EU eIDAS Regulation

Electronic Identification, Authentication and Trust Services - qualified eSignatures, seals, timestamps.


Short name	eIDAS
Region	Europe
Country or scope	European Union
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers eIDAS

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for eIDAS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for eIDAS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-EIDAS-19-SEC` Security of Trust Service Systems	Trust service providers must take appropriate technical and organisational measures to manage risks to the security of their services, including assurance that deployed software is authentic and untampered via integrity hashes (Regulation (EU) 910/2014 Art. 19(1))	Scan
`EU-EIDAS-19-BREACH` Breach Notification Readiness	Providers must notify security breaches with significant impact within 24 hours, which requires the ability to rapidly determine whether affected software components match a disclosed vulnerability (Regulation (EU) 910/2014 Art. 19(2))	Scan
`EU-EIDAS-24-TRUST` Trustworthy Systems and Products	Qualified trust service providers must use trustworthy systems and products protected against modification, which excludes running software at vague or unpinned versions (Regulation (EU) 910/2014 Art. 24(2))	Scan
`EU-EIDAS-24-REC` Record Keeping	Qualified providers must record and keep accessible relevant information concerning their services, so machine-readable records must carry a document identity and creation timestamp (Regulation (EU) 910/2014 Art. 24(2))	Scan
`EU-EIDAS-SUP` Component Source Accountability	Reliance on trustworthy products implies knowing the origin of the software components a trust service is built from, so suppliers should be named for the majority of components (Regulation (EU) 910/2014 Art. 24-style trustworthiness obligation)	Scan
`EU-EIDAS-FMT` Standardised Machine-Readable Formats	eIDAS interoperability rests on standardised, machine-processable formats defined in implementing acts, and security documentation should likewise use a standard machine-readable SBOM format (Regulation (EU) 910/2014 implementing standards framework)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`EIDAS-Art24`	Qualified Trust Service Providers: Requirements
`EIDAS-Art26`	Advanced Electronic Signatures: Requirements
`EIDAS-Art28`	Qualified Certificates for Electronic Signatures
`EIDAS-Art32`	Qualified Validation of Qualified Electronic Signatures
`EIDAS-Art41`	Qualified Electronic Seals
`EIDAS-Art42`	Qualified Electronic Time Stamps
`EIDAS-Art45`	Qualified Website Authentication Certificates
`EIDAS-Supervisory`	TSP Supervisory Notification and Audit
`EIDAS-TrustedList`	Trusted Lists Maintenance
`EIDAS-MutualRecognition`	Cross-Border Mutual Recognition

Policy templates

Written for eIDAS:

eIDAS Trust Service Provider Policy

And 22 from the standard set, adapted to eIDAS.