{ "schemaVersion": "artifactDefinition.v2", "definitionId": "IMPL-WB.artifactDefinition.v2", "artifactId": "IMPL-WB", "title": "Operational ISMS Dashboard", "artifactType": "Dashboard", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable dashboard maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic dashboard data fixture" }, "purpose": "Operational ISMS cockpit over the Arcfield freeze: SoA implementation and evidence, mandatory documents, untreated high risks, MME gaps, open CARs and incidents, review and certificate cadence, and a preview of the next 9.2 internal audit from the same engine as the internal audit report.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use IMPL-WB as the central implementation cockpit, not as a replacement for the Book 2 process.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Keep the workbook evidence-linked: status without owner, evidence and next action is not audit-ready.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "dashboard_schema", "title": "Dashboard schema", "contentType": "dashboard_schema", "required": true, "sheets": [ "Dashboard", "Packs", "Members", "ClauseLinks", "ClauseStatus", "SoA", "Mandatory", "HighRisk", "MME", "OpenActions", "Phases", "AuditDates" ], "hint": { "text": "The schema should show how workbook sheets connect to implementation evidence, owners and review outputs.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 6, "id": "dashboard_summary", "title": "Dashboard summary", "contentType": "summary_table", "required": true, "fields": [ { "name": "Clause packs present", "type": "text", "required": "yes" }, { "name": "Annex A controls recorded", "type": "text", "required": "yes" }, { "name": "Mandatory documents approved", "type": "text", "required": "yes" }, { "name": "Open actions", "type": "text", "required": "yes" }, { "name": "MME metrics below target", "type": "text", "required": "yes" }, { "name": "Current implementation phase", "type": "text", "required": "yes" }, { "name": "Next audit planned date", "type": "text", "required": "yes" }, { "name": "Overall pack readiness", "type": "text", "required": "yes" } ], "hint": { "text": "Use the summary to show whether the ISMS is ready for audit preparation and where blockers remain.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 7, "id": "workbook_dashboard_sections", "title": "Workbook / dashboard sections", "contentType": "section_table", "required": true, "columns": [ { "name": "Sheet ID", "type": "text", "required": "yes" }, { "name": "Sheet Name", "type": "text", "required": "yes" }, { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Primary Owner", "type": "text", "required": "yes" }, { "name": "Source Artifact", "type": "text", "required": "yes" }, { "name": "Key Output", "type": "text", "required": "yes" }, { "name": "Review Cadence", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "hint": { "text": "Every sheet should have a clear owner, source artifact and output so users know where evidence comes from.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 8, "id": "key_metrics_readiness_status", "title": "Key metrics and readiness status", "contentType": "metric_table", "required": true, "columns": [ { "name": "Metric ID", "type": "text", "required": "yes" }, { "name": "Metric", "type": "text", "required": "yes" }, { "name": "Target", "type": "text", "required": "yes" }, { "name": "Current", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence Reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "hint": { "text": "Metrics should be reviewable and evidence-backed, not generic progress percentages.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 9, "id": "evidence_gaps_actions", "title": "Evidence gaps and actions", "contentType": "action_table", "required": true, "columns": [ { "name": "Action ID", "type": "text", "required": "yes" }, { "name": "Gap", "type": "text", "required": "yes" }, { "name": "Related Area", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Priority", "type": "select", "required": "yes", "valueSet": "domain.priority", "options": [ "P1", "P2", "P3", "P4" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Target Date", "type": "date", "required": "yes" }, { "name": "Evidence Reference", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "hint": { "text": "Open gaps should become owned actions with due dates and evidence references before audit milestones.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 10, "id": "review_and_decision", "title": "Review and decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Decision", "type": "text", "required": "yes" }, { "name": "Workbook sections reviewed", "type": "text", "required": "yes" }, { "name": "Metrics reviewed", "type": "text", "required": "yes" }, { "name": "Open gaps", "type": "text", "required": "yes" }, { "name": "Next milestone", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a decision so implementation readiness and remaining blockers are explicit.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 11, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to IMPL-WB.artifactDefinition.v2.", "JSON Example dashboard sections must contain schemaRef pointing to the matching definition section.", "Dashboard Current values are derived at convert from snapshot measure slices. Do not author percentages such as Overall Readiness 82%.", "Workbook tabs are Dashboard plus measure slices, then review and references. Schema, summary, metrics and gaps are not duplicate Ex/Wk tabs.", "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-09-01-00", "chapterTitle": "Implementation Readiness & Planning", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "DR", "longForm": "Disaster Recovery" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "KPI", "longForm": "Key Performance Indicator" }, { "abbr": "MDR", "longForm": "Managed Detection and Response" }, { "abbr": "RR", "longForm": "Risk Register" }, { "abbr": "RTP", "longForm": "Risk Treatment Plan" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "dashboard_schema", "dashboard_summary", "workbook_dashboard_sections", "key_metrics_readiness_status", "evidence_gaps_actions", "review_and_decision" ], "minExampleRows": 3, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.dashboard.v1", "contentContractId": "content.dashboard.v1", "relations": [ { "kind": "cites", "artifactId": "REQT", "role": "measure_source", "expectedType": "Register", "rank": 1 }, { "kind": "cites", "artifactId": "SOA", "role": "measure_source", "expectedType": "Coverage", "rank": 2 }, { "kind": "cites", "artifactId": "MDR", "role": "measure_source", "expectedType": "Register", "rank": 3 }, { "kind": "cites", "artifactId": "RR", "role": "measure_source", "expectedType": "Register", "rank": 4 }, { "kind": "cites", "artifactId": "MME", "role": "measure_source", "expectedType": "Register", "rank": 5 }, { "kind": "cites", "artifactId": "CAR", "role": "measure_source", "expectedType": "Register", "rank": 6 }, { "kind": "cites", "artifactId": "IMPL-P", "role": "measure_source", "expectedType": "Register", "rank": 9 }, { "kind": "cites", "artifactId": "IAP", "role": "measure_source", "expectedType": "Plan", "rank": 10 }, { "kind": "cites", "artifactId": "OS", "role": "measure_source", "expectedType": "Statement", "rank": 11 }, { "kind": "cites", "artifactId": "ISS", "role": "measure_source", "expectedType": "Statement", "rank": 12 }, { "kind": "cites", "artifactId": "ISP", "role": "measure_source", "expectedType": "Policy", "rank": 13 }, { "kind": "cites", "artifactId": "RAM", "role": "measure_source", "expectedType": "Methodology", "rank": 14 }, { "kind": "cites", "artifactId": "DCP", "role": "measure_source", "expectedType": "Procedure", "rank": 15 }, { "kind": "cites", "artifactId": "ICP", "role": "measure_source", "expectedType": "Policy", "rank": 16 }, { "kind": "cites", "artifactId": "IRPROC", "role": "measure_source", "expectedType": "Procedure", "rank": 17 }, { "kind": "cites", "artifactId": "MRMT", "role": "measure_source", "expectedType": "Minutes", "rank": 18 }, { "kind": "cites", "artifactId": "NC-RP", "role": "measure_source", "expectedType": "Register", "rank": 19 }, { "kind": "cites", "artifactId": "CIL", "role": "measure_source", "expectedType": "Log", "rank": 7 }, { "kind": "cites", "artifactId": "S1-RDY", "role": "measure_source", "expectedType": "Assessment", "rank": 8 }, { "kind": "cites", "artifactId": "IL", "role": "measure_source", "expectedType": "Log", "rank": 20 }, { "kind": "cites", "artifactId": "SIR", "role": "measure_source", "expectedType": "Register", "rank": 21 } ] }