{ "schemaVersion": "artifactDefinition.v2", "definitionId": "ISMS-CL.artifactDefinition.v2", "artifactId": "ISMS-CL", "title": "ISMS Change Log", "artifactType": "Log", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for planning, approving, implementing and reviewing changes to the ISMS as a management system, distinct from technical production change management.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use ISMS-CL to prove that changes to the management system were planned, assessed, approved and reviewed.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Record management-system changes before implementation; technical production changes belong in the operational change process.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "isms_change_log", "title": "ISMS change log", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Change ID", "type": "text", "required": "yes", "description": "Unique ISMS change reference.", "example": "ISMS-CHG-001" }, { "name": "Change Description", "type": "text", "required": "yes", "description": "Planned ISMS change.", "example": "Extend scope" }, { "name": "Reason for Change", "type": "text", "required": "yes", "description": "Why the change is needed.", "example": "New support process" }, { "name": "Affected ISMS Element", "type": "text", "required": "yes", "description": "Scope, policy, process, role, risk method or evidence element.", "example": "Scope statement" }, { "name": "Potential Consequences", "type": "text", "required": "yes", "description": "Expected effects and risks.", "example": "More evidence owners" }, { "name": "Resources Required", "type": "text", "required": "yes", "description": "People, tools or budget required.", "example": "ISMS Manager" }, { "name": "Owner", "type": "select", "required": "yes", "description": "Accountable owner.", "example": "ISMS Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approval Role", "type": "text", "required": "yes", "description": "Approval authority.", "example": "Top Management" }, { "name": "Approval Date", "type": "date", "required": "yes", "description": "Approval date.", "example": "2026-08-12" }, { "name": "Planned Implementation Date", "type": "date", "required": "yes", "description": "Planned implementation date.", "example": "2026-09-15" }, { "name": "Actual Implementation Date", "type": "date", "required": "conditional", "description": "Actual date after implementation.", "example": "2026-08-15" }, { "name": "Status", "type": "select", "required": "yes", "description": "Open, planned, in progress, implemented or cancelled.", "example": "In progress", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Effectiveness Review", "type": "text", "required": "yes", "description": "Review plan or result.", "example": "Review after first cycle" }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence record.", "example": "MR-2026-Q3" }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional context.", "example": "Related to IPR-001." } ], "hint": { "text": "Each change row should show why the ISMS change is needed, what it affects, who approved it and how effectiveness will be reviewed.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 6, "id": "change_review_decision", "title": "Change review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Changes reviewed", "type": "text", "required": "yes" }, { "name": "Implemented changes", "type": "text", "required": "yes" }, { "name": "Open changes", "type": "text", "required": "yes" }, { "name": "Effectiveness reviews pending", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so open changes and effectiveness checks remain visible to management.", "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to ISMS-CL.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Change rows must include reason, affected ISMS element, consequences, owner, approval role, implementation date, status and evidence reference.", "Implemented changes must include actual implementation date and effectiveness review status.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 6.3", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-09-01-00", "chapterTitle": "Implementation Readiness & Planning", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "CHG", "longForm": "Change" }, { "abbr": "CL", "longForm": "Control Library" }, { "abbr": "CSR", "longForm": "Certificate Signing Request" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "RAM", "longForm": "Risk Assessment Methodology" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "isms_change_log", "change_review_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.log.v1" }