FAQ

The Digital Trust Label denotes the trustworthiness of a digital service. Our definition of digital service is aligned with the official definition by the European Commission. Digital services include a large category of online services, from simple websites to internet infrastructure services and online platforms. Digital services come in many forms and are omnipresent. We are expecting certifiable services in three categories:

Complexity Levels:

1. Low complexity services (e.g. newsletter subscription)
2. Medium complexity services (e.g. instant messaging apps)
3. High complexity services (e.g. Blockchain infrastructure and banking services)

It does not make sense to label every digital service, but especially applications where sensitive data are shared and/or a decision is taken by an algorithm.

The Digital Trust Label is especially suitable for digital services that involve sensitive data and where automated decisions are taken with significant consequences. Industries that are of particular relevance for the label are healthcare, public, media, HR, education, as well as banking & insurance. The label primarily targets B2C services.

Step 1) Check out our label criteria catalogue and obtain a first overview of the label audit process incl. cost. Generally, the label cost is between 22’000 – 45’000 CHF and highly depends on the complexity of the service to be audited. 

Step 2) Internally identify a suitable digital service matching the criteria catalogue. A B2C service with a broad user impact and/or an automated decision making process is recommended. 

Step 3) Contact the DTL Project Manager, Diana (diana@sdi-foundation.org) to set up a scoping call with the auditor (SGS) to discuss your chosen digital service and plan the next steps of the auditing process. 

No code review will be conducted as part of the audit. Instead, conducted code reviews by well recognized third-party providers can be accepted as evidence. In case such document does not exist, “snippets” of the code, hence “source code spot checks” can be conducted as part of the audit. 

The security of a digital service is primarily assessed within the categories of security, data protection and reliability. As part of the audit, checks on e.g., state-of-the-art password protection; best practices for user authentication as well as processes for fighting cyber-attacks will be assessed. Pen Tests, Monitoring, Coding Standards, Test Plans and SLAs with third-party providers thereby serve as evidence. However, it is important to highlight that 100% security can never be granted (impossible).

The check for the fair user criteria is focusing on the fair and unlimited access to a digital service across all populations, genders etc. In short, no person must be systematically disadvantaged or excluded from the digital service. This will be assessed by analyzing the e.g., decision flow of a digital service, conducted user tests, analysis or certification from credible third-parties or a live demonstration of the service during the audit.

The Digital Trust Label clearly signals to users that the provider of the certified digital service is willing “to go the extra mile”, going beyond what is legally required. As such, the label will not necessarily be made obsolete by new regulations but it will probably mean significant changes to the label over time. Of course, SDI very much welcomes a standardized approach that regulates digital services and increases transparency and trust for the consumers. Until a standardized legislation is in place, we believe that the Label can serve this important cause as a soft-law instrument and we look forward to working together with other initiatives to advance digital trust.

• A high-level Label Expert Committee has been responsible for defining the label catalogue criteria and two public consultation processes have given all interested stakeholders the possibility to give feedback and inputs in defining “trustworthy digital services”.
• Currently, our 35 defined label criteria are spread across four categories (Security, Data Protection, Reliability and Fair User Interaction). Adjustments or additions to the categories and/or criteria are possible as the label develops. We are keen to provide a challenging criteria catalogue t. The label must carry a strong purpose; however, we also need to consider the trade-off between developing a challenging label and making it practical and affordable enough for companies to conduct an audit.
• The label is understood as an ongoing and collaborative effort for strengthening transparency, trustworthiness and understandability of digital applications.
• The release of the first version is a starting point and the Label needs to continuously develop.

• The criteria catalog and the dimensions of the label are based on various studies and the work of a the Label Expert Committee.
• We conducted research on the factors determining digital trust (- all results published here) – showed that the four categories strike a balance between.
• Drawing from these findings, we decided for a holistic approach for the label criteria. Four key dimensions constitute the core of the label criteria. The operationalisation of the core principles is done through precise technical, legal or administrative specifications that can be externally verified.
• The catalogue is built on existing standards, such as ISO 27001 (information security management system), ISO 22301 (business continuity management system) and GDPR (European data protection legislation). It does not cover the P-D-C-A system, but all topics directly related to the security of the product

The length of the audit depends on  several parameters such as the completeness of the evidence provided to the auditor, resource availability and the findings as part of the audit, e.g., if there are any non-Conformities that must be solved prior to proceeding the audit. We recommend planning 14 full working days for the audit which includes the gathering of all relevant documents and evidence, interviews with the auditor and any further potential clarifications from the auditor.

We are looking to involve an independent Ombudsperson who will be in charge of taking on any potential violations and examine them on a case by case basis in the future. Until then, we are taking any feedback and potential violations via the contact form.

SDI is the label owner, hence defines the label criteria and steps to obtaining the label and makes the final label award decision. The main interaction throughout the label process will be with SDI and the auditor. Once the audit report of the candidate company has been received, independent experts will conduct the technical review to grant the label certificate. SDI has decided to conduct the technical review to provide an additional layer of trustworthiness to the auditing process to underline the credibility of the label

Not all of the label criteria may be applicable depending on the digital service to be audited. In such cases, the auditor will evaluate and discuss the list of applicable criteria with the organization directly. If a majority of the label criteria are not applicable to the digital service to be audited, the label may be deemed unsuitable for that digital service. In this case, SDI has the right to discontinue with the auditing process to safeguard the credibility and standard of the label.

For the first phase of the Digital Trust Label audit primarily documents on policies and procedures describing the general implementation of the respective requirements of the Digital Trust Label standard are required.
This can e.g. include the internal Information Security Standard, Data Privacy Standard or the risk-assessment. Also the Desaster Recovery plans or legal approvals can be of relevance. If such documentation is not available also informal descriptions can be provided.
In the second phase, i.e. the actual audit, the implementation of the policies and procedures must be proven with the respect to the service in scope. For this the auditors will rely as much as possible on already existing evidences, e.g. other existing (ISO 27001) audit reports, penetration test reports or test reports. Also detailed checks and demonstrations on the live system or checks of configurations (e.g. for servers) are possible. For external services for example SLAs oder contracts with suppliers can be reviewed.