{ "schemaVersion": "artifactDefinition.v2", "definitionId": "SIR.artifactDefinition.v2", "artifactId": "SIR", "title": "Security Incident Register", "artifactType": "Register", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for tracking security incidents from detection through triage, containment, investigation, communication, corrective action, lessons learned and closure evidence.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use SIR to keep security incidents visible from first report through closure, evidence and lessons learned.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Capture enough timeline, impact, evidence and ownership detail to support escalation, audit and post-incident review.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "security_incident_register", "title": "Security incident register", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Incident ID", "type": "text", "required": "yes", "description": "Unique incident identifier.", "example": "SIR-001" }, { "name": "Detected Date", "type": "date", "required": "yes", "description": "Date the incident was detected.", "example": "2026-08-03" }, { "name": "Detection Source", "type": "select", "required": "yes", "description": "Detection or report source.", "example": "EDR alert" }, { "name": "Category", "type": "select", "required": "yes", "description": "Incident category.", "example": "Malware detection" }, { "name": "Severity", "type": "select", "required": "yes", "description": "Low, Medium, High or Critical.", "example": "Medium", "valueSet": "domain.severity", "options": [ "Critical", "High", "Medium", "Low", "Informational" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Status", "type": "select", "required": "yes", "description": "Open, contained, in review, resolved or closed.", "example": "Closed", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Owner", "type": "select", "required": "yes", "description": "Responsible owner.", "example": "Incident Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Affected System or Data", "type": "text", "required": "yes", "description": "Affected asset, system, data or process.", "example": "Corporate email" }, { "name": "Impact Summary", "type": "text", "required": "yes", "description": "Business, data or service impact.", "example": "No data loss identified" }, { "name": "Containment Action", "type": "text", "required": "yes", "description": "Immediate containment action.", "example": "Device isolated" }, { "name": "Communication Required", "type": "text", "required": "yes", "description": "Notification or communication requirement.", "example": "Internal update" }, { "name": "Notification Status", "type": "text", "required": "yes", "description": "Status of communication or notification.", "example": "Completed" }, { "name": "Corrective Action", "type": "text", "required": "no", "description": "Linked corrective action.", "example": "CAR-2026-024" }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence record.", "example": "EDR-CASE-4481" }, { "name": "Closure Date", "type": "date", "required": "conditional", "description": "Closure date for closed incidents.", "example": "2026-08-09" }, { "name": "Lessons Learned", "type": "text", "required": "conditional", "description": "Lessons learned or reason none were identified.", "example": "Awareness reminder added" } ], "hint": { "text": "Each row should show what happened, what was affected, how it was contained, which communication was required and how closure is evidenced.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" } }, { "order": 6, "id": "incident_review_decision", "title": "Incident review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Incidents reviewed", "type": "text", "required": "yes" }, { "name": "Open incidents", "type": "text", "required": "yes" }, { "name": "High or critical incidents", "type": "text", "required": "yes" }, { "name": "Corrective actions open", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so incident trends and open corrective actions feed management review.", "bookReference": "Volume 3, S-01-07-00 Incident Response & Security Monitori" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to SIR.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Incident rows must include detection date, detection source, category, severity, status, owner, affected system or data, impact, containment action and evidence reference.", "Closed incidents must include closure date and lessons learned or a documented reason why no lessons were identified.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 3, "volumeTitle": "Secure Engineering", "chapterId": "S-01-07-00", "chapterTitle": "Incident Response & Security Monitori", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983455" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CHG", "longForm": "Change" }, { "abbr": "EDR", "longForm": "Endpoint Detection and Response" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "INC", "longForm": "Incident" }, { "abbr": "IP", "longForm": "Internet Protocol" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "SIEM", "longForm": "Security Information and Event Management" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "security_incident_register", "incident_review_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }