search

keyboard_tab EIDAS 2014/0910 EN

 BG CS DA DE EL EN ES ET FI FR GA HR HU IT LV LT MT NL PL PT RO SK SL SV print pdf

2014/0910 EN Art. 19 . Output generated live by software developed by IusOnDemand srl


just index :


whereas :


definitions:


cloud tag: and the number of total unique words without stopwords is: 121

 

Article 19

Security requirements applicable to trust_service providers

1.   Qualified and non-qualified trust_service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust_services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

2.   Qualified and non-qualified trust_service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust_service provided or on the personal data maintained therein.

Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust_service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA.

The notified supervisory body shall inform the public or require the trust_service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest.

3.   The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust_service providers.

4.   The Commission may, by means of implementing acts,:

(a)

further specify the measures referred to in paragraph 1; and

(b)

define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 3

Qualified trust_services


whereas
keyboard_arrow_down