{ "schemaVersion": "artifactDefinition.v2", "artifactId": "ONC", "title": "Onboarding Checklist", "artifactType": "Checklist", "format": "docx", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable template/example maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture", "mdDefinition": "generated output", "mdExample": "generated output" }, "purpose": "Provide auditable evidence for Onboarding Checklist.", "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated Office and Markdown outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "controlledValues": { "result": [ "Successful", "Failed", "Pending", "Not applicable" ], "yesNo": [ "Yes", "No" ], "completionStatus": [ "Complete", "Conditionally complete", "Pending", "Rejected" ] }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null, "fields": [ { "name": "Document Title", "type": "text", "required": "yes" }, { "name": "Document ID", "type": "text", "required": "yes" }, { "name": "Version", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Organization", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Classification", "type": "text", "required": "yes" }, { "name": "Effective Date", "type": "date", "required": "yes" }, { "name": "Next Review Date", "type": "date", "required": "yes" } ], "intro": "Use this section to identify the document and its control context." }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use this checklist as the auditable joiner record for every employee, contractor, or long-term external user before productive access is granted.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "requiredContent": "Explain the secure onboarding purpose and the evidence created before access is granted." }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null, "fields": [ { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Used by", "type": "text", "required": "yes" }, { "name": "Maintained by", "type": "text", "required": "yes" }, { "name": "Evidence role", "type": "text", "required": "yes" }, { "name": "ISO reference", "type": "text", "required": "yes" }, { "name": "Review cadence", "type": "text", "required": "yes" } ], "intro": "Record ownership, approval, classification, version, review cadence, and evidence context." }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Treat this section as the operating instruction for the checklist owner. It explains the minimum evidence standard and when onboarding must be blocked.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "requiredContent": "Explain when to use the checklist, who completes it, result values, blocker rules, exception rules, evidence linkage, and completion decision.", "intro": "Explain how to complete, maintain, review, and use this artifact as operational evidence." }, { "order": 6, "id": "employee_data", "title": "Employee data", "contentType": "field_table", "required": true, "hint": { "text": "Capture enough employee context to connect HR records, access requests, training records, and later offboarding without using unnecessary personal data.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "fields": [ { "name": "Employee name", "type": "text", "required": "yes" }, { "name": "Employee ID", "type": "text", "required": "yes" }, { "name": "Start date", "type": "date", "required": "yes" }, { "name": "Employment type", "type": "text", "required": "yes" }, { "name": "Contract end date", "type": "date", "required": "yes" }, { "name": "Work location", "type": "text", "required": "yes" }, { "name": "Department", "type": "text", "required": "yes" }, { "name": "Line manager", "type": "text", "required": "yes" }, { "name": "HR owner", "type": "text", "required": "yes" }, { "name": "Onboarding case reference", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete employee data information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 7, "id": "role_and_organizational_context", "title": "Role and organizational context", "contentType": "field_table", "required": true, "hint": { "text": "Use this section to justify why access is needed and to check whether the role fits the organization and segregation-of-duties model.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "fields": [ { "name": "Job role", "type": "text", "required": "yes" }, { "name": "Team", "type": "text", "required": "yes" }, { "name": "Business unit", "type": "text", "required": "yes" }, { "name": "Reports to", "type": "text", "required": "yes" }, { "name": "Org-chart position", "type": "text", "required": "yes" }, { "name": "Main responsibilities", "type": "text", "required": "yes" }, { "name": "Systems required", "type": "text", "required": "yes" }, { "name": "Privileged access required?", "type": "text", "required": "yes" }, { "name": "Security context", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete role and organizational context information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 8, "id": "pre_employment_and_contractual_checks", "title": "Pre-employment and contractual checks", "contentType": "evidence_table", "required": true, "hint": { "text": "These checks prove that contractual and policy obligations were accepted before access was activated. Screening should be risk-based and jurisdiction-aware.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "Check", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Completed by", "type": "text", "required": "yes" }, { "name": "Date", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete pre-employment and contractual checks information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 9, "id": "access_rights_granted", "title": "Access rights granted", "contentType": "access_table", "required": true, "hint": { "text": "Do not record only that “access was approved”. Record the exact permission profile, justification, approver, activation date, and next review date.