create-filegrc 0.16.24 → 0.16.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.16.24",
+  "version": "0.16.25",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/defaults.js

@@ -100,9 +100,9 @@ const controls = [
     id: "control-security-governance",
     code: "GOV-01",
     title: "Security governance",
-    statement: "Management assigns security responsibilities, and a reviewer who is separate from the policy owner and control operators independently reviews the program, risks, incidents, findings, policy approvals, and overdue work at least quarterly.",
+    statement: "Management assigns security responsibilities, and a reviewer who is separate from the policy owner and control operators independently reviews the program, risks, incidents, findings, policy approvals, and overdue work on the approved risk-based schedule.",
     requirements: ["CC1.1", "CC1.2", "CC1.3", "CC1.5"],
-    activity: "Assign an independent reviewer who is separate from program ownership and record quarterly oversight decisions, approvals, and actions.",
+    activity: "Assign an independent reviewer who is separate from program ownership and record scheduled oversight decisions, approvals, and actions.",
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "scheduled",
@@ -112,7 +112,7 @@ const controls = [
     id: "control-policy-management",
     code: "GOV-02",
     title: "Control and policy management",
-    statement: "Management selects and develops manual and technology Controls from approved objectives, commitments, risks, dependencies, and changes, and records each Control's owner, scope, procedure, operation pattern, evidence source, and implementation status. The policy owner reviews Controls, governed policies, and plans at least annually and after material changes, obtains separate approval for governed content, and retains approved revisions in Git.",
+    statement: "Management selects and develops manual and technology Controls from approved objectives, commitments, risks, dependencies, and changes, and records each Control's owner, scope, procedure, operation pattern, evidence source, and implementation status. The policy owner reviews Controls, governed policies, and plans on the approved risk-based schedule and after material changes, obtains separate approval for governed content, and retains approved revisions in Git.",
     requirements: ["CC5.1", "CC5.2", "CC5.3"],
     activity: "Review Control design and evidence paths, correct gaps or approve time-bound Exceptions, and review, approve, communicate, and version governed policies and plans.",
     controlType: "preventive",
@@ -148,7 +148,7 @@ const controls = [
     id: "control-security-training",
     code: "HR-02",
     title: "Security training and acknowledgement",
-    statement: "Employees and contractors complete general security training within 30 days of starting and at least annually. Workers complete applicable role-based training within 30 days of starting a covered role or changing roles, with completion tied to the content revision reviewed.",
+    statement: "Employees and contractors complete general security training on the approved onboarding and recurring schedules. Workers complete applicable role-based training on the approved role-based schedule when starting a covered role or changing roles, with completion tied to the content revision reviewed.",
     requirements: ["CC1.4", "CC2.2"],
     activity: "Assign general and role-based training, document non-applicability where needed, collect completion attestations, and follow up on overdue assignments.",
     controlType: "preventive",
@@ -160,7 +160,7 @@ const controls = [
     id: "control-risk-assessment",
     code: "RSK-01",
     title: "Risk assessment and treatment",
-    statement: "The organization defines security objectives and risk tolerance, assesses information security, fraud, misconduct, dependency, and change risk at least annually and after material changes, assigns owners and responses, and reviews high and critical risks at least quarterly.",
+    statement: "The organization defines security objectives and risk tolerance, assesses information security, fraud, misconduct, dependency, and change risk on the approved risk-based schedule and after material changes, assigns owners and responses, and reviews high and critical risks on the approved risk-based schedule.",
     requirements: ["CC3.1", "CC3.2", "CC3.3", "CC3.4", "CC9.1"],
     activity: "Confirm objectives and risk tolerance, identify internal and external threats, fraud and misconduct scenarios, dependencies, and changes, score risk, select treatment, and track review dates.",
     controlType: "detective",
@@ -172,7 +172,7 @@ const controls = [
     id: "control-monitoring-remediation",
     code: "MON-01",
     title: "Control monitoring and remediation",
-    statement: "Management reviews Control operation, source information, incidents, test results, Exceptions, and findings at least quarterly and after significant failures, then communicates deficiencies and assigns, tracks, and verifies corrective work through completion.",
+    statement: "Management reviews Control operation, source information, incidents, test results, Exceptions, and findings on the approved risk-based schedule and after significant failures, then communicates deficiencies and assigns, tracks, and verifies corrective work through completion.",
     requirements: ["CC4.1", "CC4.2"],
     activity: "Review control evidence and track deficiencies, owners, due dates, and verification.",
     controlType: "detective",
@@ -208,7 +208,7 @@ const controls = [
     id: "control-access-review-offboarding",
     code: "IAM-03",
     title: "Access review and offboarding",
-    statement: "Owners review privileged and production access at least quarterly and other important access at least annually. Access ends at or before notice for involuntary or high-risk departures and within 24 hours for other departures.",
+    statement: "Owners review privileged, production, and other important access on the approved risk-based schedules. Access ends when employment, services, or business need ends under the approved departure timing and escalation procedure.",
     requirements: ["CC6.2", "CC6.3"],
     activity: "Review complete access populations, including workers and third parties with customer-data access, record decisions, and remove dormant, expired, or unneeded access.",
     controlType: "detective",
@@ -232,7 +232,7 @@ const controls = [
     id: "control-data-classification-inventory",
     code: "DATA-01",
     title: "Data classification and inventory",
-    statement: "Data owners classify important data, record its approved purpose and location, and review data inventories at least annually and after material changes.",
+    statement: "Data owners classify important data, record its approved purpose and location, and review data inventories on the approved risk-based schedule and after material changes.",
     requirements: ["CC2.1", "CC6.1"],
     activity: "Maintain classification, ownership, system, vendor, and processing records.",
     controlType: "preventive",
@@ -256,7 +256,7 @@ const controls = [
     id: "control-data-retention-disposal",
     code: "DATA-03",
     title: "Data retention and disposal",
-    statement: "Owners maintain an approved retention schedule for important record classes, review it at least annually and after material data-use changes, and delete, anonymize, or securely destroy data and media when retention ends.",
+    statement: "Owners maintain an approved retention schedule for important record classes, review it on the approved risk-based schedule and after material data-use changes, and delete, anonymize, or securely destroy data and media when retention ends.",
     requirements: ["CC6.5"],
     activity: "Apply approved retention and disposal methods to active, local, backup, and vendor-held copies.",
     controlType: "preventive",
@@ -292,7 +292,7 @@ const controls = [
     id: "control-network-security",
     code: "NET-01",
     title: "Network and remote-access security",
-    statement: "The organization restricts network paths, separates production and nonproduction environments according to data and risk, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
+    statement: "The organization restricts network paths, separates production and nonproduction environments according to data and risk, protects remote access with approved encryption and authentication, and reviews material network access rules on the approved risk-based schedule.",
     requirements: ["CC6.6", "CC6.7"],
     activity: "Document and verify customer and environment boundaries, approved network rules and deviations by source, wireless safeguards, and remote production access.",
     controlType: "preventive",
@@ -304,9 +304,9 @@ const controls = [
     id: "control-change-management",
     code: "CHG-01",
     title: "Change management",
-    statement: "Source and deployment paths protect against unauthorized changes and malicious software. Material software and infrastructure changes are recorded, receive a security design or threat analysis suited to their risk, are tested, approved, deployed through an authorized process, and are recoverable. Review is independent when practical; a small team records a risk-appropriate compensating or post-deployment review, or an approved Exception, when independent pre-deployment review is not possible.",
+    statement: "Source and deployment paths protect against unauthorized changes and malicious software. Changes to infrastructure, data, software, and procedures are documented, authorized, tested, approved before implementation, deployed through an authorized process, and recoverable in proportion to risk. Code and security review, test results, authorization, and deployment evidence are traceable to the exact change and deployed revision.",
     requirements: ["CC6.8", "CC8.1"],
-    activity: "Record the reason, author, risk, security analysis when applicable, reviewer or compensating review, test result, deployment, communication, and rollback method.",
+    activity: "Record the reason, author, authorization, code and security review results, finding dispositions, test results, deployed revision and outcome, communication, and recovery method. Define emergency handling and follow-up for deferred checks.",
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "mixed",
@@ -318,7 +318,7 @@ const controls = [
     title: "Vulnerability management",
     statement: "The organization monitors for vulnerabilities, chooses scan coverage and cadence based on exposure and risk, and assigns each confirmed vulnerability an approved risk-based remediation target or time-bound Exception.",
     requirements: ["CC7.1", "CC7.2", "CC7.3"],
-    activity: "Define scan scope and cadence, severity criteria, risk-based remediation and patch targets, and time-bound Exceptions when a target cannot be met.",
+    activity: "Map host, network, dependency, web, and advisory coverage to actual sources and current scope. Reconcile results, exclusions, coverage gaps, scan failures, and findings in one periodic review. Define severity, remediation and patch targets, Exceptions, and evidence retrieval before source or CI artifact expiry.",
     controlType: "detective",
     operationMode: "hybrid",
     operationPattern: "mixed",
@@ -364,7 +364,7 @@ const controls = [
     id: "control-incident-exercise",
     code: "IR-02",
     title: "Incident response exercise",
-    statement: "The organization tests its incident process and a representative alert path from generation through acknowledgement, escalation, and fallback at least annually, then records participants, scenario, results, findings, and follow-up work.",
+    statement: "The organization tests its incident process and a representative alert path from generation through acknowledgement, escalation, and fallback on the approved risk-based schedule, then records participants, scenario, results, findings, and follow-up work.",
     requirements: ["CC7.4", "CC7.5"],
     activity: "Plan, conduct, review, and document an incident response and alert-path exercise.",
     controlType: "detective",
@@ -388,7 +388,7 @@ const controls = [
     id: "control-continuity-exercise",
     code: "BCP-02",
     title: "Continuity planning and exercise",
-    statement: "The organization maintains recovery priorities and responsibilities, reviews emergency contacts annually, and tests its continuity and disaster recovery plan at least annually.",
+    statement: "The organization maintains recovery priorities and responsibilities, reviews emergency contacts on the approved schedule, and tests its continuity and disaster recovery plan on the approved risk-based schedule.",
     requirements: ["CC7.5", "CC9.1"],
     activity: "Maintain the plan, contacts, recovery priorities, exercises, results, and follow-up work.",
     controlType: "corrective",
@@ -412,7 +412,7 @@ const controls = [
     id: "control-vendor-monitoring",
     code: "VEN-02",
     title: "Vendor monitoring",
-    statement: "Owners review critical and high-risk vendors at least annually and reassess affected vendors within 30 days after a material service change or incident, then track risks, findings, and follow-up work.",
+    statement: "Owners review critical and high-risk vendors on the approved risk-based schedule and reassess affected vendors within the approved reassessment window after a material service change or incident, then track risks, findings, and follow-up work.",
     requirements: ["CC4.1", "CC9.2"],
     activity: "Set review intervals by Vendor risk and customer-data access. Review performance, assurance, recovery, access, incidents, and contract obligations, and reassess after material change.",
     controlType: "detective",
@@ -552,7 +552,7 @@ const obligations = [
   },
   {
     id: "obligation-quarterly-vulnerability-scan",
-    title: "Quarterly vulnerability scan",
+    title: "Periodic vulnerability coverage and findings review",
     activityType: "vulnerability-scan",
     recurrence: calendar("month", 3),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
@@ -1230,7 +1230,7 @@ function starterObligationSelector(obligationId) {
     "obligation-annual-workforce-competence-review": { resourceType: "person", statuses: ["active"] },
     "obligation-annual-access-review": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
     "obligation-annual-network-access-review": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
-    "obligation-quarterly-vulnerability-scan": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
+    "obligation-quarterly-vulnerability-scan": { resourceType: "system", statuses: ["active"] },
     "obligation-quarterly-log-review": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
     "obligation-annual-backup-restoration-test": { resourceType: "system", statuses: ["active"], criticalities: ["high", "critical"] },
     "obligation-annual-critical-vendor-review": { resourceType: "vendor", statuses: ["active"], criticalities: ["high", "critical"] }
@@ -1249,7 +1249,7 @@ function starterObligationRationale(obligationId) {
     "obligation-annual-access-review": "Cover other important access, including customer-data paths not assigned to a shorter approved review schedule. Avoid counting the same access twice.",
     "obligation-monthly-endpoint-protection-verification": "Confirm device and platform classes, protection coverage, exceptions, evidence, and whether the monthly cadence fits the approved risk decision.",
     "obligation-annual-network-access-review": "Confirm the in-scope network and host rule sources, customer and environment boundaries, deviations, and review cadence.",
-    "obligation-quarterly-vulnerability-scan": "Confirm scan scope, severity method, remediation and patch targets, and whether exposure or a customer commitment requires a shorter cadence, such as monthly.",
+    "obligation-quarterly-vulnerability-scan": "Map host, network, dependency, web, and advisory sources to current scope. Reconcile complete results, gaps, failures, and finding dispositions in one review, and retrieve evidence before expiry. Choose the cadence from exposure, change, commitments, and risk; the proposed interval is a starting point.",
     "obligation-annual-critical-vendor-review": "Confirm the high and critical Vendor population, and set a separate review interval for other Vendors with customer-data access where needed."
   };
   return `Starter proposal derived from the linked Policy. Management must review the cadence, population, completion criteria, and timing before activation. ${reviews[obligationId] || ""}`.trim();

