para 6.2 IT sec

[bluesteens]

Steering summary: Proposal to remove the hard requirement for a SOC Report.

---

The requirement is essentially: The Digital Wallet provider SHALL provide a SOC report. See here.

Is this within the scope of OCI to demand this report over all other alternatives? Should it not be left to customer contract negotiations, SLA etc. to specify such requirements?

I suggest to change SHALL to SHOULD if the wording was not to be changed much. (After all, the ISO requirement is also a SHOULD.) Otherwise I suggest to rework the section to be more general in its request and offer SOC only as an example.

[lleifermann]

I also agree that this should be part of product or customer negotiations - Not a requirement of the OCI as SOC concentrates a lot around the practices and rules inside of a company.

I am currently working on v3.0.0 of this specification. If we want we can already integrate this change there.

[alexcolganLD]

Agree with @bluesteens and @lleifermann, this is an SLA question not an interoperability conformance question.

[bluesteens]

Triage:

• [x] Is Issue appropriate for OCI Architecture
• [x] Create Steering-level Summary of request
• [x] Assign Size
• [x] Assign Priority
• [x] Assign Label (if needed)
• [x] OCI affected Artifacts Identified
• [ ] Assign Triage - Artifact Version Target (v x.x.x Milestone)
• [ ] Assign Triage - Interop Profile Version Target (v x.x.x Milestone)
• [ ] Create sub-project (if needed)

Affected Parties (help determine Sunrise/Sunset):

• [ ] Trading Partners
• [ ] Issuers
• [x] Wallet Solutions
• [ ] PI Verification Solutions

Affected OCI Artifact

• [ ] Schema Document
• [ ] Identity Schema
• [ ] ATP Schema
• [ ] Issuer Conformance Criteria
• [x] Wallet Conformance Criteria
• [ ] VRS Solution Conformance Criteria
• [ ] Wallet API Specification
• [ ] Governance Document
• [ ] Conformance Program
• [ ] OCI Website
• [ ] Internal Process

Change Category (Guides Steering Review)

- Steering/Industry Review

• [x] Business-Level (May affect business operations)
• [ ] OCI Governance, Policy or website feature

- Steering/Industry Notification

• [ ] Technical-Level (Does not affect business operations)
• [ ] OCI Internal Process or Infrastructure

[rceleste125]

OCI Affected Artifact: Digital Wallet Conformance Criteria

[alexcolganLD]

Agree this seems like an SLA-level question. The criterion doesn't even specify to whom the report should be provided, which suggests that it's not an interoperability requirement.

[bluesteens]

July, 27: to be released in Digital Wallet Criteria v3.3.0, interop profile v3.2.0