{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "MME.artifactDefinition.v2",
  "artifactId": "MME",
  "title": "Monitoring and Measurement Evidence",
  "artifactType": "Register",
  "format": "xlsx",
  "productTier": "Basic",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for tracking ISMS monitoring and measurement evidence, including metrics, targets, actual results, owners, review cadence, evidence references and follow-up actions.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use MME to prove that the ISMS is monitored, measured and reviewed using defined evidence.",
        "bookReference": "Volume 1, S-00-06-00 Performance, Monitoring & Audit (Clau"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Record what is measured, why it matters, what target applies and what action is taken when performance is weak.",
        "bookReference": "Volume 1, S-00-06-00 Performance, Monitoring & Audit (Clau"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "monitoring_measurement_register",
      "title": "Monitoring and measurement register",
      "contentType": "register_table",
      "required": true,
      "minimumExampleRows": 6,
      "columns": [
        {
          "name": "Metric ID",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Metric",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Related Objective or Control",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Measurement Method",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Target",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Actual Result",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Period",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Owner",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Evidence Source",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Review Frequency",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Status",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.status.generic",
          "options": [
            "Draft",
            "In Progress",
            "Under Review",
            "Approved",
            "Closed",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Follow-up Action",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Evidence Reference",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Each row should connect a metric to a target, actual result, owner, evidence source and follow-up action.",
        "bookReference": "Volume 1, S-00-06-00 Performance, Monitoring & Audit (Clau"
      }
    },
    {
      "order": 6,
      "id": "monitoring_review_decision",
      "title": "Monitoring review decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Metrics reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Metrics on target",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Metrics below target",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Actions opened",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so performance results drive corrective action and management review.",
        "bookReference": "Volume 1, S-00-06-00 Performance, Monitoring & Audit (Clau"
      }
    },
    {
      "order": 7,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to MME.artifactDefinition.v2.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "Rows must include metric, related objective or control, method, target, actual result, owner, evidence source and status.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 9.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-06-00",
        "chapterTitle": "Performance, Monitoring & Audit (Clau",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/dp/9789908983448"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 2,
        "volumeTitle": "Implementation & Certification",
        "chapterId": "S-07-06-00",
        "chapterTitle": "Monitoring, Measurement & Performance Metrics",
        "primary": false,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "HR",
        "longForm": "Human Resources"
      },
      {
        "abbr": "IL",
        "longForm": "Impact Level"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "RTP",
        "longForm": "Risk Treatment Plan"
      },
      {
        "abbr": "SLA",
        "longForm": "Service Level Agreement"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "monitoring_measurement_register",
        "monitoring_review_decision"
      ],
      "minExampleRows": 6,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.items.v1"
}