{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "DR.artifactDefinition.v2",
  "artifactId": "DR",
  "title": "Document Register",
  "artifactType": "Register",
  "format": "xlsx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for controlling documented information, including document origin, supplied-in-companion flag, owner, approver, version, approval date, review cycle, retention, obsolete handling, location and evidence reference.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use DR as the master control point for documented information and audit evidence locations.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Do not rely on uncontrolled copies; keep one approved location, version and owner for each document.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "document_register",
      "title": "Document register",
      "contentType": "register_table",
      "required": true,
      "minimumExampleRows": 6,
      "columns": [
        {
          "name": "Document ID",
          "type": "text",
          "required": "yes",
          "description": "Unique controlled document identifier.",
          "example": "DR-001"
        },
        {
          "name": "Title",
          "type": "text",
          "required": "yes",
          "description": "Document title.",
          "example": "Information Security Policy"
        },
        {
          "name": "Type",
          "type": "select",
          "required": "yes",
          "description": "Policy, procedure, register, plan, template or record.",
          "example": "Policy"
        },
        {
          "name": "Driven by",
          "type": "text",
          "required": "yes",
          "description": "Clause, control, risk, process or business driver.",
          "example": "Clause 5.2"
        },
        {
          "name": "Origin",
          "type": "text",
          "required": "yes",
          "description": "Source or creation origin.",
          "example": "Internal ISMS document"
        },
        {
          "name": "Supplied in companion",
          "type": "boolean",
          "required": "yes",
          "description": "Whether supplied in companion package.",
          "example": "Yes",
          "valueSet": "std.boolean",
          "options": [
            "Yes",
            "No"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select Yes or No."
          }
        },
        {
          "name": "Owner",
          "type": "select",
          "required": "yes",
          "description": "Document owner.",
          "example": "ISMS Manager",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Approver",
          "type": "text",
          "required": "yes",
          "description": "Approver role.",
          "example": "Top Management"
        },
        {
          "name": "Version",
          "type": "text",
          "required": "yes",
          "description": "Current version.",
          "example": "1.0"
        },
        {
          "name": "Status",
          "type": "select",
          "required": "yes",
          "description": "Draft, Review, Active, Retired or Obsolete.",
          "example": "Active",
          "valueSet": "domain.status.generic",
          "options": [
            "Draft",
            "In Progress",
            "Under Review",
            "Approved",
            "Closed",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Approval date",
          "type": "date",
          "required": "conditional",
          "description": "Approval date for approved documents.",
          "example": "2026-08-01"
        },
        {
          "name": "Review frequency",
          "type": "text",
          "required": "yes",
          "description": "Review cycle.",
          "example": "Annual"
        },
        {
          "name": "Next review",
          "type": "date",
          "required": "conditional",
          "description": "Next review date.",
          "example": "2027-08-01"
        },
        {
          "name": "Retention",
          "type": "text",
          "required": "yes",
          "description": "Retention rule.",
          "example": "Current version plus 3 years"
        },
        {
          "name": "Obsolete handling",
          "type": "text",
          "required": "yes",
          "description": "How superseded documents are controlled.",
          "example": "Archived read-only"
        },
        {
          "name": "Location",
          "type": "text",
          "required": "yes",
          "description": "Authoritative location.",
          "example": "ISMS controlled documents"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes",
          "description": "Evidence ID or link reference.",
          "example": "ISP-001"
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "no",
          "description": "Additional context.",
          "example": "Approved and communicated."
        }
      ],
      "hint": {
        "text": "Every document row should show control status, origin, approval, review, retention and where the authoritative version lives.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 6,
      "id": "document_register_decision",
      "title": "Document register decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Documents reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Documents pending approval",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Documents overdue for review",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Obsolete documents controlled",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so stale or uncontrolled documented information is visible before audit.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 7,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to DR.artifactDefinition.v2.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "Rows must include owner, approver, version, status, review date, retention, location and evidence reference.",
    "Retired or obsolete documents must describe obsolete handling.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-02-01-00",
        "chapterTitle": "Information Security Policies & Risk",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/dp/9789908983448"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "DR",
        "longForm": "Disaster Recovery"
      },
      {
        "abbr": "ISP",
        "longForm": "Information Security Policy"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "RAM",
        "longForm": "Risk Assessment Methodology"
      },
      {
        "abbr": "RR",
        "longForm": "Risk Register"
      },
      {
        "abbr": "RTP",
        "longForm": "Risk Treatment Plan"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "document_register",
        "document_register_decision"
      ],
      "minExampleRows": 6,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.items.v1"
}