{ "schemaVersion": "artifactDefinition.v2", "definitionId": "IL.artifactDefinition.v2", "artifactId": "IL", "title": "Incident Log", "artifactType": "Log", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for recording security events and incidents from reporting through classification, containment, investigation, evidence preservation, corrective actions and closure.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use IL to ensure every reported event is triaged, evidenced and either closed or escalated into incident response.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Capture enough timeline, impact and evidence detail to support investigation, lessons learned and audit follow-up.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "incident_log", "title": "Incident log", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Incident ID", "type": "text", "required": "yes", "description": "Unique incident identifier.", "example": "IL-001" }, { "name": "Reported Date", "type": "date", "required": "yes", "description": "Date reported.", "example": "2026-08-03" }, { "name": "Reporter Role", "type": "text", "required": "yes", "description": "Role or source reporting the event.", "example": "Employee" }, { "name": "Detection Source", "type": "text", "required": "yes", "description": "How the event was detected.", "example": "EDR alert" }, { "name": "Category", "type": "select", "required": "yes", "description": "Incident category.", "example": "Malware detection" }, { "name": "Severity", "type": "select", "required": "yes", "description": "Low, Medium, High or Critical.", "example": "Medium", "valueSet": "domain.severity", "options": [ "Critical", "High", "Medium", "Low", "Informational" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Status", "type": "select", "required": "yes", "description": "Open, contained, in review or closed.", "example": "Closed", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Owner", "type": "select", "required": "yes", "description": "Responsible owner.", "example": "Incident Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Affected Asset or Process", "type": "text", "required": "yes", "description": "Affected asset, process or service.", "example": "Corporate email" }, { "name": "Impact Summary", "type": "text", "required": "yes", "description": "Business or security impact.", "example": "No data loss identified" }, { "name": "Containment Action", "type": "text", "required": "yes", "description": "Immediate action taken.", "example": "Device isolated" }, { "name": "Root Cause", "type": "text", "required": "yes", "description": "Known or suspected root cause.", "example": "Unapproved extension" }, { "name": "Corrective Action Reference", "type": "text", "required": "no", "description": "Linked corrective action.", "example": "CAR-2026-024" }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Incident evidence record.", "example": "EDR-CASE-4481" }, { "name": "Closure Date", "type": "date", "required": "conditional", "description": "Closure date for closed incidents.", "example": "2026-08-09" }, { "name": "Lessons Learned", "type": "text", "required": "conditional", "description": "Lessons learned or reason none were identified.", "example": "Awareness reminder added" } ], "hint": { "text": "Each incident row should show what happened, how it was detected, what was affected, what was done and which evidence proves closure.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" } }, { "order": 6, "id": "incident_review_decision", "title": "Incident review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Incidents reviewed", "type": "text", "required": "yes" }, { "name": "Open incidents", "type": "text", "required": "yes" }, { "name": "High-severity incidents", "type": "text", "required": "yes" }, { "name": "Corrective actions open", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so incident trends and corrective actions feed continual improvement.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to IL.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Incident rows must include reported date, category, severity, status, owner, affected asset or process, impact, action and evidence reference.", "Closed incidents must include closure date and lessons learned or a documented reason why none were identified.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 3, "volumeTitle": "Secure Engineering", "chapterId": "S-01-07-00", "chapterTitle": "Incident Response & Security Monitori", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983455" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CHG", "longForm": "Change" }, { "abbr": "EDR", "longForm": "Endpoint Detection and Response" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IL", "longForm": "Impact Level" }, { "abbr": "INC", "longForm": "Incident" }, { "abbr": "IP", "longForm": "Internet Protocol" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "SIEM", "longForm": "Security Information and Event Management" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "incident_log", "incident_review_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.log.v1" }