Cross Cutting Aspect

Score

Security

2

  Authentication

2

  Authorisation 

2

  Data Transfer Encryption

1

  Audit Logs

2

  Data protection

3

Localisation

2

  Languages

2

  Dates

3

  Local Alphabets

1

  Right-To-Left Alignment

3

Tech stack

2

Open Source

2

  Code availability

2

  Code Quality

2

  Open Source Checklist

2

  Documentation

2

Packaging / Distribution

2

  Build

2

  Packaging (publishing)

2

  Installation

2

  Upgrades

2

  Move to New Server

2

Testing

3

Contribution Model

2

Differences between Implementations

n/a

Functional Area

Bus. Proc.

Data Elem.

Loc.

Mod.

Master Data 

4

4

3

3

Insurance Product

3

4

3

3

Insurees 

4

4

3

3

Registration 

4

4

3

3

Claiming

4

4

3

3

Feedback

4

4

3

2

Analytics 

4

4

3

2

Pain point

Possible mitigation

Versioned code does not reflect all local changes

Ensure that every country runs on a checked in version, even if those are different branches

Different country implementations maintained in branches means that code is diverging

Ensure that a basic customization mechanism is pushed to the master version (via configuration) and that country implementations are submitting pull-requests to master

Implementation is bound to Microsoft SQL (See 2.4 Platform Independence)

Non-core modules: Ensure that most accesses to data layer are done via API calls rather than database.

Core modules: Evaluate cost of porting data access layer to a database-independent

Stored procedures: Redevelop stored procedures as a service with an API.

Code is developed using outdated technology

Incrementally replace non-core modules with new technologies, while development teams are gaining experience with those technologies

Deployment of a new OpenIMIS server instance is complex

Develop a windows-based Docker containerized version of OpenIMIS

Key workflows are not customizable

The application should provide clear extension points so that workflows (for ex. Claimes or registration) can be customized. This customization could happen in Code or via an interface (more complexity)

Security relevant issues (see issues in 2.1.1 Authentication, 2.1.2 Authorisation and 2.1.3 Data Transfer Encryption)

Fixes needed

Audit logs are couple with business logic (see 2.1.4 Audit Logs)

Decouple audit logs from business logic.

Data registered on mobile devices is not encrypted

Ensure that personal data in database on device is encrypted.

Data privacy issues - see 2.1.5 Data Protection (according to GDPR)

Extensive data audit needed to suggest feasible solutions for encryption of personal data.

Special calendar systems are not customizable

Support custom calendars throughout the application (Nepal support is only in front-end)

Right-to-left not supported in the applications (web app and mobile apps)

Add support for right-to-left interface in both web app and mobile app.

Code repository issues (partially resolved), see 2.5.1 Code Availability

Develop code repository guidelines (no build artefacts in repo, ensure separate modules are in separate repositories)

No automated tests or continuous integration can impact software quality and development speed.

Develop tests for new modules, set up continuous integration service.

Documentation is incomplete

Add documentation for mobile application

Manual packaging process

Packaging process should be automatic (connected to continuous integration above) and should not require manual intervention

Product names can only be in one language

Allow for product name and description in multiple languages