create-filegrc 0.3.3 → 0.4.0

package/template/data/policies/policy-mobile-computing-communications.json

@@ -1,27 +1,17 @@
 {
-  "schemaVersion": 1,
   "id": "policy-mobile-computing-communications",
   "type": "policy",
   "title": "Mobile Computing and Communications Policy",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
   "policyKind": "information-security",
   "version": "1.0",
   "effectiveOn": "{{effective_date}}",
-  "reviewCadence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
-  "audience": ["employees", "contractors"],
-  "acknowledgementRequired": true,
-  "controlIds": [
-    "control-policy-management",
-    "control-strong-authentication",
-    "control-physical-workspace-security",
-    "control-encryption-transmission",
-    "control-endpoint-protection",
-    "control-network-security"
-  ]
+  "audience": [
+    "employees",
+    "contractors"
+  ],
+  "acknowledgementRequired": true
 }

package/template/data/policies/policy-mobile-computing-communications.md

@@ -63,7 +63,7 @@ The policy owner reviews authorized mobile devices, personal-device approvals, a
 
 ## Loss, theft, or compromise
 
-Report a lost, stolen, or suspected compromised device immediately to {{policy_owner_name}} at {{security_contact_email}}. Do not delay reporting while attempting to recover or investigate the device.
+Report a lost, stolen, or suspected compromised device immediately to the current Policy Owner at {{security_contact_email}}. Do not delay reporting while attempting to recover or investigate the device.
 
 ## Return and disposal
 

package/template/data/renderer.json

@@ -1,8 +1,10 @@
 {
-  "schemaVersion": 1,
   "id": "renderer-settings",
   "type": "renderer-settings",
   "title": "Renderer settings",
   "showOnboarding": true,
+  "repositoryMode": "trunk",
+  "authoritativeBranch": "main",
+  "repositoryRemote": "origin",
   "completedStagePageIds": []
 }

package/template/data/training/training-anti-bribery-high-risk-roles.json

@@ -1,10 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "training-anti-bribery-high-risk-roles",
   "type": "training",
   "title": "Anti-Bribery Training for Higher-Risk Roles",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": ["appointment-policy-owner"],
   "audience": ["sales", "finance", "procurement", "government-interaction", "third-party-agents"],
   "assignmentTrigger": "covered-role-start-or-change",
   "completionWindowDays": 30,

package/template/data/training/training-privileged-sensitive-roles.json

@@ -1,10 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "training-privileged-sensitive-roles",
   "type": "training",
   "title": "Privileged and Sensitive Role Training",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": ["appointment-policy-owner"],
   "audience": ["privileged-administrators", "security", "finance", "privacy", "people-operations"],
   "assignmentTrigger": "covered-role-start-or-change",
   "completionWindowDays": 30,

package/template/data/training/training-secure-development.json

@@ -1,10 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "training-secure-development",
   "type": "training",
   "title": "Secure Development Training",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": ["appointment-policy-owner"],
   "audience": ["engineering", "security", "software-development", "infrastructure"],
   "assignmentTrigger": "covered-role-start-or-change",
   "completionWindowDays": 30,

package/template/data/training/training-security-awareness.json

@@ -1,18 +1,16 @@
 {
-  "schemaVersion": 1,
   "id": "training-security-awareness",
   "type": "training",
   "title": "Security Awareness and Incident Response Training",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
-  "audience": ["employees", "contractors"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
+  "audience": [
+    "employees",
+    "contractors"
+  ],
   "assignmentTrigger": "onboarding",
-  "recurrence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
   "completionWindowDays": 30,
   "policyIds": [
     "policy-clear-desk-screen",

package/template/data/training/training-security-awareness.md

@@ -162,7 +162,7 @@ Report any event that could affect the confidentiality, integrity, or availabili
 ## Reporting and first actions
 
 1. Stop the unsafe action. Do not continue entering credentials, sending data, or following the request.
-2. Report the event immediately to {{security_contact_email}}. If that route is unavailable, contact {{policy_owner_name}} through an approved alternate method.
+2. Report the event immediately to {{security_contact_email}}. If that route is unavailable, contact the current Policy Owner through an approved alternate method.
 3. State what happened, when it happened, the affected account, device, system, or data, and any action already taken.
 4. Preserve the message, file, screen, device, or other evidence. Take a screenshot only when it is safe and does not expose more sensitive data.
 5. Follow response-team instructions. Remain available for questions.

package/template/data/workspace.json

@@ -1,6 +1,5 @@
 {
-  "schemaVersion": 1,
-  "dataModelVersion": "1",
+  "dataModelVersion": "2",
   "id": "workspace",
   "type": "workspace",
   "title": "{{program_title}}",
@@ -9,8 +8,20 @@
   "description": "{{program_description}}",
   "riskMethodology": {
     "method": "5x5 likelihood and impact",
-    "likelihoodScale": ["Rare", "Unlikely", "Possible", "Likely", "Almost certain"],
-    "impactScale": ["Negligible", "Minor", "Moderate", "Major", "Severe"],
+    "likelihoodScale": [
+      "Rare",
+      "Unlikely",
+      "Possible",
+      "Likely",
+      "Almost certain"
+    ],
+    "impactScale": [
+      "Negligible",
+      "Minor",
+      "Moderate",
+      "Major",
+      "Severe"
+    ],
     "ratingBands": {
       "low": "1-4",
       "medium": "5-9",
@@ -19,9 +30,9 @@
     }
   },
   "classificationDefinitions": {
-    "Public": "Approved for public release.",
-    "Internal": "Intended for the workforce and approved partners.",
-    "Confidential": "Disclosure could harm the organization, a customer, or another person.",
-    "Restricted": "Disclosure or alteration could cause severe harm or trigger legal duties."
+    "public": "Approved for public release.",
+    "internal": "Intended for the workforce and approved partners.",
+    "confidential": "Disclosure could harm the organization, a customer, or another person.",
+    "restricted": "Disclosure or alteration could cause severe harm or trigger legal duties."
   }
 }

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",

package/template-parameters.json

@@ -7,7 +7,12 @@
     },
     {
       "key": "policy_owner_name",
-      "prompt": "Policy owner name",
+      "prompt": "Initial program lead name",
+      "required": true
+    },
+    {
+      "key": "policy_owner_job_title",
+      "prompt": "Initial program lead organization job title",
       "required": true
     },
     {

package/template/data/people/person-policy-owner.json

@@ -1,10 +0,0 @@
-{
-  "schemaVersion": 1,
-  "id": "person-policy-owner",
-  "type": "person",
-  "title": "{{policy_owner_name}}",
-  "status": "active",
-  "email": "{{policy_owner_email}}",
-  "role": "Policy Owner",
-  "teamIds": ["team-security-risk-oversight"]
-}