{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "ROAR.artifactDefinition.v2",
  "artifactId": "ROAR",
  "title": "ISMS Risks and Opportunities Register",
  "artifactType": "Register",
  "format": "xlsx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for tracking ISMS risks and opportunities, including source, assessment, owner, decision, treatment or exploitation action, evidence and review status.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use ROAR to keep risks and opportunities visible as management-system inputs, not only as one-time assessment results.",
        "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Record the source, decision and follow-up for each risk or opportunity so actions can be reviewed for effectiveness.",
        "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "risks_opportunities_register",
      "title": "Risks and opportunities register",
      "contentType": "register_table",
      "required": true,
      "minimumExampleRows": 6,
      "columns": [
        {
          "name": "Item ID",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Type",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Source",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Description",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Affected ISMS Element",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Likelihood",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.likelihood",
          "options": [
            "Rare",
            "Unlikely",
            "Possible",
            "Likely",
            "Almost Certain"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Impact",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.impact",
          "options": [
            "Insignificant",
            "Minor",
            "Moderate",
            "Major",
            "Severe"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Priority",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.priority",
          "options": [
            "P1",
            "P2",
            "P3",
            "P4"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Owner",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Decision",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Action",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Due Date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence Reference",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Status",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.status.generic",
          "options": [
            "Draft",
            "In Progress",
            "Under Review",
            "Approved",
            "Closed",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Review Notes",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Each row should show whether the item is a risk or opportunity, how it was assessed, who owns it and what action follows.",
        "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc"
      }
    },
    {
      "order": 6,
      "id": "roar_review_decision",
      "title": "ROAR review decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Items reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Risks open",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Opportunities open",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Actions overdue",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so risk and opportunity actions feed management review and continual improvement.",
        "bookReference": "Volume 2, S-07-02-00 Risk Assessment & Risk Treatment Proc"
      }
    },
    {
      "order": 7,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to ROAR.artifactDefinition.v2.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "Rows must include type, source, description, affected ISMS element, priority, owner, decision, action, due date, status and evidence reference.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022 6.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 2,
        "volumeTitle": "Implementation & Certification",
        "chapterId": "S-07-02-00",
        "chapterTitle": "Risk Assessment & Risk Treatment Proc",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "CHG",
        "longForm": "Change"
      },
      {
        "abbr": "IL",
        "longForm": "Impact Level"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "risks_opportunities_register",
        "roar_review_decision"
      ],
      "minExampleRows": 6,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.items.v1"
}