package/src/index.js

@@ -524,13 +524,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.16.24",
+    version: "0.16.25",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.16.24",
+        version: "0.16.25",
         dependencies: { filegrc: versionRange }
       }
     }

package/template/data/controls/control-change-management.md

@@ -0,0 +1,13 @@
+# Change management procedure proposal
+
+Replace this guidance with the actual procedure before marking the Control implemented.
+
+## Authorization, review, and deployment
+
+Describe how changes to infrastructure, data, software, and procedures receive authorization, code and security review suited to their risk, testing, and approval before implementation. Name the actual source and deployment paths, authorized roles, and the checks that stop an unauthorized or unsuccessful change. Keep review results and finding dispositions traceable to the reviewed change and deployed revision. Choose review methods and security checks that meet the outcomes; document how those methods operate.
+
+Describe how the operator verifies the production deployment outcome and recovers through rollback or another usable method. Record emergency authorization, recovery, deferred checks, and follow-up under the approved procedure.
+
+## Evidence retrieval
+
+Name the source Components and the people who can retrieve change and deployment records. Define the audit-period query, environment filters, and reconciliation with production changes, including emergency work. A build, plan, or failed deployment does not prove a completed production change. Preserve the author, authorization, reviewed and deployed revisions, code and security review results, test results, deployment actor and outcome, and recovery reference. Record source retention and retrieve needed evidence before it expires.

package/template/data/controls/control-vulnerability-management.md

@@ -0,0 +1,25 @@
+# Vulnerability management procedure proposal
+
+Replace this guidance with the actual procedure before marking the Control implemented.
+
+## Coverage map
+
+Map each applicable surface to the actual source Component, covered Systems and inventory, operator, retrieval method, scan or monitoring cadence, and known limits:
+
+- Host packages and operating systems, including current running hosts and unsupported assets.
+- Network exposure and reachability, including approved public and internal paths.
+- Application and build dependencies, including the deployed version and relevant dependency inventories.
+- Web surfaces, including whether checks cover public, authenticated, passive, or active behavior.
+- Newly disclosed advisories and provider notices that may affect the current inventory between scans.
+
+Record justified exclusions, provider responsibility, and uncovered surfaces. A public web check does not establish authenticated coverage, and a dependency check does not establish host or network coverage.
+
+## One periodic reconciliation
+
+Choose the review cadence from exposure, changes, commitments, and risk. Reconcile all applicable sources against current scope in one Obligation occurrence when one owner, window, and conclusion govern the review. Record each source run or export, time, coverage, exclusions, limits, findings, and gaps in the occurrence Markdown. Continuous monitoring and source schedules may differ from this review cadence; respond to actionable findings when discovered rather than waiting for the review.
+
+Distinguish a completed scan with findings, a completed scan with no findings, and a failed or incomplete scan. Job success alone does not mean no findings. Authentication errors, unreachable targets, unavailable reports, and failed executions require follow-up and restored coverage. Validate findings, assign severity from exposure and exploitability, name owners and approved remediation or patch deadlines, and verify closure or a time-bound Exception. Retain lower-severity results and explain dismissed or duplicate findings.
+
+## Evidence retrieval before expiry
+
+For every source, document report and CI artifact retention, who can retrieve complete reports, and when retrieval must occur. Preserve required reports while available, even when the periodic review or audit-period close happens later. Capture run or export identity, time and timezone, scope, parameters, findings, failures, and review decisions through Evidence Artifacts. Keep sensitive reports in approved storage when Git retention is unsuitable. Reconcile the complete period population at close; do not rely only on notifications or expiring run links.

package/template/data/documents/document-data-retention-schedule.md

@@ -20,6 +20,6 @@ Any retention exception needs a reason, owner, approval, compensating safeguards
 
 ## Review and disposal evidence
 
-Review this schedule at least annually and within 30 days after a material change to systems, data use, vendors, contracts, or applicable duties. The approver must be separate from the owner.
+Review this schedule on the approved risk-based schedule and after a material change to systems, data use, vendors, contracts, or applicable duties within the approved reassessment window. The approver must be separate from the owner.
 
 For material disposal work, retain a record of the record class, source, date range, method, completion date, responsible person, exceptions, and verification.

package/template/data/policies/policy-information-security.md

@@ -62,7 +62,7 @@ Risk assessment considers objectives, information, threats, vulnerabilities, fra
 
 ### Control design and review
 
-Management selects and develops manual and technology Controls that respond to approved objectives, commitments, risks, system dependencies, and changes. Each Control has a documented owner, scope, procedure, operating pattern, Evidence source, implementation status, and review path. Management reviews Control design at least annually and after material change, then corrects gaps or records a time-bound Exception.
+Management selects and develops manual and technology Controls that respond to approved objectives, commitments, risks, system dependencies, and changes. Each Control has a documented owner, scope, procedure, operating pattern, Evidence source, implementation status, and review path. Management reviews Control design on the approved risk-based schedule and after material change, then corrects gaps or records a time-bound Exception.
 
 ## Personnel and Human Resources Security Policy
 
@@ -76,7 +76,7 @@ Workers must accept applicable confidentiality, acceptable-use, intellectual-pro
 
 ### Competence review
 
-Management reviews at least annually and after a material role change whether workers remain capable of their assigned security and Control duties and assigns training, supervision, reassignment, or corrective action when needed. The review may be limited to security and Control responsibilities and does not mandate a broader performance-management process.
+Management reviews on the approved risk-based schedule and after a material role change whether workers remain capable of their assigned security and Control duties and assigns training, supervision, reassignment, or corrective action when needed. The review may be limited to security and Control responsibilities and does not mandate a broader performance-management process.
 
 ## Security Awareness and Training Policy
 
@@ -210,17 +210,17 @@ Configuration and maintenance work must use authorized access, protect credentia
 
 ### Change control
 
-Software and infrastructure changes must be recorded, tested, approved, deployed through an authorized process, and recoverable in proportion to risk. Use independent pre-deployment review when practical. When team size or urgency makes that separation impossible, record a risk-appropriate compensating or post-deployment review. Use a time-bound Exception when the remaining departure is material.
+Changes to infrastructure, data, software, and procedures must be documented, authorized, tested, approved before implementation, deployed through an authorized process, and recoverable in proportion to risk. Supporting procedures define how authorization, code and security review, testing, deployment, and recovery work and retain traceable results for the exact change and deployed revision. Emergency changes preserve authorization, recovery, and evidence and receive documented follow-up for any deferred checks or approved departure.
 
