A standards map, not a shopping list
No single standard defines an entire trust service. A programme usually combines legal requirements, general provider controls, service-specific policy and security requirements, technical formats or protocols, conformity-assessment requirements and organisational policy.
| Layer | Purpose | Examples |
|---|---|---|
| Framework | Legal categories, effects, supervision and status. | EU eIDAS; UK eIDAS |
| Provider requirements | General policy, security and operational controls. | ETSI EN 319 401 family |
| Service requirements | Controls for a particular trust service. | ETSI 319 4xx and 119 5xx families |
| Formats and procedures | Signature formats, validation and technical processing. | ETSI 319 1xx families |
| PKI foundations | Certificates, status protocols, timestamps and policy frameworks. | RFC 5280, 6960, 3161 and 3647 |
Principal standards families
Provider policy and security
General TSP requirements and service-specific requirements for certificate issuers, timestamps, validation, preservation and other trust services.
Signature formats
CAdES, XAdES, PAdES and ASiC profiles for signed data, documents and containers.
Creation and validation
Procedures, validation constraints, reports and service protocols for creating and assessing advanced signatures.
Certificates and identities
X.509 profiles, qualified certificate profiles, identity-proofing requirements and associated policy controls.
Trusted lists
Structures and policy rules for publishing provider, service and status information.
Assessment
Requirements used by conformity assessment bodies and schemes to assess defined service scopes.
Standard numbers and versions change. The current ETSI catalogue and the legal instruments that reference standards should be checked for each project.
How to build an applicable baseline
- Classify the service.Define jurisdiction, actors, intended status and lifecycle.
- Select authoritative sources.Record the regulation, implementing acts, standards and profiles that apply.
- Control versions and options.Do not mix requirements from drafts, superseded editions and current publications without analysis.
- Allocate requirements.Connect each requirement to policy, architecture, procedure, component, supplier and evidence.
- Maintain the baseline.Monitor changes and assess impact before adopting a new version.