In addition, the Commission considers that it is appropriate to take the necessary measures in order to ensure the effectiveness of EUDI-Wallet. In addition, the Commission considers that it is appropriate to take the necessary measures in order to ensure the effectiveness of EUDI-Wallet.

In addition, the Commission considers that it is appropriate to take the necessary measures in order to ensure the effectiveness of EUDI-Wallet. In addition, the Commission considers that it is appropriate to take the necessary measures in order to ensure the effectiveness of EUDI-Wallet.
Common Codes GmbH (client / AG) is responsible for the development and introduction of the national EUDI wallet on behalf of the Federal Ministry for Digitalization and State Modernization. For the application to be put into operation on January 2, 2027 (go-live date), an overall security assessment of the four security procedures (BSZ I & II, trust level assessment and security assessment according to the criteria catalog) is necessary. The security test of the state-owned German EUDI wallet of the first expansion stage (First Stage) includes in particular the following procedures: (1) the accelerated security certification (BSZ) I and II, (2) the risk assessment according to BSI TR-03107 and (3) the conformity assessment according to BSI TR-03189, and is carried out with the involvement of the Federal Office for Information Security (BSI). The services must therefore be provided by a BSZ testing center recognized by the BSI. This announcement concerns the interim commissioning of the above-mentioned certifications and assessments until the stated go-live date. The corresponding process-related, technical and methodological security requirements as well as the evaluation procedures are continuously developed and specified by the BSI with the aim of enabling a uniform and neutral security assessment of different EUDI wallet solutions in Germany. A key feature and challenge of the project is that both the test object and all three relevant testing and evaluation procedures are still in development or further development. This leads to additional iterations between product development, security design, risk assessment, certification and conformity assessment. In particular, the ongoing specification of the requirements and processes according to TR-03107 and TR-03189 causes considerable additional effort, the extent of which could not be fully predicted at the start of the security assessment. At the same time, there is considerable time pressure to act due to the planned start of production at the beginning of 2027. Against this background, the AG requires security testing services from a contractor who has to fulfill the following requirement(s): - BSZ accreditation: It forms the basis for efficient familiarization with the existing processes, test procedures and established procedures, in particular with the relevant regulations, the general architecture and the relevant standardization processes. These are necessary in order to quickly grasp the existing requirements for the national EUDI wallet and connections and to be able to enter into the ongoing work in a technically sound manner. - Previous knowledge in the BSZ-EUDI context: In particular the relevant regulations, the general architecture and the relevant standardization processes. Sound prior knowledge is required in order to quickly and accurately grasp the existing requirements and context. - Knowledge of the implementation of the security architecture of the national EUDI wallet: Project-specific knowledge is required, which includes in particular a comprehensive understanding of the overall system of the national EUDI wallet as well as detailed knowledge of the concrete implementation of the security architecture. Only on this basis can existing security mechanisms, dependencies and implementation decisions be adequately and promptly supported in an assessment conducted by the BSI, - Knowledge of the TR-03189 implementation in the national EUDI wallet: Project-specific knowledge is required, which, in addition to knowledge of the relevant specifications and testing methodology, includes in particular an understanding of the current implementation status and the level of conformity achieved; This knowledge is necessary in order to be able to carry out and classify the ongoing BSI tests and assessments in the specific project context appropriately and promptly.