{ "schemaVersion": "artifactDefinition.v2", "definitionId": "OFC.artifactDefinition.v2", "artifactId": "OFC", "title": "Offboarding Checklist", "artifactType": "Checklist", "format": "docx", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable template/example maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture", "mdDefinition": "generated output", "mdExample": "generated output" }, "purpose": "Provide auditable evidence for Offboarding Checklist.", "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated Office and Markdown outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint. Hints must not be generic or mechanically repeated.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "controlledValues": { "result": [ "Successful", "Failed", "Pending", "Not applicable" ], "yesNo": [ "Yes", "No" ], "completionStatus": [ "Complete", "Conditionally complete", "Pending", "Rejected" ], "priority": [ "Critical", "High", "Medium", "Low" ], "evidenceQuality": [ "Complete", "Partial", "Missing", "Not applicable" ] }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null, "fields": [ { "name": "Document Title", "type": "text", "required": "yes" }, { "name": "Document ID", "type": "text", "required": "yes" }, { "name": "Version", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Organization", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Classification", "type": "text", "required": "yes" }, { "name": "Effective Date", "type": "date", "required": "yes" }, { "name": "Next Review Date", "type": "date", "required": "yes" } ], "intro": "Use this section to identify the document and its control context." }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "requiredContent": "Explain the purpose of the Offboarding Checklist and the evidence it creates for ISO 27001 implementation and audit readiness.", "hint": { "text": "Use this checklist as an auditable control record. It should show context, checks performed, evidence reviewed, open items, and final decision for Offboarding Checklist.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null, "fields": [ { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Used by", "type": "text", "required": "yes" }, { "name": "Maintained by", "type": "text", "required": "yes" }, { "name": "Evidence role", "type": "text", "required": "yes" }, { "name": "ISO reference", "type": "text", "required": "yes" }, { "name": "Review cadence", "type": "text", "required": "yes" } ], "intro": "Record ownership, approval, classification, version, review cadence, and evidence context." }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "requiredContent": "1. Identify the owner responsible for maintaining this checklist.\n2. Complete the context section before starting the checks.\n3. Record every check with owner, date, result, evidence, and notes.\n4. Escalate failed or pending mandatory checks as blockers unless an approved exception exists.\n5. Sign off only after evidence, open items, lifecycle links, and completion decision are reviewed.", "intro": "Explain how to complete, maintain, review, and use this checklist as operational evidence.", "hint": { "text": "Treat this section as the operating instruction for the checklist owner. It defines the evidence standard and when Offboarding Checklist cannot be closed.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 6, "id": "leaver_data", "title": "Leaver data", "contentType": "field_table", "required": true, "fields": [ { "name": "Employee name", "type": "text", "required": "yes" }, { "name": "Employee ID", "type": "text", "required": "yes" }, { "name": "End date", "type": "date", "required": "yes" }, { "name": "Employment type", "type": "text", "required": "yes" }, { "name": "Department", "type": "text", "required": "yes" }, { "name": "Line manager", "type": "text", "required": "yes" }, { "name": "HR owner", "type": "text", "required": "yes" }, { "name": "Offboarding case reference", "type": "text", "required": "yes" }, { "name": "Last working day", "type": "text", "required": "yes" }, { "name": "Termination reason category", "type": "text", "required": "yes" } ], "intro": "Record the minimum leaver and case information needed to connect HR, access, asset, knowledge transfer, and evidence records.", "hint": { "text": "Capture enough context to prove that the leaver was identified correctly and that offboarding actions cover all relevant responsibilities and access paths.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 7, "id": "termination_context", "title": "Termination and role context", "contentType": "field_table", "required": true, "fields": [ { "name": "Role", "type": "text", "required": "yes" }, { "name": "Team", "type": "text", "required": "yes" }, { "name": "Business unit", "type": "text", "required": "yes" }, { "name": "Reports to", "type": "text", "required": "yes" }, { "name": "Critical responsibilities", "type": "text", "required": "yes" }, { "name": "Sensitive duties", "type": "text", "required": "yes" }, { "name": "Customer or supplier contacts", "type": "text", "required": "yes" }, { "name": "Privileged access held?", "type": "text", "required": "yes" }, { "name": "Security context", "type": "text", "required": "yes" } ], "intro": "Document the role, responsibilities, and security context that drive offboarding scope and urgency.", "hint": { "text": "Use this section to identify high-risk departures, privileged users, knowledge-transfer needs, and access that must be revoked quickly.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 8, "id": "access_revocation", "title": "Access revocation", "contentType": "access_table", "required": true, "columns": [ { "name": "System / application", "type": "text", "required": "yes" }, { "name": "Account / identity", "type": "text", "required": "yes" }, { "name": "Access type", "type": "text", "required": "yes" }, { "name": "Revocation action", "type": "text", "required": "yes" }, { "name": "Performed by", "type": "text", "required": "yes" }, { "name": "Approved by", "type": "text", "required": "yes" }, { "name": "Revocation date", "type": "date", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "List every logical access right that must be disabled, removed, transferred, or reviewed during offboarding.", "hint": { "text": "Do not record only that access was removed. Capture each system, account, revocation action, responsible person, date, result, evidence, and any residual risk.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 9, "id": "asset_return", "title": "Asset return and media handling", "contentType": "asset_table", "required": true, "columns": [ { "name": "Asset / equipment", "type": "text", "required": "yes" }, { "name": "Asset ID", "type": "text", "required": "yes" }, { "name": "Custodian", "type": "text", "required": "yes" }, { "name": "Return required?", "type": "text", "required": "yes" }, { "name": "Return date", "type": "date", "required": "yes" }, { "name": "Condition", "type": "text", "required": "yes" }, { "name": "Wipe / reset performed", "type": "text", "required": "yes" }, { "name": "Performed by", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Track return, reassignment, sanitization, or approved exception for equipment, media, badges, and other company assets.", "hint": { "text": "Connect this section to the asset inventory and make unresolved returns visible as blockers or approved exceptions.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 10, "id": "knowledge_transfer", "title": "Knowledge and ownership transfer", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Responsibility / record", "type": "text", "required": "yes" }, { "name": "Transfer action", "type": "text", "required": "yes" }, { "name": "New owner", "type": "text", "required": "yes" }, { "name": "Due date", "type": "date", "required": "yes" }, { "name": "Completed by", "type": "text", "required": "yes" }, { "name": "Completion date", "type": "date", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Record ownership transfer for processes, documents, risks, suppliers, tickets, repositories, and other business responsibilities.", "hint": { "text": "Offboarding is not complete if critical knowledge, records, or process ownership remains with the leaver without a replacement owner.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 11, "id": "checklist_execution_log", "title": "Checklist execution log", "contentType": "evidence_log_table", "required": true, "columns": [ { "name": "Check ID", "type": "text", "required": "yes" }, { "name": "Control area", "type": "text", "required": "yes" }, { "name": "What was done", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Performed by", "type": "text", "required": "yes" }, { "name": "Approved by", "type": "text", "required": "yes" }, { "name": "Date", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Use this log as the main offboarding audit trail for completed checks, owners, dates, results, evidence, and notes.", "hint": { "text": "This is the main audit trail. Each row must show what happened, who did it, who approved it, when it happened, the result, evidence, and notes.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 12, "id": "open_items_and_exceptions", "title": "Open items and exceptions", "contentType": "exception_table", "required": true, "columns": [ { "name": "Item ID", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Due date", "type": "date", "required": "yes" }, { "name": "Blocker?", "type": "text", "required": "yes" }, { "name": "Exception required?", "type": "text", "required": "yes" }, { "name": "Exception approver", "type": "text", "required": "yes" }, { "name": "Expiry date", "type": "date", "required": "yes" }, { "name": "Compensating control", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Track incomplete actions, blockers, approved exceptions, compensating controls, and expiry dates.", "hint": { "text": "Mandatory pending revocations, unreturned assets, or unresolved privileged access should block closure unless an approved, time-limited exception exists.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 13, "id": "lifecycle_linkage", "title": "Lifecycle linkage", "contentType": "linkage_table", "required": true, "columns": [ { "name": "Record", "type": "text", "required": "yes" }, { "name": "Reference", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "intro": "Link offboarding to HR, IAM, asset, supplier, evidence, access-review, and retention records.", "hint": { "text": "Offboarding is complete only when related lifecycle records are updated and future evidence or retention obligations remain traceable.