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "System / application", "type": "text", "required": "yes" }, { "name": "Permission profile", "type": "text", "required": "yes" }, { "name": "Access type", "type": "text", "required": "yes" }, { "name": "Business justification", "type": "text", "required": "yes" }, { "name": "Requested by", "type": "text", "required": "yes" }, { "name": "Approved by", "type": "text", "required": "yes" }, { "name": "Date granted", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Next review date", "type": "date", "required": "yes" } ], "intro": "Use this section to capture complete access rights granted information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 10, "id": "segregation_of_duties_check", "title": "Segregation of duties check", "contentType": "field_table", "required": true, "hint": { "text": "Use this section when role or access combinations could create excessive privileges, conflicting approval rights, or unreviewed administrative power.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "fields": [ { "name": "Checked by", "type": "text", "required": "yes" }, { "name": "Check date", "type": "date", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Conflicts identified", "type": "text", "required": "yes" }, { "name": "Conflict areas reviewed", "type": "text", "required": "yes" }, { "name": "Mitigation", "type": "text", "required": "yes" }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete segregation of duties check information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 11, "id": "equipment_and_asset_assignment", "title": "Equipment and asset assignment", "contentType": "asset_table", "required": true, "hint": { "text": "Equipment issuance should update the asset inventory and prove that the endpoint baseline, encryption, EDR/MDM, and local-admin status are known.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "Asset / equipment", "type": "text", "required": "yes" }, { "name": "Asset ID", "type": "text", "required": "yes" }, { "name": "Custodian", "type": "text", "required": "yes" }, { "name": "Configuration baseline", "type": "text", "required": "yes" }, { "name": "Encryption", "type": "text", "required": "yes" }, { "name": "EDR / MDM", "type": "text", "required": "yes" }, { "name": "Local admin", "type": "text", "required": "yes" }, { "name": "Issue date", "type": "date", "required": "yes" }, { "name": "Issued by", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete equipment and asset assignment information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 12, "id": "training_and_awareness_record", "title": "Training and awareness record", "contentType": "training_table", "required": true, "hint": { "text": "Training evidence should show completion, result or score, and refresher date. Add role-specific modules when the role handles sensitive data or privileged systems.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "Training module", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Completed by", "type": "text", "required": "yes" }, { "name": "Completion date", "type": "date", "required": "yes" }, { "name": "Result / score", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Refresher due date", "type": "date", "required": "yes" } ], "intro": "Use this section to capture complete training and awareness record information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 13, "id": "privileged_access_assessment", "title": "Privileged access assessment", "contentType": "conditional_field_table", "required": true, "hint": { "text": "If privileged access is required, require explicit system-owner and security approval, MFA, logging, and a shorter review frequency.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "fields": [ { "name": "Privileged access required?", "type": "text", "required": "yes" }, { "name": "Admin role requested", "type": "text", "required": "yes" }, { "name": "Justification", "type": "text", "required": "yes" }, { "name": "System-owner approval", "type": "text", "required": "yes" }, { "name": "Security approval", "type": "text", "required": "yes" }, { "name": "MFA enforced", "type": "text", "required": "yes" }, { "name": "Logging enabled", "type": "text", "required": "yes" }, { "name": "Break-glass excluded?", "type": "text", "required": "yes" }, { "name": "Review frequency", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete privileged access assessment information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 14, "id": "checklist_execution_log", "title": "Checklist execution log", "contentType": "evidence_log_table", "required": true, "hint": { "text": "This is the main audit trail. Each row must show what happened, who did it, who approved it, when it happened, the result, evidence, and notes.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "Check ID", "type": "text", "required": "yes" }, { "name": "Control area", "type": "text", "required": "yes" }, { "name": "What was done", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Performed by", "type": "text", "required": "yes" }, { "name": "Approved by", "type": "text", "required": "yes" }, { "name": "Date", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Use this section to maintain structured checklist execution log records with clear ownership, status, evidence, and review traceability." }, { "order": 15, "id": "open_items_and_exceptions", "title": "Open items and exceptions", "contentType": "exception_table", "required": true, "hint": { "text": "Mandatory failed or pending checks should block productive access unless an approved, time-limited exception with a compensating control exists.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "Item ID", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Due date", "type": "date", "required": "yes" }, { "name": "Blocker?", "type": "text", "required": "yes" }, { "name": "Exception required?", "type": "text", "required": "yes" }, { "name": "Exception approver", "type": "text", "required": "yes" }, { "name": "Expiry date", "type": "date", "required": "yes" }, { "name": "Compensating control", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete open items and exceptions information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 16, "id": "lifecycle_linkage", "title": "Lifecycle linkage", "contentType": "linkage_table", "required": true, "hint": { "text": "Onboarding is only complete when the related HR, access, asset, training, evidence, review, and future offboarding records are connected.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "columns": [ { "name": "Record", "type": "text", "required": "yes" }, { "name": "Reference", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "intro": "Use this section to capture complete lifecycle linkage information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 17, "id": "onboarding_completion_decision", "title": "Onboarding completion decision", "contentType": "decision_table", "required": true, "hint": { "text": "The completion decision should make clear whether onboarding is complete, conditionally complete, pending, or rejected, and why access can or cannot proceed.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" }, "fields": [ { "name": "HR completion", "type": "text", "required": "yes" }, { "name": "Line-manager confirmation", "type": "text", "required": "yes" }, { "name": "System-owner approval", "type": "text", "required": "yes" }, { "name": "ISMS review", "type": "text", "required": "yes" }, { "name": "Open blocker decision", "type": "text", "required": "yes" }, { "name": "Final status", "type": "text", "required": "yes" }, { "name": "Completion date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "Use this section to capture complete onboarding completion decision information, including responsible roles, dates, results, evidence, and notes where applicable." }, { "order": 18, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } } ], "validationRules": [ "Body MD, JSON Definition, and JSON Example must use the same section order and compatible section titles.", "Each section should have an intro that explains the practical purpose of the section before data/content is rendered.", "Every non-formal content section should have a context-specific hint stored in the JSON Definition and rendered as a callout after the section content.", "Do not include a separate Book reference chapter; book linkage belongs inside the section hint.", "Example data must look realistic and audit-ready, but must not contain real personal data.", "JSON Example must contain definitionRef pointing to ONC.artifactDefinition.v2." ], "instructionsForGenerator": [ "Use this JSON Definition as the machine-readable contract.", "Use JSON Example as the curated realistic example data source.", "Use Body MD as the canonical human-readable source.", "Generate MD Definition and MD Example downstream; do not treat them as curated source relations.", "Render section intros before content and section hints as callouts after content." ], "definitionId": "ONC.artifactDefinition.v2", "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this file by version." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-03-02-00", "chapterTitle": "HR Security: Screening, Onboarding & Offboarding", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Provide auditable evidence for Onboarding Checklist.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CISO", "longForm": "Chief Information Security Officer" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IAM", "longForm": "Identity and Access Management" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "NDA", "longForm": "Non-Disclosure Agreement" }, { "abbr": "PAM", "longForm": "Privileged Access Management" }, { "abbr": "SoA", "longForm": "Statement of Applicability" }, { "abbr": "EDR", "longForm": "Endpoint Detection and Response" }, { "abbr": "MDM", "longForm": "Mobile Device Management" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" } ], "must": [ "This file's function is: Provide auditable evidence for Onboarding Checklist. It must not be rewritten as a generic operating-rules essay.", "Identify the checklist owner and the object, process, person, control, or release being reviewed.", "Complete the context and evidence sections before recording the final decision.", "For each check, capture what was done, who performed it, who approved it where applicable, the date, result, evidence reference, and notes.", "Use controlled result values: Successful, Failed, Pending, Not applicable.", "Treat failed or pending mandatory checks as blockers unless an approved, time-limited exception exists.", "Link the checklist outcome to the relevant ISMS register, risk, control, evidence, or lifecycle record." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "employee_data", "workedExampleOrg": "Arcfield", "minBodyWords": 150, "requiredGroups": [ { "id": "introduction", "heading": "What this checklist is", "mustInclude": [ "checklist" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "employee_data", "heading": "Employee data", "mustInclude": [ "Employee", "data" ] }, { "id": "role_and_organizational_context", "heading": "Role and organizational context", "mustInclude": [ "Role", "organizational", "context" ] }, { "id": "pre_employment_and_contractual_checks", "heading": "Pre-employment and contractual checks", "mustInclude": [ "Pre-employment", "contractual", "checks" ] }, { "id": "access_rights_granted", "heading": "Access rights granted", "mustInclude": [ "Access", "rights", "granted" ] }, { "id": "checklist_execution_log", "heading": "Checklist execution log", "mustInclude": [ "Checklist", "execution" ] }, { "id": "onboarding_completion_decision", "heading": "Onboarding completion decision", "mustInclude": [ "Onboarding", "completion", "decision" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.checklist.v1", "contentContractId": "content.checklist.v1" }