create-filegrc 0.6.4 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.6.4",
+  "version": "0.7.0",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/defaults.js

@@ -7,13 +7,8 @@ const PROGRAM_LEAD_ID = "person-program-lead";
 const POLICY_OWNER_APPOINTMENT_ID = "appointment-policy-owner";
 const OVERSIGHT_TEAM_ID = "team-security-risk-oversight";
 const INFORMATION_SECURITY_POLICY_ID = "policy-information-security";
-const DATA_POLICY_ID = "policy-data-protection-handling";
 const RETENTION_SCHEDULE_ID = "document-data-retention-schedule";
-const ROLE_TRAINING_IDS = [
-  "training-secure-development",
-  "training-privileged-sensitive-roles",
-  "training-anti-bribery-high-risk-roles"
-];
+const SECURITY_PLAN_ID = "document-security-incident-recovery-plan";
 const FILEGRC_SOURCE_FAMILIES = [
   "training-acknowledgement",
   "exception-finding",
@@ -109,7 +104,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "scheduled",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-anti-bribery-corruption"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-policy-management",
@@ -121,13 +116,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [
-      "policy-anti-bribery-corruption",
-      "policy-clear-desk-screen",
-      DATA_POLICY_ID,
-      INFORMATION_SECURITY_POLICY_ID,
-      "policy-mobile-computing-communications"
-    ]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-security-communication",
@@ -139,7 +128,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-workforce-expectations",
@@ -151,7 +140,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-anti-bribery-corruption"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-security-training",
@@ -163,18 +152,6 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
-  },
-  {
-    id: "control-performance-review",
-    code: "HR-03",
-    title: "Workforce performance review",
-    statement: "Managers conduct a documented performance review at least annually and address responsibilities, conduct, and corrective action as appropriate to each worker's role.",
-    requirements: ["CC1.5"],
-    activity: "Complete and retain annual performance reviews and resulting corrective work.",
-    controlType: "detective",
-    operationMode: "manual",
-    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -187,7 +164,7 @@ const controls = [
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-monitoring-remediation",
@@ -211,7 +188,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-strong-authentication",
@@ -223,7 +200,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "continuous",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-access-review-offboarding",
@@ -235,7 +212,7 @@ const controls = [
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-physical-workspace-security",
@@ -247,7 +224,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "continuous",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-clear-desk-screen", "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-data-classification-inventory",
@@ -259,7 +236,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-encryption-transmission",
@@ -271,7 +248,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "automated",
     operationPattern: "continuous",
-    policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-data-retention-disposal",
@@ -283,7 +260,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "event-driven",
-    policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-inventory-configuration",
@@ -303,11 +280,11 @@ const controls = [
     title: "Endpoint protection",
     statement: "Devices that access company systems use approved configuration, encryption, screen locking, supported software, security updates, and continuous malware protection when supported.",
     requirements: ["CC6.6", "CC7.1"],
-    activity: "Manage endpoint safeguards and perform a full or equivalent malware scan at least monthly.",
+    activity: "Use continuous platform protection where supported and verify endpoint configuration, update, and compliance state on the risk-based schedule recorded in an Obligation when periodic work is needed.",
     controlType: "preventive",
     operationMode: "automated",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-network-security",
@@ -319,15 +296,15 @@ const controls = [
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-change-management",
     code: "CHG-01",
     title: "Change management",
-    statement: "Material software and infrastructure changes are recorded, reviewed, tested, approved, deployed through an authorized process, and recoverable; emergency changes receive later review.",
+    statement: "Material software and infrastructure changes are recorded, tested, approved, deployed through an authorized process, and recoverable. Review is independent when practical; a small team records a risk-appropriate compensating or post-deployment review, or an approved Exception, when independent pre-deployment review is not possible.",
     requirements: ["CC6.8", "CC8.1"],
-    activity: "Record the reason, author, reviewer, test result, deployment, and rollback method.",
+    activity: "Record the reason, author, risk, reviewer or compensating review, test result, deployment, and rollback method.",
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "event-driven",
@@ -337,9 +314,9 @@ const controls = [
     id: "control-vulnerability-management",
     code: "VUL-01",
     title: "Vulnerability management",
-    statement: "The organization monitors for vulnerabilities and scans internet-facing and production systems at least quarterly and after material changes when practical. Critical, High, Medium, and Low vulnerabilities are remediated within 7, 14, 30, and 30 days unless an approved exception applies.",
+    statement: "The organization monitors for vulnerabilities, chooses scan coverage and cadence based on exposure and risk, and assigns each confirmed vulnerability an approved risk-based remediation target or time-bound Exception.",
     requirements: ["CC7.1", "CC7.2", "CC7.3"],
-    activity: "Identify, validate, prioritize, remediate, or approve time-bound exceptions for vulnerabilities.",
+    activity: "Choose scan coverage and cadence. Review the starter remediation targets of Critical 7 days, High 14 days, Medium 30 days, and Low 90 days, then record the approved targets or time-bound Exceptions.",
