LSTI / eIDAS / CERTIFICATION AUDITS
For more than ten years, Stelau has supported LSTI in its eIDAS certification audits. Our consulting engineers learn to assess rigorously, understand organisations and document findings that carry real responsibility.
01 / A profession to learn
An auditor’s responsibility is substantial. A finding can affect a trust service, its users and a certification decision. The profession calls for strong technical competence, a sound method and maturity in working with others.
Our young engineers can meet this challenge through training, practice and the development of three inseparable qualities.
Identifying a genuine major nonconformity means connecting a specific requirement to verifiable facts and assessing its impact on the service. The auditor supports a proposed classification under the scheme’s rules; LSTI classifies it within its certification process.
Which requirement? Which facts? What impact?Listen to what the auditee presents and explains, be willing to revise a hypothesis and understand solutions that differ from your own habits. Assessment stays grounded in the intent and wording of the requirement, with impartiality and independence.
What does the evidence actually demonstrate?Five consecutive days of auditing can be demanding. Attention must be sustained, explanations cross-checked and open issues revisited. Tools support traceability; judgement remains attentive, responsible human work.
Do I have enough evidence to conclude?THE CORE OF THE WORK
Human interaction makes that assessment possible: attentive listening, well-chosen questions and a desire to understand. The auditor returns to the requirement, seeks evidence that clarifies it and pursues the issue until it can be reported accurately, including any remaining limitations.
02 / Engineers becoming auditors
Stelau’s consulting engineers understand the systems they examine. That technical competence helps them investigate cybersecurity aspects of audits: key protection, access control, operations, traceability and service continuity.
PKI, HSMs, cryptography, systems and protocols: understanding the mechanisms helps assess what a security measure actually achieves.
Study frameworks, prepare interviews, gather verifiable evidence and write precise findings: the method takes practice.
Training, shared experience and supervised practice support development. Assignment to audits considers assessed competence and the certification body’s procedures.
03 / A structured process
ISO 19011 provides guidance on conducting audits and auditor competence. Our animation illustrates a simple reading of that approach: prepare the investigation, gather evidence, assess it and document conclusions.
ISO 19011:2026ISO 19011 / THE PROCESS IN MOTION
Define the audit’s objectives, scope and criteria.
Review documentation and plan the investigations.
Cross-check interviews, observations and verifiable evidence.
Compare evidence with requirements and discuss findings.
Present conclusions and prepare the audit report.
Review actions and their effectiveness where required.
An educational diagram inspired by ISO 19011:2026 guidance. Each assignment is governed by its scope and scheme rules.
04 / Practice across frameworks
Our experience has grown across French and European frameworks. The scope, versions and applicable requirements are defined for each assignment; each framework serves its own purpose.
Governance, risks, practices and operational security: the general baseline for trust service providers.
Requirements for providers issuing certificates, including the specific requirements for EU qualified certificates.
Policy and security for time-stamping services: assess mechanisms, practices and service guarantees.
Identity proofing for trust services and the French remote identity verification framework: their scope and relationship must be made explicit.
Qualification frameworks for audit providers and cloud services. Technical and organisational requirements are assessed together.
From the French RGS security framework to ANSSI’s cyber hygiene guide: experience with trust requirements and practical security controls. GHI is a good-practice guide.
05 / In the field, across Europe
Auditing brings us into organisations with demanding standards. Understanding their practices, talking with their teams and checking explanations against the reality on site are also part of the profession’s appeal.
Our assignments take Stelau engineers across France and abroad, particularly in Europe. Travel, discussions in English and encounters with different organisations enrich both their experience and their technical perspective.
When an assignment runs over five days, mental availability must be sustained: prepare, listen, take notes, verify, share open issues and resume investigations. Duration depends on scope; attentive work is required throughout.
To preserve assignment confidentiality, audit photographs remain professional archives. The work images on this page introduce the approach; the final photograph shows a convivial moment. No confidential audit files or locations are shown.
06 / Requirements evolve
The European framework extends to electronic attestations of attributes. Pub-EAAs are issued by, or on behalf of, a public sector body responsible for an authentic source; QEAAs are qualified attestations. Their respective frameworks must be distinguished when preparing future assessments.
This development extends our work: understand the origin of attributes, proof mechanisms and requirements for issuers. Standards monitoring and training connect new texts with auditing practice.
ENGINEERS. AUDITORS. EXPERTS.
Our auditing practice draws on technical expertise and teamwork. Let’s talk about this profession, its responsibilities and how our engineers develop within it.
