create-filegrc 0.11.1 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/defaults.js

@@ -1125,24 +1125,39 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
     evidenceSourceKinds: FILEGRC_SOURCE_FAMILIES,
     evidenceOwnerIds: [POLICY_OWNER_APPOINTMENT_ID]
   };
-  const obligationRecords = obligations.map((obligation) => ({
-    id: obligation.id,
-    type: "obligation",
-    title: obligation.title,
+  const obligationRecords = obligations.map((obligation) => {
+    const ruleId = `${obligation.id.replace(/^obligation-/, "obligation-rule-")}-v1`;
+    return {
+      id: obligation.id,
+      type: "obligation",
+      title: obligation.title,
+      status: "proposed",
+      activityType: obligation.activityType,
+      scheduleMode: "rule",
+      ruleIds: [ruleId],
+      ownerIds: obligation.ownerIds,
+      ...(obligation.triggerPrompt ? { triggerPrompt: obligation.triggerPrompt } : {}),
+      ...(obligation.eventRiskLevels ? { eventRiskLevels: obligation.eventRiskLevels } : {}),
+      ...(obligation.scopeResourceIds ? { scopeResourceIds: obligation.scopeResourceIds } : {}),
+      ...(obligation.templateResourceId ? { templateResourceId: obligation.templateResourceId } : {}),
+      controlIds: obligation.controlIds,
+      policyIds: obligation.policyIds
+    };
+  });
+  const obligationRuleRecords = obligations.map((obligation) => ({
+    id: `${obligation.id.replace(/^obligation-/, "obligation-rule-")}-v1`,
+    type: "obligation-rule",
+    title: `${obligation.title} rule v1`,
     status: "proposed",
-    activityType: obligation.activityType,
+    obligationId: obligation.id,
+    activityDefinitionVersion: "1",
     recurrence: obligation.recurrence.mode === "calendar"
       ? { ...obligation.recurrence, anchorDate: effectiveDate }
       : obligation.recurrence,
-    ownerIds: obligation.ownerIds,
-    startsOn: effectiveDate,
-    ...(obligation.triggerPrompt ? { triggerPrompt: obligation.triggerPrompt } : {}),
-    ...(obligation.eventRiskLevels ? { eventRiskLevels: obligation.eventRiskLevels } : {}),
     ...(obligation.window ? { window: obligation.window } : {}),
-    ...(obligation.scopeResourceIds ? { scopeResourceIds: obligation.scopeResourceIds } : {}),
-    ...(obligation.templateResourceId ? { templateResourceId: obligation.templateResourceId } : {}),
-    controlIds: obligation.controlIds,
-    policyIds: obligation.policyIds
+    ...(starterObligationSelector(obligation.id) ? { selector: starterObligationSelector(obligation.id) } : {}),
+    rationale: "Starter proposal derived from the linked Policy. Management must review the cadence, population, completion criteria, and timing before activation.",
+    sourceResourceIds: [...(obligation.policyIds || [])]
   }));
   const sourceCoverageRecords = SOURCE_FAMILIES.map(([sourceFamilyId, title]) => {
     const filegrcManaged = FILEGRC_SOURCE_FAMILIES.includes(sourceFamilyId);
@@ -1201,10 +1216,29 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
     ...foundation,
     ...sourceCoverageRecords.map((record) => recordFile("source-coverage", record)),
     ...retentionScheduleItems.map((record) => recordFile("retention-schedule-items", record)),
-    ...obligationRecords.map((record) => recordFile("obligations", record))
+    ...obligationRecords.map((record) => recordFile("obligations", record)),
+    ...obligationRuleRecords.map((record) => recordFile("obligation-rules", record))
   ];
 }
 
