{ "schemaVersion": "artifactDefinition.v2", "definitionId": "ICVC.artifactDefinition.v2", "artifactId": "ICVC", "title": "ISO 27001 Control Owner Control Validation Checklist", "artifactType": "Checklist", "format": "docx", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable template/example maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture", "mdDefinition": "generated output", "mdExample": "generated output" }, "purpose": "Provide auditable evidence for ISO 27001 Control Owner Control Validation Checklist.", "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated Office and Markdown outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint. Hints must not be generic or mechanically repeated.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "controlledValues": { "result": [ "Successful", "Failed", "Pending", "Not applicable" ], "yesNo": [ "Yes", "No" ], "completionStatus": [ "Complete", "Conditionally complete", "Pending", "Rejected" ], "priority": [ "Critical", "High", "Medium", "Low" ], "evidenceQuality": [ "Complete", "Partial", "Missing", "Not applicable" ] }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null, "fields": [ { "name": "Document Title", "type": "text", "required": "yes" }, { "name": "Document ID", "type": "text", "required": "yes" }, { "name": "Version", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Organization", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Classification", "type": "text", "required": "yes" }, { "name": "Effective Date", "type": "date", "required": "yes" }, { "name": "Next Review Date", "type": "date", "required": "yes" } ], "intro": "Use this section to identify the document and its control context." }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "requiredContent": "Explain the purpose of the ISO 27001 Control Owner Control Validation Checklist and the evidence it creates for ISO 27001 implementation and audit readiness.", "hint": { "text": "Use this checklist as an auditable control record. It should show context, checks performed, evidence reviewed, open items, and final decision for ISO 27001 Control Owner Control Validation Checklist.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null, "fields": [ { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Used by", "type": "text", "required": "yes" }, { "name": "Maintained by", "type": "text", "required": "yes" }, { "name": "Evidence role", "type": "text", "required": "yes" }, { "name": "ISO reference", "type": "text", "required": "yes" }, { "name": "Review cadence", "type": "text", "required": "yes" } ], "intro": "Record ownership, approval, classification, version, review cadence, and evidence context." }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "requiredContent": "1. Identify the owner responsible for maintaining this checklist.\n2. Complete the context section before starting the checks.\n3. Record every check with owner, date, result, evidence, and notes.\n4. Escalate failed or pending mandatory checks as blockers unless an approved exception exists.\n5. Sign off only after evidence, open items, lifecycle links, and completion decision are reviewed.", "intro": "Explain how to complete, maintain, review, and use this checklist as operational evidence.", "hint": { "text": "Treat this section as the operating instruction for the checklist owner. It defines the evidence standard and when ISO 27001 Control Owner Control Validation Checklist cannot be closed.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 6, "id": "validation_context", "title": "Validation context", "contentType": "field_table", "required": true, "fields": [ { "name": "Object / record validated", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Validator", "type": "text", "required": "yes" }, { "name": "Validation date", "type": "date", "required": "yes" }, { "name": "Scope", "type": "text", "required": "yes" }, { "name": "Related risk / control", "type": "text", "required": "yes" }, { "name": "Review trigger", "type": "text", "required": "yes" }, { "name": "Evidence pack reference", "type": "text", "required": "yes" } ], "intro": "Define what is being validated, who is accountable, and why the validation is required.", "hint": { "text": "Start with a clear validation object and trigger. Auditors need to see why the validation happened and which scope, owner, and evidence pack it covers.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 7, "id": "validation_criteria", "title": "Validation criteria", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Criterion", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Expected evidence", "type": "text", "required": "yes" }, { "name": "Responsible role", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Define criteria used to judge whether the object is complete, accurate, current, and evidenced.", "hint": { "text": "Make the criteria explicit. This prevents checklist completion from becoming subjective and supports repeatable audit sampling.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 8, "id": "validation_checklist", "title": "Validation checklist", "contentType": "evidence_log_table", "required": true, "columns": [ { "name": "Check ID", "type": "text", "required": "yes" }, { "name": "Area", "type": "text", "required": "yes" }, { "name": "What was validated", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Performed by", "type": "text", "required": "yes" }, { "name": "Approved by", "type": "text", "required": "yes" }, { "name": "Date", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Use this table as the main validation audit trail with one row per performed check.", "hint": { "text": "Do not record only a check mark. Capture what was validated, who performed it, the date, result, evidence, and notes.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 9, "id": "evidence_reviewed", "title": "Evidence reviewed", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Evidence item", "type": "text", "required": "yes" }, { "name": "Source system / document", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Date reviewed", "type": "text", "required": "yes" }, { "name": "Quality result", "type": "text", "required": "yes" }, { "name": "Gap identified?", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Record evidence reviewed to support the validation conclusion.", "hint": { "text": "Evidence quality matters as much as evidence existence. Note stale, incomplete, inconsistent, or missing evidence.