{ "schemaVersion": "artifactDefinition.v2", "definitionId": "RTP.artifactDefinition.v2", "artifactId": "RTP", "title": "Risk Treatment Plan", "artifactType": "Register", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "rendered human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable register contract and validation model", "jsonExample": "curated realistic register data fixture" }, "purpose": "Define the audit-ready Risk Treatment Plan contract linking risk decisions to treatment actions, control implementation, evidence, residual-risk approval, and effectiveness checks.", "controlledValues": { "treatmentOption": [ "Mitigate", "Avoid", "Transfer", "Accept" ], "status": [ "Planned", "In progress", "Implemented", "Accepted", "Closed", "Overdue" ], "approvalStatus": [ "Approved", "Pending", "Rejected", "Escalated" ], "evidenceQuality": [ "Complete", "Partial", "Missing", "Not applicable" ] }, "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null, "fields": [ { "name": "Register Title", "type": "text", "required": "yes" }, { "name": "Register ID", "type": "text", "required": "yes" }, { "name": "Version", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Organization", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Classification", "type": "text", "required": "yes" }, { "name": "Effective Date", "type": "date", "required": "yes" }, { "name": "Next Review Date", "type": "date", "required": "yes" } ] }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "The treatment plan should close the loop between the Risk Register and the SoA. A treatment without evidence, approval, and residual-risk decision is not audit-ready.", "bookReference": "Volume 1, S-00-03-00 Planning, Risk & Objectives (Clause 6" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null, "fields": [ { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Used by", "type": "text", "required": "yes" }, { "name": "Maintained by", "type": "text", "required": "yes" }, { "name": "Evidence role", "type": "text", "required": "yes" }, { "name": "ISO reference", "type": "text", "required": "yes" }, { "name": "Review cadence", "type": "text", "required": "yes" } ] }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Treatment entries should reuse the same risk IDs and asset/control references from the Risk Register.", "bookReference": "Volume 1, S-00-03-00 Planning, Risk & Objectives (Clause 6" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "register_schema", "title": "Register schema", "contentType": "schema_table", "required": true, "requiredColumns": [ "Treatment ID", "Related risk ID", "Risk title", "Treatment option", "Treatment action", "Annex A control(s)", "SoA linkage", "Action owner", "Risk owner approval", "Start date", "Target date", "Completion date", "Status", "Evidence of completion", "Residual risk ID", "Residual risk decision", "Effectiveness check", "Review date", "Notes" ], "hint": { "text": "The schema must prove action ownership, control linkage, completion evidence, residual-risk decision, and effectiveness verification.", "bookReference": "Volume 1, S-00-03-00 Planning, Risk & Objectives (Clause 6" } }, { "order": 6, "id": "treatment_plan_entries", "title": "Treatment plan entries", "contentType": "register_table", "required": true, "minimumExampleRows": 5, "columns": [ { "name": "Treatment ID", "type": "text", "required": "yes" }, { "name": "Related risk ID", "type": "text", "required": "yes" }, { "name": "Risk title", "type": "text", "required": "yes" }, { "name": "Treatment option", "type": "text", "required": "yes" }, { "name": "Treatment action", "type": "text", "required": "yes" }, { "name": "Annex A control(s)", "type": "text", "required": "yes" }, { "name": "SoA linkage", "type": "text", "required": "yes" }, { "name": "Action owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Risk owner approval", "type": "text", "required": "yes" }, { "name": "Start date", "type": "date", "required": "yes" }, { "name": "Target date", "type": "date", "required": "yes" }, { "name": "Completion date", "type": "date", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence of completion", "type": "text", "required": "yes" }, { "name": "Residual risk ID", "type": "text", "required": "yes" }, { "name": "Residual risk decision", "type": "text", "required": "yes" }, { "name": "Effectiveness check", "type": "text", "required": "yes" }, { "name": "Review date", "type": "date", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "hint": { "text": "Treatment entries should be concrete enough that an auditor can verify who did what, by when, with which evidence, and what residual risk remains.", "bookReference": "Volume 1, S-00-03-00 Planning, Risk & Objectives (Clause 6" } }, { "order": 7, "id": "register_completeness_decision", "title": "Register completeness decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Completeness result", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Risks requiring treatment", "type": "text", "required": "yes" }, { "name": "Treatments without owner", "type": "text", "required": "yes" }, { "name": "Treatments without target date", "type": "date", "required": "yes" }, { "name": "Treatments without risk owner approval", "type": "text", "required": "yes" }, { "name": "Implemented treatments without evidence", "type": "text", "required": "yes" }, { "name": "Overdue high-risk treatments", "type": "text", "required": "yes" }, { "name": "Final status", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "The completeness decision should identify whether any treatment action blocks audit readiness.", "bookReference": "Volume 1, S-00-03-00 Planning, Risk & Objectives (Clause 6" } }, { "order": 8, "id": "evidence_and_records", "title": "Evidence and records", "contentType": "evidence_table", "required": true, "intro": "Related records live in the companion documents named below. This file cites them by their approved version. It does not copy their content. The Owner named on the cover is accountable for those live records." }, { "order": 9, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to RTP.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Treatment entries must include realistic data and link to RR risk IDs.", "Every mitigation treatment must include owner, target date, status, control linkage, and evidence state.", "Implemented or closed treatments must include evidence and effectiveness check.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "instructionsForGenerator": [ "Generate the Artifact Body after JSON Definition and JSON Example are complete.", "Render section hints after section content as callouts with plain labels.", "Render completeness decisions as vertical Field/Value tables." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-02-01-00", "chapterTitle": "Information Security Policies & Risk Management", "primary": false, "role": "Policy framework and risk-based operation.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "IAM", "longForm": "Identity and Access Management" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "RR", "longForm": "Risk Register" }, { "abbr": "RTP", "longForm": "Risk Treatment Plan" }, { "abbr": "SDLC", "longForm": "Software Development Life Cycle" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "register_schema", "treatment_plan_entries", "register_completeness_decision" ], "minExampleRows": 5, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }