Accreditation and operation of certification service providers

Certification service providers can apply for voluntary accreditation from the competent authority if they can prove that they meet the requirements of the Digital Signature Act and the Digital Signature Ordinance.

Accredited certification service providers receive a quality mark from the competent authority. They may call themselves accredited certification service providers and refer to the proven security in legal and business transactions.

Note: The application for voluntary accreditation is also deemed to be a notification of activity if the requirements specified there are met.

Requirements

• Application for accreditation
• for the certification service provider and its legal representatives: current certificates of good conduct in accordance with Section 30 (5) of the Federal Central Register Act or documents from another member state of the European Union or another state party to the Agreement on the European Economic Area that have an equivalent function or from which it can be seen that the relevant requirement is fulfilled,
• current extract from the commercial register or a comparable document or a document from another member state of the European Union or another state party to the Agreement on the European Economic Area which has an equivalent function or which shows that the requirement in question has been met,
• Proof of the necessary technical, administrative and legal expertise,
• Security concept with the following content:
  
  • Description of all necessary technical, structural and organizational security measures and their suitability
  • Overview of the products used for qualified electronic signatures with corresponding confirmations in accordance with the Signature Act
  • Overview of the organizational and operational structure and certification activities
  • Precautions and measures to ensure and maintain operations, especially in the event of emergencies
  • Procedures for assessing and ensuring the reliability of the personnel deployed
  • Assessment and evaluation of remaining security risks,
• Proof of coverage (e.g. liability insurance or comparable indemnity/guarantee obligation of a credit institution) that fulfills the requirements of § 12 of the Digital Signature Act and § 9 of the Digital Signature Ordinance,
• If applicable, proof of the transfer of tasks in accordance with the Digital Signature Act and the Digital Signature Ordinance to third parties (contracts),
• Audit and confirmation report of the audit and confirmation body, confirmation of the implementation of security concepts.