create-filegrc 0.3.4 → 0.5.0

package/template/data/policies/policy-clear-desk-screen.md

@@ -42,7 +42,7 @@ Visitors must remain in authorized areas and be supervised where confidential in
 
 ## Lost material or suspected exposure
 
-Report lost papers, devices, badges, removable media, or suspected unauthorized viewing immediately to {{policy_owner_name}} at {{security_contact_email}}.
+Report lost papers, devices, badges, removable media, or suspected unauthorized viewing immediately to the current Policy Owner at {{security_contact_email}}.
 
 ## Enforcement and review
 

package/template/data/policies/policy-data-protection-handling.json

@@ -1,33 +1,22 @@
 {
-  "schemaVersion": 1,
   "id": "policy-data-protection-handling",
   "type": "policy",
   "title": "Data Protection and Handling Policy",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
   "policyKind": "information-security",
   "version": "1.0",
-  "effectiveOn": "{{effective_date}}",
-  "reviewCadence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
-  "audience": ["employees", "contractors", "vendors"],
+  "audience": [
+    "employees",
+    "contractors",
+    "vendors"
+  ],
   "acknowledgementRequired": true,
-  "relatedDocumentIds": ["document-data-retention-schedule"],
-  "controlIds": [
-    "control-policy-management",
-    "control-risk-assessment",
-    "control-access-authorization",
-    "control-access-review-offboarding",
-    "control-data-classification-inventory",
-    "control-encryption-transmission",
-    "control-data-retention-disposal",
-    "control-incident-response",
-    "control-vendor-due-diligence",
-    "control-vendor-monitoring",
-    "control-security-exceptions"
-  ]
+  "relatedDocumentIds": [
+    "document-data-retention-schedule"
+  ],
+  "proposedEffectiveOn": "{{effective_date}}",
+  "programRole": "required"
 }

package/template/data/policies/policy-data-protection-handling.md

@@ -10,7 +10,7 @@ This policy applies to employees, contractors, vendors, systems, devices, and re
 
 ## Responsibilities
 
-{{policy_owner_name}} owns this policy. System and data owners decide which data a system may process, assign classifications, approve access, and set retention requirements. Everyone in scope must handle data according to its classification and report suspected loss or misuse.
+The current Policy Owner owns this policy. System and data owners decide which data a system may process, assign classifications, approve access, and set retention requirements. Everyone in scope must handle data according to its classification and report suspected loss or misuse.
 
 Questions and reports should be sent to {{security_contact_email}}.
 
@@ -121,7 +121,7 @@ People who develop or materially change applications complete secure-development
 
 Violations may result in access removal, corrective action, contract remedies, or other action allowed by law and agreement.
 
-Exceptions require a documented business reason, owner, risk assessment, compensating controls, expiration date, and approval from {{policy_owner_name}}.
+Exceptions require a documented business reason, owner, risk assessment, compensating controls, expiration date, and approval from the current Policy Owner.
 
 ## Review
 

package/template/data/policies/policy-employee-handbook.json

@@ -1,30 +1,21 @@
 {
-  "schemaVersion": 1,
   "id": "policy-employee-handbook",
   "type": "policy",
   "title": "Employee Handbook",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
   "policyKind": "workforce-conduct",
   "version": "1.0",
-  "effectiveOn": "{{effective_date}}",
-  "reviewCadence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
-  "audience": ["employees"],
-  "acknowledgementRequired": true,
-  "controlIds": [
-    "control-security-governance",
-    "control-policy-management",
-    "control-security-communication",
-    "control-workforce-expectations",
-    "control-performance-review"
+  "audience": [
+    "employees"
   ],
+  "acknowledgementRequired": true,
   "relatedDocumentIds": [
     "document-employee-handbook-acknowledgement",
     "document-employee-policy-acknowledgement"
-  ]
+  ],
+  "proposedEffectiveOn": "{{effective_date}}",
+  "programRole": "conditional"
 }

package/template/data/policies/policy-information-security.json

@@ -1,60 +1,29 @@
 {
-  "schemaVersion": 1,
   "id": "policy-information-security",
   "type": "policy",
   "title": "Information Security Policy",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
   "policyKind": "information-security",
   "version": "1.0",
-  "effectiveOn": "{{effective_date}}",
-  "reviewCadence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
-  "audience": ["employees", "contractors", "vendors"],
+  "audience": [
+    "employees",
+    "contractors",
+    "vendors"
+  ],
   "acknowledgementRequired": true,
   "relatedPolicyIds": [
     "policy-clear-desk-screen",
     "policy-data-protection-handling",
     "policy-mobile-computing-communications"
   ],
-  "controlIds": [
-    "control-security-governance",
-    "control-policy-management",
-    "control-security-communication",
-    "control-workforce-expectations",
-    "control-security-training",
-    "control-performance-review",
-    "control-risk-assessment",
-    "control-monitoring-remediation",
-    "control-access-authorization",
-    "control-strong-authentication",
-    "control-access-review-offboarding",
-    "control-physical-workspace-security",
-    "control-data-classification-inventory",
-    "control-encryption-transmission",
-    "control-data-retention-disposal",
-    "control-inventory-configuration",
-    "control-endpoint-protection",
-    "control-network-security",
-    "control-change-management",
-    "control-vulnerability-management",
-    "control-penetration-testing",
-    "control-logging-monitoring",
-    "control-incident-response",
-    "control-incident-exercise",
-    "control-backup-restoration",
-    "control-continuity-exercise",
-    "control-vendor-due-diligence",
-    "control-vendor-monitoring",
-    "control-security-exceptions"
-  ],
   "relatedDocumentIds": [
     "document-business-continuity-disaster-recovery",
     "document-incident-response-plan",
     "document-data-retention-schedule"
-  ]
+  ],
+  "proposedEffectiveOn": "{{effective_date}}",
+  "programRole": "required"
 }

package/template/data/policies/policy-information-security.md

@@ -17,7 +17,7 @@ More specific standards and procedures may set stricter requirements.
 
 ## Governance and responsibilities
 
-{{policy_owner_name}} owns the information security program and this policy. Questions and incident reports should be sent to {{security_contact_email}}.
+The current Policy Owner owns the information security program and this policy. Questions and incident reports should be sent to {{security_contact_email}}.
 
 The policy owner:
 
@@ -28,7 +28,7 @@ The policy owner:
 
 An independent reviewer chairs the security and risk oversight group. This person must be separate from the policy owner and able to challenge the owner's decisions. The reviewer will usually be another leader or manager in the organization, but may be external. The reviewer approves policies and governed plans, challenges management's assessment of control operation, and records independent decisions.
 
-The security and risk oversight group meets at least quarterly to review the risk register, material incidents, significant findings, vendor and access review results, policy changes, exercises, and overdue work. Each meeting has formal minutes, decisions, and assigned actions. A one-person company must appoint a qualified external person to fill the independent reviewer role because no second internal person is available.
+The security and risk oversight group meets at least quarterly to review the risk register, material incidents, significant findings, vendor and access review results, policy changes, exercises, and overdue work. Each meeting has formal minutes, decisions, and assigned actions. When no suitable internal independent reviewer is available, the organization appoints a qualified external person to fill the role.
 
 System and process owners classify their systems and data, approve access, maintain safeguards, respond to findings, and keep recovery information current.
 
@@ -224,7 +224,7 @@ An exception to this policy requires:
 - Compensating controls
 - An accountable owner
 - An expiration or review date
-- Approval from {{policy_owner_name}} or a person with greater authority
+- Approval from the current Policy Owner or a person with greater authority
 
 Violations may result in access removal, corrective action, contract remedies, or other action allowed by law and agreement.
 

package/template/data/policies/policy-mobile-computing-communications.json

@@ -1,27 +1,18 @@
 {
-  "schemaVersion": 1,
   "id": "policy-mobile-computing-communications",
   "type": "policy",
   "title": "Mobile Computing and Communications Policy",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
   "policyKind": "information-security",
   "version": "1.0",
-  "effectiveOn": "{{effective_date}}",
-  "reviewCadence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
-  "audience": ["employees", "contractors"],
+  "audience": [
+    "employees",
+    "contractors"
+  ],
   "acknowledgementRequired": true,
-  "controlIds": [
-    "control-policy-management",
-    "control-strong-authentication",
-    "control-physical-workspace-security",
-    "control-encryption-transmission",
-    "control-endpoint-protection",
-    "control-network-security"
-  ]
+  "proposedEffectiveOn": "{{effective_date}}",
+  "programRole": "supporting"
 }

package/template/data/policies/policy-mobile-computing-communications.md

@@ -63,7 +63,7 @@ The policy owner reviews authorized mobile devices, personal-device approvals, a
 
