{ "schemaVersion": "artifactExample.v2", "artifactId": "RTP", "title": "Risk Treatment Plan", "definitionRef": { "artifactId": "RTP", "definitionSchemaVersion": "artifactDefinition.v2", "definitionId": "RTP.artifactDefinition.v2", "title": "Risk Treatment Plan" }, "organization": "Arcfield", "examplePurpose": "Realistic curated treatment-plan data aligned with RR and SOA.", "sections": [ { "id": "title_page", "title": "Title Page", "values": { "Register Title": "Risk Treatment Plan", "Register ID": "RTP-REG-001", "Version": "1.1", "Status": "Approved", "Organization": "Arcfield", "Owner": "Risk Manager", "Approver": "Top Management", "Classification": "Internal", "Effective Date": "2026-09-11", "Next Review Date": "2027-09-11" }, "items": [ "Register Title: Risk Treatment Plan", "Register ID: RTP-REG-001", "Version: 1.1", "Status: Approved", "Organization: Arcfield", "Owner: Risk Manager", "Approver: Top Management", "Classification: Internal", "Effective Date: 2026-09-11", "Next Review Date: 2027-09-11" ], "contentType": "metadata" }, { "id": "abstract", "title": "Abstract", "text": "This example links Arcfield risk treatment decisions to concrete treatment actions, Annex A controls, SoA linkage, owners, approvals, target dates, evidence, residual-risk decisions and effectiveness checks. Rows are the 11 September 2026 operating sample of the certified Arcfield Platform ISMS in the surveillance cycle after certificate ARC-ISMS-2025-001.", "contentType": "narrative" }, { "id": "document_control", "title": "Document Control", "rows": [ { "Property": "Purpose", "Value": "Track actions required to treat unacceptable or prioritized information security risks." }, { "Property": "Used by", "Value": "ISMS Manager, Risk Manager, Risk Owners, Control Owners, Top Management, Internal Auditor" }, { "Property": "Maintained by", "Value": "Risk Manager" }, { "Property": "Evidence role", "Value": "Mandatory ISO 27001 risk treatment record" }, { "Property": "ISO reference", "Value": "ISO/IEC 27001:2022 Clauses 6.1.3 and 8.3, linked to Annex A controls" }, { "Property": "Review cadence", "Value": "Monthly while active, before management review, and after treatment completion" } ], "contentType": "control_table" }, { "id": "instructions", "title": "Instructions", "items": [ "Create one treatment row for every risk that requires mitigation, avoidance, transfer, or explicit acceptance.", "Link each treatment to a Risk Register row and, where relevant, Annex A controls and the SoA.", "Assign a role-based action owner and approving risk owner.", "Record target date, status, completion evidence, and effectiveness check.", "Recalculate or confirm residual risk after treatment.", "Escalate overdue high-risk treatment actions to management review.", "Use sheets ending in “Ex” as read-only examples. Enter live data only on the matching “Wk” (Working) sheets.", "Every operative list is an Excel Table with frozen headers and filters. Add new rows on the next empty worksheet row beneath the table so Excel expands it — do not leave blank rows inside the table.", "Where a column offers a dropdown, choose a value from the list (Status, Owner role, Priority, Severity, Likelihood, Impact, Applicability, Evidence Status, Review Result). Do not invent free-text variants.", "Enter dates as YYYY-MM-DD. Date columns are validated and formatted accordingly.", "Review the Flag columns (Overdue, Review Due, Missing Owner, Missing Evidence). They calculate automatically and highlight gaps for follow-up.", "Keep Cover, Legal, Book, Lists and Metadata unchanged. System sheets are protected on purpose.", "Reuse Risk IDs from the Risk Register on every treatment row; record SoA linkage and Action owner from the role dropdown." ], "contentType": "ordered_list" }, { "id": "register_schema", "title": "Register schema", "schemaRef": { "definitionId": "RTP.artifactDefinition.v2", "sectionId": "register_schema", "requiredColumnsRef": "sections.register_schema.requiredColumns" }, "rows": [ { "Column": "Treatment ID", "Type": "text", "Required": "yes", "Description": "Stable unique treatment identifier.", "Example": "RTP-2026-014" }, { "Column": "Related risk ID", "Type": "text", "Required": "yes", "Description": "Linked Risk Register entry.", "Example": "RISK-2026-014" }, { "Column": "Risk