create-filegrc 0.3.4 → 0.5.0

package/src/defaults.js

@@ -3,7 +3,8 @@ import { mkdir, writeFile } from "node:fs/promises";
 
 const FRAMEWORK_ID = "framework-aicpa-trust-services-criteria";
 const DESCRIPTION_FRAMEWORK_ID = "framework-aicpa-soc2-description-criteria";
-const OWNER_ID = "person-policy-owner";
+const PROGRAM_LEAD_ID = "person-program-lead";
+const POLICY_OWNER_APPOINTMENT_ID = "appointment-policy-owner";
 const OVERSIGHT_TEAM_ID = "team-security-risk-oversight";
 const INFORMATION_SECURITY_POLICY_ID = "policy-information-security";
 const DATA_POLICY_ID = "policy-data-protection-handling";
@@ -13,6 +14,41 @@ const ROLE_TRAINING_IDS = [
   "training-privileged-sensitive-roles",
   "training-anti-bribery-high-risk-roles"
 ];
+const FILEGRC_SOURCE_FAMILIES = [
+  "training-acknowledgement",
+  "exception-finding",
+  "governance",
+  "risk-management",
+  "vendor-management"
+];
+const FILEGRC_SOURCE_CONTROL_CODES = new Set([
+  "GOV-01",
+  "GOV-02",
+  "GOV-03",
+  "HR-01",
+  "HR-02",
+  "RSK-01",
+  "MON-01",
+  "EXC-01",
+  "VEN-01",
+  "VEN-02"
+]);
+const SOURCE_FAMILIES = [
+  ["workforce", "Workforce System"],
+  ["training-acknowledgement", "Training and Acknowledgements"],
+  ["identity-access", "Identity and Access Systems"],
+  ["production-change", "Production Change Systems"],
+  ["security-monitoring", "Security Monitoring Systems"],
+  ["vulnerability-management", "Vulnerability Management"],
+  ["endpoint-asset", "Endpoint Management Systems"],
+  ["backup-recovery", "Backup and Recovery"],
+  ["vendor-management", "Vendors"],
+  ["exception-finding", "Exceptions and Findings"],
+  ["data-handling", "Data Protection Configuration"],
+  ["network-security", "Network Security Systems"],
+  ["governance", "Governance"],
+  ["risk-management", "Risk Management"]
+];
 
 const commonCriteria = [
   ["CC1.1", "Integrity and ethical values", "Set, communicate, and enforce standards for integrity and ethical conduct."],
@@ -72,7 +108,7 @@ const controls = [
     activity: "Assign an independent reviewer who is separate from program ownership and record quarterly oversight decisions, approvals, and actions.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Quarterly",
+    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID, "policy-anti-bribery-corruption"]
   },
   {
@@ -84,7 +120,7 @@ const controls = [
     activity: "Review, approve, communicate, and version policies and plans.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Annually and after material changes",
+    operationPattern: "mixed",
     policies: [
       "policy-anti-bribery-corruption",
       "policy-clear-desk-screen",
@@ -102,7 +138,7 @@ const controls = [
     activity: "Maintain reporting routes and communicate policies, changes, and security information.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Ongoing and after material changes",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -114,7 +150,7 @@ const controls = [
     activity: "Complete screening when appropriate, agreements, policy acknowledgement, and corrective action.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Before access and on material change",
+    operationPattern: "event-driven",
     policies: [INFORMATION_SECURITY_POLICY_ID, "policy-anti-bribery-corruption"]
   },
   {
@@ -126,7 +162,7 @@ const controls = [
     activity: "Assign general and role-based training, document non-applicability where needed, collect completion attestations, and follow up on overdue assignments.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Onboarding and annually",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
   },
   {
@@ -138,7 +174,7 @@ const controls = [
     activity: "Complete and retain annual performance reviews and resulting corrective work.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Annually",
+    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -150,7 +186,7 @@ const controls = [
     activity: "Identify threats and changes, score risk, select treatment, and track review dates.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Annually, quarterly for high risks, and after material changes",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -162,7 +198,7 @@ const controls = [
     activity: "Review control evidence and track deficiencies, owners, due dates, and verification.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Quarterly and as issues arise",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -174,7 +210,7 @@ const controls = [
     activity: "Request, approve, provision, change, and record access.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Per access event",
+    operationPattern: "event-driven",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -186,7 +222,7 @@ const controls = [
     activity: "Configure and monitor authentication, credential storage, and privileged roles.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Continuous",
+    operationPattern: "continuous",
     policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
   },
   {
@@ -198,7 +234,7 @@ const controls = [
