{ "schemaVersion": "artifactDefinition.v2", "definitionId": "DOP.artifactDefinition.v2", "artifactId": "DOP", "title": "Documented Operating Procedure", "artifactType": "Procedure", "format": "docx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable body in this Contract and the matching Example JSON", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Provide a reusable structure for documented operating procedures linked to ISMS controls.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "A usable procedure names who does what, with which system, and which record is produced.", "bookReference": "Volume 1, S-00-08-00 Annex A Controls" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Apply Instructions with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-00-08-00 Annex A Controls" } }, { "order": 6, "id": "procedure_template_content", "title": "Procedure", "contentType": "statement_sections", "required": true, "hint": { "text": "Apply Procedure with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-00-08-00 Annex A Controls" }, "minimumExampleRows": 7 }, { "order": 9, "id": "evidence_and_records", "title": "Evidence and records", "contentType": "register_table", "required": true, "hint": { "text": "Apply Evidence and records with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-00-08-00 Annex A Controls" } }, { "order": 10, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-00-08-00 Annex A Controls" } } ], "validationRules": [ "{'id': 'required-sections-present', 'description': 'All required Contract sections must be present in the Example.'}", "{'id': 'example-matches-schema-columns', 'description': 'Example table rows should use the Contract column names for schema-backed sections.'}" ], "generation": { "source": "Contract.json", "method": "curated-json", "note": "Contract.json and Example.json are SSOT." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this file by version." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-08-00", "chapterTitle": "Annex A Controls", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Provide a reusable structure for documented operating procedures linked to ISMS controls.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "RAM", "longForm": "Risk Assessment Methodology" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "EV", "longForm": "Extended Validation" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "This file's function is: Provide a reusable structure for documented operating procedures linked to ISMS controls. It must not be rewritten as a generic operating-rules essay.", "Replace the template title with the real procedure name and ID.", "Keep steps numbered, role-based and testable.", "Identify systems/tools and the records each step produces.", "Define exceptions and escalation paths.", "Link related policies, risks and controls by ID.", "Train affected staff and keep acknowledgement or competence evidence." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "procedure_template_content", "workedExampleOrg": "Arcfield", "minBodyWords": 400, "requiredGroups": [ { "id": "introduction", "heading": "What this document is", "mustInclude": [ "document" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "purpose", "heading": "Purpose", "mustInclude": [ "Purpose" ] }, { "id": "scope_and_applicability", "heading": "Scope and applicability", "mustInclude": [ "Scope", "applicability" ] }, { "id": "roles_and_responsibilities", "heading": "Roles and responsibilities", "mustInclude": [ "Roles", "responsibilities" ] }, { "id": "inputs_and_prerequisites", "heading": "Inputs and prerequisites", "mustInclude": [ "Inputs", "prerequisites" ] }, { "id": "procedure_steps", "heading": "Procedure steps", "mustInclude": [ "Procedure", "steps" ] }, { "id": "outputs_and_records", "heading": "Outputs and records", "mustInclude": [ "Outputs", "records" ] }, { "id": "exceptions_and_escalation", "heading": "Exceptions and escalation", "mustInclude": [ "Exceptions", "escalation" ] }, { "id": "related_references", "heading": "Related references", "mustInclude": [ "Related", "references" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.workflow.v1", "contentContractId": "content.procedure.v1", "relations": [ { "kind": "cites", "artifactId": "MDR", "role": "evidence_register", "expectedType": "Register", "rank": 30 }, { "kind": "cites", "artifactId": "DR", "role": "evidence_register", "expectedType": "Register", "rank": 31 }, { "kind": "cites", "artifactId": "RRS", "role": "evidence_register", "expectedType": "Register", "rank": 32 } ] }