title", "Type": "text", "Required": "yes", "Description": "Short risk title.", "Example": "Unauthorized privileged access to production platform" }, { "Column": "Treatment option", "Type": "select", "Required": "yes", "Description": "Mitigate, Avoid, Transfer, Accept.", "Example": "Mitigate" }, { "Column": "Treatment action", "Type": "text", "Required": "yes", "Description": "Action required to treat the risk.", "Example": "Implement quarterly privileged-access review evidence pack" }, { "Column": "Annex A control(s)", "Type": "text", "Required": "conditional", "Description": "Related ISO controls.", "Example": "A.5.15, A.5.16, A.8.2" }, { "Column": "SoA linkage", "Type": "text", "Required": "conditional", "Description": "Linked SoA control rows.", "Example": "SOA-A.5.15" }, { "Column": "Action owner", "Type": "text", "Required": "yes", "Description": "Role responsible for implementation.", "Example": "IT Operations" }, { "Column": "Risk owner approval", "Type": "text", "Required": "yes", "Description": "Risk owner decision or approval status.", "Example": "Approved by Service Owner" }, { "Column": "Start date", "Type": "date", "Required": "yes", "Description": "Treatment start date.", "Example": "2026-08-29" }, { "Column": "Target date", "Type": "date", "Required": "yes", "Description": "Planned completion date.", "Example": "2026-09-30" }, { "Column": "Completion date", "Type": "date", "Required": "conditional", "Description": "Actual completion date.", "Example": "2026-09-28" }, { "Column": "Status", "Type": "select", "Required": "yes", "Description": "Planned, In progress, Implemented, Accepted, Closed, Overdue.", "Example": "In progress" }, { "Column": "Evidence of completion", "Type": "text", "Required": "conditional", "Description": "Evidence of implemented treatment.", "Example": "ACC-REV-2026-Q3" }, { "Column": "Residual risk ID", "Type": "text", "Required": "conditional", "Description": "Residual-risk reference.", "Example": "RISK-2026-014-R" }, { "Column": "Residual risk decision", "Type": "text", "Required": "conditional", "Description": "Acceptance or further treatment decision.", "Example": "Residual risk accepted as Medium" }, { "Column": "Effectiveness check", "Type": "text", "Required": "conditional", "Description": "How effectiveness will be or was checked.", "Example": "Q4 privileged access review confirms no unauthorized admin accounts" }, { "Column": "Review date", "Type": "date", "Required": "yes", "Description": "Last review date.", "Example": "2026-08-29" }, { "Column": "Notes", "Type": "text", "Required": "no", "Description": "Additional context.", "Example": "Evidence pack due before management review." } ], "contentType": "schema_table" }, { "id": "treatment_plan_entries", "title": "Treatment plan entries", "schemaRef": { "definitionId": "RTP.artifactDefinition.v2", "sectionId": "treatment_plan_entries", "columnsRef": "sections.treatment_plan_entries.columns" }, "rows": [ { "Treatment ID": "RTP-2026-014", "Related risk ID": "RISK-2026-014", "Risk title": "Unauthorized privileged access to production platform", "Treatment option": "Mitigate", "Treatment action": "Implement quarterly privileged-access review evidence pack", "Annex A control(s)": "A.5.15, A.5.16, A.8.2", "SoA linkage": "SOA-A.5.15", "Action owner": "IT Operations", "Risk owner approval": "Approved by Service Owner", "Start date": "2026-08-29", "Target date": "2026-09-30", "Completion date": "", "Status": "In progress", "Evidence of completion": "ACC-REV-2026-Q3 pending", "Residual risk ID": "RISK-2026-014-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Q4 review confirms privileged access baseline", "Review date": "2026-08-29", "Notes": "Must close before management review.", "Evidence reference": "ACC-REV-2026-Q3 pending" }, { "Treatment ID": "RTP-2026-018", "Related risk ID": "RISK-2026-018", "Risk title": "Customer Portal outage affects onboarding commitments", "Treatment option": "Transfer / Mitigate", "Treatment action": "Confirm SaaS SLA, escalation route, and exit support", "Annex A control(s)": "A.5.19, A.5.20, A.5.23, A.8.14", "SoA linkage": "SOA-A.5.23", "Action owner": "Supplier Manager", "Risk owner approval": "Approved by Head of Customer Success", "Start date": "2026-08-29", "Target date": "2026-10-15", "Completion