 ### Security design and development safeguards
 
-Material or high-risk designs and changes receive a documented security analysis suited to the change. This may include threat analysis, abuse cases, architecture review, data-flow review, or another approved method. Based on applicability and risk, Development and deployment Controls address protected branches, controlled credentials, dependency and secret detection, input and authorization checks, production-data restrictions, security testing, emergency change review, deployment approval, communication, and rollback.
+Code and security review evaluate the change against its objectives, affected data, access boundaries, dependencies, and risk. Procedures define suitable review methods and security checks, retain their results and disposition of findings, and prevent unauthorized changes or malicious software from reaching production. Review and test evidence must be traceable to the deployed revision. Owners verify deployment outcomes and maintain a usable rollback or other recovery method.
 
 ## Vulnerability, Patch, and Penetration Testing Policy
 
 ### Vulnerability and patch management
 
-{{company_name}} monitors trusted sources for vulnerabilities affecting in-scope Systems and Components. Management selects scanning coverage, penetration-testing applicability, remediation targets, and review cadence from exposure, material change, customer commitments, technical capability, and risk. Management documents the selected coverage, targets, cadence, and review decisions.
+{{company_name}} monitors trusted sources for vulnerabilities affecting in-scope Systems and Components. Management selects scanning coverage, penetration-testing applicability, remediation targets, and review cadence from exposure, material change, customer commitments, technical capability, and risk. Management documents the selected coverage, targets, cadence, and review decisions. Coverage considers hosts, network exposure, dependencies, web surfaces, and newly disclosed advisories, with documented exclusions and limits. One periodic review reconciles the applicable sources against current scope, identifies gaps and failed or incomplete scans, and records finding dispositions and follow-up. Scan execution failures require investigation and restored coverage; they do not establish a clean result. Supporting procedures retrieve complete reports and retain needed evidence before source records or CI artifacts expire.
 
 Findings receive validated scope, severity, an owner, treatment, and target date. A missed target requires documented exposure, compensating Controls, a revised date, and risk approval or Exception. Security updates are obtained from trusted sources, tested when appropriate, and applied according to the approved risk-based targets.
 

package/template/data/training/training-security-awareness.md

@@ -4,7 +4,7 @@
 
 Security depends on the choices people make while using accounts, devices, data, and company systems. This training explains the common warning signs, the safeguards everyone must use, and how to report a suspected incident.
 
-This training applies to employees and contractors who use {{company_name}} systems or information. Complete it within 30 days after starting, at least annually, and again when assigned after a material change or incident.
+This training applies to employees and contractors who use {{company_name}} systems or information. Complete it on the approved onboarding and recurring schedules, and again when assigned after a material change or incident.
 
 Questions and incident reports use the current approved security reporting channel delivered with this assignment.
 
@@ -145,7 +145,7 @@ People who design, build, review, deploy, or administer company Systems must:
 - Keep plaintext secrets out of source code, build output, tickets, chat, and logs. Repository access alone must never decrypt approved source-controlled ciphertext.
 - Validate input, authorization, error handling, and sensitive-data use at trust boundaries.
 - Review new and changed dependencies, resolve security findings within the approved risk targets, and record Exceptions when a target cannot be met.
-- Separate development and production duties when practical. Record a compensating or post-deployment review when team size or urgency prevents independent pre-deployment review.
+- Retain traceable code and security review, testing, authorization, and deployment results for the exact change and deployed revision under the approved procedure.
 - Record emergency changes, limit their scope, validate the result, and complete the required follow-up review.
 
 Approved supporting standards, procedures, and schedules document the tools, settings, approval paths, and evidence.
@@ -191,7 +191,7 @@ Do not:
 
 ## What happens after a report
 
-The response team determines the event's scope and severity. It coordinates containment, evidence preservation, recovery, required communications, and follow-up work. Material incidents receive a root-cause and lessons review within one week.
+The response team determines the event's scope and severity. It coordinates containment, evidence preservation, recovery, required communications, and follow-up work. Material incidents receive a root-cause and lessons review within the approved follow-up window.
 
 The person who reports an event should cooperate with the response but should not classify, investigate, contain, or communicate the incident unless assigned that role.
 

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.16.24",
+  "version": "0.16.25",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",