+ The OCI Steering Committee SHALL agree on a suitable specification release process with the OCI Service Providers to allow for realistic deadlines to compliance. This process SHOULD include considerations regarding audit requirements, time to audit, and any other necessary arrangements. Where these considerations allow for a grace period between the trigger of a new audit or self-attestation and the execution of those, the affected OCI Service Providers SHALL continue to be considered as valid OCI Service Providers for that period.
@@ -173,7 +173,7 @@The formal audit of a Digital Wallet provider SHALL address all compliance criteria as set out in the published OCI Digital Wallet Conformance Criteria document found at the following public location: OCI GitHub - Digital Wallet Conformance Criteria.
Since the nature of the various conformance criteria differs, auditors SHOULD distinguish between Test of Details and Test of Controls as applicable to individual criteria or groups of criteria.
- To the extent that OCI conformance criteria are covered by another audit, auditors MAY rely on audit work performed by other trustworthy entities to avoid duplication of work, for example in the context of a SOC2 or ISO audit.
+ To the extent that OCI conformance criteria are covered by another audit, auditors MAY rely on audit work performed by other trustworthy entities to avoid duplication of work, for example in the context of a SOC 2 or ISO audit.
OCI has not yet standardized the DIDComm-based wallet-to-wallet communication that is to be implemented by Digital Wallet Providers. Since the initial overview of technologies proposed in the Digital Wallet Conformance Criteria only permits the implementation of custom DIDComm flows that might be outside of OCI's future recommendations, From a10583a40f89e57c9670c8ad8b4e6c12e17b594a Mon Sep 17 00:00:00 2001 From: Chris <34170038+bluesteens@users.noreply.github.com> Date: Wed, 18 Oct 2023 18:23:58 +0200 Subject: [PATCH 2/9] flowchart link added --- content/DRAFT/index.html | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/DRAFT/index.html b/content/DRAFT/index.html index f56f598..85a50e4 100644 --- a/content/DRAFT/index.html +++ b/content/DRAFT/index.html @@ -165,6 +165,10 @@
The OCI Steering Committee SHALL agree on a suitable specification release process with the OCI Service Providers to allow for realistic deadlines to compliance. This process SHOULD include considerations regarding audit requirements, time to audit, and any other necessary arrangements. Where these considerations allow for a grace period between the trigger of a new audit or self-attestation and the execution of those, the affected OCI Service Providers SHALL continue to be considered as valid OCI Service Providers for that period.
+
+ The formal audit SHALL address all compliance criteria in the OCI Credential Issuer Conformance Criteria as it relates to the specific Credential Type(s) the Credential Issuer offers. From 8aa31e2ebc3a3ca6764b88ec599213fee2031686 Mon Sep 17 00:00:00 2001 From: Chris <34170038+bluesteens@users.noreply.github.com> Date: Thu, 19 Oct 2023 10:29:25 +0200 Subject: [PATCH 3/9] Self-Attestation types & need for signature --- content/DRAFT/index.html | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/content/DRAFT/index.html b/content/DRAFT/index.html index 85a50e4..94c6e6f 100644 --- a/content/DRAFT/index.html +++ b/content/DRAFT/index.html @@ -258,7 +258,7 @@
Self-attestation refers to representations made by the Service Provider in reference to the relevant OCI Conformance Criteria as a whole or selected requirements therein. Such representations SHALL be signed by the Service Provider’s senior management and provided to the OCI Steering Committee for publication, either as a stand-alone document or as a statement of permission for OCI to hyperlink to the service provider’s own public storage location. Where OCI prescribes a template for such representations, the latest published version at the time of signing SHALL be used by the Service Provider.
-
- At any time the OCI Steering Committee MAY challenge any Service Provider on the claims made. The Service Provider SHALL then address the points of concern raised by the OCI Steering Committee in a form and timeframe appropriate to the situation and as agreed with the OCI Steering Committee.
+
Self-attestation, in general, refers to representations made by the Service Provider in reference to the relevant OCI Conformance Criteria as a whole or selected requirements therein. OCI distinguishes between Attestation of Conformance and Operational Attestation.
+
+ An Attestation of Conformance is an explicit statement by the Service Provider about their adherence to the applicable OCI Conformance Criteria. Such self-attestation SHALL be signed by the Service Provider’s senior management and provided to the OCI Steering Committee for publication, either as a stand-alone document or as a statement of permission for OCI to hyperlink to the Service Provider’s own public storage location. Where OCI prescribes a template for such representation, the latest published version at the time of signing SHALL be used by the Service Provider.
+
+ An Operational Attestation is a presentation of operational or system performance data by the Service Provider in relation to selected requirements within the applicable OCI Conformance Criteria. Such self-attestation NEED NOT be signed by the Service Provider’s senior management or other staff. The Service Provider NEED NOT make any claim beyond the presented data in the self-attestation.
+
+ At any time the OCI Steering Committee MAY challenge any Service Provider on any of the statements or claims made. The Service Provider SHALL then address the points of concern raised by the OCI Steering Committee in a form and timeframe appropriate to the situation and as agreed with the OCI Steering Committee.
OCI provides a public repository for submitted self-attestations at https://github.com/Open-Credentialing-Initiative/marketplace/tree/main/proof. +
OCI provides a public repository for submitted self-attestations.
Where self-attestation is permissible or required as additional evidence on top of a third-party audit (refer to Test of Controls), the Service Provider SHALL make the necessary documentation available to OCI. +
Where Operational Attestation is permissible or required as additional evidence on top of a third-party audit (refer to Test of Controls), the Service Provider SHALL make the necessary documentation available to OCI.
VRS providers SHALL self-attest that they are in compliance with all requirements within the OCI VRS Providers Conformance Criteria. +
VRS providers SHALL provide Attestation of Conformance, i.e. self-attest that they are in compliance with all requirements within the OCI VRS Providers Conformance Criteria.