date": "", "Status": "In progress", "Evidence of completion": "SINV-CLOUDHOST-2026-Q3", "Residual risk ID": "RISK-2026-018-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Supplier SLA reviewed during Q4 supplier review", "Review date": "2026-08-29", "Notes": "Supplier contact update pending.", "Evidence reference": "SINV-CLOUDHOST-2026-Q3" }, { "Treatment ID": "RTP-2026-021", "Related risk ID": "RISK-2026-021", "Risk title": "ISMS evidence repository loses integrity", "Treatment option": "Mitigate", "Treatment action": "Implement quarterly export and permission review for evidence repository", "Annex A control(s)": "A.5.33, A.8.13", "SoA linkage": "SOA-A.5.33", "Action owner": "Workspace Administrator", "Risk owner approval": "Approved by ISMS Manager", "Start date": "2026-08-28", "Target date": "2026-09-15", "Completion date": "", "Status": "Planned", "Evidence of completion": "EVID-EXPORT-2026-Q3 planned", "Residual risk ID": "RISK-2026-021-R", "Residual risk decision": "Residual risk expected Low", "Effectiveness check": "Restore test and permission sample", "Review date": "2026-08-28", "Notes": "Align with audit-pack generation. STALL-2026-Q3: this treatment has not moved since the 2025 improvement programme.", "Evidence reference": "EVID-EXPORT-2026-Q3 planned" }, { "Treatment ID": "RTP-2026-027", "Related risk ID": "RISK-2026-027", "Risk title": "Source repository secret exposure", "Treatment option": "Mitigate", "Treatment action": "Validate secret scanning and branch protection for customer portal repository", "Annex A control(s)": "A.8.4, A.8.5, A.8.28", "SoA linkage": "SOA-A.8.28", "Action owner": "DevOps Engineer", "Risk owner approval": "Approved by Engineering Lead", "Start date": "2026-08-27", "Target date": "2026-09-20", "Completion date": "", "Status": "In progress", "Evidence of completion": "SSDLC-REL-2026-014", "Residual risk ID": "RISK-2026-027-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Release evidence includes scan results", "Review date": "2026-08-27", "Notes": "Link to S-SDLC evidence.", "Evidence reference": "SSDLC-REL-2026-014" }, { "Treatment ID": "RTP-2026-031", "Related risk ID": "RISK-2026-031", "Risk title": "Identity provider misconfiguration", "Treatment option": "Mitigate", "Treatment action": "Add monthly identity-provider configuration and break-glass review", "Annex A control(s)": "A.5.15, A.5.17, A.8.2", "SoA linkage": "SOA-A.5.17", "Action owner": "IT Operations", "Risk owner approval": "Approved by IT Operations Manager", "Start date": "2026-08-29", "Target date": "2026-09-30", "Completion date": "", "Status": "In progress", "Evidence of completion": "IAM-CTRL-2026-Q3", "Residual risk ID": "RISK-2026-031-R", "Residual risk decision": "Residual risk expected Low", "Effectiveness check": "Next monthly configuration sample", "Review date": "2026-08-29", "Notes": "Privileged review cadence required.", "Evidence reference": "IAM-CTRL-2026-Q3" }, { "Treatment ID": "RTP-2026-033", "Related risk ID": "RISK-2026-033", "Risk title": "HR personnel data retained beyond requirement", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-033 and keep evidence on the cited control records.", "Annex A control(s)": "A.5.31, A.5.34, A.8.10", "SoA linkage": "SOA-A.5.34", "Action owner": "HR Manager", "Risk owner approval": "Approved by HR Manager", "Start date": "2026-09-11", "Target date": "2026-11-20", "Completion date": "", "Status": "Planned", "Evidence of completion": "RTP-2026-033 evidence pending", "Residual risk ID": "RISK-2026-033-R", "Residual risk decision": "Residual risk expected Low", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Link retention schedule to folder review. STALL-2026-Q3: this treatment has not moved since the 2025 improvement programme.", "Evidence reference": "RTP-2026-033 evidence pending" }, { "Treatment ID": "RTP-2026-041", "Related risk ID": "RISK-2026-041", "Risk title": "Customer health records exposed from misconfigured object storage", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-041 and keep evidence on the cited control records.", "Annex A control(s)": "A.5.12, A.5.33, A.8.3", "SoA linkage": "SOA-A.5.33", "Action owner": "Cloud Service Owner", "Risk owner approval": "Approved by Cloud Service Owner", "Start date": "2026-09-11", "Target