provider, for how long, under which iSHARE Licence) comes from an instruction the rightsholder gave, and the issuer can show that instruction afterwards. The rightsholder can withdraw the instruction. Loss of entitlement (contract ended, data transferred, dispute) leads to revocation on the status list within the time set in P05. The rightsholder receives a record of every issuance and revocation made on its behalf.", "examples": "Provide the instruction format, the log that links each instruction to the credential issued, and the procedure for withdrawal and for loss of entitlement.", "answerType": "yesno", "answerCategory": "Yes/No", "section": "5. Credential issuance operations", "subsectionTitle": "5.4 Data rights verification", "applicability": "Data Rights Controller (Authorisation Registry)", "evidence": [ { "type": "policy", "label": "Instruction, withdrawal and loss-of-entitlement procedure" }, { "type": "demonstration", "label": "Log sample linking instruction to credential" } ], "mappings": { "eidas1502": "2.2.3 (analogous)", "iso27001": "A.12.4", "gleifQvi": "-", "trustFramework": "Delegation evidence; status list" }, "source": "proposed in 3.0 (not in the Excel framework)", "explanation": "The scope of the credential (who, which data and attributes, at which Service Provider, for how long, under which iSHARE Licence) comes from an instruction the rightsholder gave, and the issuer can show that instruction afterwards. The rightsholder can withdraw the instruction. Loss of entitlement (contract ended, data transferred, dispute) leads to revocation on the status list within the time set in P05. The rightsholder receives a record of every issuance and revocation made on its behalf." } ], "decisionRules": { "completeness": "All applicable controls answered and each with at least one evidence item; portal blocks submission otherwise.", "mandatory": "All yes/no controls must be Met, or Partially met with an accepted remediation plan (recorded as a condition with a due date).", "assuranceLevel": "Issuer LoA = minimum LoA achieved on applicable LoA controls. The Foundation may accredit at a lower LoA than requested.", "outcomes": [ "Accredited", "Accredited with conditions", "Not accredited (re-assessment available once within the accreditation fee)" ], "validity": "12 months; renewed through the annual review. Evidence items with a validity period are tracked and requested again when they expire." }, "timelines": { "intakeCall": "within 5 working days of registration", "impedimentCheck": "within 5 working days of application", "evidenceWindow": "30 calendar days (extendable on request)", "completenessFeedback": "within 5 working days of submission", "assessmentDecision": "within 30 calendar days of a complete dossier (4-6 weeks end-to-end)", "reassessment": "within 10 working days of remediation (one included)", "registryPublication": "within 2 working days of payment", "annualReview": "opens 60 days before the accreditation anniversary", "withdrawalNotice": "6 months (Certified Party)", "holderGracePeriod": "90 days to obtain replacement credentials", "disputeWindow": "5 working days per step", "testNetworkAccess": "issued when the application is accepted", "conformanceTesting": "all suites passed before the decision; re-runs unlimited; results imported within 1 working day of the run", "referenceCodeAccess": "invitation within 1 working day of a passed suite", "changeRequestDecision": "within 10 working days (keys, endpoints); scope changes follow the delta assessment" }, "conformance": { "tool": "iSHARE Conformance Test Tool (CTT), admin portal ctt.isharetest.net; results carry a test run identifier and per-case JSON logs", "principle": "Conformance testing is an explicit stage after application acceptance and a gate before the decision. Test-network access (client id, test certificate) is issued when the application is accepted. Every requested role must pass the CTT suite for every framework version the issuer supports. The test run identifier and report are attached as evidence to P03 and P04. Re-runs are unlimited.", "versions": [ { "id": "2.2", "profile": "JWT / iSHARE API profile", "suites": { "PCI": "Participant Registry (Satellite) API suite: /token, /capabilities, /parties, /trusted_list", "PR": "Participant Registry (Satellite) API suite: /token, /capabilities, /parties, /trusted_list", "DRC": "Authorisation Registry suite: /token, /capabilities, /delegation (Permit and Deny masks)", "ICI": "Identity Provider suite: /capabilities, /authorise, /token (M2M and H2M), /userinfo" } }, { "id": "3.0", "profile": "Verifiable-credential profile (W3C VCDM 2.0, schemas.ishare.eu v3, DCP 1.0, OpenID4VCI/OpenID4VP)", "suites": { "PCI": "Participant Credential Issuer suite: ParticipantCredential, ComplianceCredential, DataspaceParticipantCredential, status list, issuer metadata", "PR": "Participant Registry suite: ParticipantCredential issuance, status lists, registry API", "DRC": "Data Rights Controller suite: DataRightsCredential, iSHARE Licence reference, holder binding, status list", "ICI": "Identity Credential Issuer suite: OpenID4VCI issuance, OpenID4VP presentation, holder binding, revocation" } } ], "referenceCode": { "rule": "Passing a suite for version V and role R grants access to the reference implementations tagged for V and R. Open-source repositories are always available. Restricted repositories (the Participant Registry codebase, per the Accession Agreement) are shared under the NDA until the Accession Agreement is signed, are limited to the versions and roles passed, and are withdrawn on offboarding. Every grant and withdrawal is logged in the audit trail.", "repositories": [ { "id": "pci-3", "name": "ishare-participant-credential-issuer (3.0 reference, placeholder)", "version": "3.0", "roles": [ "PCI", "PR" ], "access": "restricted" }, { "id": "drc-3", "name": "ishare-data-rights-controller (3.0 reference, placeholder)", "version": "3.0", "roles": [ "DRC" ], "access": "restricted" }, { "id": "vc-3", "name": "ishare-vc-toolkit (schemas v3, profiles, verifier library, status-list tooling)", "version": "3.0", "roles": [ "PCI", "DRC", "ICI", "PR" ], "access": "public" }, { "id": "sat-2", "name": "iSHARESatellite (Participant Registry deployment)", "version": "2.2", "roles": [ "PCI", "PR" ], "access": "restricted" }, { "id": "ar-2", "name": "AuthorizationRegistry (C# reference implementation)", "version": "2.2", "roles": [ "DRC" ], "access": "public" }, { "id": "py-2", "name": "python-ishare (Satellite and Authorisation Registry APIs)", "version": "2.2", "roles": [ "PCI", "DRC", "PR" ], "access": "public" }, { "id": "oas", "name": "openapi and code-snippets", "version": "all", "roles": [ "PCI", "DRC", "ICI", "PR" ], "access": "public" } ] } }, "selfService": { "principle": "issuer.ishare.eu is also the management environment of a Qualified Issuer. Display and team changes are self-service and immediate; changes that affect the registry entry or the scope of accreditation go through a change request.", "rules": [ { "change": "Display name, tagline, description, logo, website, contact, sectors, visibility toggles", "handling": "self-service", "effect": "published immediately on the Trusted Issuers page; logged" }, { "change": "Data spaces served", "handling": "notify", "effect": "Data Space Authority informed" }, { "change": "Team members and roles (except DAR), notifications, API tokens", "handling": "self-service", "effect": "logged in the audit trail" }, { "change": "Keys, endpoints, status-list URL", "handling": "change-request", "effect": "Foundation approval; registry entry updated with effective date" }, { "change": "Roles, credential types, framework versions", "handling": "change-request", "effect": "delta assessment and CTT for the added scope" }, { "change": "Legal name, identifier, DAR", "handling": "change-request", "effect": "register check; agreement addendum" } ] }, "excelColumns": { "Section": "section", "Subsection": "subsectionTitle", "Applicability": "applicability", "Question": "questionVerbatim", "Explanation": "explanation", "Examples": "examples", "Answer category": "answerCategory", "Answer": "(filled by the candidate: response.answer)", "Score": "(derived from the answer: LoA or Yes/No)", "Explanation Participant": "(filled by the candidate: response.narrative)", "Foundation decision": "(filled by the assessor: verdict)" }, "note": "Controls 1-36 carry the Excel text verbatim in explanation/examples; guidance is a condensed summary." }