{ "schemaVersion": "artifactDefinition.v2", "definitionId": "RR.artifactDefinition.v2", "artifactId": "RR", "title": "Risk Register", "artifactType": "Register", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "rendered human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable register contract and validation model", "jsonExample": "curated realistic register data fixture" }, "purpose": "Define the audit-ready Risk Register contract for ISO 27001 risk assessment, treatment linkage, residual-risk decision, SoA linkage, evidence, and review tracking.", "controlledValues": { "riskRating": [ "Critical", "High", "Medium", "Low" ], "treatmentOption": [ "Mitigate", "Avoid", "Transfer", "Accept" ], "status": [ "Open", "In treatment", "Accepted", "Closed" ], "cia": [ "Confidentiality", "Integrity", "Availability" ], "evidenceQuality": [ "Complete", "Partial", "Missing", "Not applicable" ] }, "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null, "fields": [ { "name": "Register Title", "type": "text", "required": "yes" }, { "name": "Register ID", "type": "text", "required": "yes" }, { "name": "Version", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Organization", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Classification", "type": "text", "required": "yes" }, { "name": "Effective Date", "type": "date", "required": "yes" }, { "name": "Next Review Date", "type": "date", "required": "yes" } ] }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "intro": "Explain how the register supports ISO 27001 risk assessment and treatment.", "hint": { "text": "Use the Risk Register to make the risk assessment auditable. Every significant risk should be traceable to an asset or process, a risk owner, treatment evidence, and a residual-risk decision.", "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null, "fields": [ { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Used by", "type": "text", "required": "yes" }, { "name": "Maintained by", "type": "text", "required": "yes" }, { "name": "Evidence role", "type": "text", "required": "yes" }, { "name": "ISO reference", "type": "text", "required": "yes" }, { "name": "Review cadence", "type": "text", "required": "yes" } ] }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below.", "hint": { "text": "Instructions should require risk ownership, scoring, treatment linkage, evidence, review dates, and escalation of risks above tolerance.", "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc" } }, { "order": 5, "id": "register_schema", "title": "Register schema", "contentType": "schema_table", "required": true, "requiredColumns": [ "Risk ID", "Risk title", "Asset / process at risk", "Risk owner", "CIA affected", "Threat", "Vulnerability / cause", "Consequence", "Existing controls", "Likelihood", "Impact", "Inherent score", "Inherent rating", "Treatment option", "Treatment ID", "Related control(s)", "SoA linkage", "Residual likelihood", "Residual impact", "Residual score", "Residual rating", "Status", "Last review date", "Next review date", "Evidence reference", "Notes" ], "hint": { "text": "The schema must support inherent-risk scoring, residual-risk scoring, treatment decisions, and evidence traceability.", "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc" } }, { "order": 6, "id": "risk_register_entries", "title": "Risk register entries", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Risk ID", "type": "text", "required": "yes" }, { "name": "Risk title", "type": "text", "required": "yes" }, { "name": "Asset / process at risk", "type": "text", "required": "yes" }, { "name": "Risk owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "CIA affected", "type": "text", "required": "yes" }, { "name": "Threat", "type": "text", "required": "yes" }, { "name": "Vulnerability / cause", "type": "text", "required": "yes" }, { "name": "Consequence", "type": "text", "required": "yes" }, { "name": "Existing controls", "type": "text", "required": "yes" }, { "name": "Likelihood", "type": "select", "required": "yes", "valueSet": "domain.likelihood", "options": [ "Rare", "Unlikely", "Possible", "Likely", "Almost Certain" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Impact", "type": "select", "required": "yes", "valueSet": "domain.impact", "options": [ "Insignificant", "Minor", "Moderate", "Major", "Severe" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Inherent score", "type": "text", "required": "yes" }, { "name": "Inherent rating", "type": "text", "required": "yes" }, { "name": "Treatment option", "type": "text", "required": "yes" }, { "name": "Treatment ID", "type": "text", "required": "yes" }, { "name": "Related control(s)", "type": "text", "required": "yes" }, { "name": "SoA linkage", "type": "text", "required": "yes" }, { "name": "Residual likelihood", "type": "text", "required": "yes" }, { "name": "Residual impact", "type": "text", "required": "yes" }, { "name": "Residual score", "type": "text", "required": "yes" }, { "name": "Residual rating", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Last review date", "type": "date", "required": "yes" }, { "name": "Next review date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "hint": { "text": "Use the same asset IDs, risk IDs, treatment IDs, and SoA references across AI, RR, RTP, and SOA.", "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc" } }, { "order": 7, "id": "register_completeness_decision", "title": "Register completeness decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Completeness result", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Risks without owner", "type": "text", "required": "yes" }, { "name": "High risks without treatment", "type": "text", "required": "yes" }, { "name": "Risks without evidence reference", "type": "text", "required": "yes" }, { "name": "Risks without next review date", "type": "date", "required": "yes" }, { "name": "Residual risks above tolerance", "type": "text", "required": "yes" }, { "name": "Final status", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "A risk register is audit-ready only if ownership, treatment, review dates, and evidence are complete for material risks.", "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc" } }, { "order": 8, "id": "evidence_and_records", "title": "Evidence and records", "contentType": "evidence_table", "required": true, "intro": "Related records live in the companion documents named below. This file cites them by their approved version. It does not copy their content. The Owner named on the cover is accountable for those live records." }, { "order": 9, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to RR.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Risk register entries must include at least six realistic risks.", "High or Critical inherent risks must have a treatment option, treatment ID, owner, due/review date, and evidence reference.", "Residual risk must be recorded or explicitly pending for risks in treatment.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "instructionsForGenerator": [ "Generate the Artifact Body after JSON Definition and JSON Example are complete.", "Render section hints after section content as callouts with plain labels.", "Render completeness decisions as vertical Field/Value tables." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-02-00", "chapterTitle": "Risk Assessment & Risk Treatment Proc", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" }, { "abbr": "RR", "longForm": "Risk Register" }, { "abbr": "RTP", "longForm": "Risk Treatment Plan" }, { "abbr": "SDLC", "longForm": "Software Development Life Cycle" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SSO", "longForm": "Single Sign-On" }, { "abbr": "SoA", "longForm": "Statement of Applicability" }, { "abbr": "BCP", "longForm": "Business Continuity Plan" }, { "abbr": "BIA", "longForm": "Business Impact Analysis" }, { "abbr": "CSP", "longForm": "Cloud Service Provider" }, { "abbr": "DLP", "longForm": "Data Loss Prevention" }, { "abbr": "DPIA", "longForm": "Data Protection Impact Assessment" }, { "abbr": "DSAR", "longForm": "Data Subject Access Request" }, { "abbr": "PAM", "longForm": "Privileged Access Management" }, { "abbr": "RPO", "longForm": "Recovery Point Objective" }, { "abbr": "RTO", "longForm": "Recovery Time Objective" }, { "abbr": "SCP", "longForm": "Secure Copy Protocol" }, { "abbr": "YAML", "longForm": "YAML Ain’t Markup Language" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "register_schema", "risk_register_entries", "register_completeness_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }