{ "schemaVersion": "artifactDefinition.v2", "definitionId": "PBIVC.artifactDefinition.v2", "artifactId": "PBIVC", "title": "Process Owner Business Impact Validation Checklist", "artifactType": "Checklist", "format": "docx", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable template/example maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture", "mdDefinition": "generated output", "mdExample": "generated output" }, "purpose": "Provide auditable evidence for Process Owner Business Impact Validation Checklist.", "hintPolicy": { "storage": "Each content section stores its hint in this JSON Definition.", "visualization": "Generated Office and Markdown outputs render each hint as a visually highlighted callout after the section content.", "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint. Hints must not be generic or mechanically repeated.", "format": { "requiredParts": [ "short practical explanation", "detailed book reference" ] } }, "controlledValues": { "result": [ "Successful", "Failed", "Pending", "Not applicable" ], "yesNo": [ "Yes", "No" ], "completionStatus": [ "Complete", "Conditionally complete", "Pending", "Rejected" ], "priority": [ "Critical", "High", "Medium", "Low" ], "evidenceQuality": [ "Complete", "Partial", "Missing", "Not applicable" ] }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null, "fields": [ { "name": "Document Title", "type": "text", "required": "yes" }, { "name": "Document ID", "type": "text", "required": "yes" }, { "name": "Version", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Organization", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Approver", "type": "text", "required": "yes" }, { "name": "Classification", "type": "text", "required": "yes" }, { "name": "Effective Date", "type": "date", "required": "yes" }, { "name": "Next Review Date", "type": "date", "required": "yes" } ], "intro": "Use this section to identify the document and its control context." }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "requiredContent": "Explain the purpose of the Process Owner Business Impact Validation Checklist and the evidence it creates for ISO 27001 implementation and audit readiness.", "hint": { "text": "Use this checklist as an auditable control record. It should show context, checks performed, evidence reviewed, open items, and final decision for Process Owner Business Impact Validation Checklist.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null, "fields": [ { "name": "Purpose", "type": "text", "required": "yes" }, { "name": "Used by", "type": "text", "required": "yes" }, { "name": "Maintained by", "type": "text", "required": "yes" }, { "name": "Evidence role", "type": "text", "required": "yes" }, { "name": "ISO reference", "type": "text", "required": "yes" }, { "name": "Review cadence", "type": "text", "required": "yes" } ], "intro": "Record ownership, approval, classification, version, review cadence, and evidence context." }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "requiredContent": "1. Identify the owner responsible for maintaining this checklist.\n2. Complete the context section before starting the checks.\n3. Record every check with owner, date, result, evidence, and notes.\n4. Escalate failed or pending mandatory checks as blockers unless an approved exception exists.\n5. Sign off only after evidence, open items, lifecycle links, and completion decision are reviewed.", "intro": "Explain how to complete, maintain, review, and use this checklist as operational evidence.", "hint": { "text": "Treat this section as the operating instruction for the checklist owner. It defines the evidence standard and when Process Owner Business Impact Validation Checklist cannot be closed.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 6, "id": "process_context", "title": "Process context", "contentType": "field_table", "required": true, "fields": [ { "name": "Process name", "type": "text", "required": "yes" }, { "name": "Process owner", "type": "text", "required": "yes" }, { "name": "Business unit", "type": "text", "required": "yes" }, { "name": "Criticality", "type": "text", "required": "yes" }, { "name": "Customers impacted", "type": "text", "required": "yes" }, { "name": "Regulatory relevance", "type": "text", "required": "yes" }, { "name": "BIA reference", "type": "text", "required": "yes" }, { "name": "Review trigger", "type": "text", "required": "yes" } ], "intro": "Describe the process and accountability context for the business impact validation.", "hint": { "text": "The validation must start from a clearly identified process, owner, scope, and trigger.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 7, "id": "impact_assumptions", "title": "Impact assumptions", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Impact area", "type": "text", "required": "yes" }, { "name": "Assumption", "type": "text", "required": "yes" }, { "name": "Time threshold", "type": "text", "required": "yes" }, { "name": "Impact rating", "type": "text", "required": "yes" }, { "name": "Validated by", "type": "text", "required": "yes" }, { "name": "Date", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Validate financial, operational, legal, customer, safety, and reputation impact assumptions.", "hint": { "text": "Auditors expect BIA assumptions to be justified, reviewed by process owners, and supported by evidence or rationale.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 8, "id": "rto_rpo_validation", "title": "RTO / RPO validation", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Service / data set", "type": "text", "required": "yes" }, { "name": "RTO", "type": "text", "required": "yes" }, { "name": "RPO", "type": "text", "required": "yes" }, { "name": "Business justification", "type": "text", "required": "yes" }, { "name": "Technical feasibility", "type": "text", "required": "yes" }, { "name": "Validated by", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Validate recovery-time and recovery-point objectives against business needs and technical feasibility.", "hint": { "text": "RTO/RPO values should not be aspirational only; link them to process impact and recovery capability.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 9, "id": "dependencies_and_resources", "title": "Dependencies and minimum resources", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Dependency / resource", "type": "text", "required": "yes" }, { "name": "Type", "type": "text", "required": "yes" }, { "name": "Minimum requirement", "type": "text", "required": "yes" }, { "name": "Provider / owner", "type": "text", "required": "yes" }, { "name": "Availability assumption", "type": "text", "required": "yes" }, { "name": "Validation result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Confirm people, systems, suppliers, facilities, data, and equipment required for minimum operation.", "hint": { "text": "Continuity plans fail when dependencies are incomplete. Record external dependencies and manual-workaround assumptions.