—

the functional and technical capabilities of the electronic ledger platform and its use throughout the provision of the recording of data in a qualified electronic ledger as a qualified trust service;

—

the specific data origin authentication mechanisms used when providing the service;

—

the specific sequential chronological ordering mechanisms used when providing the service.

—

where applicable, the cryptographic link used to ensure the sequence of data records;

—

where applicable, the consensus mechanism ensuring finality and integrity of data records and transactions stored in the ledger, including any cautionary time until finality and integrity are achieved;

—

the specific data integrity mechanisms used when providing the service.

—

REQ-6.2-03 Subscribers and parties relying on the trust service shall be informed, in a clear, comprehensive and easily accessible manner, in a publicly accessible space and individually, of precise terms and conditions, including the items listed above, before entering into a contractual relationship.

—

REQ-6.3-04X The TSP shall establish procedures to notify any changes in the provision of the trust service to the supervisory body, in accordance with business requirements and relevant laws and regulations. The TSP shall notify the supervisory body at least:

—

REQ-7.2-04X TSP's personnel in trusted role shall be able to fulfil the requirement of »expert knowledge, experience and qualifications« through formal training and credentials, or actual experience, or a combination of the two.

—

REQ-7.2-05X This shall include regular (at least every 12 months) updates on new threats and current security practices.

—

REQ-7.5-01X Appropriate security controls shall be in place for the management of any cryptographic keys, cryptographic algorithms, and cryptographic devices throughout their lifecycle, following, where appropriate, a cryptographic agility approach.

—

REQ-7.5-02 For the purpose of the provision of its trust services, the TSP shall select and use suitable cryptographic techniques compliant with the Agreed Cryptographic Mechanisms endorsed by the European Cybersecurity Certification Group and published by ENISA [1].

—

REQ-7.5-03 Providers of qualified electronic ledgers shall establish the origin of data records in the electronic ledger. To this extent, they shall use advanced electronic signatures based on qualified certificates or advanced electronic seals based on qualified certificates created by the users of the service in accordance with the following standards and specifications:

—

REQ-7.5-04: Providers of qualified electronic ledgers shall ensure the unique sequential chronological ordering of data records in the electronic ledger. To this extent, they shall use cryptographic links, based in hash lists or hash trees, using cryptographic hash functions, in accordance with the following specifications and standards:

—

REQ-7.5-05 Providers of qualified electronic ledgers shall ensure the integrity of data records recorded in a qualified electronic ledger. To this extent, they shall use advanced electronic signatures based on qualified certificates or advanced electronic seals based on qualified certificates, in accordance with the following standards and specifications:

—

REQ-7.5-06 Where digital signature mechanisms are used, signing private keys of the provider of qualified electronic ledger shall be held and used within a secure cryptographic device which is a trustworthy system certified in accordance with:

—

REQ-7.8-14X The vulnerability scan requested by REQ-7.8-13 shall be performed at least once per quarter.

—

REQ-7.8-18X The penetration test requested by REQ-7.8-17X shall be performed at least once per year.

—

REQ-7.8-21X: Firewalls shall also be configured to prevent all protocols and accesses not required for the operation of the TSP.

—

REQ-7.9.1-02X Monitoring activities shall take account of the sensitivity of any information collected or analysed.

—

REQ-7.12-02A The TSP's termination plan shall comply with the requirements set out in the implementing acts adopted pursuant to Art.24(5) of Regulation (EU) No 910/2014 [i.1].