Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Certification checklist #38

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Certification checklist #38

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e8f8957
checklist versino
bhox May 31, 2018
ecf0d19
checklist version
bhox May 31, 2018
4358ec9
new checklist filename
bhox May 31, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions certification_checklists.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
## Overview
As an open-source project, there is no centralizing body that can assess if implementations of OpenGDPR are following the spec correctly. Instead implementors can self-certify their implementation by testing it against the following two checklists, one for processors and one for controllers.

## Self-Certification Checklist: Processors

- [ ] New requests: validations and correctly processing new requests, including included extensions
- [ ] Request status objects: sending correct status objects and `expected_completion` time
- [ ] Request cancellation
- [ ] Generating and securing results files in the `results_url` field
- [ ] `/discovery`: public certificate, supported identity types, extensions
- [ ] API security: authentication & authorization
- [ ] Requests are signed with the private key
- [ ] Private key is protected and securely managed
- [ ] Callbacks are sent on status changes
- [ ] Major version number in URLs
- [ ] Logging activity
- [ ] Publishing any required extensions
- [ ] Defined process for fulfilling each request type
- [ ] Metrics on the fulfillment to ensure correct operations


## Self-Certification Checklist: Controllers
- [ ] New `opengdpr_requests`: correctly populating required fields especially `identity_types` and `extensions`
- [ ] Request status: polling or callbacks to track progress
- [ ] Callback receipt: stable endpoint for receiving status objects
- [ ] Certificate validation and caching
- [ ] Signature validations on requests
- [ ] Logging