{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "RMP.artifactDefinition.v2",
  "artifactId": "RMP",
  "title": "Risk Management Plan",
  "artifactType": "Procedure",
  "format": "docx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable workflow maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example workflow data fixture"
  },
  "purpose": "Define the information security risk management approach, scope, roles, methodology, risk appetite, treatment process, review cadence and reporting model.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use RMP as the operating workflow that connects risk criteria, risk register, treatment plan and SoA decisions.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "change_log",
      "title": "Revision history",
      "contentType": "revision_table",
      "required": true
    },
    {
      "order": 5,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Keep risk workflow evidence-linked: every assessed risk needs owner, treatment decision, residual risk and review evidence.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 6,
      "id": "workflow_schema",
      "title": "Workflow schema",
      "contentType": "workflow_schema",
      "required": true,
      "steps": [
        "Define risk context and criteria",
        "Identify risk scenarios",
        "Assess likelihood and impact",
        "Evaluate risk against appetite",
        "Select treatment option",
        "Approve residual risk",
        "Track treatment evidence",
        "Report and review risk status"
      ],
      "hint": {
        "text": "The schema should show how risks move from identification to treatment, acceptance and reporting.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 7,
      "id": "workflow_steps",
      "title": "Workflow steps",
      "contentType": "workflow_steps",
      "required": true,
      "hint": {
        "text": "Each workflow step should create or update a risk record, treatment record, decision record or reporting input.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 8,
      "id": "roles_and_responsibilities",
      "title": "Roles and responsibilities",
      "contentType": "role_table",
      "required": true,
      "hint": {
        "text": "Separate process ownership from risk ownership so treatment accountability remains clear.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 9,
      "id": "evidence_and_records",
      "title": "Evidence and records",
      "contentType": "evidence_table",
      "required": true,
      "hint": {
        "text": "Risk evidence should prove methodology, assessment, treatment, acceptance and management reporting.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 10,
      "id": "review_and_decision",
      "title": "Review and decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Decision",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Risks reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "High risks",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Treatments overdue",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Residual risks accepted",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Open actions",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so overdue treatments and accepted residual risks are visible to management.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    },
    {
      "order": 11,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true,
      "hint": {
        "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk"
      }
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to RMP.artifactDefinition.v2.",
    "JSON Example workflow sections must contain schemaRef pointing to the matching definition section.",
    "Workflow steps must include step ID, trigger, activity, responsible role, input, output, evidence reference and status.",
    "Risk decisions must include owner, treatment decision, residual risk and review evidence.",
    "Body must render workflow schema, example steps, roles, evidence and review decision.",
    "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 A.5.36",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022 A.8.8",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022 6.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-02-01-00",
        "chapterTitle": "Information Security Policies & Risk Management",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/dp/9789908983448"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "purpose": "Define the information security risk management approach, scope, roles, methodology, risk appetite, treatment process, review cadence and reporting model.",
    "requiredEditorialElements": [
      "introduction as purpose prose",
      "scope of this document versus neighbouring records",
      "terms as a first-class group",
      "worked Arcfield example",
      "practical examples, pitfalls, evidence and external references"
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "RR",
        "longForm": "Risk Register"
      },
      {
        "abbr": "ISO",
        "longForm": "International Organization for Standardization"
      },
      {
        "abbr": "RTP",
        "longForm": "Risk Treatment Plan"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "EV",
        "longForm": "Extended Validation"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "KRI",
        "longForm": "Key Risk Indicator"
      },
      {
        "abbr": "MFA",
        "longForm": "Multi-Factor Authentication"
      },
      {
        "abbr": "RAM",
        "longForm": "Risk Assessment Methodology"
      },
      {
        "abbr": "RAMT",
        "longForm": "Risk Acceptance Minutes"
      },
      {
        "abbr": "SSO",
        "longForm": "Single Sign-On"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      }
    ],
    "must": [
      "This file's function is: Define the information security risk management approach, scope, roles, methodology, risk appetite, treatment process, review cadence and reporting model. It must not be rewritten as a generic operating-rules essay.",
      "Confirm risk context, scope and criteria before each formal risk review.",
      "Identify new and changed risk scenarios from assets, incidents, suppliers, vulnerabilities and obligations.",
      "Assess likelihood and impact using the approved methodology.",
      "Select treatment options and assign treatment owners.",
      "Link treatments to SoA controls and evidence requirements.",
      "Escalate high risks, overdue treatments and residual-risk decisions to management."
    ],
    "mustNot": [
      "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function."
    ],
    "exampleBody": {
      "sectionId": "workflow_steps",
      "workedExampleOrg": "Arcfield",
      "minBodyWords": 400,
      "requiredGroups": [
        {
          "id": "introduction",
          "heading": "What this procedure is",
          "mustInclude": [
            "procedure"
          ]
        },
        {
          "id": "scope",
          "heading": "Scope",
          "mustInclude": [
            "Scope"
          ]
        },
        {
          "id": "terms",
          "heading": "Terms used here",
          "mustInclude": [
            "Terms"
          ]
        },
        {
          "id": "workflow_steps",
          "heading": "Workflow steps",
          "mustInclude": [
            "Workflow",
            "steps"
          ]
        },
        {
          "id": "roles_and_responsibilities",
          "heading": "Roles and responsibilities",
          "mustInclude": [
            "Roles",
            "responsibilities"
          ]
        },
        {
          "id": "review_and_decision",
          "heading": "Review and decision",
          "mustInclude": [
            "Review",
            "decision"
          ]
        }
      ],
      "requiredSections": [
        {
          "id": "change_log",
          "title": "Revision history",
          "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version."
        },
        {
          "id": "external_references",
          "title": "References",
          "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue."
        }
      ]
    }
  },
  "editorialContractId": "editorial.docx.workflow.v1",
  "contentContractId": "content.procedure.v1",
  "relations": [
    {
      "kind": "cites",
      "artifactId": "MDR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 30
    },
    {
      "kind": "cites",
      "artifactId": "DR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 31
    },
    {
      "kind": "cites",
      "artifactId": "RRS",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 32
    }
  ]
}