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 14, "id": "offboarding_completion_decision", "title": "Offboarding completion decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "HR completion", "type": "text", "required": "yes" }, { "name": "Line-manager confirmation", "type": "text", "required": "yes" }, { "name": "IT confirmation", "type": "text", "required": "yes" }, { "name": "Security review", "type": "text", "required": "yes" }, { "name": "Open blocker decision", "type": "text", "required": "yes" }, { "name": "Final status", "type": "text", "required": "yes" }, { "name": "Completion date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "State the final offboarding decision and explain whether the case can be closed without unresolved blockers.", "hint": { "text": "The completion decision should clearly state whether offboarding is complete, conditionally complete, pending, or rejected and why closure can or cannot proceed.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 15, "id": "validation_checklist", "title": "Validation checklist", "contentType": "section", "required": true, "hint": { "text": "Recovered during enrichment.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 16, "id": "evidence_reviewed", "title": "Evidence reviewed", "contentType": "section", "required": true, "hint": { "text": "Recovered during enrichment.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 17, "id": "validation_decision", "title": "Validation decision", "contentType": "section", "required": true, "hint": { "text": "Recovered during enrichment.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } }, { "order": 18, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)" } } ], "validationRules": [ "Body MD, JSON Definition, and JSON Example must use the same section order and compatible section titles.", "Each section must have an intro that explains the practical purpose of the section before data/content is rendered.", "Every non-formal content section must have a context-specific hint stored in the JSON Definition and rendered as a callout after the section content.", "Checklist sections must capture what was done, who performed it, when it was done, the result, evidence reference, and notes where applicable.", "Do not include a separate Book reference chapter; book linkage belongs inside the section hint.", "Example data must look realistic and audit-ready, but must not contain real personal data.", "JSON Example must contain definitionRef pointing to OFC.artifactDefinition.v2." ], "instructionsForGenerator": [ "Use this JSON Definition as the machine-readable contract.", "Use JSON Example as the curated realistic example data source.", "Use Body MD as the canonical human-readable source.", "Generate MD Definition and MD Example downstream; do not treat them as curated source relations.", "Render section intros before content and section hints as callouts after content." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this file by version." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-03-02-00", "chapterTitle": "HR Security: Screening, Onboarding & Offboarding", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Provide auditable evidence for Offboarding Checklist.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CISO", "longForm": "Chief Information Security Officer" }, { "abbr": "CRM", "longForm": "Customer Relationship Management" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IAM", "longForm": "Identity and Access Management" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MDM", "longForm": "Mobile Device Management" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "This file's function is: Provide auditable evidence for Offboarding Checklist. It must not be rewritten as a generic operating-rules essay.", "Identify the checklist owner and the object, process, person, control, or release being reviewed.", "Complete the context and evidence sections before recording the final decision.", "For each check, capture what was done, who performed it, who approved it where applicable, the date, result, evidence reference, and notes.", "Use controlled result values: Successful, Failed, Pending, Not applicable.", "Treat failed or pending mandatory checks as blockers unless an approved, time-limited exception exists.", "Link the checklist outcome to the relevant ISMS register, risk, control, evidence, or lifecycle record." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "leaver_data", "workedExampleOrg": "Arcfield", "minBodyWords": 150, "requiredGroups": [ { "id": "introduction", "heading": "What this checklist is", "mustInclude": [ "checklist" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "leaver_data", "heading": "Leaver data", "mustInclude": [ "Leaver", "data" ] }, { "id": "validation_checklist", "heading": "Validation checklist", "mustInclude": [ "Validation", "checklist" ] }, { "id": "evidence_reviewed", "heading": "Evidence reviewed", "mustInclude": [ "Evidence", "reviewed" ] }, { "id": "validation_decision", "heading": "Validation decision", "mustInclude": [ "Validation", "decision" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.checklist.v1", "contentContractId": "content.checklist.v1" }