{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "ELAI.artifactDefinition.v2",
  "artifactId": "ELAI",
  "title": "Evidence Log / Audit Pack Index",
  "artifactType": "Index",
  "format": "xlsx",
  "productTier": "Basic",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for an audit evidence index that maps evidence items to clauses, controls, owners, locations, coverage periods, collection status, independent review and audit-pack readiness.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use ELAI as the central evidence map for audit preparation, not as a loose file list.",
        "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Evidence should be mapped to requirements and reviewed before it is included in an audit pack.",
        "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "evidence_log",
      "title": "Evidence log",
      "contentType": "register_table",
      "required": true,
      "minimumExampleRows": 6,
      "columns": [
        {
          "name": "Evidence ID",
          "type": "text",
          "required": "yes",
          "description": "Unique evidence identifier.",
          "example": "ELAI-001"
        },
        {
          "name": "Evidence / artifact",
          "type": "text",
          "required": "yes",
          "description": "Evidence name.",
          "example": "Approved ISMS Scope Statement"
        },
        {
          "name": "Evidence type",
          "type": "select",
          "required": "yes",
          "description": "Document, register, record, minutes, report or screenshot.",
          "example": "Document"
        },
        {
          "name": "Clause or control",
          "type": "text",
          "required": "yes",
          "description": "Related ISO clause or control.",
          "example": "Clause 4.3"
        },
        {
          "name": "Where it lives",
          "type": "text",
          "required": "yes",
          "description": "Controlled evidence location.",
          "example": "ISMS controlled documents"
        },
        {
          "name": "Owner",
          "type": "select",
          "required": "yes",
          "description": "Evidence owner.",
          "example": "ISMS Manager",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Date produced",
          "type": "date",
          "required": "conditional",
          "description": "Evidence creation or export date.",
          "example": "2026-07-25"
        },
        {
          "name": "Covers period",
          "type": "text",
          "required": "yes",
          "description": "Period covered by the evidence.",
          "example": "2026 Q3"
        },
        {
          "name": "Collected",
          "type": "select",
          "required": "yes",
          "description": "Whether evidence has been collected.",
          "example": "Yes"
        },
        {
          "name": "Independently reviewed",
          "type": "boolean",
          "required": "yes",
          "description": "Whether evidence was reviewed.",
          "example": "Yes",
          "valueSet": "std.boolean",
          "options": [
            "Yes",
            "No"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select Yes or No."
          }
        },
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "description": "Accepted, accepted with comments, pending or rejected.",
          "example": "Accepted",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Confidentiality",
          "type": "select",
          "required": "yes",
          "description": "Classification.",
          "example": "Internal"
        },
        {
          "name": "Audit pack status",
          "type": "select",
          "required": "yes",
          "description": "Ready, Needs review, Excluded or Replaced.",
          "example": "Ready"
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "no",
          "description": "Additional review notes.",
          "example": "Matches certification scope."
        }
      ],
      "hint": {
        "text": "Every evidence row should show what requirement it supports, where it lives, who owns it, and whether it is ready for auditor use.",
        "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review"
      }
    },
    {
      "order": 6,
      "id": "audit_pack_decision",
      "title": "Audit pack decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Evidence items",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Collected items",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Independently reviewed items",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Items not ready",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with an audit-pack decision so unresolved evidence gaps are visible before the audit.",
        "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review"
      }
    },
    {
      "order": 7,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to ELAI.artifactDefinition.v2.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "Evidence rows must include clause or control, owner, location, collected status, independent review status and audit pack status.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 8.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Operational planning and control this register evidences."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 2,
        "volumeTitle": "Implementation & Certification",
        "chapterId": "S-07-05-00",
        "chapterTitle": "Internal Audit & Management Review",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "evidence_log",
        "audit_pack_decision"
      ],
      "minExampleRows": 6,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.index.v1"
}