# ETSI TC ESI; Electronic Signatures and Trust Infrastructures; Policy and security requirements for Smart Contracts using Electronic Ledgers

Scott Cadzow, Luigi Liquori, Juan-Carlos Cruellas Ibarz, Michal Tabor, Nick

Pope, Xun Xiao, Paolo Cornaglia, Porro Davide, Tooba Faisal, Steffen

Schwalm, et al.

► To cite this version:

Scott Cadzow, Luigi Liquori, Juan-Carlos Cruellas Ibarz, Michal Tabor, Nick Pope, et al. ETSI TC ESI; Electronic Signatures and Trust Infrastructures; Policy and security requirements for Smart Contracts using Electronic Ledgers. ETSI, 2025, pp.26. hal-05409969

HAL Id: hal-05409969

https://inria.hal.science/hal-05409969v1

Submitted on 10 Dec 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# ETSI TS ESI; Electronic Signatures and Trust Infrastructures (ESI); Policy and security requirements for Smart Contracts using Electronic Ledgers

Scott Cadzow (8), Luigi Liquori (1,2,3), Juan-Carloz Cruellas Ibarz (4), Michal Tabor (6), Nick Pope (7), Xu Xun (9), Paolo Cornaglia (5), Davide Porro (5), Tooba Faisal (10), Steffen Schwalm (11), Andrea Caccia (12)

1 Centre Inria d'UCA

2 KAIROS - Logical Time for Formal Embedded System Design

3 UCA - Université Côte d'Azur

4 UPC - Politechnic University of Catalonia

5 - InfoCert, Italy

6 - Obserwatorium.biz, Poland

7 - SSA, UK

8 - CCC, UK

9 - Huawei, Germany

10 - Nokia, France

11 - MSG group, Germany

12 - Studio Caccia, Italy

## Executive summary

The present document specifies the policy and security requirements for Smart Contracts using Electronic Ledgers as defined in Regulation (EU) 910/2014 amended by Regulation (EU) 2024/1183 [i.3], and with other trustworthy tools, taking into account the framework of requirements identified in ETSI TR 119 540 [i.1].

NOTE 1: The present document extends provisions from ETSI EN 319 401 [1] and TS 18264 [2], using the structure of ETSI EN 319 401 [1] as the basis, to address the general requirements identified by the Chain of Trust described in clause 5.1 of [i.1].

NOTE 2: When applying ETSI EN 319 401 [1] to the scope and context of the present document any reference in ETSI EN 319 401 [1] to TSP is to be read as "SC Provider".

NOTE 3: In ETSI EN 319 401 [1] there are references to "management bodies" which for the purposes of the present document is to be read as an entity within the SC provider's organization with a defined role identifiable using methods defined in ETSI TS 119 542 [5].

## Protected by ETSI IPR. Please refer this document as

S. Cadzow, L. Liquori, J-C Cruellas Ibarz, M. Tabor, N. Pope, X. Xun, P. Cornaglia, D. Porro, T. Faisal, S. Schwalm, A. Caccia. ETSI Technical Standard TS 119541. Policy and security requirements for Smart Contracts using Electronic Ledgers, final, 26 pages, November 2025.

## The full document can be found on

https://www.etsi.org/deliver/etsi_ts/119500_119599/119541/01.01.01_60/ts_119541v010101p.pdf

## Informative references

References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies.

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long-term validity. The following referenced documents may be useful in implementing an ETSI deliverable or add to the reader's understanding, but are not required for conformance to the present document.
[i.1] ETSI TR 119 540: "Electronic Signatures and Trust Infrastructures (ESI); Standardisation requirements for smart contracts based on electronic ledgers".

[i.2] ETSI EN 319 411-1: "Electronic Signatures and Trust Infrastructures (ESI); Policy and security requirements for Trust Service Providers issuing certificates; Part 1: General requirements".

[i.3] Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework.

[i.4] CA/Browser forum: "Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates Version 3.9.0".

[i.5] Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act).

[i.6] Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive).

[i.7] ETSI GS PDL 003: "Permissioned Distributed Ledger (PDL); Smart Contracts; System Architecture and Functional Specification".

NOTE: The above reference applies only where the provisions extend those identified in ISO 23257 [4].

[i.8] ENISA/JRC: "Cyber Resilience Act Requirements Standards Mapping", Joint Research Centre & ENISA Joint Analysis.

[i.9] ETSI Guide to the Use of English for drafting ETSI deliverables.

[i.10] ETSI TR 103 838: "Cyber Security; Guide to Coordinated Vulnerability Disclosure".

[i.11] ETSI EN 303 645: "CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements".

[i.12] ETSI TR 104 034: "Cyber Security (CYBER); Software Bill of Materials (SBOM) Compendium".

[i.13] Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act).

[i.14] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[i.15] ISO/IEC 27002:2022: "Information security, cybersecurity and privacy protection — Information security controls".