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 10, "id": "gaps_and_actions", "title": "Gaps and actions", "contentType": "action_table", "required": true, "columns": [ { "name": "Gap / action ID", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Related item", "type": "text", "required": "yes" }, { "name": "Priority", "type": "select", "required": "yes", "valueSet": "domain.priority", "options": [ "P1", "P2", "P3", "P4" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Due date", "type": "date", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Track validation gaps, remediation actions, owners, due dates, and closure evidence.", "hint": { "text": "Every failed or partial validation needs an owner, due date, and closure evidence.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 11, "id": "exceptions", "title": "Exceptions", "contentType": "exception_table", "required": true, "columns": [ { "name": "Exception ID", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Reason", "type": "text", "required": "yes" }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Expiry date", "type": "date", "required": "yes" }, { "name": "Compensating control", "type": "text", "required": "yes" }, { "name": "Residual risk", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Document approved deviations from mandatory validation requirements.", "hint": { "text": "Exceptions should be explicit, time-limited, risk-aware, and supported by compensating controls.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 12, "id": "lifecycle_linkage", "title": "Lifecycle linkage", "contentType": "linkage_table", "required": true, "columns": [ { "name": "Record", "type": "text", "required": "yes" }, { "name": "Reference", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "intro": "Link validation outcome to related registers, risk records, SoA entries, control evidence, and management review inputs.", "hint": { "text": "Validation is useful only if the result updates connected ISMS records and remains traceable.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 13, "id": "validation_decision", "title": "Validation decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Validation result", "type": "text", "required": "yes" }, { "name": "Accepted by owner", "type": "text", "required": "yes" }, { "name": "Reviewer", "type": "text", "required": "yes" }, { "name": "Open blocker decision", "type": "text", "required": "yes" }, { "name": "Final status", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "State the final validation decision.", "hint": { "text": "The final decision should make clear whether validation is complete, conditionally complete, pending, or rejected and why.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } }, { "order": 14, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 5, S-08-04-00 ISO 27001 & NIS2" } } ], "validationRules": [ "Body MD, JSON Definition, and JSON Example must use the same section order and compatible section titles.", "Each section must have an intro that explains the practical purpose of the section before data/content is rendered.", "Every non-formal content section must have a context-specific hint stored in the JSON Definition and rendered as a callout after the section content.", "Checklist sections must capture what was done, who performed it, when it was done, the result, evidence reference, and notes where applicable.", "Do not include a separate Book reference chapter; book linkage belongs inside the section hint.", "Example data must look realistic and audit-ready, but must not contain real personal data.", "JSON Example must contain definitionRef pointing to ICVC.artifactDefinition.v2." ], "instructionsForGenerator": [ "Use this JSON Definition as the machine-readable contract.", "Use JSON Example as the curated realistic example data source.", "Use Body MD as the canonical human-readable source.", "Generate MD Definition and MD Example downstream; do not treat them as curated source relations.", "Render section intros before content and section hints as callouts after content." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this file by version." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 5, "volumeTitle": "Dual Compliance", "chapterId": "S-08-04-00", "chapterTitle": "ISO 27001 & NIS2", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983479" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Provide auditable evidence for ISO 27001 Control Owner Control Validation Checklist.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CISO", "longForm": "Chief Information Security Officer" }, { "abbr": "CRM", "longForm": "Customer Relationship Management" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "This file's function is: Provide auditable evidence for ISO 27001 Control Owner Control Validation Checklist. It must not be rewritten as a generic operating-rules essay.", "Identify the checklist owner and the object, process, person, control, or release being reviewed.", "Complete the context and evidence sections before recording the final decision.", "For each check, capture what was done, who performed it, who approved it where applicable, the date, result, evidence reference, and notes.", "Use controlled result values: Successful, Failed, Pending, Not applicable.", "Treat failed or pending mandatory checks as blockers unless an approved, time-limited exception exists.", "Link the checklist outcome to the relevant ISMS register, risk, control, evidence, or lifecycle record." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "validation_context", "workedExampleOrg": "Arcfield", "minBodyWords": 150, "requiredGroups": [ { "id": "introduction", "heading": "What this checklist is", "mustInclude": [ "checklist" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "validation_context", "heading": "Validation context", "mustInclude": [ "Validation", "context" ] }, { "id": "validation_checklist", "heading": "Validation checklist", "mustInclude": [ "Validation", "checklist" ] }, { "id": "evidence_reviewed", "heading": "Evidence reviewed", "mustInclude": [ "Evidence", "reviewed" ] }, { "id": "validation_decision", "heading": "Validation decision", "mustInclude": [ "Validation", "decision" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.checklist.v1", "contentContractId": "content.checklist.v1" }