regulator-portal-service — Service Readiness
Version: 1.0 Status: Draft Owner: Regulator-facing + Legal + SRE Last Updated: 2026-04-21 References: SERVICE_OVERVIEW.md, _report.md, FAILURE_MODES.md
Production-readiness checklist. Emphasis on: mTLS + national-PKI enforcement, LI workflow dual-control, SIEM resilience, attestation integrity.
1. Code Readiness
| Criterion | Status |
|---|---|
| Web BFF with Next.js (login, LI, complaint, reports, attestation) | ☐ |
| REST API with mTLS-only enforcement | ☐ |
| SIEM forwarder (CEF/LEEF/JSON) with disk-WAL buffer | ☐ |
| LI state-machine + dual-control (60 s window) | ☐ |
| Report generation pipeline (read-through → build → HSM sign → S3) | ☐ |
| Auditor time-boxed access with automatic revocation | ☐ |
| Evidence auto-collection cron + freshness tracking | ☐ |
| Annual attestation bundle generator | ☐ |
| CRL + OCSP-staple enforcement on every handshake | ☐ |
| Idempotency on writes | ☐ |
2. Testing Readiness
Covered in TESTING_STRATEGY.md. Key gates for GA:
- Unit ≥ 90%/80%; integration passing; contract tests passing.
- Cert-bypass corpus: 0 bypasses.
- Mid-session cert revocation ends session within next request.
- SIEM disk-WAL drain test: 7 days of outage → 7 days of events replayed correctly.
- Dual-control window enforcement tests.
- Attestation-bundle signature verification test.
3. Observability Readiness
All metrics + alerts + dashboards from OBSERVABILITY.md; all runbooks per alert.
4. Security Readiness
| Criterion | Status |
|---|---|
| mTLS + national-PKI chain configured | ☐ |
| CRL / OCSP staple enforcement on every login | ☐ |
| SIEM destination mTLS (where supported) | ☐ |
| HSM signing key provisioned | ☐ |
| Disk-WAL encrypted at rest | ☐ |
| Postgres UPDATE/DELETE trigger on li_audit, complaints, attestations | ☐ |
| Security team sign-off | ☐ |
5. Operational Readiness
| Criterion | Status |
|---|---|
| 3 Deployments (web, api, siem-forwarder) reviewed | ☐ |
| Disk-WAL PVC sized (50 GB) | ☐ |
| PDB per Deployment | ☐ |
| mTLS certificates provisioned and rotated via cert-manager | ☐ |
| Runbooks per alert | ☐ |
| On-call: Regulator-facing + Legal primary; SRE + Security secondary | ☐ |
| Dual-control bridge (phone + Slack) for urgent LI | ☐ |
| Emergency-approver procedure documented | ☐ |
6. Documentation Readiness
All 16 docs Complete. Plus per-alert runbooks + regulator user guide + auditor onboarding guide.
7. Compliance / Regulatory Readiness
| Criterion | Status |
|---|---|
| ATRA MoU for portal access | ☐ |
| National-PKI CA trust chain ratified | ☐ |
| LI workflow approved by Legal | ☐ |
| Auditor-portal approved by Security + Legal | ☐ |
| Evidence catalog populated for at least one framework (ISO 27001) | ☐ |
| SIEM destination schema approved by ATRA | ☐ |
| Audit retention policy (7 y) configured | ☐ |
8. Go/No-Go Criteria
- All §1 complete.
- Coverage met.
- Load + security tests pass.
- 14-day shadow mode: upstream reads happen but no regulator user onboarded.
- Chaos drill (mTLS storm, SIEM out, HSM out, upstream out, disk-WAL fill) all recovered.
- Sign-offs: Regulator Liaison, Legal, Security, Compliance.
- Rollback validated.
9. Post-Launch Review
Within 30 days:
- Regulator user adoption (logins / day).
- LI SLA attainment (100% within 24 h).
- Complaint SLA attainment (95% within 5 business days).
- SIEM event loss (target 0).
- WAL utilization trend.
- Auditor time-box compliance.
- Evidence freshness (target ≥ 95% CURRENT).
- Cost analysis: SIEM bandwidth, HSM signing counts, S3.
10. Phased Rollout
| Phase | Duration | Behaviour | Exit criteria |
|---|---|---|---|
| P0 — Pre-migration | 3 months | ATRA + Auditor engagement; PKI setup; SIEM destination handshakes | MoUs signed |
| P1 — Read-Only Reports | 30 d | Daily CDR status + monthly compliance reports live; no LI yet; SIEM active | ATRA-verified |
| P2 — Complaint + Scheduled Reports | 30 d | Complaint ingest + scheduled + ad-hoc reports | Regulator satisfaction |
| P3 — LI Workflow | 30 d | LI request/delivery workflow live | ATRA MoU executed |
| P4 — SIEM + Attestation | 30 d | Full SIEM forwarding + attestation catalog + auditor portal | ISO 27001 attestation ready |
| P5 — External Auditor | Ongoing | Third-party auditors onboarded | Steady state |
Rollback flags: REG_LI_WORKFLOW_ENABLED, REG_SIEM_FORWARDING_ENABLED, REG_AUDITOR_PORTAL_ENABLED.