Update SSP section 10.7 (Data Flow) to explain external services

[brittag]

In order for Technical Reviewers to understand our system, we should ensure our system overview section 10.7 (data flow) reflects our system very well, especially areas that they had questions about.

Setup

Read the guidance in HOWTO update the SSP before working on this.

This story is part of the larger task filed at https://github.com/18F/cg-compliance/issues/172 (our overall update of our System Overview sections).

The core place where we keep diagrams is this Diagrams folder. The "Latest key diagrams used in SSP" sub-folder should always have the latest/best versions of our diagrams. There is no actual source file available for our Data Flow diagram - we just modify the png the best we can.

Important context: this task derives from the JAB reviewer items (additional notes here) - see those documents for more details - specifically item number 18.

Acceptance criteria

• [ ] Section 10.7 (data flow) includes an updated diagram which shows system interconnects and what data is exchanged in which direction with external systems. The diagram should make it clear which account is used for which human interaction points.
• [ ] The diagram should have additional text explanation (before or after the diagram) that references the attached table of services and the same naming should be used. This should refer to AC-2 for more details.
• [ ] The updated diagram should be in the relevant Google Drive folders, so that we can easily attach it as an SSP attachment (for a larger view for our TRs).

[jmcarp]

From @NoahKunin:

@jmcarp we answered this during the JAB mtg

[12:01]
I'll do a formal review, but the core gap was third-party services

[12:01]
even if the data flow is one way, or basically cul-de-sacs, we need to visualize them

[12:01]
the problem is we mentioned stuff in the system diagram and software / service inventory, that was totally absent from data flow

Questions:

• Is work on this item blocked on @NoahKunin's "formal review"?
• Where are the notes from the JAB meeting?
• Where are the system diagram and software / service inventory?
• What are the requirements of the data diagram?

cc @brittag

[brittag]

More info about how to approach this task:

• Work on this item is not blocked on any one person's formal review! In practice, this task may be blocked on our team not yet having an authoritative/complete list of services that should be included in this diagram. (In other words: we haven't yet worked on getting this list of external services up to the level of detail and comprehensiveness we probably need.)
• The notes from the relevant JAB meeting are in this spreadsheet and this additional notes doc.
• We have two main things we could call "the system diagram": we have a Data Flow diagram (the thing this task is about) and a boundary/network diagram. Both of those are in this diagrams folder.
• The draft software/service inventory is this list of external services mentioned above.
• The basic user need for this data diagram is: add more info to it so that our system reviewers (the JAB TRs) understand better how our various internal and external services connect to system components.

We can totally decide this is blocked for now until we improve that list of services - that's a legit decision.

[brittag]

Moving this to "In Progress" since Josh has made progress on diagram concepts!

[brittag]

Status: they made some small diagrams that show some components! These are going to be useful to include.

It's unclear though what the full/overall requirements are for the diagrams for this section - it seems useful to make some more progress on Section 9 and 10 (and the services table attachment) before tackling this one in more depth. So I'll move this one back to "ready" for now, I think.

[NoahKunin]

While this is a very cool concept for moving forward, we needed just to focus on the external service flows. If the content from 9 days ago is current, I'll take it from here. If not, please come back here and drop a link @sharms

[mogul]

@brittag @NoahKunin Can we close this now?

[brittag]

Yeah, closing this - we are now in a new phase of this work, so this issue is no longer helpful.