{ "schemaVersion": "artifactDefinition.v2", "definitionId": "REQT.artifactDefinition.v2", "artifactId": "REQT", "title": "ISO 27001 Clauses 4-10 Requirements Tracker", "artifactType": "Register", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "register_schema", "title": "Register schema", "contentType": "schema_table", "required": true }, { "order": 6, "id": "requirements_tracker_entries", "title": "Requirements tracker entries", "contentType": "register_table", "required": true, "columns": [ { "name": "Clause ID", "type": "text", "required": "yes" }, { "name": "Clause title", "type": "text", "required": "yes" }, { "name": "Requirement summary", "type": "text", "required": "yes" }, { "name": "Implementation expectation", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Implementation status", "type": "text", "required": "yes" }, { "name": "Documentation status", "type": "text", "required": "yes" }, { "name": "Evidence status", "type": "select", "required": "yes", "valueSet": "domain.evidenceStatus", "options": [ "Missing", "Requested", "Received", "Verified", "Rejected" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Operating effectiveness", "type": "text", "required": "yes" }, { "name": "Linked artifact(s)", "type": "artifactRef", "required": "yes", "description": "References companion Contract(s) by artifactId.", "artifactRef": { "scope": "companion", "value": "artifactId", "cardinality": "oneOrMore", "separator": ";", "description": "Cell values are companion Contract artifactId values (e.g. RR, RTP, SOA)." } }, { "name": "Evidence reference", "type": "text", "required": "yes" }, { "name": "Gap / action", "type": "text", "required": "yes" }, { "name": "Target date", "type": "date", "required": "yes" }, { "name": "Review date", "type": "date", "required": "yes" } ] }, { "order": 7, "id": "register_completeness_decision", "title": "Register completeness decision", "contentType": "decision_table", "required": true }, { "order": 8, "id": "requirements_tracker", "title": "Requirements tracker", "contentType": "section", "required": true, "hint": { "text": "Recovered during enrichment." } }, { "order": 9, "id": "evidence_and_records", "title": "Evidence and records", "contentType": "evidence_table", "required": true, "intro": "Related records live in the companion documents named below. This file cites them by their approved version. It does not copy their content. The Owner named on the cover is accountable for those live records." }, { "order": 10, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to REQT.artifactDefinition.v2.", "JSON Example must cover ISO/IEC 27001:2022 management-system clauses 4.1 through 10.2.", "Each requirement row must include owner, status, evidence state, linked artifact or evidence reference, and review or target date.", "Body must render the title page, abstract, document control, instructions, schema, register entries and completeness decision in that order.", "No legacy MD references, mdDefinition/mdExample sourceModel entries, generic placeholder dates, bold Hint labels or standalone Book reference section allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 5, "volumeTitle": "Dual Compliance", "chapterId": "S-08-04-00", "chapterTitle": "ISO 27001 & NIS2", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983479" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CL", "longForm": "Control Library" }, { "abbr": "CR", "longForm": "Change Request" }, { "abbr": "DR", "longForm": "Disaster Recovery" }, { "abbr": "GS", "longForm": "General Support" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IP", "longForm": "Internet Protocol" }, { "abbr": "IRP", "longForm": "Incident Response Plan" }, { "abbr": "ISP", "longForm": "Information Security Policy" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "KPI", "longForm": "Key Performance Indicator" }, { "abbr": "OS", "longForm": "Operating System" }, { "abbr": "RACI", "longForm": "Responsible, Accountable, Consulted, and Informed" }, { "abbr": "RAM", "longForm": "Risk Assessment Methodology" }, { "abbr": "RAMT", "longForm": "Risk Acceptance Minutes" }, { "abbr": "RASM", "longForm": "Risk Analysis Statement according to MAGERIT" }, { "abbr": "RR", "longForm": "Risk Register" }, { "abbr": "RTP", "longForm": "Risk Treatment Plan" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "register_schema", "requirements_tracker_entries", "register_completeness_decision", "requirements_tracker" ], "minExampleRows": 3, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }