{ "schemaVersion": "artifactDefinition.v2", "definitionId": "ACM.artifactDefinition.v2", "artifactId": "ACM", "title": "Access Control Matrix", "artifactType": "Matrix", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable matrix maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for mapping role-based access to systems, data scopes, privilege levels, approval requirements, MFA requirements, segregation-of-duties notes, review cadence and evidence.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use ACM to define access by role before provisioning, so least privilege and review expectations are clear.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Define standard access by role rather than named person, then use UAI and access reviews to evidence actual assignments.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "access_control_matrix", "title": "Access control matrix", "contentType": "matrix_table", "required": true, "minimumExampleRows": 7, "columns": [ { "name": "Role", "type": "text", "required": "yes", "description": "Role receiving access.", "example": "Support Agent" }, { "name": "System or Service", "type": "text", "required": "yes", "description": "System, application or service.", "example": "CloudDesk Support" }, { "name": "Data Scope", "type": "text", "required": "yes", "description": "Data or function in scope.", "example": "Assigned tickets" }, { "name": "Access Level", "type": "text", "required": "yes", "description": "Permission level.", "example": "Standard user" }, { "name": "Privileged Access", "type": "boolean", "required": "yes", "description": "Whether access is privileged.", "example": "No", "valueSet": "std.boolean", "options": [ "Yes", "No" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select Yes or No." } }, { "name": "Business Justification", "type": "text", "required": "yes", "description": "Why the role needs access.", "example": "Handle support requests" }, { "name": "Approval Required", "type": "boolean", "required": "yes", "description": "Whether approval is required.", "example": "Yes", "valueSet": "std.boolean", "options": [ "Yes", "No" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select Yes or No." } }, { "name": "Approver Role", "type": "text", "required": "yes", "description": "Role approving access.", "example": "Support Manager" }, { "name": "MFA Required", "type": "boolean", "required": "yes", "description": "MFA requirement.", "example": "Yes", "valueSet": "std.boolean", "options": [ "Yes", "No" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select Yes or No." } }, { "name": "Segregation of Duties Note", "type": "text", "required": "yes", "description": "SoD constraint or note.", "example": "No admin configuration rights" }, { "name": "Review Frequency", "type": "text", "required": "yes", "description": "Review cadence.", "example": "Quarterly" }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence or review reference.", "example": "ARR-2026-08" }, { "name": "Status", "type": "select", "required": "yes", "description": "Active, pilot, revoked or open follow-up.", "example": "Active", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional context.", "example": "Exception expires." } ], "hint": { "text": "Each matrix row should show the approved access pattern for a role, including privilege, justification, review and evidence.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 6, "id": "access_matrix_review", "title": "Access matrix review", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Rows reviewed", "type": "text", "required": "yes" }, { "name": "Privileged access patterns", "type": "text", "required": "yes" }, { "name": "Rows needing follow-up", "type": "text", "required": "yes" }, { "name": "Review focus", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so excessive permissions, missing approvals and review gaps become visible.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to ACM.artifactDefinition.v2.", "JSON Example matrix sections must contain schemaRef pointing to the matching definition section.", "Access rows must include role, system or service, data scope, access level, business justification, approval requirement, approver role, MFA requirement, review frequency and evidence reference.", "Privileged access rows must explicitly mark Privileged Access as Yes and include an approver role and evidence reference.", "Body must render the contract schema and the example data.", "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-05-00", "chapterTitle": "Internal Audit & Management Review", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "COO", "longForm": "Chief Operating Officer" }, { "abbr": "CTO", "longForm": "Chief Technology Officer" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "access_control_matrix", "access_matrix_review" ], "minExampleRows": 7, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.matrix.v1", "contentContractId": "content.matrix.v1" }