{ "schemaVersion": "artifactExample.v2", "artifactId": "ONC", "title": "Onboarding Checklist", "definitionRef": { "artifactId": "ONC", "definitionSchemaVersion": "artifactDefinition.v2", "definitionId": "ONC.artifactDefinition.v2", "title": "Onboarding Checklist" }, "organization": "Arcfield", "sections": [ { "id": "title_page", "title": "Title Page", "values": { "Document Title": "Onboarding Checklist", "Document ID": "ONC-CHK-001", "Version": "1.1", "Status": "Approved", "Organization": "Arcfield", "Owner": "HR Manager", "Approver": "ISMS Manager", "Classification": "Internal", "Effective Date": "2026-09-11", "Next Review Date": "2027-09-11" }, "items": [ "Document Title: Onboarding Checklist", "Document ID: ONC-CHK-001", "Version: 1.1", "Status: Approved", "Organization: Arcfield", "Owner: HR Manager", "Approver: ISMS Manager", "Classification: Internal", "Effective Date: 2026-09-11", "Next Review Date: 2027-09-11" ], "contentType": "metadata" }, { "id": "abstract", "title": "Abstract", "text": "This example shows secure onboarding for a Product Operations employee before productive access is granted. It connects HR prerequisites, role context, access approval, asset assignment, training, privileged-access assessment, execution evidence, open items, lifecycle linkage and final completion decision. This checklist tests whether the 11 September 2026 freeze is complete for the surveillance cycle after certificate ARC-ISMS-2025-001.", "contentType": "narrative" }, { "id": "document_control", "title": "Document Control", "contentType": "control_table" }, { "id": "change_log", "title": "Revision history", "groups": [ { "text": "A published change is a new row. Do not edit an approved version in place." }, { "rows": [ { "Version": "1.0", "Date": "2026-08-29", "Change": "Initial Arcfield Platform publication.", "Approved by": "ISMS Manager" }, { "Version": "1.1", "Date": "2026-09-11", "Change": "Approved Arcfield worked example after the 11 September 2026 internal audit.", "Approved by": "ISMS Manager" } ] } ], "contentType": "revision_table" }, { "id": "instructions", "title": "Instructions", "groups": [ { "text": "Copy this file as the controlled Word master for your ISMS. The Arcfield identity fields on the cover are the approved worked example. Complete the steps below when you adopt the file for your organization." }, { "items": [ "Fill the cover identity fields (Organization, Version, Classification, Owner, Approver, Effective Date and Next Review Date) when you adopt this file. The Arcfield values shown here are the approved worked example.", "Issue your own version and a new Revision history row. Do not edit an approved version in place.", "Cite this approved version from related records. Do not copy this file into those records." ] } ], "contentType": "ordered_list" }, { "id": "employee_data", "title": "Employee data", "values": { "Employee name": "Alex Morgan", "Employee ID": "EMP-2026-047", "Start date": "2026-09-01", "Employment type": "Permanent", "Contract end date": "Not applicable", "Work location": "Madrid / hybrid", "Department": "Product Operations", "Line manager": "Head of Product Operations", "HR owner": "HR Manager", "Onboarding case reference": "HR-ONB-2026-023" }, "text": "Record the minimum employee and onboarding case information needed to link HR, access, asset, training, and evidence records.", "groups": [ { "id": "introduction", "heading": "What this checklist is", "level": 1, "text": "This document is Arcfield's Onboarding Checklist. Provide auditable evidence for Onboarding Checklist. It is not a methodology essay or the governing policy. This checklist applies to the Arcfield Platform (B2B SaaS for regulated fintech and health customers): production, customer data, CI/CD, privileged access and critical suppliers. Neighbouring records (TRC, ISO, ISS) cite this Document Control version. Do not copy these paragraphs into them." }, { "id": "scope", "heading": "Scope", "level": 1, "text": "Use this table before you copy a rule into another record or exclude a duty from this file.", "rows": [ { "In this file": "The rules, roles, worked Arcfield example and the records this file owns.", "Not in this file": "The ISMS boundary (ISS), Annex A selection (SoA) or live rows in TRC, ISO, ISS." }, { "In this file": "Interfaces that must cite this Document Control version, including CI/CD, identity and suppliers where they affect CIA.", "Not in this file": "Live ISS scope rows, SoA applicability decisions, or neighbouring live registers. Those files keep their own approved versions; this file does not duplicate them." } ] }, { "id": "terms", "heading": "Terms used here", "level": 1, "text": "These terms are local to this file. Expand every acronym on first use in the body.", "rows": [ { "Term": "Check ID", "Meaning": "The stable identifier for one check or question. Do not reuse an ID for a different question." }, { "Term": "Exception", "Meaning": "A time-bound, approved departure with expiry and a compensating control." }, { "Term": "CIA", "Meaning": "Confidentiality, Integrity and Availability of in-scope information and services." }, { "Term": "Document Control version", "Meaning": "The approved version cited from neighbouring records. Do not copy this body into those records." } ] }, { "id": "employee_data", "heading": "Employee data", "level": 1, "text": "Use this table for employee data in the Arcfield Platform ISMS. Record the minimum employee and onboarding case information needed to link HR, access, asset, training, and evidence records. Field Value Employee name Alex Morgan Employee ID EMP-2026-047 Start date 2026-09-01 Employment type Permanent Contract end date Not applicable Work location Madrid / hybrid Department Product Operations Line manager Head of Product Operations HR owner HR Manager Onboarding case reference HR-ONB-2026-023 Cite this Document Control version from neighbouring records.", "rows": [ { "Field": "Employee name", "Value": "Alex Morgan" }, { "Field": "Employee ID", "Value": "EMP-2026-047" }, { "Field": "Start date", "Value": "2026-09-01" }, { "Field": "Employment type", "Value": "Permanent" }, { "Field": "Contract end date", "Value": "Not applicable" }, { "Field": "Work location", "Value": "Madrid / hybrid" }, { "Field": "Department", "Value": "Product Operations" }, { "Field": "Line manager", "Value": "Head of Product Operations" }, { "Field": "HR owner", "Value": "HR Manager" }, { "Field": "Onboarding case reference", "Value": "HR-ONB-2026-023" } ] }, { "id": "role_and_organizational_context", "heading": "Role and organizational context", "level": 1, "text": "Use this table for role and organizational context in the Arcfield Platform ISMS. Describe the person’s role, reporting line, organization placement, and security context before access is requested. Field Value Job role Product Operations Specialist Team Product Operations Business unit SaaS Platform Reports to Head of Product Operations Org-chart position Operations / Product Operations Main responsibilities Customer onboarding workflow administration Systems required Customer Portal, Ticketing Platform, Knowledge Base Privileged access required? No Security context Handles confidential customer operational data Cite this Document Control version from neighbouring records.", "rows": [ { "Field": "Job role", "Value": "Product Operations Specialist" }, { "Field": "Team", "Value": "Product Operations" }, { "Field": "Business unit", "Value": "SaaS Platform" }, { "Field": "Reports to", "Value": "Head of Product Operations" }, { "Field": "Org-chart position", "Value": "Operations / Product Operations" }, { "Field": "Main responsibilities", "Value": "Customer onboarding workflow administration" }, { "Field": "Systems required", "Value": "Customer Portal, Ticketing Platform, Knowledge Base" }, { "Field": "Privileged access required?", "Value": "No" }, { "Field": "Security context", "Value": "Handles confidential customer operational data" } ] }, { "id": "pre_employment_and_contractual_checks", "heading": "Pre-employment and contractual checks", "level": 1, "text": "Use this table for pre-employment and contractual checks in the Arcfield Platform ISMS. Document mandatory employment, confidentiality, screening, policy acknowledgement, and privacy obligations before access activation. Check Required? Completed by Date Result Evidence reference Notes Employment agreement signed Yes HR Manager 2026-08-20 Successful HR-ONB-2026-023 Signed contract stored in HR file. Confidentiality obligation accepted Yes HR Manager 2026-08-20 Successful NDA-2026-047 NDA accepted before account creation. Information Security Policy acknowledged Yes Alex Morgan 2026-08-29 Successful POL-ACK-2026-188 Acknowledgement recorded. Cite this Document Control version from neighbouring records.", "rows": [ { "Check": "Employment agreement signed", "Required?": "Yes", "Completed by": "HR Manager", "Date": "2026-08-20", "Result": "Successful", "Evidence reference": "HR-ONB-2026-023", "Notes": "Signed contract stored in HR file." }, { "Check": "Confidentiality obligation accepted", "Required?": "Yes", "Completed by": "HR Manager", "Date": "2026-08-20", "Result": "Successful", "Evidence reference": "NDA-2026-047", "Notes": "NDA accepted before account creation." }, { "Check": "Information Security Policy acknowledged", "Required?": "Yes", "Completed by": "Alex Morgan", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "POL-ACK-2026-188", "Notes": "Acknowledgement recorded." } ] }, { "id": "access_rights_granted", "heading": "Access rights granted", "level": 1, "text": "Use this table for access rights granted in the Arcfield Platform ISMS. List every system or application access right granted during onboarding, including justification, approver, evidence, and next review date. System / application Permission profile Access type Business justification Requested by Approved by Date granted Result Evidence reference Next review date Customer Portal Product Operations standard Read/write Manage onboarding workflow cases Line Manager Product Systems Owner 2026-09-01 Successful IAM-APP-2026-441 2026-12-01 Ticketing Platform Operations agent Read/write Handle customer onboarding tasks Line Manager IT Operations 2026-09-01 Successful IAM-APP-2026-442 2026-12-01 Cite this Document Control version from neighbouring records.", "rows": [ { "System / application": "Customer Portal", "Permission profile": "Product Operations standard", "Access type": "Read/write", "Business justification": "Manage onboarding workflow cases", "Requested by": "Line Manager", "Approved by": "Product Systems Owner", "Date granted": "2026-09-01", "Result": "Successful", "Evidence reference": "IAM-APP-2026-441", "Next review date": "2026-12-01" }, { "System / application": "Ticketing Platform", "Permission profile": "Operations agent", "Access type": "Read/write", "Business justification": "Handle customer onboarding tasks", "Requested by": "Line Manager", "Approved by": "IT Operations", "Date granted": "2026-09-01", "Result": "Successful", "Evidence reference": "IAM-APP-2026-442", "Next review date": "2026-12-01" } ] }, { "id": "checklist_execution_log", "heading": "Checklist execution log", "level": 1, "text": "Use this table for checklist execution log in the Arcfield Platform ISMS. Use this log as the main onboarding audit trail for completed checks, owners, dates, results, evidence, and notes. Check ID Control area What was done Required? Performed by Approved by Date Result Evidence reference Notes ONB-001 HR prerequisites Validated employment agreement, NDA and policy acknowledgement Yes HR Manager Line Manager 2026-08-29 Successful HR-ONB-2026-023 All prerequisites complete. ONB-002 Access provisioning Provisioned Customer Portal and ticketing access Yes IT Operations Product Systems Owner 2026-09-01 Successful IAM-REQ-2026-441 No privileged access granted. Cite this Document Control version from neighbouring records.", "rows": [ { "Check ID": "ONB-001", "Control area": "HR prerequisites", "What was done": "Validated employment agreement, NDA and policy acknowledgement", "Required?": "Yes", "Performed by": "HR Manager", "Approved by": "Line Manager", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "HR-ONB-2026-023", "Notes": "All prerequisites complete." }, { "Check ID": "ONB-002", "Control area": "Access provisioning", "What was done": "Provisioned Customer Portal and ticketing access", "Required?": "Yes", "Performed by": "IT Operations", "Approved by": "Product Systems Owner", "Date": "2026-09-01", "Result": "Successful", "Evidence reference": "IAM-REQ-2026-441", "Notes": "No privileged access granted." } ] }, { "id": "onboarding_completion_decision", "heading": "Onboarding completion decision", "level": 1, "text": "Use this table for onboarding completion decision in the Arcfield Platform ISMS. State the final onboarding decision and explain whether access may proceed without unresolved blockers. Field Value HR completion Complete Line-manager confirmation Confirmed System-owner approval Approved for standard access ISMS review No blocker identified Open blocker decision No blockers remain Final status Complete Completion date 2026-09-01 Evidence reference EVID-ONC-2026-211 Cite this Document Control version from neighbouring records.", "rows": [ { "Field": "HR completion", "Value": "Complete" }, { "Field": "Line-manager confirmation", "Value": "Confirmed" }, { "Field": "System-owner approval", "Value": "Approved for standard access" }, { "Field": "ISMS review", "Value": "No blocker identified" }, { "Field": "Open blocker decision", "Value": "No blockers remain" }, { "Field": "Final status", "Value": "Complete" }, { "Field": "Completion date", "Value": "2026-09-01" }, { "Field": "Evidence reference", "Value": "EVID-ONC-2026-211" } ] } ], "contentType": "field_table" }, { "id": "role_and_organizational_context", "title": "Role and organizational context", "values": { "Job role": "Product Operations Specialist", "Team": "Product Operations", "Business unit": "SaaS Platform", "Reports to": "Head of Product Operations", "Org-chart position": "Operations / Product Operations", "Main responsibilities": "Customer onboarding workflow administration", "Systems required": "Customer Portal; Ticketing Platform; Knowledge Base", "Privileged access required?": "No", "Security context": "Handles confidential customer operational data" }, "rows": [ { "Field": "Job role", "Value": "Product Operations Specialist" }, { "Field": "Team", "Value": "Product Operations" }, { "Field": "Business unit", "Value": "SaaS Platform" }, { "Field": "Reports to", "Value": "Head of Product Operations" }, { "Field": "Org-chart position", "Value": "Operations / Product Operations" }, { "Field": "Main responsibilities", "Value": "Customer onboarding workflow administration" }, { "Field": "Systems required", "Value": "Customer Portal, Ticketing Platform, Knowledge Base" }, { "Field": "Privileged access required?", "Value": "No" }, { "Field": "Security context", "Value": "Handles confidential customer operational data" } ], "text": "Describe the person’s role, reporting line, organization placement, and security context before access is requested.", "contentType": "field_table" }, { "id": "pre_employment_and_contractual_checks", "title": "Pre-employment and contractual checks", "rows": [ { "Check": "Employment agreement signed", "Required?": "Yes", "Completed by": "HR Manager", "Date": "2026-08-20", "Result": "Successful", "Evidence reference": "HR-ONB-2026-023", "Notes": "Signed contract stored in HR file." }, { "Check": "Confidentiality obligation accepted", "Required?": "Yes", "Completed by": "HR Manager", "Date": "2026-08-20", "Result": "Successful", "Evidence reference": "NDA-2026-047", "Notes": "NDA accepted before account creation." }, { "Check": "Information Security Policy acknowledged", "Required?": "Yes", "Completed by": "Alex Morgan", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "POL-ACK-2026-188", "Notes": "Acknowledgement recorded." } ], "text": "Document mandatory employment, confidentiality, screening, policy acknowledgement, and privacy obligations before access activation.", "contentType": "evidence_table" }, { "id": "access_rights_granted", "title": "Access rights granted", "rows": [ { "System / application": "Customer Portal", "Permission profile": "Product Operations standard", "Access type": "Read/write", "Business justification": "Manage onboarding workflow cases", "Requested by": "Line Manager", "Approved by": "Product Systems Owner", "Date granted": "2026-09-01", "Result": "Successful", "Evidence reference": "IAM-APP-2026-441", "Next review date": "2026-12-01" }, { "System / application": "Ticketing Platform", "Permission profile": "Operations agent", "Access type": "Read/write", "Business justification": "Handle customer onboarding tasks", "Requested by": "Line Manager", "Approved by": "IT Operations", "Date granted": "2026-09-01", "Result": "Successful", "Evidence reference": "IAM-APP-2026-442", "Next review date": "2026-12-01" } ], "text": "List every system or application access right granted during onboarding, including justification, approver, evidence, and next review date.", "contentType": "access_table" }, { "id": "segregation_of_duties_check", "title": "Segregation of duties check", "values": { "Checked by": "ISMS Manager", "Check date": "2026-08-29", "Result": "Successful", "Conflicts identified": "None", "Conflict areas reviewed": "Customer Portal approval rights and ticket closure rights", "Mitigation": "No privileged or approval role granted", "Approver": "Product Systems Owner", "Evidence reference": "SOD-ONC-2026-047" }, "contentType": "field_table" }, { "id": "equipment_and_asset_assignment", "title": "Equipment and asset assignment", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Asset / equipment": "Managed laptop", "Asset ID": "LAP-047", "Custodian": "Alex Morgan", "Configuration baseline": "Arcfield macOS secure baseline", "Encryption": "Enabled", "EDR / MDM": "Enabled", "Local admin": "No", "Issue date": "2026-08-30", "Issued by": "IT Operations", "Result": "Successful", "Evidence reference": "ASSET-ISSUE-2026-047" } ] } ], "contentType": "asset_table" }, { "id": "training_and_awareness_record", "title": "Training and awareness record", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Training module": "Information Security Awareness", "Required?": "Yes", "Completed by": "Alex Morgan", "Completion date": "2026-08-29", "Result / score": "92%", "Evidence reference": "TRC-2026-047-SEC", "Refresher due date": "2027-08-29" }, { "Training module": "Customer Data Handling", "Required?": "Yes", "Completed by": "Alex Morgan", "Completion date": "2026-08-30", "Result / score": "Passed", "Evidence reference": "TRC-2026-047-DATA", "Refresher due date": "2027-08-30" } ] } ], "contentType": "training_table" }, { "id": "privileged_access_assessment", "title": "Privileged access assessment", "values": { "Privileged access required?": "No", "Admin role requested": "None", "Justification": "Standard