{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "MDR.artifactDefinition.v2",
  "artifactId": "MDR",
  "title": "Mandatory Documents and Records Register",
  "artifactType": "Register",
  "format": "xlsx",
  "productTier": "Basic",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for tracking the 27 mandatory ISO 27001 documents and records, including ownership, required status, approval, review cadence, location and evidence readiness.",
  "mandatoryDocumentSet": [
    {
      "id": "MDR-001",
      "documentOrRecord": "ISMS scope statement",
      "isoReference": "Clause 4.3",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-002",
      "documentOrRecord": "Information security policy",
      "isoReference": "Clause 5.2",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-003",
      "documentOrRecord": "Information security risk assessment process",
      "isoReference": "Clause 6.1.2",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-004",
      "documentOrRecord": "Information security risk treatment process",
      "isoReference": "Clause 6.1.3",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-005",
      "documentOrRecord": "Statement of Applicability",
      "isoReference": "Clause 6.1.3 d",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-006",
      "documentOrRecord": "Information security objectives",
      "isoReference": "Clause 6.2",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-007",
      "documentOrRecord": "Evidence of competence",
      "isoReference": "Clause 7.2",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-008",
      "documentOrRecord": "Documented information required by the ISMS",
      "isoReference": "Clause 7.5",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-009",
      "documentOrRecord": "Operational planning and control records",
      "isoReference": "Clause 8.1",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-010",
      "documentOrRecord": "Risk assessment results",
      "isoReference": "Clause 8.2",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-011",
      "documentOrRecord": "Risk treatment results",
      "isoReference": "Clause 8.3",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-012",
      "documentOrRecord": "Monitoring and measurement results",
      "isoReference": "Clause 9.1",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-013",
      "documentOrRecord": "Internal audit programme",
      "isoReference": "Clause 9.2",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-014",
      "documentOrRecord": "Internal audit results",
      "isoReference": "Clause 9.2",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-015",
      "documentOrRecord": "Management review results",
      "isoReference": "Clause 9.3",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-016",
      "documentOrRecord": "Nonconformity records",
      "isoReference": "Clause 10.1",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-017",
      "documentOrRecord": "Corrective action results",
      "isoReference": "Clause 10.1",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-018",
      "documentOrRecord": "Inventory of information and associated assets",
      "isoReference": "A 5.9",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-019",
      "documentOrRecord": "Acceptable use rules for information and associated assets",
      "isoReference": "A 5.10",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-020",
      "documentOrRecord": "Access control policy or rules",
      "isoReference": "A 5.15",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-021",
      "documentOrRecord": "Identity management records",
      "isoReference": "A 5.16",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-022",
      "documentOrRecord": "Authentication information allocation and management records",
      "isoReference": "A 5.17",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-023",
      "documentOrRecord": "Privileged access rights records",
      "isoReference": "A 8.2",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-024",
      "documentOrRecord": "Information access restriction rules",
      "isoReference": "A 8.3",
      "mandatoryStatus": "Mandatory document"
    },
    {
      "id": "MDR-025",
      "documentOrRecord": "Secure configuration records",
      "isoReference": "A 8.9",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-026",
      "documentOrRecord": "Information deletion records",
      "isoReference": "A 8.10",
      "mandatoryStatus": "Mandatory record"
    },
    {
      "id": "MDR-027",
      "documentOrRecord": "Event log records",
      "isoReference": "A 8.15",
      "mandatoryStatus": "Mandatory record"
    }
  ],
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use MDR to make the complete mandatory document set visible and audit-ready.",
        "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Track the required document or record itself, not only the template; link the approved location and evidence status.",
        "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "mandatory_documents_register",
      "title": "Mandatory documents and records register",
      "contentType": "register_table",
      "required": true,
      "requiredExampleRows": 27,
      "columns": [
        {
          "name": "Record ID",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Document or Record",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "ISO Reference",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Mandatory Status",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Purpose",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Owner",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Approver",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Location",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Version",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Status",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.status.generic",
          "options": [
            "Draft",
            "In Progress",
            "Under Review",
            "Approved",
            "Closed",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Last Review Date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Next Review Date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence Reference",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Each row should show whether the document or record exists, where it is controlled, who owns it and when it is reviewed.",
        "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning"
      }
    },
    {
      "order": 6,
      "id": "mandatory_documents_review",
      "title": "Mandatory documents review",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Items reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Approved items",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Items needing update",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Missing items",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so gaps in mandatory documented information are visible before audit.",
        "bookReference": "Volume 2, S-09-01-00 Implementation Readiness & Planning"
      }
    },
    {
      "order": 7,
      "id": "evidence_and_records",
      "title": "Evidence and records",
      "contentType": "evidence_table",
      "required": true,
      "intro": "Related records live in the companion documents named below. This file cites them by their approved version. It does not copy their content. The Owner named on the cover is accountable for those live records."
    },
    {
      "order": 8,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to MDR.artifactDefinition.v2.",
    "JSON Definition must name the complete 27-item mandatoryDocumentSet.",
    "JSON Example mandatory_documents_register section must contain exactly 27 rows matching the mandatoryDocumentSet.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "Rows must include ISO reference, mandatory status, owner, location, status and evidence reference.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 8.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Operational planning and control this register evidences."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 2,
        "volumeTitle": "Implementation & Certification",
        "chapterId": "S-09-01-00",
        "chapterTitle": "Implementation Readiness & Planning",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "CAPA",
        "longForm": "Corrective and Preventive Action"
      },
      {
        "abbr": "CEO",
        "longForm": "Chief Executive Officer"
      },
      {
        "abbr": "CIS",
        "longForm": "Center for Internet Security"
      },
      {
        "abbr": "DEL",
        "longForm": "Deliverable"
      },
      {
        "abbr": "DSAR",
        "longForm": "Data Subject Access Request"
      },
      {
        "abbr": "HR",
        "longForm": "Human Resources"
      },
      {
        "abbr": "IAM",
        "longForm": "Identity and Access Management"
      },
      {
        "abbr": "ISP",
        "longForm": "Information Security Policy"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "MDR",
        "longForm": "Managed Detection and Response"
      },
      {
        "abbr": "MFA",
        "longForm": "Multi-Factor Authentication"
      },
      {
        "abbr": "NC",
        "longForm": "Nonconformity"
      },
      {
        "abbr": "RAM",
        "longForm": "Risk Assessment Methodology"
      },
      {
        "abbr": "RBAC",
        "longForm": "Role-Based Access Control"
      },
      {
        "abbr": "RTP",
        "longForm": "Risk Treatment Plan"
      },
      {
        "abbr": "SIEM",
        "longForm": "Security Information and Event Management"
      },
      {
        "abbr": "SLA",
        "longForm": "Service Level Agreement"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "mandatory_documents_register",
        "mandatory_documents_review"
      ],
      "minExampleRows": 3,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.items.v1"
}