{ "schemaVersion": "artifactDefinition.v2", "definitionId": "ARR.artifactDefinition.v2", "artifactId": "ARR", "title": "Access Rights Register", "artifactType": "Register", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for an auditable register of access rights, approvals, business justifications, review status, revocation evidence, and privileged access decisions.", "controlledValues": { "accessStatus": [ "Active", "Pending", "Suspended", "Revoked" ], "privilegeType": [ "Standard", "Privileged", "Service account", "Emergency" ], "reviewResult": [ "Confirmed", "Changed", "Revoked", "Exception approved" ], "evidenceStatus": [ "Complete", "Partial", "Missing" ] }, "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use ARR as operational evidence for who has access, why access is justified, who approved it, and whether it was reviewed or revoked.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Keep the register synchronized with joiner-mover-leaver events and periodic access reviews.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "access_rights_register", "title": "Access rights register", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Access ID", "type": "text", "required": "yes", "description": "Unique access record identifier.", "example": "ARR-001" }, { "name": "User or Role", "type": "text", "required": "yes", "description": "User, role, group, service account or contractor role.", "example": "Customer Operations Lead" }, { "name": "Person Type", "type": "select", "required": "yes", "description": "Employee, contractor, service account or role.", "example": "Employee" }, { "name": "System", "type": "text", "required": "yes", "description": "System or application.", "example": "Customer Portal Admin" }, { "name": "Asset ID", "type": "text", "required": "yes", "description": "Linked asset identifier.", "example": "AST-001" }, { "name": "Access Level", "type": "text", "required": "yes", "description": "Granted access level.", "example": "Administrator" }, { "name": "Privilege Type", "type": "select", "required": "yes", "description": "Standard, Privileged, Service account or Emergency.", "example": "Privileged" }, { "name": "Business Justification", "type": "text", "required": "yes", "description": "Why the access is needed.", "example": "Manage service configuration." }, { "name": "Approver", "type": "text", "required": "yes", "description": "Person or role approving access.", "example": "Head of Customer Operations" }, { "name": "Approval Date", "type": "date", "required": "yes", "description": "Approval date.", "example": "2026-07-02" }, { "name": "Status", "type": "select", "required": "yes", "description": "Active, Pending, Suspended or Revoked.", "example": "Active", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Last Review", "type": "date", "required": "yes", "description": "Last access review date.", "example": "2026-08-29" }, { "name": "Review Result", "type": "select", "required": "yes", "description": "Confirmed, Changed, Revoked or Exception approved.", "example": "Confirmed", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Revocation Date", "type": "date", "required": "conditional", "description": "Required if access is revoked.", "example": "2026-08-16" }, { "name": "Evidence Status", "type": "select", "required": "yes", "description": "Complete, Partial or Missing.", "example": "Complete", "valueSet": "domain.evidenceStatus", "options": [ "Missing", "Requested", "Received", "Verified", "Rejected" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence record for approval, review or revocation.", "example": "ACC-REV-2026-Q3-001" }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional notes.", "example": "MFA enforced." } ], "hint": { "text": "Every access row must be traceable to a business need, approval, review outcome and evidence reference.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 6, "id": "access_review_decision", "title": "Access review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Active access records", "type": "text", "required": "yes" }, { "name": "Privileged access records", "type": "text", "required": "yes" }, { "name": "Revocations confirmed", "type": "text", "required": "yes" }, { "name": "Open exceptions", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close the register with a review decision so access governance can be verified during audit.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to ARR.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Access rows must include approval, justification, status, review result, and evidence reference.", "Revoked access must include a revocation date.", "Privileged access must have a named approver and review result.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "instructionsForGenerator": [ "Generate the Artifact Body after JSON Definition and JSON Example are complete.", "Render section hints after section content as callouts with plain labels.", "Use the JSON Example as the data source for the rendered register." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-04-00", "chapterTitle": "Business Impact Analysis & Business C", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-05-00", "chapterTitle": "Internal Audit & Management Review", "primary": false, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CTO", "longForm": "Chief Technology Officer" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" }, { "abbr": "PAM", "longForm": "Privileged Access Management" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "access_rights_register", "access_review_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }