General requirements
Article 8
Open ↗1. National certification schemes shall contain cybersecurity requirements based on a risk assessment of each specific supported architecture. Those cybersecurity requirements shall aim to treat the identified cybersecurity risks and threats, as established in the risk register set out in Annex I. 2. In line with Article 5a(23) of Regulation (EU) No 910/2014, national certification schemes shall require wallet solutions, and the electronic identification schemes under which they are provided, to be resistant against attackers with high attack potential for assurance level high, as referred to Implementing Regulation (EU) 2015/1502. 3. National certification schemes shall establish security criteria, which shall include the following requirements: (a) Cyber Resilience Act where applicable, or requirements meeting the security objectives set out in Article 51 of Regulation (EU) 2019/881; (b) the establishment and implementation of policies and procedures concerning the management of risks associated with the operation of a wallet solution, including the identification and assessment of risks and the mitigation of the identified risks; (c) the establishment and implementation of policies and procedures related to the management of changes and to the management of vulnerabilities in accordance with Article 5 of this Regulation; (d) the establishment and implementation of human resource management policies and procedures, including requirements on expertise, reliability, experience, security training, and qualifications of personnel involved in the development or operation of the wallet solution; (e) requirements relating to the wallet solution’s operating environment, including in the form of assumptions on the security of the devices and platforms on which the software components of the wallet solution run, including WSCDs and where applicable and relevant, conformity assessment requirements to confirm that those assumptions are verified on the relevant devices and platforms; (f) for each assumption that is not backed by a certificate of conformity or other acceptable assurance information, a description of the mechanism that the wallet provider uses to enforce the assumption, as well as a justification that the mechanism is sufficient to ensure that the assumption is verified; (g) the establishment and implementation of measures to ensure the use of a currently certified version of the wallet solution. 4. National certification schemes shall contain functional requirements relating to update mechanisms for every software component of the wallet solutions and the electronic identification scheme under which they are provided for the operations listed in Annex III. 5. National certification schemes shall require that the following information and documentation is provided or otherwise made available to the certification body by the applicant for certification: (a) evidence related to the information referred to in Annex IV, point 1, including where necessary details on the wallet solution and its source code, including: — architecture information: for every component of the wallet solution (including product, process and service components), a description of its essential security properties, including its external dependencies; — controls and assurance levels: for every security control of the wallet solution, a description of the control and the required assurance level, based on the Annex to Implementing Regulation (EU) 2015/1502, which sets out a number of technical specifications and procedures that apply to the various controls implemented by the electronic identification means; — mapping the controls to architecture components: a description of how the controls of the wallet are implemented using the different components of the wallet solution, based on a rationale explaining why a given assurance level is required, and how the control is implemented with all required security aspects at the appropriate level; — rationale and justification of risk coverage: a justification of: — the mapping of controls to components; — the suitability of the proposed evaluation plan to appropriately cover all controls; — the coverage provided by the controls of the cybersecurity risks and threats identified in the risk register, complemented by controls of risks and threats specific to the implementation, at the appropriate assurance level; (b) the information listed in Annex V; (c) a complete list of the certificates of conformity and other assurance information used as evidence during the evaluation activities; (d) any other information relevant for the evaluation activities.