EIDAS 2014/0910 EN

1. Trust services provided by trust_service providers established in a third country shall be recognised as legally equivalent to qualified trust_services provided by qualified trust_service providers established in the Union where the trust_services originating from the third country are recognised under an agreement concluded between the Union and the third country in question or an international organisation in accordance with Article 218 TFEU.

2. Agreements referred to in paragraph 1 shall ensure, in particular, that:

(a)

the requirements applicable to qualified trust_service providers established in the Union and the qualified trust_services they provide are met by the trust_service providers in the third country or international organisations with which the agreement is concluded, and by the trust_services they provide;

(b)	the qualified trust_services provided by qualified trust_service providers established in the Union are recognised as legally equivalent to trust_services provided by trust_service providers in the third country or international organisation with which the agreement is concluded.

Article 19

Security requirements applicable to trust_service providers

1. Qualified and non-qualified trust_service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust_services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

2. Qualified and non-qualified trust_service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust_service provided or on the personal data maintained therein.

Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust_service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA.

The notified supervisory body shall inform the public or require the trust_service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest.

3. The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust_service providers.

4. The Commission may, by means of implementing acts,:

(a)	further specify the measures referred to in paragraph 1; and

(b)	define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 3

Qualified trust_services

whereas

(55) IT security certification based on international standards such as ISO 15408 and related evaluation methods and mutual recognition arrangements is an important tool for verifying the security of qualified electronic_signature creation devices and should be promoted.
However, innovative solutions and services such as mobile signing and cloud signing rely on technical and organisational solutions for qualified electronic_signature creation devices for which security standards may not yet be available or for which the first IT security certification is ongoing.
The level of security of such qualified electronic_signature creation devices could be evaluated by using alternative processes only where such security standards are not available or where the first IT security certification is ongoing.
Those processes should be comparable to the standards for IT security certification insofar as their security levels are equivalent.
Those processes could be facilitated by a peer review.

- = -

(72) When adopting delegated or implementing acts, the Commission should take due account of the standards and technical specifications drawn up by European and international standardisation organisations and bodies, in particular the European Committee for Standardisation (CEN), the European Telecommunications Standards Institute (ETSI), the International organisation for Standardisation (ISO) and the International Telecommunication Union (ITU), with a view to ensuring a high level of security and interoperability of electronic_identification and trust_services.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN