{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "SRP.artifactDefinition.v2",
  "artifactId": "SRP",
  "title": "Supplier Relationships Policy",
  "artifactType": "Policy",
  "format": "docx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "curated Example JSON is the worked Arcfield body; no Artifact Candidate page is in this factory",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated fictional Arcfield example (EXAMPLE_DECISION, pending review)"
  },
  "editorialStandard": {
    "purpose": "Define supplier security classification, due diligence, contracting, monitoring, incident and exit rules.",
    "requiredEditorialElements": [
      "introduction as purpose prose",
      "scope of this document versus neighbouring records",
      "terms as a first-class group",
      "worked Arcfield example",
      "practical examples, pitfalls, evidence and external references"
    ],
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 A.5.19",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022 A.5.20",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022 A.5.21",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022 A.5.22",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022 A.5.23",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Annex A control this artifact implements."
      },
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-02-02-00",
        "chapterTitle": "Supplier Security & Third-party Risk Management",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/dp/9789908983448"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "ISO",
        "longForm": "International Organization for Standardization"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "DPA",
        "longForm": "Data Processing Agreement"
      },
      {
        "abbr": "EV",
        "longForm": "Extended Validation"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "SLA",
        "longForm": "Service Level Agreement"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      }
    ],
    "must": [
      "This file's function is: Define supplier security classification, due diligence, contracting, monitoring, incident and exit rules. It must not be rewritten as a generic operating-rules essay.",
      "Identify suppliers that process data, operate services, provide infrastructure or affect security evidence.",
      "Classify supplier risk by data sensitivity, service criticality, access, dependency and regulatory impact.",
      "Complete due diligence before use for relevant suppliers.",
      "Include security, privacy, incident, audit, subcontractor and exit clauses where applicable.",
      "Monitor suppliers according to risk level.",
      "Record incidents, changes and exit planning for critical suppliers."
    ],
    "mustNot": [
      "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function."
    ],
    "exampleBody": {
      "sectionId": "policy_content",
      "workedExampleOrg": "Arcfield",
      "minBodyWords": 400,
      "requiredGroups": [
        {
          "id": "introduction",
          "heading": "What this policy is",
          "mustInclude": [
            "policy"
          ]
        },
        {
          "id": "scope",
          "heading": "Scope",
          "mustInclude": [
            "Scope"
          ]
        },
        {
          "id": "terms",
          "heading": "Terms used here",
          "mustInclude": [
            "Terms"
          ]
        },
        {
          "id": "supplier_classification",
          "heading": "Supplier classification",
          "mustInclude": [
            "Supplier",
            "classification",
            "SRP-CLS-001"
          ]
        },
        {
          "id": "due_diligence",
          "heading": "Due diligence",
          "mustInclude": [
            "diligence",
            "SRP-DD-001"
          ]
        },
        {
          "id": "contractual_requirements",
          "heading": "Contractual requirements",
          "mustInclude": [
            "Contractual",
            "requirements",
            "SRP-CTR-001"
          ]
        },
        {
          "id": "ongoing_monitoring",
          "heading": "Ongoing monitoring",
          "mustInclude": [
            "Ongoing",
            "monitoring",
            "SRP-MON-001"
          ]
        },
        {
          "id": "supplier_incidents_changes_and_exit",
          "heading": "Supplier incidents, changes and exit",
          "mustInclude": [
            "Supplier",
            "incidents",
            "changes",
            "SRP-EXT-001"
          ]
        },
        {
          "id": "evidence",
          "heading": "Evidence expectations",
          "mustInclude": [
            "SRP-EV-001",
            "expectation"
          ]
        }
      ],
      "requiredSections": [
        {
          "id": "change_log",
          "title": "Revision history",
          "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version."
        },
        {
          "id": "external_references",
          "title": "References",
          "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue."
        }
      ]
    }
  },
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Apply Abstract with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true
    },
    {
      "order": 4,
      "id": "change_log",
      "title": "Revision history",
      "contentType": "revision_table",
      "required": true
    },
    {
      "order": 5,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Apply Instructions with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk"
      }
    },
    {
      "order": 6,
      "id": "policy_content",
      "title": "Policy",
      "contentType": "policy_sections",
      "required": true,
      "hint": {
        "text": "Apply Policy with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk"
      }
    },
    {
      "order": 9,
      "id": "evidence_and_records",
      "title": "Evidence and records",
      "contentType": "evidence_table",
      "required": true,
      "hint": {
        "text": "Apply Evidence and records with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk"
      }
    },
    {
      "order": 10,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true,
      "hint": {
        "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.",
        "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk"
      }
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to SRP.artifactDefinition.v2.",
    "Policy must define supplier classification, due diligence, contracting, monitoring, incident handling, change notification and exit controls.",
    "Body must include practical examples, common pitfalls and evidence expectations.",
    "No legacy MD references or standalone Book reference section allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "purpose": "Define supplier security classification, due diligence, contracting, monitoring, incident and exit rules.",
  "editorialContractId": "editorial.docx.policy.v1",
  "contentContractId": "content.literary.v1",
  "relations": [
    {
      "kind": "cites",
      "artifactId": "MDR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 30
    },
    {
      "kind": "cites",
      "artifactId": "DR",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 31
    },
    {
      "kind": "cites",
      "artifactId": "RRS",
      "role": "evidence_register",
      "expectedType": "Register",
      "rank": 32
    },
    {
      "kind": "cites",
      "artifactId": "AI",
      "role": "inventory",
      "expectedType": "Inventory",
      "rank": 20
    },
    {
      "kind": "cites",
      "artifactId": "SINV",
      "role": "inventory",
      "expectedType": "Inventory",
      "rank": 21
    },
    {
      "kind": "cites",
      "artifactId": "UAI",
      "role": "inventory",
      "expectedType": "Inventory",
      "rank": 22
    }
  ]
}