SCHEDULE FOR MANDATORY SURVEILLANCE EVALUATIONS
ANNEX IXSupplementary provisions
ANNEX IX SCHEDULE FOR MANDATORY SURVEILLANCE EVALUATIONS 1. Article 18 specifies requirements for the certification lifecycle, in particular the performance of regular evaluation activities. These activities shall include at least the following: (a) a full evaluation of the object of conformity assessment in the initial evaluation and at every recertification evaluation, including an update feature of any product component; (b) a vulnerability assessment in the initial evaluation and at every recertification evaluation, and at least every two years in surveillance evaluations, covering at least the changes in the object of conformity assessment and the changes in the threat environment since the last vulnerability assessment; (c) additional activities such as penetration testing in case of an increased risk level or the emergence of new threats; (d) an evaluation of the operating effectiveness of maintenance processes at least every year in surveillance and recertification evaluations, covering at least version control, update and vulnerability management processes; (e) following a successful review and certification decision, the issuance of a certificate of conformity after the initial evaluation and after every recertification evaluation. 2. A reference schedule is set out in Table 1 based on a 4-year cycle, where: (a) year 1 starts when the certificate of conformity is first issued; and (b) all evaluation activities shall be performed within 12-months from the evaluation of the previous year. 3. The schedule set out in Table 1 is a recommendation to ensure timely recertification and to avoid disruptions in the provision of the wallet solution. Other schedules may be possible, as long as the validity of the certificate of conformity does not exceed five years, as laid down in Article 5c(4) of Regulation (EU) No 910/2014. 4. In addition to the regular evaluations, a special evaluation might be triggered at the demand of the certification body or of the holder of the certificate of conformity, following a significant change to the object of certification or to the threat environment. 5. Any evaluation, including surveillance evaluations and special evaluations, might lead to the issuance of a new certificate of conformity, in particular in case of significant changes to the object of certification, but with the same date of expiry as the original certificate of conformity. Table 1 A full 4-year evaluation cycle Time Eval. type Activities Year 0 Initial — Full evaluation of the object of certification, including vulnerability assessment — Including a feature to perform updates on each software component — Evaluation of the maintenance processes, excluding their operating effectiveness — Issuance of the certificate of conformity and start of the 4-year cycle Year 1 Surveillance — Evaluation of the operating effectiveness of the maintenance processes — At least version check, update, vulnerability management — Evaluation of changes impacting the security of the product Year 2 Surveillance — Vulnerability assessment of the full solution — Evaluation of the operating effectiveness of the maintenance processes — At least version control, update, vulnerability management — Evaluation of changes impacting the security of the product Year 3 Surveillance — Evaluation of the operating effectiveness of the maintenance processes — At least version check, update, vulnerability management — Evaluation of changes impacting the security of the product Year 4 Recertification (1) Full evaluation of the object of certification, including vulnerability assessment (2) Simplified evaluation for features/processes that have not changed (3) Including a feature to perform updates on each software component (4) Evaluation of the maintenance processes, including their operating effectiveness (5) Issuance of a new certificate of conformity