Certificate Number: ETS 037
Scope: On the request of KPN B.V. (hereafter referred to as: KPN), the annual certification audit on all areas and processes was performed by BSI Group The Netherlands B.V. (John M. Keynesplein 9, 1066 EP Amsterdam, The Netherlands).
The full audit covered all applicable requirements from the audit criteria listed below (see “Audit Information”) and are defined in KPN’s Statement of Applicability, dated 26 June 2025 and the Overview of Applicability, dated 27 May 2025.
The scope of the assessment comprised the provision of the following Trust Service Provider component services to the (qualified) Trust Service Provider CIBG in The Hague, with regard to the UZI-register and ZOVAR:
-,,Dissemination Service;
-,,Registration Service (partly);
-,,Revocation Management Service (partly);
-,,Certificate Generation Service;
-,,Certificate Status Service.
These TSP component services are being provided for:
-,,Issuance of public key certificates (non-qualified trust service), in accordance with the policies: NCP, NCP+
Our annual certification audit was performed in June and July 2025. The result of the annual certification audit is that we conclude, based on the objective evidence collected during the certification audit for the period from 1 June 2024 through 31 May 2025, the areas assessed for:
-,,Issuance of public key certificates (non-qualified trust service), in accordance with the policies: NCP, NCP+
were generally found to be effective, based on the applicable requirements defined in KPN’s Statement of Applicability, dated 26 June 2025 and the Overview of Applicability, dated 27 May 2025.
Audit information:
Audit criteria:
-,,ETSI EN 319 401 v3.1.1 (2024-06) General Policy Requirements for Trust Service Providers;
-,,ETSI EN 319 411-1 v1.4.1 (2023-10) Electronic Signatures and Infrastructures (ESI) - Policy and security requirements for Trust Service Providers issuing certificates - Part 1: General requirements, for the policies: NCP, NCP+
-,,CA/Browser Forum - Network and Certificate System Security Requirements v2.03 (December 13, 2024);
-,,PKIoverheid – Program of Requitements v5.1, G3 Legacy Organization Person certificates (previously 3a), G3 Legacy Organization Services certificates (previously 3b), Private Server certificates (previously 3h)
Audit Period of Time:
1 June 2024 – 31 May 2025
Audit performed:
June-July 2025
Information and Contact:
BSI Group the Netherlands B.V., John M. Keynesplein 9, 1066 EP Amsterdam, NL
