ISMS: Information Security Management for EUDI Wallet Providers

An Information Security Management System (ISMS) is a systematic approach to managing sensitive company information so that it remains secure, encompassing people, processes, and technology. An ISMS includes all the policies, procedures, guidelines, resources, and associated activities that an organization manages to protect its information assets. Typically implemented according to the ISO/IEC 27001 standard, an ISMS follows the Plan-Do-Check-Act (PDCA) cycle to continuously improve security posture. For EUDI Wallet providers, credential issuers, and trust service providers, an ISMS is both a best practice and a regulatory requirement, demonstrating to regulators, auditors, and citizens that security is managed systematically rather than ad hoc.

An ISMS operates on the Plan-Do-Check-Act (PDCA) continuous improvement cycle:

• •Plan: Establish the ISMS scope, conduct risk assessment, select controls, and define the security policy. For EUDI Wallet providers, this includes identifying all assets involved in credential issuance, storage, and verification, and assessing threats specific to digital identity infrastructure.
• •Do: Implement the selected controls, train staff, and operate the ISMS. This includes deploying HSMs, implementing access controls, establishing incident response procedures, and conducting security awareness training for all personnel handling wallet infrastructure.
• •Check: Monitor and review the ISMS through internal audits, security metrics, incident analysis, and management reviews. Regular penetration testing and vulnerability scanning verify that technical controls are effective.
• •Act: Take corrective and preventive actions based on audit findings, incident reviews, and changing threat environments. Update risk assessments, implement new controls, and improve existing procedures. The ISMS is never "finished" -- it continuously evolves.

ISO 27001 Annex A defines 93 controls across four categories. For EUDI Wallet providers, the most critical controls include:

Organizational controls: Information security policies, defined roles and responsibilities, segregation of duties (ensuring no single person can compromise the credential signing process), supplier relationship security (vetting HSM vendors, cloud providers), and information security in project management (applying security from the design phase of new wallet features).

People controls: Background screening for personnel with access to signing keys, security awareness training covering EUDI-specific threats, confidentiality agreements, and secure off-boarding procedures that revoke all access when employees leave.

Technological controls: Cryptographic key management procedures (covering the full lifecycle from generation to destruction), secure development lifecycle for wallet applications, vulnerability management and patching, log monitoring and SIEM (Security Information and Event Management), and network security controls including segmentation of credential signing infrastructure from general IT systems.

ISO 27001 certification serves as a trust signal in the EUDI ecosystem. When a wallet provider is ISO 27001 certified, it demonstrates to regulators, other ecosystem participants, and citizens that its security practices meet an internationally recognized standard and have been independently verified.

The eIDAS 2.0 implementing acts reference ISO 27001 as one of the acceptable frameworks for demonstrating security management. Qualified Trust Service Providers (QTSPs) under eIDAS are already required to meet equivalent standards. As the EUDI Wallet ecosystem matures, ISO 27001 certification (potentially extended with ISO 27701 for privacy management and ISO 27017/27018 for cloud security) is expected to become a de facto requirement for all significant ecosystem participants.

Beyond certification, the ISMS creates a culture of security within the organization. By requiring regular risk assessments, training, audits, and management reviews, it ensures that security remains a priority at all organizational levels -- from developers writing wallet code to executives making strategic decisions about the EUDI service offering.