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 10, "id": "validation_checklist", "title": "Validation checklist", "contentType": "evidence_log_table", "required": true, "columns": [ { "name": "Check ID", "type": "text", "required": "yes" }, { "name": "Area", "type": "text", "required": "yes" }, { "name": "What was validated", "type": "text", "required": "yes" }, { "name": "Required?", "type": "text", "required": "yes" }, { "name": "Performed by", "type": "text", "required": "yes" }, { "name": "Approved by", "type": "text", "required": "yes" }, { "name": "Date", "type": "text", "required": "yes" }, { "name": "Result", "type": "text", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Use this table as the main BIA validation audit trail.", "hint": { "text": "Capture who validated each assumption, when, with which result, and which evidence supports it.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 11, "id": "gaps_and_actions", "title": "Gaps and actions", "contentType": "action_table", "required": true, "columns": [ { "name": "Gap / action ID", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Related process", "type": "text", "required": "yes" }, { "name": "Priority", "type": "select", "required": "yes", "valueSet": "domain.priority", "options": [ "P1", "P2", "P3", "P4" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Due date", "type": "date", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Notes", "type": "text", "required": "yes" } ], "intro": "Track gaps in assumptions, dependencies, feasibility, or continuity requirements.", "hint": { "text": "Every unrealistic target or missing dependency should create an action or accepted risk.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 12, "id": "validation_decision", "title": "Validation decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Process owner confirmation", "type": "text", "required": "yes" }, { "name": "BCM review", "type": "text", "required": "yes" }, { "name": "Open blocker decision", "type": "text", "required": "yes" }, { "name": "Final status", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "intro": "State the final process-owner validation decision.", "hint": { "text": "The decision should explain whether the BIA record is accepted, conditionally accepted, pending, or rejected.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 13, "id": "evidence_reviewed", "title": "Evidence reviewed", "contentType": "section", "required": true, "hint": { "text": "Recovered during enrichment.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } }, { "order": 14, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 2, S-07-04-00 Business Impact Analysis & Business C" } } ], "validationRules": [ "Body MD, JSON Definition, and JSON Example must use the same section order and compatible section titles.", "Each section must have an intro that explains the practical purpose of the section before data/content is rendered.", "Every non-formal content section must have a context-specific hint stored in the JSON Definition and rendered as a callout after the section content.", "Checklist sections must capture what was done, who performed it, when it was done, the result, evidence reference, and notes where applicable.", "Do not include a separate Book reference chapter; book linkage belongs inside the section hint.", "Example data must look realistic and audit-ready, but must not contain real personal data.", "JSON Example must contain definitionRef pointing to PBIVC.artifactDefinition.v2." ], "instructionsForGenerator": [ "Use this JSON Definition as the machine-readable contract.", "Use JSON Example as the curated realistic example data source.", "Use Body MD as the canonical human-readable source.", "Generate MD Definition and MD Example downstream; do not treat them as curated source relations.", "Render section intros before content and section hints as callouts after content." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this file by version." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-04-00", "chapterTitle": "Business Impact Analysis & Business Continuity Planning", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Provide auditable evidence for Process Owner Business Impact Validation Checklist.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "BIA", "longForm": "Business Impact Analysis" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "AI", "longForm": "Artificial Intelligence" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CISO", "longForm": "Chief Information Security Officer" }, { "abbr": "CRM", "longForm": "Customer Relationship Management" }, { "abbr": "DPIA", "longForm": "Data Protection Impact Assessment" }, { "abbr": "DRP", "longForm": "Disaster Recovery Plan" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "RPO", "longForm": "Recovery Point Objective" }, { "abbr": "RTO", "longForm": "Recovery Time Objective" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SoA", "longForm": "Statement of Applicability" }, { "abbr": "BCM", "longForm": "Business Continuity Management" } ], "must": [ "This file's function is: Provide auditable evidence for Process Owner Business Impact Validation Checklist. It must not be rewritten as a generic operating-rules essay.", "Identify the checklist owner and the object, process, person, control, or release being reviewed.", "Complete the context and evidence sections before recording the final decision.", "For each check, capture what was done, who performed it, who approved it where applicable, the date, result, evidence reference, and notes.", "Use controlled result values: Successful, Failed, Pending, Not applicable.", "Treat failed or pending mandatory checks as blockers unless an approved, time-limited exception exists.", "Link the checklist outcome to the relevant ISMS register, risk, control, evidence, or lifecycle record." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "process_context", "workedExampleOrg": "Arcfield", "minBodyWords": 150, "requiredGroups": [ { "id": "introduction", "heading": "What this checklist is", "mustInclude": [ "checklist" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "process_context", "heading": "Process context", "mustInclude": [ "Process", "context" ] }, { "id": "validation_checklist", "heading": "Validation checklist", "mustInclude": [ "Validation", "checklist" ] }, { "id": "evidence_reviewed", "heading": "Evidence reviewed", "mustInclude": [ "Evidence", "reviewed" ] }, { "id": "validation_decision", "heading": "Validation decision", "mustInclude": [ "Validation", "decision" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.checklist.v1", "contentContractId": "content.checklist.v1" }