+function starterObligationSelector(obligationId) {
+  const definitions = {
+    "obligation-annual-workforce-competence-review": { resourceType: "person", statuses: ["active"] },
+    "obligation-annual-access-review": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
+    "obligation-annual-network-access-review": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
+    "obligation-quarterly-vulnerability-scan": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
+    "obligation-quarterly-log-review": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
+    "obligation-annual-backup-restoration-test": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
+    "obligation-annual-critical-vendor-review": { resourceType: "vendor", statuses: ["active"], criticalities: ["high", "critical"] }
+  };
+  const definition = definitions[obligationId];
+  return definition ? {
+    ...definition,
+    membershipMode: "as-of",
+    cutoff: "window-end"
+  } : null;
+}
+
 export async function writeBaselineRecords(target, effectiveDate, starter = "security") {
   for (const { path: relativePath, record } of baselineRecordFiles(effectiveDate, starter)) {
     const path = join(target, relativePath);

package/src/index.js

@@ -10,7 +10,7 @@ const execute = promisify(execFile);
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 const textExtensions = new Set(["", ".json", ".md", ".txt", ".yml", ".yaml", ".gitignore"]);
 const STARTER_PROFILES = new Set(["foundation", "security"]);
-const SECURITY_TEMPLATE_COLLECTIONS = new Set(["collection-reviews", "documents", "policies", "training"]);
+const SECURITY_TEMPLATE_COLLECTIONS = new Set(["collection-reviews", "documents", "policies", "reporting-route-sets", "training"]);
 
 export async function createFilegrc(options = {}) {
   const parameterConfig = JSON.parse(await readFile(join(packageRoot, "template-parameters.json"), "utf8"));
@@ -523,13 +523,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.11.1",
+    version: "0.12.0",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.11.1",
+        version: "0.12.0",
         dependencies: { filegrc: versionRange }
       }
     }

package/template/AGENTS.md

@@ -42,6 +42,10 @@ Read `data/AGENTS.md` before changing records. More specific instructions inside
 
 - Read `README.md` and run `npm run validate` before broad changes.
 - Treat `data/` as the source of truth. Do not hand-edit `.filegrc/` output.
+- Let Git exclusively supply version-control facts, including authors, commit timestamps, messages, diffs, revisions, renames, and prior file versions. Do not copy them into records or maintain a parallel change log.
+- Store each mutable program fact in one authoritative record and refer to it by ID. Policies state durable rules and outcomes instead of copying current people, vendors, systems, reporting channels, schedules, targets, or inventories.
+- A Reporting Channel Set holds the normal and fallback ways people send a report for one purpose, such as a security email address and a hotline. Keep one revision for each Program and purpose. Commit its proposal before recording approval, use separate Appointment kinds for approval and ongoing responsibility, and create a successor instead of editing an approved revision.
+- Keep an Obligation occurrence rolled up when one owner, window, population rule, and reconciliation conclusion govern the work. Split it only when a member needs its own owner, deadline, conclusion, or follow-up lifecycle.
 - Keep compliance records focused on business facts, decisions, scope, Controls, and Evidence. Do not mention filegrc versions, migrations, or workflow mechanics unless filegrc itself is the subject.
 - Use UTF-8 JSON for structured records and Markdown for long-form work.
 - Keep one resource in each JSON file.
@@ -70,7 +74,7 @@ Run `npm run check:milestone` in CI. Before an assurance goal is selected it che
 
 ## Git is the audit trail
 
-Git supplies file authors, commit timestamps, messages, diffs, and revisions. Do not add fields such as `createdAt`, `updatedAt`, `createdBy`, `updatedBy`, or a second change log.
+Git exclusively supplies file authors, commit timestamps, messages, diffs, revisions, renames, and prior versions. Do not add fields such as `createdAt`, `updatedAt`, `createdBy`, `updatedBy`, or a second change log.
 
 Domain events still need explicit dates. Keep values such as `occurredOn`, `scheduledFor`, `approvedOn`, `completedOn`, and audit-period dates in their records.
 
@@ -115,7 +119,7 @@ npx filegrc migrate --to-model 8 --preview --json
 
 Older workspaces migrate one version at a time. Review every preview’s automatic, review-required, and unsupported classifications before applying it with the same options and `--yes`. The v8 migration preserves legacy retention prose as notes, renames Component processing operations, and creates no retention periods or disposition behavior.
 
-The [model v8 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v8.md) explains the structured retention and mapping changes.
+The [model v10 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v10.md) explains Reporting Channel Sets and the legacy-route review. The [model v9 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v9.md) explains rolled-up Obligation occurrences, reviewed schedule rules, and temporal Collection Reviews.
 
 Run these commands when working with records:
 
@@ -127,11 +131,17 @@ npx filegrc list risk --json
 npx filegrc get risk-example
 npx filegrc get risk-example --mutation
 npx filegrc references risk-example --json
+npx filegrc reporting-route-sets --json
+npx filegrc reporting-route-set scaffold approve --id REPORTING_ROUTE_SET_ID
+npx filegrc reporting-route-set scaffold cancel --id REPORTING_ROUTE_SET_ID
+npx filegrc reporting-route-set scaffold successor --id SUCCESSOR_ROUTE_SET_ID
 npx filegrc describe risk
 npx filegrc search "access review"
 npm run serve
 ```
 
+The Reporting Channel Set scaffolds are action-specific. Approval needs the exact committed proposal, current route-set revision, authorized Appointment, actual times, timezone, and verified fixed Evidence. Cancellation needs its own authority, time, reason, Evidence, and current revision. A successor approval also includes the predecessor cancellation authority, Evidence, and revision so FileGRC records the cutover atomically. Replace every placeholder before passing the payload to `reporting-route-set approve` or `reporting-route-set cancel`.
+
 Prefer existing fields. Put organization-specific values under `extensions` with a namespace owned by {{company_name}}. Add structure only when validation, filtering, relationships, due dates, or audit completeness need it. Variable procedures, interviews, observations, rationale, and detailed results belong in the record's Markdown companion.
 
 Never change a resource ID after it is committed. Create a replacement and link the records if identity truly changes.
@@ -282,7 +292,7 @@ Link a control test to its `audit-population` record when sampling applies. Link
 
 ## Content and approvals
 
-The initial program lead is {{policy_owner_name}}, {{policy_owner_job_title}}, at {{policy_owner_email}}. The separate Policy Owner Appointment records this person’s starting program authority, and the security reporting address is {{security_contact_email}}. Update the Person when their organizational position changes. End and replace Appointments when named authority moves to someone else.
+The initial program lead is {{policy_owner_name}}, {{policy_owner_job_title}}, at {{policy_owner_email}}. The separate Policy Owner Appointment records this person’s starting program authority. The Reporting Channel Set holds the normal and fallback ways people send security concerns. Update the Person when their organizational position changes. End and replace Appointments when named authority moves to someone else.
 
 Appoint an independent management reviewer during policy review, not as a condition of defining the service boundary. The reviewer must be separate from the policy owner and able to challenge the owner’s decisions. Assign another internal leader or manager when a suitable reviewer is available. Otherwise, appoint a qualified external reviewer. The reviewer chairs Security and Risk Oversight and approves policies and governed documents.
 

package/template/README.md

@@ -19,7 +19,7 @@ npm run serve
 
 Requires Node.js 20 or newer and Git.
 
-Existing model v7 workspaces must run `npx filegrc migrate --to-model 8 --preview --json` after installing a model v8 package. The migration preserves legacy retention prose as notes and creates no retention periods or disposition behavior. Older workspaces migrate one model version at a time. See the [model v8 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v8.md).
+Existing model v9 workspaces must run `npx filegrc migrate --to-model 10 --preview --json` after installing a model v10 package. The migration preserves prior Reporting Routes as legacy facts and asks management to create one reviewed Reporting Channel Set: the normal and fallback ways people send a report for one purpose. It does not infer missing Program, channel pairing, authority, or event-time facts. Older workspaces migrate one model version at a time. See the [model v10 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v10.md).
 
 ## How it works
 
@@ -27,7 +27,7 @@ The repository is the program. There is no separate application database.
 
 - **JSON** holds records that filegrc validates, filters, and connects.
 - **Markdown** holds policies, procedures, plans, minutes, and narratives.
-- **Git** supplies authors, timestamps, revisions, diffs, and commit messages.
+- **Git** exclusively supplies authors, commit timestamps, revisions, diffs, renames, prior versions, and commit messages.
 
 Use the same source through the local web app, a text editor, the CLI, or CI. Browser and CLI actions call the same rules, so engineers and agents see the same validation and readiness results.
 

package/template/data/AGENTS.md

@@ -101,7 +101,7 @@ When `guide` returns a collection review requirement, review the listed type-spe
 
 Use Retention Schedule Items as the structured rows of the Data Retention Schedule. Keep a row `planned` until management has approved its Information Types, scope, cutoff, period, disposition action, instructions, sources, approver, date, and reviewed source revisions. Run `npx filegrc program-readiness --json` after changing an information use, source-coverage record, Commitment, Policy, or other source. FileGRC may identify missing or stale decisions, but it must never infer an organization-specific period or deletion behavior.
 
-Store a relationship only on its authoritative record. Control Tests store `auditId`; Evidence Artifacts store `auditIds`; Commitments store `systemIds` and `controlIds`; Controls store `policyIds`, `requirementIds`, `systemIds`, `componentIds`, and `evidenceSourceComponentIds`; Risks store `controlIds`; Components store their `vendorId` and `systemUses`. Use `references` to inspect derived inbound links.
+Store a relationship only on its authoritative record. Control Tests store `auditId`; Evidence Artifacts store `auditIds`; Commitments store `systemIds` and `controlIds`; Controls store `policyIds`, `requirementIds`, `systemIds`, `componentIds`, and `evidenceSourceComponentIds`; Risks store `controlIds`; Components store their `vendorId` and `systemUses`; Reporting Channel Sets store the normal and fallback ways people send a report, the rules requiring them, and the responsible role. Use `references` to inspect derived inbound links.
 
 Use explicit business dates. Git records when a file changed, but it does not replace `occurredOn`, `scheduledFor`, `completedOn`, `approvedOn`, or similar fields.
 
@@ -188,8 +188,13 @@ Use `get RESOURCE_ID --mutation` and `update` so JSON and Markdown change togeth
 
 ```sh
 npx filegrc obligations --json
+npx filegrc activate-obligation-rule RULE_ID --scaffold > activation.json
+npx filegrc activate-obligation-rule RULE_ID activation.json
 npx filegrc complete OBLIGATION_ID --scaffold --window-start YYYY-MM-DD --completed-on YYYY-MM-DD > completion-mutation.json
 npx filegrc complete OBLIGATION_ID completion-mutation.json
+npx filegrc reconcile-obligation OBLIGATION_ID --scaffold --window-start YYYY-MM-DD > occurrence.json
+npx filegrc reconcile-obligation OBLIGATION_ID occurrence.json
+npx filegrc reconcile-obligation OBLIGATION_ID --scaffold --window-start YYYY-MM-DD --correct-finalized > occurrence-correction.json
 npx filegrc trigger EVENT_TYPE --occurred-on YYYY-MM-DD --subject RESOURCE_ID --json
 npx filegrc complete-action ACTION_ITEM_ID --scaffold --completed-on YYYY-MM-DD > completion-mutation.json
 npx filegrc complete-action ACTION_ITEM_ID completion-mutation.json --completed-on YYYY-MM-DD
@@ -204,6 +209,10 @@ Fill the scaffold with the actual work, evidence, review, and every null or empt
 npx filegrc program-readiness --summary --json
 npx filegrc prepare-audit AUDIT_ID
 npx filegrc audit-readiness AUDIT_ID --json
+npx filegrc reconcile-management-documents AUDIT_ID --scaffold > management-reconciliation.json
+npx filegrc reconcile-management-documents AUDIT_ID management-reconciliation.json
+npx filegrc correct-audit-population POPULATION_ID --scaffold > population-correction.json
+npx filegrc correct-audit-population POPULATION_ID population-correction.json
 npx filegrc evidence-packet --audit AUDIT_ID --preview --json
 ```
 

package/template/data/collection-reviews/collection-review-classification.json

@@ -0,0 +1,10 @@
+{
+  "id": "collection-review-classification",
+  "type": "collection-review",
+  "title": "Information handling classifications review",
+  "status": "planned",
+  "resourceType": "classification",
+  "scopeResourceIds": [
+    "program-soc-2"
+  ]
+}

package/template/data/documents/document-security-incident-recovery-plan.md

@@ -4,11 +4,11 @@
 
 This plan coordinates reporting, response, recovery, and continuity when a security event or disruption affects {{company_name}} or an in-scope service. Supporting procedures, system records, and retained evidence document the actual technical configuration and operation.
 
-## Reporting routes
+## Reporting channels
 
-The primary reporting route is {{security_contact_email}}.
+People send suspected security concerns through the current approved normal reporting channel, such as the security email address. If that channel is unavailable, compromised, or involved in the concern, they use the approved fallback channel. The Reporting Channel Set is the source of truth for the current destinations, responsible role, and effective period.
 
-[Complete before activation: Name a usable alternate reporting route, its owner, protected location, and how workers can find it when the primary email, identity, or collaboration System is unavailable, compromised, or involved in the concern. Do not put plaintext credentials, private keys, tokens, or recovery codes in this plan.]
+[Complete before activation: Describe how workers can find the fallback reporting channel when the normal email, identity, or collaboration System is unavailable, compromised, or involved in the concern. Do not copy the destination here or include plaintext credentials, private keys, tokens, or recovery codes.]
 
 Reports may describe suspected unauthorized access, malware, data loss, credential exposure, security-Control failure, service disruption, fraud affecting the service, or another policy violation. The recipient records the report, protects confidentiality, preserves relevant information, and assigns an initial owner.
 

package/template/data/obligations/AGENTS.md

@@ -4,10 +4,12 @@ An obligation is a reusable policy schedule or event template. It is not the rec
 
 - Calendar obligations need a valid recurrence anchor, owners, expected completion types, and policy or control links.
 - Event obligations need a stable lowercase `eventType`, a prompt, owners, expected completion types, and an explicit deadline window.
+- Keep one rolled-up Obligation Occurrence per rule window when one queue-level owner, population rule, and reconciliation conclusion govern the work. Reconcile each selected member to dated completion proof, an approved Exception, or a reviewed non-applicability decision.
+- Split the work only when a member needs its own queue owner, deadline, conclusion, or follow-up lifecycle.
 - Keep completed occurrences in `completionResourceIds`. Do not replace prior links when a new period starts.
 - Configure and enable Obligations during Step 3. An enabled Obligation remains dormant until every governing Policy and required program Document is active and effective and, when it names Controls, at least one linked Control is implemented. FileGRC starts calendar work from the latest Policy or governed Document effective date, so pre-cutover periods do not become overdue work.
 - Calendar Obligations generated with `status: proposed` contain suggested starting cadences. Review the scope and risk, edit the cadence when needed, and change the Obligation to `active` only when management accepts that schedule. A proposed Obligation never counts as a configured schedule.
-- When an approved cadence changes, update the policy, control, and obligation together.
+- When an approved cadence changes, update its authoritative Obligation schedule. Keep the durable required outcome in the Policy and the implementation fact in the Control instead of copying the cadence across all three records.
 - Pause or retire a template only when the underlying policy work no longer applies. Do not delete historical templates that explain prior periods.
 
 Use `npx filegrc obligations --json` to inspect calculated recurring work and preview every Policy Event task, owner, deadline, and requested proof. Run `npx filegrc complete OBLIGATION_ID --scaffold --window-start YYYY-MM-DD --completed-on YYYY-MM-DD > completion-mutation.json`, fill the actual work and proof, then pass that file to `npx filegrc complete OBLIGATION_ID completion-mutation.json`. The scaffold includes the current Obligation revision, and the final command creates and links the dated occurrence in one validated write. Use `npx filegrc trigger EVENT_TYPE ...` only after the matching event occurs; it adds all configured Action Items to the Work Queue atomically.

package/template/data/policies/policy-information-security.json

@@ -17,6 +17,20 @@
     "document-security-incident-recovery-plan",
     "document-data-retention-schedule"
   ],
+  "reportingRouteRequirements": [
+    {
+      "purposeKey": "security-reporting",
+      "programScope": "all-programs",
+      "requiredLanes": [
+        "primary",
+        "alternate"
+      ],
+      "distinctChannels": true,
+      "independentDependencies": false,
+      "effectiveAt": "1970-01-01T00:00:00Z",
+      "timezone": "UTC"
+    }
+  ],
   "proposedEffectiveOn": "{{effective_date}}",
   "programRole": "required"
 }

package/template/data/policies/policy-information-security.md

@@ -50,7 +50,7 @@ Management obtains or generates, checks, and uses relevant information from inte
 
 Everyone in scope must act honestly, protect company and customer information, follow approved security processes, disclose conflicts that could affect security decisions, and preserve accurate records. Fraud, deliberate Control bypass, false Evidence, credential sharing, unauthorized access, concealment of a security event, and retaliation for a good-faith report are prohibited.
 
-Suspected security events, Control failures, fraud, or policy violations must be reported promptly through the primary route at {{security_contact_email}} or the usable alternate route documented in the Security Incident and Recovery Plan. A person may use the alternate route when the primary route is unavailable, compromised, or involved in the concern. Management investigates credible reports, limits disclosure to people who need the information, preserves relevant records, and records corrective action.
+Suspected security events, Control failures, fraud, or policy violations must be reported promptly through the current normal Security Reporting Channel or its usable fallback. A person may use the fallback when the normal channel is unavailable, compromised, or involved in the concern. Management investigates credible reports, limits disclosure to people who need the information, preserves relevant records, and records corrective action.
 
 ## Risk Management and Compliance Policy
 

package/template/data/reporting-route-sets/reporting-route-set-security-reporting.json

@@ -0,0 +1,23 @@
+{
+  "id": "reporting-route-set-security-reporting",
+  "type": "reporting-route-set",
+  "title": "Security reporting channels",
+  "status": "draft",
+  "programId": "program-soc-2",
+  "purposeKey": "security-reporting",
+  "purposeLabel": "Security reporting",
+  "primaryLane": {
+    "channelKind": "email",
+    "destination": "{{security_contact_email}}"
+  },
+  "alternateLane": {
+    "channelKind": "other",
+    "destination": "TBD: protected alternate channel"
+  },
+  "authorityAppointmentKind": "policy-owner",
+  "approvalAppointmentKind": "independent-policy-reviewer",
+  "sourceResourceIds": [
+    "policy-information-security",
+    "document-security-incident-recovery-plan"
+  ]
+}

package/template/data/reporting-route-sets/reporting-route-set-security-reporting.md

@@ -0,0 +1,9 @@
+# Security reporting channels
+
+This record tells FileGRC where people should send security concerns. A channel can be an email address, phone number, web form, named in-person contact, or another clear destination.
+
+- The normal channel is the method people should use first.
+- The fallback channel must still work when the normal channel is unavailable, compromised, or involved in the concern.
+- The responsible Appointment identifies the role that keeps both channels usable and known to the intended audience.
+
+Before proposing this set, replace the fallback placeholder and confirm that people can find both channels. Do not store credentials, recovery codes, or other secrets here.

package/template/data/training/training-security-awareness.md

@@ -6,7 +6,7 @@ Security depends on the choices people make while using accounts, devices, data,
 
 This training applies to employees and contractors who use {{company_name}} systems or information. Complete it within 30 days after starting, at least annually, and again when assigned after a material change or incident.
 
-Questions and incident reports should be sent to {{security_contact_email}}.
+Questions and incident reports use the current approved security reporting channel delivered with this assignment.
 
 ## Your responsibilities
 
@@ -176,7 +176,7 @@ Report any event that could affect the confidentiality, integrity, or availabili
 ## Reporting and first actions
 
 1. Stop the unsafe action. Do not continue entering credentials, sending data, or following the request.
-2. Report the event immediately to {{security_contact_email}}. If that route is unavailable, contact the current Policy Owner through an approved alternate method.
+2. Report the event immediately through the approved security reporting channel delivered with this assignment. If that channel is unavailable, use the current approved fallback channel.
 3. State what happened, when it happened, the affected account, device, system, or data, and any action already taken.
 4. Preserve the message, file, screen, device, or other evidence. Take a screenshot only when it is safe and does not expose more sensitive data.
 5. Follow response-team instructions. Remain available for questions.
@@ -200,7 +200,7 @@ The person who reports an event should cooperate with the response but should no
 After reviewing this training:
 
 - Ask about any requirement you do not understand.
-- Confirm that you know how to reach {{security_contact_email}}.
+- Confirm that you know how to use the security reporting channel delivered with this assignment.
 - Complete the assigned training acknowledgement.
 
 The acknowledgement records the exact training revision reviewed and any signed evidence required for the assignment.

package/template/data/workspace.json

@@ -1,5 +1,5 @@
 {
-  "dataModelVersion": "8",
+  "dataModelVersion": "10",
   "id": "workspace",
   "type": "workspace",
   "title": "{{program_title}}",

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",