keyboard_tab EIDAS 2014/0910 EN

(20) Cooperation by Member States should facilitate the technical interoperability of the notified electronic_identification schemes with a view to fostering a high level of trust and security appropriate to the degree of risk.

  The exchange of information and the sharing of best practices between Member States with a view to their mutual recognition should help such cooperation.

(28) To enhance in particular the trust of small and medium-sized enterprises (SMEs) and consumers in the internal market and to promote the use of trust_services and products, the notions of qualified trust_services and qualified trust_service provider should be introduced with a view to indicating requirements and obligations that ensure high-level security of whatever qualified trust_services and products are used or provided.

(38) Notification of security breaches and security risk assessments is essential with a view to providing adequate information to concerned parties in the event of a breach of security or loss of integrity.

(44) This Regulation aims to ensure a coherent framework with a view to providing a high level of security and legal certainty of trust_services.

  In this regard, when addressing the conformity assessment of products and services, the Commission should, where appropriate, seek synergies with existing relevant European and international schemes such as the Regulation (EC) No 765/2008 of the European Parliament and of the Council (9) which sets out the requirements for accreditation of conformity assessment bodies and market surveillance of products.

(45) In order to allow an efficient initiation process, which should lead to the inclusion of qualified trust_service providers and the qualified trust_services they provide into trusted lists, preliminary interactions between prospective qualified trust_service providers and the competent supervisory body should be encouraged with a view to facilitating the due diligence leading to the provisioning of qualified trust_services.

(55) IT security certification based on international standards such as ISO 15408 and related evaluation methods and mutual recognition arrangements is an important tool for verifying the security of qualified electronic_signature creation devices and should be promoted.

  However, innovative solutions and services such as mobile signing and cloud signing rely on technical and organisational solutions for qualified electronic_signature creation devices for which security standards may not yet be available or for which the first IT security certification is ongoing.

  The level of security of such qualified electronic_signature creation devices could be evaluated by using alternative processes only where such security standards are not available or where the first IT security certification is ongoing.

  Those processes should be comparable to the standards for IT security certification insofar as their security levels are equivalent.

  Those processes could be facilitated by a peer review.

(72) When adopting delegated or implementing acts, the Commission should take due account of the standards and technical specifications drawn up by European and international standardisation organisations and bodies, in particular the European Committee for Standardisation (CEN), the European Telecommunications Standards Institute (ETSI), the International Organisation for Standardisation (ISO) and the International Telecommunication Union (ITU), with a view to ensuring a high level of security and interoperability of electronic_identification and trust_services.