create-filegrc 0.1.0 → 0.3.0

package/template/data/policies/policy-data-protection-handling.json

@@ -5,7 +5,6 @@
   "title": "Data Protection and Handling Policy",
   "status": "draft",
   "ownerIds": ["person-policy-owner"],
-  "approverIds": ["person-independent-approver"],
   "policyKind": "information-security",
   "version": "1.0",
   "effectiveOn": "{{effective_date}}",

package/template/data/policies/policy-employee-handbook.json

@@ -5,7 +5,6 @@
   "title": "Employee Handbook",
   "status": "draft",
   "ownerIds": ["person-policy-owner"],
-  "approverIds": ["person-independent-approver"],
   "policyKind": "workforce-conduct",
   "version": "1.0",
   "effectiveOn": "{{effective_date}}",

package/template/data/policies/policy-information-security.json

@@ -5,7 +5,6 @@
   "title": "Information Security Policy",
   "status": "draft",
   "ownerIds": ["person-policy-owner"],
-  "approverIds": ["person-independent-approver"],
   "policyKind": "information-security",
   "version": "1.0",
   "effectiveOn": "{{effective_date}}",

package/template/data/policies/policy-information-security.md

@@ -26,9 +26,9 @@ The policy owner:
 - Coordinates incidents, exercises, reviews, and audit work.
 - Approves security exceptions or obtains the required approval.
 
-An external independent reviewer chairs the security and risk oversight group. This person must be separate from the policy owner and must not operate the controls under review. The reviewer approves policies and governed plans, challenges management's assessment of control operation, and records independent decisions.
+An independent reviewer chairs the security and risk oversight group. This person must be separate from the policy owner and able to challenge the owner's decisions. The reviewer will usually be another leader or manager in the organization, but may be external. The reviewer approves policies and governed plans, challenges management's assessment of control operation, and records independent decisions.
 
-The security and risk oversight group meets at least quarterly to review the risk register, material incidents, significant findings, vendor and access review results, policy changes, exercises, and overdue work. Each meeting has formal minutes, decisions, and assigned actions. A one-person company must appoint a qualified external person to fill the independent reviewer role before it approves the program.
+The security and risk oversight group meets at least quarterly to review the risk register, material incidents, significant findings, vendor and access review results, policy changes, exercises, and overdue work. Each meeting has formal minutes, decisions, and assigned actions. A one-person company must appoint a qualified external person to fill the independent reviewer role because no second internal person is available.
 
 System and process owners classify their systems and data, approve access, maintain safeguards, respond to findings, and keep recovery information current.
 
@@ -230,4 +230,4 @@ Violations may result in access removal, corrective action, contract remedies, o
 
 ## Review
 
-The policy owner reviews this policy at least annually and after a material change to systems, services, risks, or obligations. The external independent reviewer, who must be separate from the policy owner, approves this policy and other governed policies and plans. The security and risk oversight group reviews material changes and records its decision in meeting minutes. Git history records approvals and changes.
+The policy owner reviews this policy at least annually and after a material change to systems, services, risks, or obligations. An independent reviewer who is separate from the policy owner approves this policy and other governed policies and plans. The reviewer may be internal or external. The security and risk oversight group reviews material changes and records its decision in meeting minutes. Git history records approvals and changes.

package/template/data/policies/policy-mobile-computing-communications.json

@@ -5,7 +5,6 @@
   "title": "Mobile Computing and Communications Policy",
   "status": "draft",
   "ownerIds": ["person-policy-owner"],
-  "approverIds": ["person-independent-approver"],
   "policyKind": "information-security",
   "version": "1.0",
   "effectiveOn": "{{effective_date}}",

package/template/data/renderer.json

@@ -3,5 +3,6 @@
   "id": "renderer-settings",
   "type": "renderer-settings",
   "title": "Renderer settings",
-  "showOnboarding": true
+  "showOnboarding": true,
+  "completedStagePageIds": []
 }

