{ "schemaVersion": "artifactDefinition.v2", "definitionId": "CIL.artifactDefinition.v2", "artifactId": "CIL", "title": "Continual Improvement Log", "artifactType": "Log", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for recording ISMS improvement opportunities, decisions, ownership, prioritization, implementation status, benefits, evidence, and management review follow-up.", "controlledValues": { "source": [ "Management review", "Internal audit", "External audit", "Monitoring", "Incident", "Risk review", "Employee suggestion", "Supplier review" ], "priority": [ "High", "Medium", "Low" ], "status": [ "Proposed", "Accepted", "In progress", "Implemented", "Rejected", "Deferred" ], "benefitStatus": [ "Confirmed", "Partially confirmed", "Pending", "Not applicable" ] }, "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use the log to show that improvement is managed as a live ISMS process, not only as audit remediation.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Record why an improvement was accepted, deferred or rejected so decisions remain auditable.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "continual_improvement_log", "title": "Continual improvement log", "contentType": "register_table", "required": true, "minimumExampleRows": 5, "columns": [ { "name": "Improvement ID", "type": "text", "required": "yes", "description": "Unique improvement identifier.", "example": "CIL-001" }, { "name": "Date raised", "type": "date", "required": "yes", "description": "Date the opportunity was raised.", "example": "2026-08-05" }, { "name": "Source", "type": "select", "required": "yes", "description": "Source of the improvement.", "example": "Internal audit" }, { "name": "Improvement opportunity", "type": "text", "required": "yes", "description": "What should be improved.", "example": "Automate evidence reminders." }, { "name": "Related clause or control", "type": "text", "required": "yes", "description": "Related ISO clause or Annex A control.", "example": "A.5.18" }, { "name": "Expected benefit", "type": "text", "required": "yes", "description": "Expected improvement outcome.", "example": "Reduce incomplete evidence." }, { "name": "Priority", "type": "select", "required": "yes", "description": "High, Medium or Low.", "example": "High", "valueSet": "domain.priority", "options": [ "P1", "P2", "P3", "P4" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Decision", "type": "text", "required": "yes", "description": "Accepted, deferred or rejected decision.", "example": "Accepted" }, { "name": "Owner", "type": "select", "required": "yes", "description": "Accountable owner.", "example": "IT Operations Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Target date", "type": "date", "required": "yes", "description": "Planned implementation date.", "example": "2026-09-30" }, { "name": "Status", "type": "select", "required": "yes", "description": "Current status.", "example": "In progress", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Implementation evidence", "type": "text", "required": "conditional", "description": "Evidence of implementation.", "example": "Workflow ticket IAM-214" }, { "name": "Benefit check", "type": "text", "required": "yes", "description": "How the benefit will be or was checked.", "example": "Verify Q4 access evidence." }, { "name": "Benefit status", "type": "select", "required": "yes", "description": "Confirmed, Partially confirmed, Pending or Not applicable.", "example": "Pending" }, { "name": "Next review date", "type": "date", "required": "yes", "description": "Next review date.", "example": "2026-10-31" }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional information.", "example": "Linked to CAR-001." } ], "hint": { "text": "Every improvement row should connect an opportunity to a decision, owner, evidence and benefit check.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 6, "id": "improvement_review_decision", "title": "Improvement review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Open improvements", "type": "text", "required": "yes" }, { "name": "Implemented improvements", "type": "text", "required": "yes" }, { "name": "Deferred improvements", "type": "text", "required": "yes" }, { "name": "Rejected improvements", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Summarize improvement performance so management can see whether the ISMS is becoming more effective.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to CIL.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Improvement rows must include source, opportunity, expected benefit, decision, owner, status and evidence or next review.", "Implemented rows should include implementation evidence and benefit check.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 10.1", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-05-00", "chapterTitle": "Internal Audit & Management Review", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IAM", "longForm": "Identity and Access Management" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "continual_improvement_log", "improvement_review_decision" ], "minExampleRows": 5, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.log.v1" }