On the request of CIBG, Uitvoeringsorganisatie van het ministerie van Volksgezondheid, Welzijn en Sport (hereafter referred to as: CIBG), the annual certification audit on all areas and processes was performed by BSI Group The Netherlands B.V. (John M. Keynesplein 9, 1066 EP Amsterdam, The Netherlands).
The full audit covered all applicable requirements from the audit criteria listed below (see “Audit Information”) and are defined in CIBG’s statement of applicability (dated 24 August 2023) and the Overview of applicability.
The scope of the assessment comprised the following Trust Service Provider component services:
-,,Registration Service (p);
-,,Certificate Generation Service (c);
-,,Dissemination Service (p);
-,,Revocation Management Service (p);
-,,Revocation Status Service (c);
-,,Subject Device Provision Service (c);
The TSP component services are performed, partly (p) or completely (c) by subcontractors under the responsibility of CIBG.
These TSP component services are being provided for:
-,,Issuance of public key certificates (non-qualified trust service) in accordance with the ETSI-policies: NCP, NCP+ and OVCP
The certificates are issued through the issuing Certification Authorities, as specified below:
Root CA: Staat der Nederlanden Private Root CA - G1 (not in scope)
Domain CA: Staat der Nederlanden Private Services CA - G1 (not in scope)
-,,Issuing CA: UZI-register Private Server CA G1
Sha256 Fingerprint:
BDD860EF8E87E2B2C7EBB34DD6E9E1771A3A3C5DEC850BA7080E3E2904DBD897
+,,Services - Server (2.16.528.1.1003.1.2.8.6), in accordance with policy: NCP, OVCP
-,,Issuing CA: ZOVAR Private Server CA G1
Sha256 Fingerprint:
FE54263BC96C2DFBAC5BE5F449CFF7F5B12B6255A7BBCF761BA979E5986E1598
+,,Services - Server (2.16.528.1.1003.1.2.8.6), in accordance with policy: NCP, OVCP
Root CA: Staat der Nederlanden Root CA - G3 (not in scope)
Domein CA: Staat der Nederlanden Organisatie Persoon CA - G3 (not in scope)
-,,Issuing CA: UZI-register Zorgverlener CA G3
Sha256 Fingerprint (2017):
3EAD4F72F06F1054881D2728DE033A8E13FADE6BD165084018EB943C17378DAA
Sha256 Fingerprint (2019):
507DB60D263D3D09D283DE2E3AA435DFD8775E52BC335702E3832BBB57EC1CBD
+,,Authentication (2.16.528.1.1003.1.2.5.1), in accordance with policy: NCP+
+,,Confidentiality (2.16.528.1.1003.1.2.5.3), in accordance with policy: NCP+
-,,Issuing CA: UZI-register Medewerker op naam CA G3
Sha256 Fingerprint (2017):
D8553A2880E96B7AA4C7413DD903AFD3D580504695DD26A168FD48CCE7B1474A
Sha256 Fingerprint (2019):
D28DB435E31212A3BDCCF87620F6544B99A9C02328BF983E882FD0627A1D130F
+,,Authentication (2.16.528.1.1003.1.2.5.1), in accordance with policy: NCP+
+,,Confidentiality (2.16.528.1.1003.1.2.5.3), in accordance with policy: NCP+
Domein CA: Staat der Nederlanden Organisatie Services CA - G3 (not in scope)
-,,Issuing CA: UZI-register Medewerker niet op naam CA G3
Sha256 Fingerprint (2017):
38DED3FF6827579008AF4887EB9698A3CFA927FA8ED59F06BA090FB9A63E2D77
Sha256 Fingerprint (2019):
972957304031234ED17679FDCB97556D6173D5F2BF0E6E66D612680CA6E77685
+,,Authentication (2.16.528.1.1003.1.2.5.4), in accordance with policy: NCP+
+,,Confidentiality (2.16.528.1.1003.1.2.5.5), in accordance with policy: NCP+
The Certification Authority processes and services are documented in the following documents:
-,,Certification Practice Statement (CPS) UZI-register, version 11.6, 1 March 2023 (OID: 2.16.528.1.1007.1.1)
-,,Certification Practice Statement (CPS) ZOVAR, version 6.4, 1 March 2023 (OID: 2.16.528.1.1007.5.1.1)
-,,PKI Disclosure Statement (PDS) UZI-Register, version 11.6, 1 March 2023 (published at: https://www.zorgcsp.nl/pds/pds.html)
Our annual certification audit was performed in August and September 2023. The result of the full audit is that we conclude, based on the objective evidence collected during the certification audit for the period from 1 September 2022 through 31 August 2023, the areas assessed for:
-,,Issuance of public key certificates (non-qualified trust service), in accordance with the policies: NCP, NCP+, OVCP
were generally found to be effective, based on the applicable requirements defined in CIBG’s statement of applicability (dated 24 August 2023) and the Overview of applicability.
Audit information:
Audit criteria:
-,,ETSI EN 319 401 v2.3.1 (2021-05) General Policy Requirements for Trust Service Providers
-,,ETSI EN 319 411-1 v1.3.1 (2021-05) Electronic Signatures and Infrastructures (ESI) - Policy and security requirements for Trust Service Providers issuing certificates - Part 1: General requirements, for the policies: NCP, NCP+, OVCP
-,,CA/Browser Forum - Network and Certificate System Security Requirements v1.7 (April 5, 2021)
-,,Regulation (EU) N 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, Chapter III - Trust Services
-,,PKIoverheid - Programma van Eisen v4.11 (2023), part 3 Basiseisen, part 3 Aanvullende eisen and the requirements from parts 3a, 3b, 3h
Audit Period of Time:
1 September 2022 - 31 August 2023
Audit performed:
August and September 2023
Information and Contact:
BSI Group the Netherlands B.V., John M. Keynesplein 9, 1066 EP Amsterdam, NL
|