package/template/data/risk-assessments/AGENTS.md

@@ -9,7 +9,7 @@ Use a `risk-assessment` for the dated assessment process and one `risk` record f
 3. Scaffold the assessment and keep it `planned` or `in-progress` while the work is underway.
 4. Write the method, inputs reviewed, threats considered, observations, decisions, and conclusion in Record Markdown.
 5. Create or update the individual `risk` records. Link all risks considered with `riskIds`, newly identified risks with `newRiskIds`, and materially changed risks with `changedRiskIds`.
-6. Link evidence, findings, and follow-up action items. Do not hide an unresolved issue in the narrative.
+6. Link evidence from the assessment. When a confirmed gap needs its own lifecycle, create a Finding whose `sourceResourceId` points to this assessment. Create an Action Item only for separately assigned follow-up. Do not hide an unresolved issue in the narrative.
 7. Use a reviewer who is not one of the assessors. Set `methodology` and `approvedOn` before marking the assessment `complete`.
 8. Run validation, review the full diff, and commit the assessment, risk changes, and evidence together when practical.
 

package/template/data/systems/system-filegrc-program-repository.md

@@ -1,9 +1,9 @@
-# FileGRC Program Repository
+# filegrc Program Repository
 
-This Git repository is the system of record for FileGRC governance records and their revision history. It can supply the training and acknowledgement catalog, exception and finding populations, policy and document approvals, obligation history, event checklists, and management evidence indexes.
+This Git repository is the system of record for filegrc governance records and their revision history. It can supply the training and acknowledgement catalog, exception and finding populations, policy and document approvals, obligation history, Policy Event workflows, and management evidence indexes.
 
 ## Evidence Extraction
 
-Run FileGRC from a clean commit. Use resource dates and audit links to select the exact engagement date or period, save the query or agent instructions with the export, and retain the fixed result behind an evidence record. Record a zero count when the committed source query returns no relevant items.
+Run filegrc from a clean commit. Use resource dates and audit links to select the exact engagement date or period, save the query or agent instructions with the export, and retain the fixed result behind an evidence record. Record a zero count when the committed source query returns no relevant items.
 
 The repository is authoritative only for records stored here. Identity, workforce, source-control, deployment, monitoring, endpoint, backup, vulnerability, and vendor systems remain authoritative for the activity they perform.

package/template/data/workspace.json

@@ -5,7 +5,7 @@
   "type": "workspace",
   "title": "{{company_name}} SOC 2 Program",
   "organizationName": "{{company_name}}",
-  "timezone": "UTC",
+  "timezone": "{{timezone}}",
   "description": "SOC 2 Security program based on the AICPA Trust Services Criteria.",
   "riskMethodology": {
     "method": "5x5 likelihood and impact",

package/template/package.json

@@ -1,8 +1,8 @@
 {
   "name": "{{project_name}}",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "private": true,
-  "description": "FileGRC workspace for a SOC 2 program",
+  "description": "filegrc workspace for a SOC 2 program",
   "type": "module",
   "scripts": {
     "serve": "filegrc serve",

package/template-parameters.json

@@ -2,18 +2,30 @@
   "parameters": [
     {
       "key": "company_name",
-      "prompt": "Company name",
+      "prompt": "Legal organization name",
       "required": true
     },
     {
       "key": "policy_owner_name",
-      "prompt": "Your name",
+      "prompt": "Policy owner name",
       "required": true
     },
     {
       "key": "security_contact_email",
       "prompt": "Security contact email",
       "required": true
+    },
+    {
+      "key": "policy_owner_email",
+      "prompt": "Policy owner email",
+      "required": true,
+      "defaultFrom": "security_contact_email"
+    },
+    {
+      "key": "timezone",
+      "prompt": "Program timezone",
+      "required": true,
+      "defaultSource": "local-timezone"
     }
   ],
   "generated": [
@@ -26,6 +38,10 @@
       "key": "project_name",
       "source": "target-directory-name"
     },
+    {
+      "key": "filegrc_version",
+      "source": "resolved-filegrc-version"
+    },
     {
       "key": "filegrc_version_range",
       "source": "resolved-filegrc-version"

package/template/data/people/person-independent-approver.json

@@ -1,10 +0,0 @@
-{
-  "schemaVersion": 1,
-  "id": "person-independent-approver",
-  "type": "person",
-  "title": "Independent Approver",
-  "status": "external",
-  "role": "External Security and Risk Oversight Reviewer",
-  "employmentType": "external-reviewer",
-  "teamIds": ["team-security-risk-oversight"]
-}