     activity: "Review access populations, record decisions, and remove dormant, expired, or unneeded access.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Quarterly, annually, and per workforce event",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -210,7 +246,7 @@ const controls = [
     activity: "Control visitors and facilities, secure workspaces, and report loss or exposure.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Continuous",
+    operationPattern: "continuous",
     policies: [INFORMATION_SECURITY_POLICY_ID, "policy-clear-desk-screen", "policy-mobile-computing-communications"]
   },
   {
@@ -222,7 +258,7 @@ const controls = [
     activity: "Maintain classification, ownership, system, vendor, and processing records.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Annually and after material changes",
+    operationPattern: "mixed",
     policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -234,7 +270,7 @@ const controls = [
     activity: "Configure encryption and approved transfer methods based on classification.",
     controlType: "preventive",
     operationMode: "automated",
-    frequency: "Continuous",
+    operationPattern: "continuous",
     policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
   },
   {
@@ -246,7 +282,7 @@ const controls = [
     activity: "Apply approved retention and disposal methods to active, local, backup, and vendor-held copies.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Per retention event",
+    operationPattern: "event-driven",
     policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -258,7 +294,7 @@ const controls = [
     activity: "Maintain inventories, baselines, ownership, classification, and approved deviations.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Ongoing with annual review",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -270,7 +306,7 @@ const controls = [
     activity: "Manage endpoint safeguards and perform a full or equivalent malware scan at least monthly.",
     controlType: "preventive",
     operationMode: "automated",
-    frequency: "Continuous with monthly scanning",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
   },
   {
@@ -282,7 +318,7 @@ const controls = [
     activity: "Manage boundaries, firewall rules, wireless safeguards, and remote production access.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Continuous with annual review",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
   },
   {
@@ -294,7 +330,7 @@ const controls = [
     activity: "Record the reason, author, reviewer, test result, deployment, and rollback method.",
     controlType: "preventive",
     operationMode: "hybrid",
-    frequency: "Per change",
+    operationPattern: "event-driven",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -306,7 +342,7 @@ const controls = [
     activity: "Identify, validate, prioritize, remediate, or approve time-bound exceptions for vulnerabilities.",
     controlType: "detective",
     operationMode: "hybrid",
-    frequency: "Quarterly and after material changes",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -318,7 +354,7 @@ const controls = [
     activity: "Define scope, perform independent testing, review results, and track findings.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Annually",
+    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -330,7 +366,7 @@ const controls = [
     activity: "Collect, protect, alert on, test, and review important log output and access.",
     controlType: "detective",
     operationMode: "hybrid",
-    frequency: "Continuous with quarterly review",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -342,7 +378,7 @@ const controls = [
     activity: "Triage events, preserve evidence, coordinate response and notification review, and complete retrospectives.",
     controlType: "corrective",
     operationMode: "hybrid",
-    frequency: "Per event",
+    operationPattern: "event-driven",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -354,7 +390,7 @@ const controls = [
     activity: "Plan, conduct, review, and document an incident response and alert-path exercise.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Annually",
+    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -366,7 +402,7 @@ const controls = [
     activity: "Protect and monitor backups, then test retrieval and use of restored data.",
     controlType: "corrective",
     operationMode: "hybrid",
-    frequency: "Daily with annual restoration test",
+    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -378,7 +414,7 @@ const controls = [
     activity: "Maintain the plan, contacts, recovery objectives, exercises, results, and follow-up work.",
     controlType: "corrective",
     operationMode: "manual",
-    frequency: "Annually and after material disruption",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -390,7 +426,7 @@ const controls = [
     activity: "Assess service, data, access, assurance, recovery, incidents, and contract terms before access.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Before access and after material changes",
+    operationPattern: "event-driven",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -402,7 +438,7 @@ const controls = [
     activity: "Review vendor performance, assurance, recovery, access, incidents, and contract obligations.",