 ## Loss, theft, or compromise
 
-Report a lost, stolen, or suspected compromised device immediately to {{policy_owner_name}} at {{security_contact_email}}. Do not delay reporting while attempting to recover or investigate the device.
+Report a lost, stolen, or suspected compromised device immediately to the current Policy Owner at {{security_contact_email}}. Do not delay reporting while attempting to recover or investigate the device.
 
 ## Return and disposal
 

package/template/data/renderer.json

@@ -1,11 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "renderer-settings",
   "type": "renderer-settings",
   "title": "Renderer settings",
   "showOnboarding": true,
   "repositoryMode": "trunk",
   "authoritativeBranch": "main",
-  "repositoryRemote": "origin",
-  "completedStagePageIds": []
+  "repositoryRemote": "origin"
 }

package/template/data/systems/system-filegrc-program-repository.md

@@ -1,9 +1,9 @@
 # filegrc Program Repository
 
-This Git repository is the system of record for filegrc governance records and their revision history. It can supply the training and acknowledgement catalog, exception and finding populations, policy and document approvals, obligation history, Policy Event workflows, and management evidence indexes.
+This Git repository is the system of record for filegrc governance records and their revision history. It can supply the training and acknowledgement catalog, exception and finding populations, policy and document approvals, risk register and assessments, vendor inventory and reviews, oversight records, obligation history, Policy Event workflows, and management evidence indexes.
 
 ## Evidence Extraction
 
 Run filegrc from a clean commit. Use resource dates and audit links to select the exact engagement date or period, save the query or agent instructions with the export, and retain the fixed result behind an evidence record. Record a zero count when the committed source query returns no relevant items.
 
-The repository is authoritative only for records stored here. Identity, workforce, source-control, deployment, monitoring, endpoint, backup, vulnerability, and vendor systems remain authoritative for the activity they perform.
+The repository is authoritative only for records stored here. Identity, workforce, source-control, deployment, monitoring, endpoint, backup, vulnerability, and external vendor-management systems remain authoritative for the activity they perform.

package/template/data/training/training-anti-bribery-high-risk-roles.json

@@ -1,10 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "training-anti-bribery-high-risk-roles",
   "type": "training",
   "title": "Anti-Bribery Training for Higher-Risk Roles",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": ["appointment-policy-owner"],
   "audience": ["sales", "finance", "procurement", "government-interaction", "third-party-agents"],
   "assignmentTrigger": "covered-role-start-or-change",
   "completionWindowDays": 30,

package/template/data/training/training-privileged-sensitive-roles.json

@@ -1,10 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "training-privileged-sensitive-roles",
   "type": "training",
   "title": "Privileged and Sensitive Role Training",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": ["appointment-policy-owner"],
   "audience": ["privileged-administrators", "security", "finance", "privacy", "people-operations"],
   "assignmentTrigger": "covered-role-start-or-change",
   "completionWindowDays": 30,

package/template/data/training/training-secure-development.json

@@ -1,10 +1,9 @@
 {
-  "schemaVersion": 1,
   "id": "training-secure-development",
   "type": "training",
   "title": "Secure Development Training",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
+  "ownerIds": ["appointment-policy-owner"],
   "audience": ["engineering", "security", "software-development", "infrastructure"],
   "assignmentTrigger": "covered-role-start-or-change",
   "completionWindowDays": 30,

