Chapter II, Article 3 · Commission Implementing Regulation (EU) 2024/2981

Contents

Article 3Establishment of national certification schemes#

1.Member States shall assign a scheme owner for each national certification scheme.

2.The object of certification defined in national certification schemes shall be the provision and operation of wallet solutions and of the electronic identification schemes under which they are provided.

3.In accordance with Implementing Regulation (EU) 2015/1502, the object of certification in national certification schemes shall include the following elements:

(a)the software components, including settings and configurations of a wallet solution and of the electronic identification scheme under which the wallet solutions are provided;

(b)the hardware components and platforms on which the software components referred to in point (b) run on or rely upon for critical operations, in cases where they are provided directly or indirectly by the wallet solution and electronic identification scheme under which they are provided and when they are required to meet the desired level of assurance for those software components. When the hardware components and platforms are not provided by the wallet provider, national certification schemes shall formulate assumptions for evaluation of the hardware components and platforms, under which resistance against attackers with high attack potential in line with Implementing Regulation (EU) 2015/1502 can be provided, and specify the evaluation activities to confirm these assumptions as referred in Annex IV;

(c)the processes that support the provision and operation of a wallet solution, including the user onboarding process as referred to in Article 5a of Regulation (EU) No 910/2014, covering at least enrolment, electronic means management and organisation pursuant to section 2.1, 2.2, and 2.4 of Annex I to Implementing Regulation (EU) 2015/1502.

4.National certification schemes shall include a description of the specific architecture of the wallet solutions and of the electronic identification scheme under which they are provided. When national certification schemes cover more than one specific architecture, they shall include a profile for each specific architecture.

5.For each profile, national certification schemes shall set out at least the following:

(a)the specific architecture of a wallet solution and of the electronic identification scheme under which they are provided;

(b)the security controls associated to assurance levels set out in Article 8 of Regulation (EU) No 910/2014;

(c)an evaluation plan drawn-up in accordance with section 7.4.1 of EN ISO/IEC 17065;2012;

(d)the security requirements necessary to address the cybersecurity risks and threats listed in the risk register set out in Annex I of this Regulation, up to the required assurance level, and to meet, where applicable, the objectives defined in Article 51 of Regulation (EU) 2019/881;

(e)a mapping of the controls referred to in point (b) of this paragraph to the components of the architecture;

(f)a description of how the security controls, the mapping, the security requirements and the evaluation plan referred to in points (b) to (c) allow providers of wallet solutions and the electronic identification scheme under which they are provided to adequately address the cybersecurity risks and threats identified in the risk register referred to in point (d), up to the required assurance level based on a risk assessment to refine and complement the risks and threats listed in the risk register with risks and threats specific to the architecture.

6.The evaluation plan referred to in paragraph 5, point (c) shall list evaluation activities to be included in the evaluation of wallet solutions and of the electronic identification scheme under which they are provided.

7.The evaluation activity referred to in paragraph 6 shall require providers of wallet solutions and the electronic identification scheme under which they are provided to provide information meeting the requirements listed in Annex II.

Defined terms · 14

Show every defined term

certification body
means a third-party conformity assessment body operating certification schemes;
critical assets
means assets within or in relation to a wallet unit of such extraordinary importance that where their availability, confidentiality or integrity are compromised, this would have a very serious, debilitating effect on the ability to rely on the wallet unit;
embedded disclosure policy
means a set of rules, embedded in an electronic attestation of attributes by its provider, that indicates the conditions that a wallet-relying party has to meet to access the electronic attestation of attributes.
incident
means an incident as defined in point (6) of Article 6 of Directive (EU) 2022/2555 of the European Parliament and of the Council;
object of certification
means products, processes and services or a combination thereof to which specified requirements apply;
risk register
means a record of information relevant to the certification process about identified risks;
scheme owner
means an organisation which is responsible for developing and maintaining a certification scheme;
wallet instance
means the application installed and configured on a wallet user’s device or environment, which is part of a wallet unit, and that the wallet user uses to interact with the wallet unit;
wallet provider
means a natural or legal person who provides wallet solutions;
wallet secure cryptographic application
means an application that manages critical assets by being linked to and using the cryptographic and non-cryptographic functions provided by the wallet secure cryptographic device;
wallet secure cryptographic device
means a tamper-resistant device that provides an environment that is linked to and used by the wallet secure cryptographic application to protect critical assets and provide cryptographic functions for the secure execution of critical operations;
wallet solution
means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices;
wallet unit
means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user;
wallet user
means a user who is in control of the wallet unit;