Skip to content

Mobile-ID Digital TrustISO/IEC 27001:2022 · SIS351224I008Published certification scope

View evidence

DEVELOPER

Scope Catalog

Model access by resource/action and purpose so an integration requests the smallest permission set needed for its workflow.

01 / CONCEPT

Integration contract

01

Resource

Patient, Observation, DiagnosticReport, Appointment, Consent or service-specific capability.

02

Action

Read, search, create, update or execute a constrained operation.

03

Purpose

Business/clinical purpose and audience are reviewed with the requested scope.

04

Environment

Sandbox approval does not automatically grant production access.

02 / WORKFLOW

From sandbox to evidence

01Map workflow to data actions
02Remove unnecessary write/search access
03Request scope with justification
04Test denial paths
05Review before production
06Re-review when purpose or integration changes

03 / SECURITY & PRODUCTION

Production is an evidence decision

A sandbox scope or catalog entry is not an entitlement. Production access is approved for the minimum resource/action/purpose needed by the confirmed workflow.