There is a pad explaining the process (thanks @jmaris)

https://pad.softwarefreedom.net/pad/#/2/pad/view/uJAiNHWU7XUlErGMwS9Z2OzStjlXZqMSnD+zJ2Y7unI

The current #ETSI standards are written in Markdown and separated by the software class, like #Browser #PasswordManager or #VPN

Here, contributors can read them and open issues if things are unclear, overly restrictive or could be otherwise improved:

https://labs.etsi.org/rep/stan4cra

Non-commercial #FOSS is excluded, so this would be relevant for commercial projects (which can be fully free software).