Chapter VI, Article 13 · Commission Implementing Regulation (EU) 2024/2981

Contents

Article 13Evaluation activities#

1.National certification schemes shall contain methods and procedures to be used by the conformity assessment bodies when conducting their evaluation activities in accordance with EN ISO/IEC 17065:2012, which shall cover at least the following aspects:

(a)the methods and procedures to conduct evaluation activities, including those related to WSCD, as set out in Annex IV;

(b)the audit of the implementation of the wallet solution and the electronic identification scheme under which they are provided, based on the risk register, set out in Annex I and complemented where necessary by implementation-specific risks;

(c)functional testing activities, based, when available and appropriate, on test suites that are defined according to technical specifications or standards;

(d)assessment of the existence and suitability of maintenance processes, including at least version management, update management and vulnerability management;

(e)assessment of the operating effectiveness of the maintenance processes, including at least version management, update management and vulnerability management;

(f)dependency analysis provided by the wallet provider, including a methodology to assess the acceptability of assurance information, which shall include the elements set out in Annex VI;

(g)vulnerability assessment, at the appropriate level, including:

—a review of the design of the wallet solution, and where applicable, of its source code;

—testing of the resistance of the wallet solution against attackers with high attack potential for assurance level ‘high’ pursuant to Section 2.2.1 of the Annex to Implementing Regulation (EU) 2015/1502;

(h)assessment of the evolution of the threat environment and its impact on the coverage of the risks by the wallet solution, to determine which evaluation activities are required on the various components of the wallet solution.

2.National certification schemes shall contain an evaluation to determine whether the implementation of wallet solutions and the electronic identification scheme under which those wallet solutions are provided match the architecture set out in Article 3 paragraph 5, point (a), as well as an evaluation to determine whether the evaluation plan proposed together with the implementation matches the evaluation plan referred to in Article 3 paragraph 5, point (c).

3.National certification schemes shall set out sampling rules, in order to avoid the repetition of identical evaluation activities and to focus on activities that are specific to a given variant. Those sampling rules shall allow functional and security tests to be performed only on a sample of variants of a target component of a wallet solution and the electronic identification scheme under which they a provided and on a sample of target devices. National certification schemes shall require all certification bodies to justify their use of sampling.

4.National certification schemes shall require the evaluation, by the certification body, of the WSCA based on the methods and procedures set out in Annex IV.

Defined terms · 14

Show every defined term

certification body
means a third-party conformity assessment body operating certification schemes;
critical assets
means assets within or in relation to a wallet unit of such extraordinary importance that where their availability, confidentiality or integrity are compromised, this would have a very serious, debilitating effect on the ability to rely on the wallet unit;
embedded disclosure policy
means a set of rules, embedded in an electronic attestation of attributes by its provider, that indicates the conditions that a wallet-relying party has to meet to access the electronic attestation of attributes.
incident
means an incident as defined in point (6) of Article 6 of Directive (EU) 2022/2555 of the European Parliament and of the Council;
object of certification
means products, processes and services or a combination thereof to which specified requirements apply;
risk register
means a record of information relevant to the certification process about identified risks;
scheme owner
means an organisation which is responsible for developing and maintaining a certification scheme;
wallet instance
means the application installed and configured on a wallet user’s device or environment, which is part of a wallet unit, and that the wallet user uses to interact with the wallet unit;
wallet provider
means a natural or legal person who provides wallet solutions;
wallet secure cryptographic application
means an application that manages critical assets by being linked to and using the cryptographic and non-cryptographic functions provided by the wallet secure cryptographic device;
wallet secure cryptographic device
means a tamper-resistant device that provides an environment that is linked to and used by the wallet secure cryptographic application to protect critical assets and provide cryptographic functions for the secure execution of critical operations;
wallet solution
means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices;
wallet unit
means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user;
wallet user
means a user who is in control of the wallet unit;