{ "schemaVersion": "artifactDefinition.v2", "definitionId": "RACI.artifactDefinition.v2", "artifactId": "RACI", "title": "ISMS RACI Matrix", "artifactType": "Matrix", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable matrix maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for assigning ISMS responsibilities and authorities with exactly one accountable role per activity, clear responsible roles, consulted and informed stakeholders, named confirmation and evidence.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use RACI to make ISMS responsibilities explicit, confirmed and auditable before work starts.", "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Each activity must have exactly one Accountable role; multiple Responsible roles are allowed only when work is clearly shared.", "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "raci_matrix", "title": "RACI matrix", "contentType": "matrix_table", "required": true, "minimumExampleRows": 8, "columns": [ { "name": "Process or Activity", "type": "text", "required": "yes", "description": "ISMS process or activity.", "example": "Maintain ISMS scope" }, { "name": "ISO Reference", "type": "text", "required": "yes", "description": "Related ISO clause or control.", "example": "Clause 4.3" }, { "name": "Accountable Role", "type": "text", "required": "yes", "description": "Single accountable role.", "example": "ISMS Manager" }, { "name": "Responsible Role", "type": "text", "required": "yes", "description": "Role or roles doing the work.", "example": "Compliance Lead" }, { "name": "Consulted Roles", "type": "text", "required": "yes", "description": "Roles consulted before decision or execution.", "example": "Legal Counsel" }, { "name": "Informed Roles", "type": "text", "required": "yes", "description": "Roles informed of status or outcome.", "example": "Top Management" }, { "name": "Named Individual or Group", "type": "text", "required": "yes", "description": "Current holder of the assignment.", "example": "ISMS Office" }, { "name": "Backup Owner", "type": "text", "required": "no", "description": "Backup owner for continuity.", "example": "Compliance Lead" }, { "name": "Confirmation Status", "type": "select", "required": "yes", "description": "Confirmed, partially confirmed, confirmed with action open, scheduled or pending.", "example": "Confirmed" }, { "name": "Confirmation Date", "type": "date", "required": "yes", "description": "Date assignment was confirmed or scheduled.", "example": "2026-08-29" }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence for assignment or acknowledgement.", "example": "RACI-REVIEW-2026-Q3" }, { "name": "Change Log Reference", "type": "text", "required": "yes", "description": "Related decision or change log.", "example": "DAL-2026-001" }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional context.", "example": "Cloud admin review pending." } ], "hint": { "text": "Each row should show the activity, one accountable role, practical working ownership and evidence that the assignment was confirmed.", "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities" } }, { "order": 6, "id": "raci_review_decision", "title": "RACI review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Activities reviewed", "type": "text", "required": "yes" }, { "name": "Rows with one accountable role", "type": "text", "required": "yes" }, { "name": "Confirmations pending", "type": "text", "required": "yes" }, { "name": "Open role conflicts", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so missing confirmations and role conflicts become visible before audit.", "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to RACI.artifactDefinition.v2.", "JSON Example matrix sections must contain schemaRef pointing to the matching definition section.", "Each RACI row must have exactly one Accountable Role.", "Rows must include Responsible Role, Confirmation Status, Evidence Reference and Change Log Reference.", "Body must render the contract schema and the example data.", "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 5.3", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-09-02-00", "chapterTitle": "Team, Roles & Responsibilities", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "BCP", "longForm": "Business Continuity Plan" }, { "abbr": "BIA", "longForm": "Business Impact Analysis" }, { "abbr": "CAB", "longForm": "Change Advisory Board" }, { "abbr": "CAPA", "longForm": "Corrective and Preventive Action" }, { "abbr": "CEO", "longForm": "Chief Executive Officer" }, { "abbr": "CHG", "longForm": "Change" }, { "abbr": "COO", "longForm": "Chief Operating Officer" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "ICT", "longForm": "Information and Communications Technology" }, { "abbr": "ISP", "longForm": "Information Security Policy" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "KPI", "longForm": "Key Performance Indicator" }, { "abbr": "MDR", "longForm": "Managed Detection and Response" }, { "abbr": "NC", "longForm": "Nonconformity" }, { "abbr": "RACI", "longForm": "Responsible, Accountable, Consulted, and Informed" }, { "abbr": "RR", "longForm": "Risk Register" }, { "abbr": "RTP", "longForm": "Risk Treatment Plan" }, { "abbr": "SIEM", "longForm": "Security Information and Event Management" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SOC", "longForm": "Security Operations Center" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "raci_matrix", "raci_review_decision" ], "minExampleRows": 8, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.matrix.v1", "contentContractId": "content.matrix.v1" }