{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "ISS.artifactDefinition.v2",
  "artifactId": "ISS",
  "title": "ISMS Scope Statement",
  "artifactType": "Statement",
  "format": "docx",
  "productTier": "Basic",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable template maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "editorialStandard": {
    "purpose": "This statement freezes the ISMS boundary for a software company so an auditor can see what is in, what is out, who approved exclusions and which interfaces carry shared responsibility. It is not the organization statement, not the SoA and not the asset inventory.",
    "requiredEditorialElements": [
      "introduction as purpose prose",
      "scope of this statement versus OS, SoA and asset inventory",
      "terms as a first-class group",
      "ISMS scope statement covering people, processes, technology and suppliers",
      "explicit, justified, approved exclusions",
      "interfaces and change triggers",
      "practical examples, pitfalls, evidence and external references"
    ],
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 4.3",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Determine the ISMS scope as documented information, considering clause 4.1 and 4.2 issues and requirements."
      },
      {
        "label": "ISO/IEC 27001:2022 4.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "External and internal issues that shape the boundary."
      },
      {
        "label": "ISO/IEC 27001:2022 4.2",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Interested-party requirements that the scope must not hide."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-01-00",
        "chapterTitle": "Context of the Organization (Clause 4)",
        "primary": true,
        "role": "Context, interested parties and scope.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "OS",
        "longForm": "Organization Statement"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      },
      {
        "abbr": "API",
        "longForm": "Application Programming Interface"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CR",
        "longForm": "Change Request"
      },
      {
        "abbr": "EV",
        "longForm": "Extended Validation"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "MFA",
        "longForm": "Multi-Factor Authentication"
      },
      {
        "abbr": "RAM",
        "longForm": "Risk Assessment Methodology"
      },
      {
        "abbr": "SSO",
        "longForm": "Single Sign-On"
      }
    ],
    "must": [
      "State the ISMS boundary in prose and make exclusions explicit, justified, approved and reviewable.",
      "Name cloud, identity, CI/CD, support and critical-supplier interfaces when they can affect in-scope CIA.",
      "State the golden thread: this statement → asset inventory, supplier inventory, RAM, SoA and audit plan."
    ],
    "mustNot": [
      "Do not hide a production trust path behind a marketing-site exclusion.",
      "Do not put SoA control selections in this statement.",
      "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)."
    ],
    "softwareCompanyAdaptations": [
      "Treat SaaS production, non-production that can reach production secrets, and evidence stores as in-scope unless an approved exclusion says otherwise.",
      "Use Arcfield as the worked example (cover variant A)."
    ],
    "exampleBody": {
      "sectionId": "scope_content",
      "workedExampleOrg": "Arcfield",
      "minBodyWords": 400,
      "requiredGroups": [
        {
          "id": "introduction",
          "heading": "What this statement is",
          "mustInclude": [
            "ISMS boundary",
            "not OS or SoA"
          ]
        },
        {
          "id": "scope",
          "heading": "Scope",
          "mustInclude": [
            "not OS",
            "not SoA"
          ]
        },
        {
          "id": "terms",
          "heading": "Terms used here",
          "mustInclude": [
            "exclusion",
            "interface"
          ]
        },
        {
          "id": "scope_statement",
          "heading": "ISMS scope statement",
          "mustInclude": [
            "SaaS or production",
            "people, processes, technology"
          ]
        },
        {
          "id": "exclusions",
          "heading": "Exclusions",
          "mustInclude": [
            "explicit",
            "justified",
            "approved"
          ]
        }
      ],
      "requiredSections": [
        {
          "id": "change_log",
          "title": "Revision history",
          "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version."
        },
        {
          "id": "external_references",
          "title": "References",
          "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue."
        }
      ]
    }
  },
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use the scope statement to make the audit boundary explicit before risks, controls and evidence are sampled.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "change_log",
      "title": "Revision history",
      "contentType": "revision_table",
      "required": true
    },
    {
      "order": 5,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Do not treat exclusions as shortcuts; every exclusion needs rationale, approval, review and downstream traceability.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 6,
      "id": "scope_content",
      "title": "Scope",
      "contentType": "scope_sections",
      "required": true,
      "requiredElements": [
        "scope decision principle",
        "management approval",
        "context inputs",
        "interested parties",
        "scope statement",
        "included boundaries",
        "exclusions",
        "interfaces and dependencies",
        "scope change triggers",
        "downstream traceability"
      ],
      "hint": {
        "text": "A good scope statement lets an auditor decide what is in scope without reconstructing the boundary in interviews.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 7,
      "id": "exclusion_approval_matrix",
      "title": "Exclusion approval matrix",
      "contentType": "approval_matrix",
      "required": true,
      "columns": [
        {
          "name": "Exclusion type",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Required approval",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Required evidence",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Review rule",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "An exclusion is a controlled scope decision; approval must match risk, customer impact and shared responsibility.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 10,
      "id": "evidence_and_records",
      "title": "Evidence and records",
      "contentType": "evidence_table",
      "required": true,
      "columns": [
        {
          "name": "Evidence ID",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Record type",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Owner",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Retention / review rule",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Typical issue",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "The scope is audit-ready only when scope decisions, exclusions, changes and trace links can be retrieved.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 11,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true,
      "hint": {
        "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to ISS.artifactDefinition.v2.",
    "Template must include explicit scope applicability, exclusion approval, supplier/shared-responsibility handling and downstream traceability.",
    "Body must include practical examples, common pitfalls and evidence expectations.",
    "No mdDefinition, mdExample, legacy helper sections, standalone Book reference section or generic placeholder dates are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialContractId": "editorial.docx.statement.v1",
  "contentContractId": "content.literary.v1",
  "relations": [
    {
      "kind": "cites",
      "artifactId": "MDR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 1
    },
    {
      "kind": "cites",
      "artifactId": "DR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 2
    },
    {
      "kind": "cites",
      "artifactId": "RRS",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 3
    },
    {
      "kind": "cites",
      "artifactId": "AI",
      "role": "inventory",
      "expectedType": "Inventory",
      "rank": 20
    },
    {
      "kind": "cites",
      "artifactId": "SINV",
      "role": "inventory",
      "expectedType": "Inventory",
      "rank": 21
    },
    {
      "kind": "cites",
      "artifactId": "UAI",
      "role": "inventory",
      "expectedType": "Inventory",
      "rank": 22
    }
  ]
}