{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "CMTP.artifactDefinition.v2",
  "artifactId": "CMTP",
  "title": "Competence Matrix and Training Plan",
  "artifactType": "Matrix",
  "format": "xlsx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable matrix maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for mapping ISMS roles to competence requirements, evidence held, gaps, training actions, owners, target dates and effectiveness verification.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use CMTP to connect each ISMS role to required competence, evidence and gap-closing action.",
        "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Treat gaps as actions: every missing competence needs an owner, target date and effectiveness check.",
        "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "competence_matrix",
      "title": "Competence matrix",
      "contentType": "matrix_table",
      "required": true,
      "minimumExampleRows": 6,
      "columns": [
        {
          "name": "Role",
          "type": "text",
          "required": "yes",
          "description": "ISMS or business role.",
          "example": "System Owner"
        },
        {
          "name": "Person or Group",
          "type": "text",
          "required": "yes",
          "description": "Assigned group or individual.",
          "example": "Product team leads"
        },
        {
          "name": "ISMS Responsibilities",
          "type": "text",
          "required": "yes",
          "description": "Security responsibilities.",
          "example": "Approve asset risk information"
        },
        {
          "name": "Competence Required",
          "type": "text",
          "required": "yes",
          "description": "Required knowledge or skill.",
          "example": "Risk assessment basics"
        },
        {
          "name": "Evidence Held",
          "type": "text",
          "required": "yes",
          "description": "Existing competence evidence.",
          "example": "Training record TRC-005"
        },
        {
          "name": "Gap Identified",
          "type": "boolean",
          "required": "yes",
          "description": "Yes or No.",
          "example": "Yes",
          "valueSet": "std.boolean",
          "options": [
            "Yes",
            "No"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select Yes or No."
          }
        },
        {
          "name": "Action to Close Gap",
          "type": "text",
          "required": "conditional",
          "description": "Training, coaching or certification action.",
          "example": "Complete workshop"
        },
        {
          "name": "Action Owner",
          "type": "select",
          "required": "conditional",
          "description": "Owner for closing the gap.",
          "example": "ISMS Manager",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": true,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Target Date",
          "type": "date",
          "required": "conditional",
          "description": "Planned completion date.",
          "example": "2026-09-05"
        },
        {
          "name": "Effectiveness Verification",
          "type": "text",
          "required": "yes",
          "description": "How effectiveness is checked.",
          "example": "Sample review"
        },
        {
          "name": "Evidence Reference",
          "type": "text",
          "required": "yes",
          "description": "Evidence record.",
          "example": "TRC-REVIEW-2026-Q3"
        },
        {
          "name": "Status",
          "type": "select",
          "required": "yes",
          "description": "Current, scheduled, action open or open follow-up.",
          "example": "Current",
          "valueSet": "domain.status.generic",
          "options": [
            "Draft",
            "In Progress",
            "Under Review",
            "Approved",
            "Closed",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "no",
          "description": "Additional context.",
          "example": "Linked to training record."
        }
      ],
      "hint": {
        "text": "Each matrix row should show the role, required competence, evidence, gap decision and verification approach.",
        "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities"
      }
    },
    {
      "order": 6,
      "id": "competence_review_decision",
      "title": "Competence review decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Roles reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Gaps identified",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Actions open",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Effectiveness checks pending",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so competence gaps remain visible until training evidence proves closure.",
        "bookReference": "Volume 2, S-09-02-00 Team, Roles & Responsibilities"
      }
    },
    {
      "order": 7,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to CMTP.artifactDefinition.v2.",
    "JSON Example matrix sections must contain schemaRef pointing to the matching definition section.",
    "Rows must include role, responsibilities, competence required, evidence held, gap decision, owner, target date or documented reason, evidence reference and status.",
    "Rows with gaps must include action owner, target date and effectiveness verification.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 7.2",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 2,
        "volumeTitle": "Implementation & Certification",
        "chapterId": "S-09-02-00",
        "chapterTitle": "Team, Roles & Responsibilities",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "HR",
        "longForm": "Human Resources"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "competence_matrix",
        "competence_review_decision"
      ],
      "minExampleRows": 6,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.matrix.v1",
  "contentContractId": "content.matrix.v1"
}