date": "2026-12-11", "Completion date": "", "Status": "In progress", "Evidence of completion": "RTP-2026-041 evidence pending", "Residual risk ID": "RISK-2026-041-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Linked to ICP Restricted handling and CSP shared-responsibility split.", "Evidence reference": "RTP-2026-041 evidence pending" }, { "Treatment ID": "RTP-2026-042", "Related risk ID": "RISK-2026-042", "Risk title": "Unreviewed CI/CD change reaches Arcfield Platform production", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-042 and keep evidence on the cited control records.", "Annex A control(s)": "A.8.25, A.8.28, A.8.32", "SoA linkage": "SOA-A.8.28", "Action owner": "Engineering Lead", "Risk owner approval": "Approved by Engineering Lead", "Start date": "2026-09-11", "Target date": "2026-10-31", "Completion date": "", "Status": "In progress", "Evidence of completion": "RTP-2026-042 evidence pending", "Residual risk ID": "RISK-2026-042-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Cite SSDP and the production change record; do not copy pipeline YAML into RR.", "Evidence reference": "RTP-2026-042 evidence pending" }, { "Treatment ID": "RTP-2026-043", "Related risk ID": "RISK-2026-043", "Risk title": "Hosting supplier cannot evidence the shared-responsibility split", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-043 and keep evidence on the cited control records.", "Annex A control(s)": "A.5.19, A.5.21, A.5.23", "SoA linkage": "SOA-A.5.19", "Action owner": "Supplier Manager", "Risk owner approval": "Approved by Supplier Manager", "Start date": "2026-09-11", "Target date": "2026-11-30", "Completion date": "", "Status": "In progress", "Evidence of completion": "RTP-2026-043 evidence pending", "Residual risk ID": "RISK-2026-043-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Linked to SRP and CSP. Exit clause follow-up is ISO-006.", "Evidence reference": "RTP-2026-043 evidence pending" }, { "Treatment ID": "RTP-2026-044", "Related risk ID": "RISK-2026-044", "Risk title": "Privileged cloud-console session without recording", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-044 and keep evidence on the cited control records.", "Annex A control(s)": "A.8.2, A.8.5, A.8.15", "SoA linkage": "SOA-A.8.2", "Action owner": "IT Operations Manager", "Risk owner approval": "Approved by IT Operations Manager", "Start date": "2026-09-11", "Target date": "2026-10-31", "Completion date": "", "Status": "In progress", "Evidence of completion": "RTP-2026-044 evidence pending", "Residual risk ID": "RISK-2026-044-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Complements RISK-2026-014. Evidence is the PAM session export, not this row.", "Evidence reference": "RTP-2026-044 evidence pending" }, { "Treatment ID": "RTP-2026-045", "Related risk ID": "RISK-2026-045", "Risk title": "Arcfield Platform backup restore untested for customer configuration", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-045 and keep evidence on the cited control records.", "Annex A control(s)": "A.5.29, A.5.30, A.8.13", "SoA linkage": "SOA-A.8.13", "Action owner": "Operations Lead", "Risk owner approval": "Approved by Operations Lead", "Start date": "2026-09-11", "Target date": "2026-12-11", "Completion date": "", "Status": "In progress", "Evidence of completion": "RTP-2026-045 evidence pending", "Residual risk ID": "RISK-2026-045-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Cite BRP restore evidence. Linked to BCP/BIA recovery objectives.", "Evidence reference": "RTP-2026-045 evidence pending" }, { "Treatment ID": "RTP-2026-046", "Related risk ID": "RISK-2026-046", "Risk title": "Support attachment with health data copied into an unapproved SaaS tool", "Treatment option": "Mitigate", "Treatment action": "Execute the treatment recorded on RISK-2026-046 and keep evidence on the cited control records.", "Annex A control(s)": "A.5.10, A.5.12, A.8.12", "SoA linkage": "SOA-A.5.10", "Action owner": "Incident Manager", "Risk owner approval": "Approved by Incident Manager", "Start date": "2026-09-11", "Target date": "2026-10-31", "Completion date": "", "Status": "In progress", "Evidence of completion": "RTP-2026-046 evidence pending", "Residual risk ID": "RISK-2026-046-R", "Residual risk decision": "Residual risk expected Medium", "Effectiveness