package/template/data/training/training-security-awareness.json

@@ -1,18 +1,16 @@
 {
-  "schemaVersion": 1,
   "id": "training-security-awareness",
   "type": "training",
   "title": "Security Awareness and Incident Response Training",
   "status": "draft",
-  "ownerIds": ["person-policy-owner"],
-  "audience": ["employees", "contractors"],
+  "ownerIds": [
+    "appointment-policy-owner"
+  ],
+  "audience": [
+    "employees",
+    "contractors"
+  ],
   "assignmentTrigger": "onboarding",
-  "recurrence": {
-    "mode": "calendar",
-    "unit": "year",
-    "interval": 1,
-    "anchorDate": "{{effective_date}}"
-  },
   "completionWindowDays": 30,
   "policyIds": [
     "policy-clear-desk-screen",

package/template/data/training/training-security-awareness.md

@@ -162,7 +162,7 @@ Report any event that could affect the confidentiality, integrity, or availabili
 ## Reporting and first actions
 
 1. Stop the unsafe action. Do not continue entering credentials, sending data, or following the request.
-2. Report the event immediately to {{security_contact_email}}. If that route is unavailable, contact {{policy_owner_name}} through an approved alternate method.
+2. Report the event immediately to {{security_contact_email}}. If that route is unavailable, contact the current Policy Owner through an approved alternate method.
 3. State what happened, when it happened, the affected account, device, system, or data, and any action already taken.
 4. Preserve the message, file, screen, device, or other evidence. Take a screenshot only when it is safe and does not expose more sensitive data.
 5. Follow response-team instructions. Remain available for questions.

package/template/data/workspace.json

@@ -1,6 +1,5 @@
 {
-  "schemaVersion": 1,
-  "dataModelVersion": "1",
+  "dataModelVersion": "3",
   "id": "workspace",
   "type": "workspace",
   "title": "{{program_title}}",
@@ -9,8 +8,20 @@
   "description": "{{program_description}}",
   "riskMethodology": {
     "method": "5x5 likelihood and impact",
-    "likelihoodScale": ["Rare", "Unlikely", "Possible", "Likely", "Almost certain"],
-    "impactScale": ["Negligible", "Minor", "Moderate", "Major", "Severe"],
+    "likelihoodScale": [
+      "Rare",
+      "Unlikely",
+      "Possible",
+      "Likely",
+      "Almost certain"
+    ],
+    "impactScale": [
+      "Negligible",
+      "Minor",
+      "Moderate",
+      "Major",
+      "Severe"
+    ],
     "ratingBands": {
       "low": "1-4",
       "medium": "5-9",
@@ -19,9 +30,9 @@
     }
   },
   "classificationDefinitions": {
-    "Public": "Approved for public release.",
-    "Internal": "Intended for the workforce and approved partners.",
-    "Confidential": "Disclosure could harm the organization, a customer, or another person.",
-    "Restricted": "Disclosure or alteration could cause severe harm or trigger legal duties."
+    "public": "Approved for public release.",
+    "internal": "Intended for the workforce and approved partners.",
+    "confidential": "Disclosure could harm the organization, a customer, or another person.",
+    "restricted": "Disclosure or alteration could cause severe harm or trigger legal duties."
   }
 }

package/template/package.json

@@ -1,13 +1,14 @@
 {
   "name": "{{project_name}}",
-  "version": "0.3.4",
+  "version": "0.5.0",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",
   "scripts": {
     "serve": "filegrc serve",
     "build": "filegrc build",
-    "validate": "filegrc validate"
+    "validate": "filegrc validate",
+    "check:milestone": "filegrc milestone-check"
   },
   "dependencies": {
     "filegrc": "{{filegrc_version_range}}"

package/template-parameters.json

@@ -7,7 +7,12 @@
     },
     {
       "key": "policy_owner_name",
-      "prompt": "Policy owner name",
+      "prompt": "Initial program lead name",
+      "required": true
+    },
+    {
+      "key": "policy_owner_job_title",
+      "prompt": "Initial program lead organization job title",
       "required": true
     },
     {

package/template/data/people/person-policy-owner.json

@@ -1,10 +0,0 @@
-{
-  "schemaVersion": 1,
-  "id": "person-policy-owner",
-  "type": "person",
-  "title": "{{policy_owner_name}}",
-  "status": "active",
-  "email": "{{policy_owner_email}}",
-  "role": "Policy Owner",
-  "teamIds": ["team-security-risk-oversight"]
-}