operational role only", "System-owner approval": "Not applicable", "Security approval": "Not applicable", "MFA enforced": "Yes", "Logging enabled": "Yes", "Break-glass excluded?": "Yes", "Review frequency": "Quarterly standard access review", "Evidence reference": "PAM-ASSESS-ONC-2026-047" }, "contentType": "conditional_field_table" }, { "id": "checklist_execution_log", "title": "Checklist execution log", "rows": [ { "Check ID": "ONB-001", "Control area": "HR prerequisites", "What was done": "Validated employment agreement, NDA and policy acknowledgement", "Required?": "Yes", "Performed by": "HR Manager", "Approved by": "Line Manager", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "HR-ONB-2026-023", "Notes": "All prerequisites complete." }, { "Check ID": "ONB-002", "Control area": "Access provisioning", "What was done": "Provisioned Customer Portal and ticketing access", "Required?": "Yes", "Performed by": "IT Operations", "Approved by": "Product Systems Owner", "Date": "2026-09-01", "Result": "Successful", "Evidence reference": "IAM-REQ-2026-441", "Notes": "No privileged access granted." } ], "text": "Use this log as the main onboarding audit trail for completed checks, owners, dates, results, evidence, and notes.", "contentType": "evidence_log_table" }, { "id": "open_items_and_exceptions", "title": "Open items and exceptions", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Item ID": "ONC-OPEN-001", "Description": "Knowledge Base role to be confirmed after first week", "Owner": "Line Manager", "Due date": "2026-09-08", "Blocker?": "No", "Exception required?": "No", "Exception approver": "", "Expiry date": "", "Compensating control": "Access limited to standard read role until confirmation", "Status": "Open follow-up", "Notes": "Non-blocking post-start validation." } ] } ], "contentType": "exception_table" }, { "id": "lifecycle_linkage", "title": "Lifecycle linkage", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Record": "HR onboarding case", "Reference": "HR-ONB-2026-023", "Owner": "HR Manager", "Status": "Complete" }, { "Record": "Access request", "Reference": "IAM-REQ-2026-441", "Owner": "IT Operations", "Status": "Complete" }, { "Record": "Asset Inventory", "Reference": "ASSET-ISSUE-2026-047", "Owner": "Asset Manager", "Status": "Updated" } ] } ], "contentType": "linkage_table" }, { "id": "onboarding_completion_decision", "title": "Onboarding completion decision", "values": { "HR completion": "Complete", "Line-manager confirmation": "Confirmed", "System-owner approval": "Approved for standard access", "ISMS review": "No blocker identified", "Open blocker decision": "No blockers remain; one non-blocking role confirmation follow-up is tracked.", "Final status": "Conditionally complete", "Completion date": "2026-09-01", "Evidence reference": "EVID-ONC-2026-211" }, "rows": [ { "Field": "HR completion", "Value": "Complete" }, { "Field": "Line-manager confirmation", "Value": "Confirmed" }, { "Field": "System-owner approval", "Value": "Approved for standard access" }, { "Field": "ISMS review", "Value": "No blocker identified" }, { "Field": "Open blocker decision", "Value": "No blockers remain" }, { "Field": "Final status", "Value": "Complete" }, { "Field": "Completion date", "Value": "2026-09-01" }, { "Field": "Evidence reference", "Value": "EVID-ONC-2026-211" } ], "text": "State the final onboarding decision and explain whether access may proceed without unresolved blockers.", "contentType": "decision_table" }, { "id": "external_references", "title": "References", "groups": [ { "text": "Cite these sources from workshops and audits. This list names ISO clauses, book chapters and companion artifacts used by this file." }, { "rows": [ { "Kind": "ISO", "Reference": "ISO/IEC 27001:2022", "How this document uses it": "Normative ISMS requirements this companion artifact supports.", "href": "https://www.iso.org/standard/82875.html" }, { "Kind": "Book", "Reference": "Building the ISMS, HR Security: Screening, Onboarding & Offboarding", "How this document uses it": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "TRC Training Records (Building the ISMS, Security Awareness & Training Programs)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" } ], "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." } ], "contentType": "reference_table" } ], "enrichment": { "source": "Example.json", "method": "curated-json", "note": "Completes Example JSON with renderer-native sections and generalized groups; no mdSource helper fields." }, "snapshotRef": { "snapshotId": "arcfield.platform.surv.2026-09-11", "schemaVersion": "evidenceSnapshot.v1" }, "scenarioRef": { "githubIssue": 64, "crId": "CR-TYPE-ARCFIELD-001", "family": "Checklist", "role": "Completeness check against the freeze" } }