On the request of Gjaldstovan, a certification audit was performed by BSI Group The Netherlands B.V. (John M. Keynesplein 9, 1066 EP Amsterdam, The Netherlands).
The audit covered applicable requirements from the audit criteria listed below (see “Audit Information”) and are defined in Gjaldstovan’s Statement of Applicability, dated 29 May 2024 and the Overview of Applicability, version 2024.
The scope of the assessment comprised the following Trust Service Provider component services:
-,,Registration Service (*)
-,,Certificate Generation Service (*)
-,,Dissemination Service (*)
-,,Revocation Management Service (*)
-,,Revocation Status Service (*)
-,,Subject Device Provision Service (*) (only applies to the issuance of hard token certificates, policy NCP+)
The TSP component services marked (*) are performed partly or completely by subcontractors under the responsibility of Gjaldstovan.
These TSP component services are being provided for the following (non-qualified) trust service:
-,,Issuance of public key certificates, in accordance with the policies NCP and NCP+
The certificates are issued through the issuing Certification Authorities, as specified below:
Root CA: Faroe Islands RootCA1 v1
-,,Issuing CA: Issuing CA: Faroe Islands IssuingCA1 v1
+,,MobileTokenRSAv1: Authentication, in accordance with policy NCP
-,,Issuing CA: Issuing CA: Faroe Islands IssuingCA2 v1
+,,CitizenCardsRSAv1: Authentication, in accordance with policy NCP+ (hard-token)
The Certification Authority processes and services are documented in the following documents:
-,,Gjaldstovan Certificate Policy - Faroe Islands Root CA, version 1.1, 01.05.2020
-,,Certification Practice Statement - Faroe Islands RootCA1 v1, version 1.1, 09.06.2021
-,,Certification Practice Statement - Faroe Islands IssuingCA1 v1, version 2.0, 01.01.2022
-,,Certification Practice Statement - Faroe Islands IssuingCA2 v1, version 2.0, 01.01.2022
-,,Samleikin PKI Disclosure Statement, version 1.1, 09.06.2021
Our certification audit was performed in May 2024. The result of the audit is that we conclude, based on the objective evidence collected during the certification audit for the period from 1 June 2023 through 31 May 2024, the areas assessed during the audit were generally found to be effective, based on the applicable requirements defined in Gjaldstovan’s Statement of Applicability, dated 29 May 2024 and the Overview of Applicability, version 2024.
Audit information:
Root CA:
Faroe Islands RootCA1 v1
CN=Faroe Islands RootCA1 v1,O=Gjaldstovan,C=FO
Sha256 Fingerprint:
3D36AB32DF7502D4855BC350371915468EA28BEFC8DFE2360AD1BCCE6F25EBA3
Issuing CA:
Faroe Islands IssuingCA1 v1
CN=Faroe Islands IssuingCA1 v1,O=Gjaldstovan,C=FO
Sha256 Fingerprint:
7DF39B23762F7E9AE6EE2B6DFA41B22F37B0120930DB58ABEEAE357D005B1FF8
Issuing CA:
Faroe Islands IssuingCA2 v1
CN=Faroe Islands IssuingCA2 v1,O=Gjaldstovan,C=FO
Sha256 Fingerprint:
18D6C955EE4219370D1C80663FE04F2223DE8F6497E4667538451C2471AE7EA9
Audit criteria:
-,,ETSI EN 319 401 v2.3.1 (2021-05) General Policy Requirements for Trust Service Providers;
-,,ETSI EN 319 411-1 v1.3.1 (2021-05) Electronic Signatures and Infrastructures (ESI) - Policy and security requirements for Trust Service Providers issuing certificates - Part 1: General requirements, for the policies: NCP and NCP+.
Audit performed:
May 2024
|