     controlType: "detective",
     operationMode: "manual",
-    frequency: "Annually and after material changes or incidents",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -414,7 +450,7 @@ const controls = [
     activity: "Request, assess, approve, monitor, and close time-bound exceptions.",
     controlType: "preventive",
     operationMode: "manual",
-    frequency: "Per exception",
+    operationPattern: "event-driven",
     policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   }
 ];
@@ -435,7 +471,7 @@ const obligations = [
     title: "Annual policy and governed-plan review",
     activityType: "policy-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: [
       "policy-anti-bribery-corruption",
       "policy-clear-desk-screen",
@@ -463,10 +499,14 @@ const obligations = [
     title: "Annual security awareness training",
     activityType: "training",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: ["training-security-awareness"],
     templateResourceId: "training-security-awareness",
-    controlIds: ["control-security-training"],
+    controlIds: [
+      "control-security-communication",
+      "control-workforce-expectations",
+      "control-security-training"
+    ],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -474,7 +514,7 @@ const obligations = [
     title: "Annual workforce performance review",
     activityType: "performance-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-performance-review"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -483,7 +523,7 @@ const obligations = [
     title: "Quarterly privileged and production access review",
     activityType: "access-review",
     recurrence: calendar("month", 3),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -492,7 +532,7 @@ const obligations = [
     title: "Annual important-system access review",
     activityType: "access-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -501,7 +541,7 @@ const obligations = [
     title: "Annual system, company and personal device, vendor, and data inventory review",
     activityType: "inventory-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-data-classification-inventory"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -510,7 +550,7 @@ const obligations = [
     title: "Monthly endpoint malware scan",
     activityType: "security-scan",
     recurrence: calendar("month", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-endpoint-protection"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -519,7 +559,7 @@ const obligations = [
     title: "Annual firewall and network access review",
     activityType: "network-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-network-security"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -528,7 +568,7 @@ const obligations = [
     title: "Quarterly vulnerability scan",
     activityType: "vulnerability-scan",
     recurrence: calendar("month", 3),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vulnerability-management"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -537,7 +577,7 @@ const obligations = [
     title: "Annual independent penetration test",
     activityType: "penetration-test",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-penetration-testing"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -546,7 +586,7 @@ const obligations = [
     title: "Quarterly security log and log-access review",
     activityType: "log-review",
     recurrence: calendar("month", 3),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-logging-monitoring"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -555,7 +595,7 @@ const obligations = [
     title: "Annual incident response and alert-path exercise",
     activityType: "exercise",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: ["document-incident-response-plan"],
     templateResourceId: "document-incident-response-plan",
     controlIds: ["control-incident-exercise", "control-logging-monitoring"],
@@ -566,7 +606,7 @@ const obligations = [
     title: "Annual backup restoration test",
     activityType: "backup-test",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-backup-restoration"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -586,8 +626,8 @@ const obligations = [
     title: "Annual critical and high-risk vendor review",
     activityType: "vendor-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
-    controlIds: ["control-vendor-monitoring"],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-vendor-due-diligence", "control-vendor-monitoring"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
   {
@@ -595,7 +635,7 @@ const obligations = [
     title: "Annual emergency contact review",
     activityType: "continuity-review",
     recurrence: calendar("year", 1),
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: ["document-business-continuity-disaster-recovery"],
     controlIds: ["control-continuity-exercise"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
@@ -607,8 +647,7 @@ const obligations = [
     recurrence: event("person-started"),
     triggerPrompt: "New employee or contractor?",
     window: eventWindow(0),
-    completionResourceTypes: ["attestation", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-workforce-expectations"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -619,8 +658,7 @@ const obligations = [
     recurrence: event("person-started"),
     triggerPrompt: "New employee or contractor?",
     window: eventWindow(0),
-    completionResourceTypes: ["access-grant", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -631,8 +669,7 @@ const obligations = [
     recurrence: event("person-started"),
     triggerPrompt: "New employee or contractor?",
     window: eventWindow(0),
-    completionResourceTypes: ["asset"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -643,8 +680,7 @@ const obligations = [
     recurrence: event("person-started"),
     triggerPrompt: "New employee or contractor?",
     window: eventWindow(30),
-    completionResourceTypes: ["attestation", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: ["training-security-awareness"],
     templateResourceId: "training-security-awareness",
     controlIds: ["control-security-training"],
@@ -657,8 +693,7 @@ const obligations = [
     recurrence: event("person-started"),
     triggerPrompt: "New employee or contractor?",
     window: eventWindow(30),
-    completionResourceTypes: ["attestation", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: ROLE_TRAINING_IDS,
     controlIds: ["control-security-training"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
@@ -670,8 +705,7 @@ const obligations = [
     recurrence: event("person-ended"),
     triggerPrompt: "Employee or contractor departing?",
     window: eventWindowHours(24),
-    completionResourceTypes: ["access-grant", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -682,8 +716,7 @@ const obligations = [
     recurrence: event("person-ended"),
     triggerPrompt: "Employee or contractor departing?",
     window: eventWindow(7),
-    completionResourceTypes: ["asset", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding", "control-inventory-configuration"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -691,11 +724,11 @@ const obligations = [
     id: "obligation-high-risk-departure-access",
     title: "Revoke access at or before departure notice",
     activityType: "access-removal",
-    recurrence: event("high-risk-person-ended"),
+    recurrence: event("person-ended"),
+    eventRiskLevels: ["high"],
     triggerPrompt: "Involuntary or high-risk departure?",
     window: eventWindowHours(0),
-    completionResourceTypes: ["access-grant", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -706,8 +739,7 @@ const obligations = [
     recurrence: event("person-role-changed"),
     triggerPrompt: "Worker role changed?",
     window: eventWindow(3),
-    completionResourceTypes: ["access-grant", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization", "control-access-review-offboarding"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -718,8 +750,7 @@ const obligations = [
     recurrence: event("person-role-changed"),
     triggerPrompt: "Worker role changed?",
     window: eventWindow(30),
-    completionResourceTypes: ["attestation", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: ROLE_TRAINING_IDS,
     controlIds: ["control-security-training"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
@@ -731,8 +762,7 @@ const obligations = [
     recurrence: event("personal-device-access-planned"),
     triggerPrompt: "Personal device needs company access?",
     window: eventWindow(0),
-    completionResourceTypes: ["evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization", "control-endpoint-protection"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
   },
@@ -743,8 +773,7 @@ const obligations = [
     recurrence: event("personal-device-access-planned"),
     triggerPrompt: "Personal device needs company access?",
     window: eventWindow(0),
-    completionResourceTypes: ["asset", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-endpoint-protection"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
   },
@@ -755,8 +784,7 @@ const obligations = [
     recurrence: event("vendor-access-planned"),
     triggerPrompt: "New vendor access or data use?",
     window: eventWindow(0),
-    completionResourceTypes: ["vendor-review", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -767,8 +795,7 @@ const obligations = [
     recurrence: event("vendor-access-planned"),
     triggerPrompt: "New vendor access or data use?",
     window: eventWindow(0),
-    completionResourceTypes: ["document", "vendor"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -779,8 +806,7 @@ const obligations = [
     recurrence: event("vendor-reassessment-needed"),
     triggerPrompt: "Vendor changed materially or had an incident?",
     window: eventWindow(30),
-    completionResourceTypes: ["vendor-review", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -791,8 +817,7 @@ const obligations = [
     recurrence: event("vendor-reassessment-needed"),
     triggerPrompt: "Vendor changed materially or had an incident?",
     window: eventWindow(30),
-    completionResourceTypes: ["vendor", "risk", "document", "action-item", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring", "control-data-classification-inventory"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
   },
@@ -803,7 +828,6 @@ const obligations = [
     recurrence: event("system-material-change"),
     triggerPrompt: "Material system, service, or data-use change?",
     window: eventWindow(30),
-    completionResourceTypes: ["risk-assessment", "risk", "evidence"],
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
@@ -815,8 +839,7 @@ const obligations = [
     recurrence: event("system-material-change"),
     triggerPrompt: "Material system, service, or data-use change?",
     window: eventWindow(30),
-    completionResourceTypes: ["vulnerability-scan", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vulnerability-management"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -827,7 +850,6 @@ const obligations = [
     recurrence: event("system-material-change"),
     triggerPrompt: "Material system, service, or data-use change?",
     window: eventWindow(30),
-    completionResourceTypes: ["meeting", "policy", "control", "evidence"],
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-policy-management", "control-security-communication"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
@@ -839,8 +861,7 @@ const obligations = [
     recurrence: event("system-material-change"),
     triggerPrompt: "Material system, service, or data-use change?",
     window: eventWindow(30),
-    completionResourceTypes: ["document", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: [RETENTION_SCHEDULE_ID],
     templateResourceId: RETENTION_SCHEDULE_ID,
     controlIds: ["control-data-retention-disposal", "control-data-classification-inventory"],
@@ -853,8 +874,7 @@ const obligations = [
     recurrence: event("system-material-change"),
     triggerPrompt: "Material system, service, or data-use change?",
     window: eventWindow(30),
-    completionResourceTypes: ["control-test", "exercise", "evidence"],
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-logging-monitoring", "control-incident-exercise"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -865,7 +885,6 @@ const obligations = [
     recurrence: event("material-incident"),
     triggerPrompt: "Material security incident?",
     window: eventWindow(7),
-    completionResourceTypes: ["incident", "document", "evidence"],
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-incident-response"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
@@ -877,9 +896,151 @@ const obligations = [
     recurrence: event("material-incident"),
     triggerPrompt: "Material security incident?",
     window: eventWindow(7),
-    completionResourceTypes: ["action-item", "finding"],
     ownerIds: [OVERSIGHT_TEAM_ID],
-    controlIds: ["control-monitoring-remediation"],
+    controlIds: ["control-monitoring-remediation", "control-security-exceptions"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-vendor-activation-review",
+    title: "Complete vendor activation review",
+    activityType: "vendor-review",
+    recurrence: event("vendor-activated"),
+    triggerPrompt: "Vendor activated?",
+    window: eventWindow(30),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-vendor-due-diligence", "control-vendor-monitoring"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-vendor-termination-closeout",
+    title: "Revoke vendor access and confirm data return or disposal",
+    activityType: "access-removal",
+    recurrence: event("vendor-terminated"),
+    triggerPrompt: "Vendor terminated?",
+    window: eventWindow(7),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-vendor-monitoring", "control-access-review-offboarding"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+  },
+  {
+    id: "obligation-data-use-change-assessment",
+    title: "Assess the changed data use and control impact",
+    activityType: "risk-assessment",
+    recurrence: event("material-data-use-change"),
+    triggerPrompt: "Material data-use change?",
+    window: eventWindow(30),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-risk-assessment", "control-data-classification-inventory"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+  },
+  {
+    id: "obligation-incident-closure-review",
+    title: "Complete incident closure and lessons-learned review",
+    activityType: "incident-retrospective",
+    recurrence: event("incident-closed"),
+    triggerPrompt: "Incident closed?",
+    window: eventWindow(7),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-incident-response", "control-monitoring-remediation"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-policy-revision-approval",
+    title: "Review and approve the revised policy",
+    activityType: "policy-review",
+    recurrence: event("policy-revised"),
+    triggerPrompt: "Policy materially revised?",
+    window: eventWindow(30),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-policy-management"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-emergency-change-review",
+    title: "Complete emergency-change post-review",
+    activityType: "change-review",
+    recurrence: event("emergency-change"),
+    triggerPrompt: "Emergency change completed?",
+    window: eventWindow(2),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-change-management"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-exception-expiry-review",
+    title: "Review expired exception and compensating controls",
+    activityType: "exception-review",
+    recurrence: event("exception-expired"),
+    triggerPrompt: "Exception expired?",
+    window: eventWindow(1),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-monitoring-remediation", "control-security-exceptions"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-service-account-creation-review",
+    title: "Authorize and review the new service account",
+    activityType: "access-provisioning",
+    recurrence: event("service-account-created"),
+    triggerPrompt: "Service account created?",
+    window: eventWindow(3),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-access-authorization"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-service-account-expiry",
+    title: "Disable or renew the expired service account",
+    activityType: "access-removal",
+    recurrence: event("service-account-expired"),
+    triggerPrompt: "Service account expired?",
+    window: eventWindow(1),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-access-review-offboarding"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-vulnerability-confirmed-remediation",
+    title: "Assign confirmed vulnerability remediation",
+    activityType: "remediation",
+    recurrence: event("vulnerability-confirmed"),
+    triggerPrompt: "Vulnerability confirmed?",
+    window: eventWindow(3),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-vulnerability-management"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-vulnerability-overdue-escalation",
+    title: "Escalate overdue vulnerability remediation",
+    activityType: "remediation",
+    recurrence: event("vulnerability-overdue"),
+    triggerPrompt: "Vulnerability remediation overdue?",
+    window: eventWindow(1),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-vulnerability-management", "control-monitoring-remediation"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-asset-disposal-proof",
+    title: "Record asset sanitization and disposal proof",
+    activityType: "asset-recovery",
+    recurrence: event("asset-disposed"),
+    triggerPrompt: "Asset disposed?",
+    window: eventWindow(7),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-inventory-configuration", "control-data-retention-disposal"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+  },
+  {
+    id: "obligation-continuity-activation-review",
+    title: "Review continuity activation, recovery, and follow-up",
+    activityType: "continuity-review",
+    recurrence: event("continuity-activated"),
+    triggerPrompt: "Continuity plan activated?",
+    window: eventWindow(7),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-continuity-exercise", "control-monitoring-remediation"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   }
 ];
@@ -890,7 +1051,6 @@ export function baselineRecordPaths(starter = "security") {
 
 export function baselineRecordFiles(effectiveDate, starter = "security") {
   const framework = {
-    schemaVersion: 1,
     id: FRAMEWORK_ID,
     type: "framework",
     title: "AICPA Trust Services Criteria",
@@ -904,7 +1064,6 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
     }
   };
   const descriptionFramework = {
-    schemaVersion: 1,
     id: DESCRIPTION_FRAMEWORK_ID,
     type: "framework",
     title: "AICPA SOC 2 Description Criteria",
@@ -918,79 +1077,74 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
     }
   };
   const commonRequirements = commonCriteria.map(([reference, name, description]) => ({
-    schemaVersion: 1,
     id: requirementId(reference),
     type: "requirement",
     title: `${reference}: ${name}`,
     frameworkId: FRAMEWORK_ID,
     reference,
-    applicability: "applicable",
+    applicability: "undetermined",
     description,
-    applicabilityRationale: "Included in the default SOC 2 Security baseline. Confirm applicability and exact interpretation with the selected auditor.",
+    applicabilityRationale: "Confirm applicability against the selected service, scope, and auditor guidance before accepting this starter criterion.",
     tags: ["security", "common-criteria"]
   }));
   const descriptionRequirements = descriptionCriteria.map(([reference, name, description]) => ({
-    schemaVersion: 1,
     id: requirementId(reference),
     type: "requirement",
     title: `${reference}: ${name}`,
     frameworkId: DESCRIPTION_FRAMEWORK_ID,
     reference,
-    applicability: "applicable",
+    applicability: "undetermined",
     description,
-    applicabilityRationale: "Included for preparing the system description. Confirm the official criterion and expected presentation with the selected auditor.",
+    applicabilityRationale: "Confirm applicability against the selected service and auditor guidance before accepting this starter description criterion.",
     tags: ["description-criteria"]
   }));
   const controlRecords = controls.map((control) => ({
-    schemaVersion: 1,
     id: control.id,
     type: "control",
     title: control.title,
     status: "planned",
     statement: control.statement,
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     requirementIds: control.requirements.map(requirementId),
     code: control.code,
     activity: control.activity,
     controlType: control.controlType,
     operationMode: control.operationMode,
-    frequency: control.frequency,
-    policyIds: control.policies
+    operationPattern: control.operationPattern,
+    policyIds: control.policies,
+    ...(FILEGRC_SOURCE_CONTROL_CODES.has(control.code)
+      ? { evidenceSourceIds: ["system-filegrc-program-repository"] }
+      : {})
   }));
   const team = {
-    schemaVersion: 1,
     id: OVERSIGHT_TEAM_ID,
     type: "team",
     title: "Security and Risk Oversight",
-    status: "inactive",
+    status: "planned",
     purpose: "Provide independent oversight of the security program, risk register, incidents, findings, vendor and access reviews, policy changes, exercises, and overdue work. The chair must be separate from the policy owner and people who operate the controls under review.",
-    memberIds: [OWNER_ID],
-    chairIds: [],
-    meetingCadence: calendar("month", 3, effectiveDate)
+    memberIds: [PROGRAM_LEAD_ID],
+    chairIds: []
   };
   const programRepository = {
-    schemaVersion: 1,
     id: "system-filegrc-program-repository",
     type: "system",
     title: "filegrc Program Repository",
     status: "active",
     criticality: "high",
-    ownerIds: [OWNER_ID],
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     description: "The Git repository that is authoritative for filegrc governance records, approvals, exceptions, findings, acknowledgements, evidence indexes, and their revision history.",
     systemKind: "governance-system-of-record",
     environment: "Git repository",
-    dataClassification: "Confidential",
+    classificationId: "confidential",
     internetExposed: false,
-    inScope: false,
-    evidenceSourceKinds: ["training-acknowledgement", "exception-finding"],
-    evidenceOwnerIds: [OWNER_ID]
+    evidenceSourceKinds: FILEGRC_SOURCE_FAMILIES,
+    evidenceOwnerIds: [POLICY_OWNER_APPOINTMENT_ID]
   };
   const obligationRecords = obligations.map((obligation) => ({
-    schemaVersion: 1,
     id: obligation.id,
     type: "obligation",
     title: obligation.title,
-    status: "active",
+    status: "proposed",
     activityType: obligation.activityType,
     recurrence: obligation.recurrence.mode === "calendar"
       ? { ...obligation.recurrence, anchorDate: effectiveDate }
@@ -998,13 +1152,32 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
     ownerIds: obligation.ownerIds,
     startsOn: effectiveDate,
     ...(obligation.triggerPrompt ? { triggerPrompt: obligation.triggerPrompt } : {}),
+    ...(obligation.eventRiskLevels ? { eventRiskLevels: obligation.eventRiskLevels } : {}),
     ...(obligation.window ? { window: obligation.window } : {}),
-    ...(obligation.completionResourceTypes ? { completionResourceTypes: obligation.completionResourceTypes } : {}),
     ...(obligation.scopeResourceIds ? { scopeResourceIds: obligation.scopeResourceIds } : {}),
     ...(obligation.templateResourceId ? { templateResourceId: obligation.templateResourceId } : {}),
     controlIds: obligation.controlIds,
     policyIds: obligation.policyIds
   }));
+  const sourceCoverageRecords = SOURCE_FAMILIES.map(([sourceFamilyId, title]) => {
+    const filegrcManaged = FILEGRC_SOURCE_FAMILIES.includes(sourceFamilyId);
+    return {
+      id: `source-coverage-${sourceFamilyId}`,
+      type: "source-coverage",
+      title: `${title} coverage`,
+      status: filegrcManaged ? "active" : "planned",
+      sourceFamilyId,
+      coverageKind: filegrcManaged ? "filegrc" : "external-system",
+      scopeResourceIds: ["workspace"],
+      ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+      ...(filegrcManaged ? {
+        collectionCadence: "Record work when it occurs and export the complete population for the audit period.",
+        retention: "Keep records for the period defined in the approved Data Retention Schedule.",
+        reconciliationMethod: "Export the complete filegrc source-family population, compare it with related in-scope records and Work Queue activity, and investigate omissions or duplicates.",
+        validFrom: effectiveDate
+      } : {})
+    };
+  });
 
   const foundation = [
     recordFile("systems", programRepository),
@@ -1019,6 +1192,7 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
     ...descriptionRequirements.map((record) => recordFile("requirements", record)),
     ...controlRecords.map((record) => recordFile("controls", record)),
     ...foundation,
+    ...sourceCoverageRecords.map((record) => recordFile("source-coverage", record)),
     ...obligationRecords.map((record) => recordFile("obligations", record))
   ];
 }
@@ -1044,17 +1218,19 @@ function event(eventType) {
   return { mode: "event", eventType };
 }
 
-function eventWindow(endOffsetDays = 30) {
+function eventWindow(dueAfter = 30) {
   return {
-    startOffsetDays: 0,
-    endOffsetDays
+    precision: "date",
+    startsAfter: 0,
+    dueAfter
   };
 }
 
-function eventWindowHours(endOffsetHours) {
+function eventWindowHours(dueAfter) {
   return {
-    startOffsetHours: 0,
-    endOffsetHours
+    precision: "timestamp",
+    startsAfter: 0,
+    dueAfter
   };
 }