Chapter IV, Article 8, Paragraph 5. · Commission Implementing Regulation (EU) 2024/2981

Contents

5.National certification schemes shall require that the following information and documentation is provided or otherwise made available to the certification body by the applicant for certification:

(a)evidence related to the information referred to in Annex IV, point 1, including where necessary details on the wallet solution and its source code, including:

—architecture information: for every component of the wallet solution (including product, process and service components), a description of its essential security properties, including its external dependencies;

—controls and assurance levels: for every security control of the wallet solution, a description of the control and the required assurance level, based on the Annex to Implementing Regulation (EU) 2015/1502, which sets out a number of technical specifications and procedures that apply to the various controls implemented by the electronic identification means;

—mapping the controls to architecture components: a description of how the controls of the wallet are implemented using the different components of the wallet solution, based on a rationale explaining why a given assurance level is required, and how the control is implemented with all required security aspects at the appropriate level;

—rationale and justification of risk coverage: a justification of:

—the mapping of controls to components;

—the suitability of the proposed evaluation plan to appropriately cover all controls;

—the coverage provided by the controls of the cybersecurity risks and threats identified in the risk register, complemented by controls of risks and threats specific to the implementation, at the appropriate assurance level;

(b)the information listed in Annex V;

(c)a complete list of the certificates of conformity and other assurance information used as evidence during the evaluation activities;

(d)any other information relevant for the evaluation activities.

Defined terms · 14

Show every defined term

certification body
means a third-party conformity assessment body operating certification schemes;
critical assets
means assets within or in relation to a wallet unit of such extraordinary importance that where their availability, confidentiality or integrity are compromised, this would have a very serious, debilitating effect on the ability to rely on the wallet unit;
embedded disclosure policy
means a set of rules, embedded in an electronic attestation of attributes by its provider, that indicates the conditions that a wallet-relying party has to meet to access the electronic attestation of attributes.
incident
means an incident as defined in point (6) of Article 6 of Directive (EU) 2022/2555 of the European Parliament and of the Council;
object of certification
means products, processes and services or a combination thereof to which specified requirements apply;
risk register
means a record of information relevant to the certification process about identified risks;
scheme owner
means an organisation which is responsible for developing and maintaining a certification scheme;
wallet instance
means the application installed and configured on a wallet user’s device or environment, which is part of a wallet unit, and that the wallet user uses to interact with the wallet unit;
wallet provider
means a natural or legal person who provides wallet solutions;
wallet secure cryptographic application
means an application that manages critical assets by being linked to and using the cryptographic and non-cryptographic functions provided by the wallet secure cryptographic device;
wallet secure cryptographic device
means a tamper-resistant device that provides an environment that is linked to and used by the wallet secure cryptographic application to protect critical assets and provide cryptographic functions for the secure execution of critical operations;
wallet solution
means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices;
wallet unit
means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user;
wallet user
means a user who is in control of the wallet unit;