{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "SAS.artifactDefinition.v2",
  "artifactId": "SAS",
  "title": "Systems Architecture Statement",
  "artifactType": "Statement",
  "format": "docx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable template maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "editorialStandard": {
    "purpose": "This statement is the freeze of how Arcfield Platform is built and operated for ISO/IEC 27001. It names systems, trust boundaries, shared responsibility, complementary user entity controls, data locations, subprocessors, controls and evidence. It is not a C5 Type 1 or Type 2 attest report.",
    "requiredEditorialElements": [
      "introduction as purpose prose",
      "scope of this description versus ISS and SoA",
      "terms as a first-class group",
      "service and use cases",
      "system boundary and architecture",
      "how to read the diagram",
      "shared responsibility",
      "complementary user entity controls",
      "data locations",
      "subprocessors",
      "organization and roles",
      "controls and evidence index"
    ],
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 4.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Organisational context that the architecture must make visible."
      },
      {
        "label": "ISO/IEC 27001:2022 8.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Operational planning and control of the in-scope service."
      },
      {
        "label": "ISO/IEC 27001:2022 A.8",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Technological controls on access, logging, change and backup that this statement must name."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-01-00",
        "chapterTitle": "Context of the Organization (Clause 4)",
        "primary": true,
        "role": "Context and scope the architecture must support.",
        "href": "https://www.amazon.com/dp/9789908983448"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 3,
        "volumeTitle": "Secure Engineering",
        "chapterId": "S-01-01-00",
        "chapterTitle": "Secure SDLC Framework & Change Management",
        "primary": false,
        "role": "Engineering and change paths.",
        "href": "https://www.amazon.com/dp/9789908983455"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 4,
        "volumeTitle": "Secure Operations",
        "chapterId": "S-06-02-00",
        "chapterTitle": "Advanced Monitoring, Threat Detection",
        "primary": false,
        "role": "Operations, logging and restore.",
        "href": "https://www.amazon.com/dp/9789908983462"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "SSO",
        "longForm": "Single Sign-On"
      },
      {
        "abbr": "MFA",
        "longForm": "Multi-Factor Authentication"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "DPA",
        "longForm": "Data Processing Agreement"
      },
      {
        "abbr": "DPIA",
        "longForm": "Data Protection Impact Assessment"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      },
      {
        "abbr": "ISS",
        "longForm": "ISMS Scope Statement"
      },
      {
        "abbr": "IRAR",
        "longForm": "ISMS Role Appointment Record"
      },
      {
        "abbr": "LMP",
        "longForm": "Logging and Monitoring Procedure"
      },
      {
        "abbr": "CUEC",
        "longForm": "Complementary User Entity Controls"
      }
    ],
    "must": [
      "The Example title_page values must include the approved document version, owner, approver, effective date and next review date.",
      "Open with purpose prose, then scope and terms. Do not add a How-this-document-is-structured heading.",
      "Name systems, trust boundaries, shared-responsibility splits, complementary user entity controls, data locations and subprocessors.",
      "Record the CUEC process and the template customer organizations fill. Do not paste customer evidence into this file.",
      "Record document approval once in Document Control. Do not add a Review and approval chapter."
    ],
    "mustNot": [
      "Do not emit a C5 attest product, a Type 1/Type 2 report structure, or a BSI audit programme as this artifact.",
      "Do not emit a second Document Control table or a How-this-document-is-structured heading.",
      "Do not leave a heading that repeats the first sentence of the paragraph.",
      "Do not mention editorialStandard, form_schema or other generator JSON paths in buyer-facing text."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield / Arcfield Platform as the worked example (cover variant A).",
      "Name SaaS, cloud, CI/CD, privileged access and supplier interfaces where they affect this artifact."
    ],
    "exampleBody": {
      "sectionId": "statement_content",
      "workedExampleOrg": "Arcfield",
      "minBodyWords": 900,
      "requiredGroups": [
        {
          "id": "introduction",
          "heading": "What this statement is",
          "mustInclude": [
            "Arcfield",
            "not a C5"
          ]
        },
        {
          "id": "scope",
          "heading": "Scope of this description",
          "mustInclude": [
            "ISS",
            "SoA"
          ]
        },
        {
          "id": "terms",
          "heading": "Terms used here",
          "mustInclude": [
            "Trust boundary"
          ]
        },
        {
          "id": "service_and_use_cases",
          "heading": "Service and use cases",
          "mustInclude": [
            "Arcfield Platform"
          ]
        },
        {
          "id": "system_boundary_and_architecture",
          "heading": "System boundary and architecture",
          "mustInclude": [
            "CI/CD",
            "Data plane"
          ]
        },
        {
          "id": "architecture_reading",
          "heading": "How to read the diagram",
          "mustInclude": [
            "Trust boundaries",
            "in-region",
            "audit logs"
          ]
        },
        {
          "id": "shared_responsibility",
          "heading": "Shared responsibility",
          "mustInclude": [
            "Arcfield still evidences",
            "CUEC"
          ]
        },
        {
          "id": "cuec",
          "heading": "Complementary user entity controls",
          "mustInclude": [
            "completeness",
            "plausibility",
            "template"
          ]
        },
        {
          "id": "data_locations",
          "heading": "Data types, locations and jurisdiction",
          "mustInclude": [
            "EU"
          ]
        },
        {
          "id": "subprocessors",
          "heading": "Subprocessors and suppliers",
          "mustInclude": [
            "DPA"
          ]
        },
        {
          "id": "organization_and_roles",
          "heading": "Organization and roles",
          "mustInclude": [
            "Engineering Lead"
          ]
        },
        {
          "id": "controls",
          "heading": "Controls on this architecture",
          "mustInclude": [
            "Access"
          ]
        },
        {
          "id": "evidence_index",
          "heading": "Evidence index",
          "mustInclude": [
            "SAS-EV-"
          ]
        }
      ]
    },
    "documentQuality": {
      "register": "The Example JSON carries every publishable professional-document field. The renderer formats those fields; it must not invent purpose, scope, terms or revision history.",
      "requiredInformation": [
        {
          "id": "identity",
          "in": "title_page.values",
          "form": "Version, Owner, Approver, Effective Date, Next Review Date, Classification"
        },
        {
          "id": "purpose",
          "in": "body.introduction",
          "form": "opening paragraphs stating what this document is and is not; no nested headings"
        },
        {
          "id": "scope",
          "in": "body.scope",
          "form": "Heading 2 group: how-to sentence plus in-scope / out-of-scope table"
        },
        {
          "id": "audience",
          "in": "body.introduction",
          "form": "named actors in the purpose prose, not a separate heading"
        },
        {
          "id": "terms",
          "in": "body.terms",
          "form": "Heading 2 group: how-to sentence plus table of local terms not already covered by acronyms"
        },
        {
          "id": "change_log",
          "in": "change_log",
          "form": "how-to sentence plus table Version, Date, Change, Approved by; last Version matches title_page.values.Version"
        }
      ],
      "prose": [
        "Abstract is a cover blurb. It must not copy the first body paragraph.",
        "Instructions tell the reader how to copy this Word file into the ISMS. They are imperative, one action per item, parallel grammar, and must not explain the generator.",
        "Body paragraphs are complete sentences, not noun-phrase fragments under a heading.",
        "Every table or list has a how-to sentence immediately before it.",
        "Do not add a How-this-document-is-structured heading or a Review and approval chapter."
      ]
    }
  },
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Apply Abstract with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true
    },
    {
      "order": 4,
      "id": "change_log",
      "title": "Revision history",
      "contentType": "revision_table",
      "required": true
    },
    {
      "order": 5,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Apply Instructions with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 6,
      "id": "statement_content",
      "title": "Systems architecture statement",
      "contentType": "statement_sections",
      "required": true,
      "hint": {
        "text": "Apply Systems architecture statement with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 9,
      "id": "evidence_and_records",
      "title": "Evidence and records",
      "contentType": "evidence_table",
      "required": true,
      "hint": {
        "text": "Apply Evidence and records with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    },
    {
      "order": 10,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true,
      "hint": {
        "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-00-01-00 Context of the Organization (Clause 4)"
      }
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to SAS.artifactDefinition.v2.",
    "Body must define system boundary, components, data flows, trust boundaries, dependencies, control mapping and evidence expectations.",
    "No legacy MD references or standalone Book reference section allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialContractId": "editorial.docx.statement.v1",
  "contentContractId": "content.literary.v1",
  "relations": [
    {
      "kind": "includesInstance",
      "artifactId": "AI",
      "role": "inScopeAssets",
      "fromSection": "asset_inventory_entries",
      "key": "Asset ID",
      "columns": [
        "Asset ID",
        "Asset name",
        "Asset owner",
        "Classification"
      ],
      "projection": "idsAndNames",
      "targetGroup": "system_boundary_and_architecture",
      "rank": 1
    },
    {
      "kind": "cites",
      "artifactId": "MDR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 30
    },
    {
      "kind": "cites",
      "artifactId": "DR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 31
    },
    {
      "kind": "cites",
      "artifactId": "RRS",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 32
    }
  ]
}