check": "Next review confirms residual rating", "Review date": "2026-09-11", "Notes": "Linked to ICP handling rules and DSAR/DPIA records. Do not paste attachments into RR.", "Evidence reference": "RTP-2026-046 evidence pending" } ], "contentType": "register_table" }, { "id": "register_completeness_decision", "title": "Register completeness decision", "values": { "Completeness result": "Complete", "Reviewed by": "Risk Manager", "Risks requiring treatment": 5, "Treatments without owner": 0, "Treatments without target date": 0, "Treatments without risk owner approval": 0, "Implemented treatments without evidence": 0, "Overdue high-risk treatments": 0, "Final status": "Audit-ready", "Decision date": "2026-08-29", "Evidence reference": "RTP-COMPLETE-2026-Q3" }, "rows": [ { "Field": "Completeness result", "Value": "Complete", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Reviewed by", "Value": "Risk Manager", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Risks requiring treatment", "Value": "5", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Treatments without owner", "Value": "0", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Treatments without target date", "Value": "0", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Treatments without risk owner approval", "Value": "0", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Implemented treatments without evidence", "Value": "0", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Overdue high-risk treatments", "Value": "0", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Final status", "Value": "Audit-ready", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Decision date", "Value": "2026-08-29", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" }, { "Field": "Evidence reference", "Value": "RTP-COMPLETE-2026-Q3", "Evidence reference": "RTP-COMPLETE-2026-Q3", "Evidence status": "Complete" } ], "contentType": "decision_table" }, { "id": "evidence_and_records", "title": "Evidence and records", "groups": [ { "text": "Related records live in the companion documents named below. This file cites them by their approved version. It does not copy their content. The Owner named on the cover is accountable for those live records." }, { "items": [ "[Risk Register](RR_Risk_Register.xlsx) — Live Risk IDs this plan treats.", "[Risk Acceptance Minutes](RAMT_Risk_Acceptance_Minutes.docx) — Residual decisions after treatment.", "[Statement of Applicability](SOA_Statement_of_Applicability_SoA.xlsx) — Annex A controls named on treatment rows." ], "ordered": true, "relationView": "evidence" } ], "contentType": "evidence_table" }, { "id": "external_references", "title": "References", "groups": [ { "text": "Cite these sources from workshops and audits. This list names ISO clauses, book chapters and companion artifacts used by this file." }, { "rows": [ { "Kind": "ISO", "Reference": "ISO/IEC 27001:2022", "How this document uses it": "Normative source this artifact implements or cites.", "href": "https://www.iso.org/standard/82875.html" }, { "Kind": "Book", "Reference": "Building the ISMS, Planning, Risk & Objectives (Clause 6)", "How this document uses it": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "SOA Statement of Applicability (SoA) (Building the ISMS, Context of the Organization (Clause 4))", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "ISO Information Security Objectives (Building the ISMS, Information Security Policies & Risk Management)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "RR Risk Register (Building the ISMS, Planning, Risk & Objectives (Clause 6))", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "SINV Supplier Inventory (Building the ISMS, Supplier Security & Third-party Risk Management)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" } ] } ], "contentType": "reference_table" } ], "enrichment": { "source": "Example.json", "method": "curated-json", "note": "Completes Example JSON with renderer-native sections and generalized groups; no mdSource helper fields." }, "snapshotRef": { "snapshotId": "arcfield.platform.surv.2026-09-11", "schemaVersion": "evidenceSnapshot.v1" }, "scenarioRef": { "githubIssue": 64, "crId": "CR-TYPE-ARCFIELD-001", "family": "Register", "role": "Operating sample of the 11 September 2026 freeze" } }