{ "schemaVersion": "artifactDefinition.v2", "definitionId": "CAR.artifactDefinition.v2", "artifactId": "CAR", "title": "Corrective Actions Register", "artifactType": "Register", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for tracking nonconformities, corrections, root causes, corrective actions, effectiveness checks, ownership, deadlines, closure and evidence.", "controlledValues": { "source": [ "Internal audit", "External audit", "Incident", "Management review", "Monitoring", "Supplier review", "Customer complaint" ], "grading": [ "Minor nonconformity", "Major nonconformity", "Observation", "Improvement" ], "status": [ "Open", "In progress", "Implemented", "Effectiveness check", "Closed", "Overdue" ], "effectivenessResult": [ "Effective", "Not effective", "Pending", "Not due" ] }, "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use CAR to prove that nonconformities are corrected at root-cause level, not merely recorded.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Do not close an action until implementation evidence and an effectiveness check are recorded.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "corrective_actions_register", "title": "Corrective actions register", "contentType": "register_table", "required": true, "minimumExampleRows": 5, "columns": [ { "name": "NC ID", "type": "text", "required": "yes", "description": "Unique nonconformity or action identifier.", "example": "CAR-001" }, { "name": "Date raised", "type": "date", "required": "yes", "description": "Date the issue was raised.", "example": "2026-08-05" }, { "name": "Source", "type": "select", "required": "yes", "description": "Where the issue came from.", "example": "Internal audit" }, { "name": "Raised by", "type": "text", "required": "yes", "description": "Role that raised the issue.", "example": "Internal Auditor" }, { "name": "Clause or control", "type": "text", "required": "yes", "description": "Related ISO clause, Annex A control or internal requirement.", "example": "Clause 9.2" }, { "name": "Description of nonconformity", "type": "text", "required": "yes", "description": "Clear statement of the issue.", "example": "Evidence incomplete." }, { "name": "Grading", "type": "select", "required": "yes", "description": "Severity or type.", "example": "Minor nonconformity" }, { "name": "Immediate correction", "type": "text", "required": "yes", "description": "Immediate containment or correction.", "example": "Collected missing evidence." }, { "name": "Root cause", "type": "text", "required": "yes", "description": "Underlying cause.", "example": "Checklist did not require attachment." }, { "name": "Similar issues elsewhere", "type": "text", "required": "yes", "description": "Result of extent check.", "example": "No further cases found." }, { "name": "Corrective action", "type": "text", "required": "yes", "description": "Action to eliminate root cause.", "example": "Update procedure." }, { "name": "Action owner", "type": "select", "required": "yes", "description": "Accountable role.", "example": "IT Operations Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Target date", "type": "date", "required": "yes", "description": "Due date.", "example": "2026-09-15" }, { "name": "Status", "type": "select", "required": "yes", "description": "Open, In progress, Implemented, Effectiveness check, Closed, Overdue.", "example": "In progress", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Implementation evidence", "type": "text", "required": "conditional", "description": "Evidence that the corrective action was implemented.", "example": "Updated procedure" }, { "name": "Effectiveness check", "type": "text", "required": "yes", "description": "Planned or completed check.", "example": "Verify next quarterly review." }, { "name": "Effectiveness result", "type": "select", "required": "yes", "description": "Effective, Not effective, Pending, or Not due.", "example": "Pending" }, { "name": "Closure date", "type": "date", "required": "conditional", "description": "Closure date for closed actions.", "example": "2026-07-20" }, { "name": "Evidence reference", "type": "text", "required": "yes", "description": "Evidence record.", "example": "CAR-001-ACC-REV" } ], "hint": { "text": "Separate the finding, immediate correction, root cause, corrective action and effectiveness result so the record is audit-ready.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4" } }, { "order": 6, "id": "closure_decision", "title": "Closure decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Open actions", "type": "text", "required": "yes" }, { "name": "Overdue actions", "type": "text", "required": "yes" }, { "name": "Actions awaiting effectiveness check", "type": "text", "required": "yes" }, { "name": "Closed actions", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Summarize whether corrective actions are controlled and whether management escalation is needed.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to CAR.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Each row must separate nonconformity, correction, root cause, corrective action and effectiveness check.", "Closed rows must include implementation evidence, effectiveness result and closure date.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 10.1", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-01-00", "chapterTitle": "Context of the Organization (Clause 4", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CSS", "longForm": "Cascading Style Sheets" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IR", "longForm": "Incident Response" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "NC", "longForm": "Nonconformity" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "corrective_actions_register", "closure_decision" ], "minExampleRows": 5, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }