britpayson
commented
2 years ago During early discussion’s within OCI, the collective group agreed that Credentials should have an expiration date; however, it would not be determined by the expiry date of the underlying evidence as it could be as short as one day (ie – State BOP license expiration) or have no set expiration (ie – corporate documentation). At that point it was recommended that 1-year be established as the default knowing this might change later down the road.
With that being said, I would agree that having OCI specify a specific validity time period would simply be an arbitrary number. I believe the intent is to make it clear that during the given validity period, an Issuer must perform ongoing monitoring (according to the Conformance Criteria) which as Issuer could associate to a service contract / agreement for credentialing services.
Should the issue be raised further in the future, I would recommend that the wording be updated to reflect this intent – for example:
Identity:
Current Wording - 6.3 Identity Credential Monitoring and Expiration An Identity Credential SHALL expire one year from the date it is issued. The expiration date indicates when the credential is no longer monitored, after which it SHALL be considered invalid. During this one-year term, the Credential Issuer SHALL perform continuous monitoring (on at least a weekly basis) to identify possible triggers for revocation / recertification.
Suggested Wording: An Identity Credential SHALL expire upon the expiration date set by the Credential Issuer. The expiration date indicates when the credential is no longer monitored, after which it SHALL be considered invalid. During this validity period, the Credential Issuer SHALL perform continuous monitoring (on at least a weekly basis) to identify possible triggers for revocation / recertification.
ATP:
Current Wording - 6.6 ATP Credential Monitoring and Expiration An ATP Credential SHALL expire one year from the date it is issued. The expiration date indicates when the credential is no longer monitored, after which it SHALL be considered invalid. During this one-year term, the Credential Issuer SHALL perform continuous monitoring to identify possible triggers for revocation / recertification.
Suggested Wording: An ATP Credential SHALL expire upon the expiration date set by the Credential Issuer. The expiration date indicates when the credential is no longer monitored, after which it SHALL be considered invalid. During this validity period, the Credential Issuer SHALL perform continuous monitoring to identify possible triggers for revocation / recertification.
bluesteens
rceleste125
ewaldorf
lleifermann
para 6.3 Identity Credential Monitoring and Expiration para 6.6 ATP Credential Monitoring and Expiration
... require the VC to be valid and monitored for 1 year. I feel this requirement is arbitrary and goes beyond the scope OCI because:
In my opinion, OCI should not define expiration dates or minimum periods, as these depend on legal and commercial factors outside OCI's and the CI's influence. Any arbitrary period seems meaningless. The job of the CI is to keep monitoring for as long as needed (i.e. customer pays) or until VC revocation on any of the grounds specified in the conformance criteria.