     controlType: "detective",
     operationMode: "hybrid",
     operationPattern: "mixed",
@@ -349,7 +326,7 @@ const controls = [
     id: "control-penetration-testing",
     code: "PEN-01",
     title: "Penetration testing",
-    statement: "An independent penetration test evaluates the external attack surface of the in-scope service at least annually, with findings tracked to resolution or approved risk treatment.",
+    statement: "Management records whether independent penetration testing is needed for the in-scope service, then documents its scope and cadence from exposure, change, customer commitments, and risk decisions. Findings are tracked to resolution or approved risk treatment.",
     requirements: ["CC7.1", "CC7.2"],
     activity: "Define scope, perform independent testing, review results, and track findings.",
     controlType: "detective",
@@ -361,7 +338,7 @@ const controls = [
     id: "control-logging-monitoring",
     code: "LOG-01",
     title: "Logging and monitoring",
-    statement: "Important systems record security and operational events, protect and retain security logs for at least 12 months, and provide risk-based alerting, quarterly review, annual end-to-end alert-path testing, and testing after material alerting changes.",
+    statement: "Important systems record and protect security and operational events, retain them according to the approved Data Retention Schedule, and use risk-based alerting, review, and alert-path testing recorded in the applicable Controls and Obligations.",
     requirements: ["CC7.2", "CC7.3"],
     activity: "Collect, protect, alert on, test, and review important log output and access.",
     controlType: "detective",
@@ -379,7 +356,7 @@ const controls = [
     controlType: "corrective",
     operationMode: "hybrid",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-incident-exercise",
@@ -397,9 +374,9 @@ const controls = [
     id: "control-backup-restoration",
     code: "BCP-01",
     title: "Backup and restoration",
-    statement: "Important production data is backed up at least daily and retained for at least 30 days unless an approved stronger objective applies, with failures monitored and restoration tested annually.",
+    statement: "Each important System has backup scope, frequency, retention, monitoring, and restore validation that meet its approved recovery objectives, or a documented alternate recovery approach when backups are not the chosen safeguard.",
     requirements: ["CC7.5", "CC9.1"],
-    activity: "Protect and monitor backups, then test retrieval and use of restored data.",
+    activity: "Record System recovery objectives and backup or alternate recovery procedures, monitor the chosen safeguards, and validate recovery on the approved schedule.",
     controlType: "corrective",
     operationMode: "hybrid",
     operationPattern: "scheduled",
@@ -421,13 +398,13 @@ const controls = [
     id: "control-vendor-due-diligence",
     code: "VEN-01",
     title: "Vendor due diligence and contracting",
-    statement: "Vendors receive access to Confidential or Restricted data only after risk-based security and privacy review and suitable contractual safeguards.",
+    statement: "New Vendors receive risk-based security and privacy review and suitable contractual safeguards before access to Confidential or Restricted data. Vendors that predate Policy adoption receive a documented transition review, deadline, or approved risk acceptance.",
     requirements: ["CC9.2"],
     activity: "Assess service, data, access, assurance, recovery, incidents, and contract terms before access.",
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-vendor-monitoring",
@@ -439,7 +416,7 @@ const controls = [
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-security-exceptions",
@@ -451,7 +428,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   }
 ];
 
@@ -473,13 +450,8 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: [
-      "policy-anti-bribery-corruption",
-      "policy-clear-desk-screen",
-      DATA_POLICY_ID,
       INFORMATION_SECURITY_POLICY_ID,
-      "policy-mobile-computing-communications",
-      "document-business-continuity-disaster-recovery",
-      "document-incident-response-plan",
+      SECURITY_PLAN_ID,
       RETENTION_SCHEDULE_ID
     ],
     controlIds: ["control-policy-management"],
@@ -492,7 +464,7 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-security-training",
@@ -507,15 +479,6 @@ const obligations = [
       "control-workforce-expectations",
       "control-security-training"
     ],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
-  },
-  {
-    id: "obligation-annual-performance-review",
-    title: "Annual workforce performance review",
-    activityType: "performance-review",
-    recurrence: calendar("year", 1),
-    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    controlIds: ["control-performance-review"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -525,7 +488,7 @@ const obligations = [
     recurrence: calendar("month", 3),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-access-review",
@@ -534,7 +497,7 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-inventory-review",
@@ -543,12 +506,12 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
-    id: "obligation-monthly-malware-scan",
-    title: "Monthly endpoint malware scan",
-    activityType: "security-scan",
+    id: "obligation-monthly-endpoint-protection-verification",
+    title: "Monthly endpoint protection configuration verification",
+    activityType: "endpoint-verification",
     recurrence: calendar("month", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-endpoint-protection"],
@@ -596,8 +559,8 @@ const obligations = [
     activityType: "exercise",
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ["document-incident-response-plan"],
-    templateResourceId: "document-incident-response-plan",
+    scopeResourceIds: [SECURITY_PLAN_ID],
+    templateResourceId: SECURITY_PLAN_ID,
     controlIds: ["control-incident-exercise", "control-logging-monitoring"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -616,8 +579,8 @@ const obligations = [
     activityType: "exercise",
     recurrence: calendar("year", 1),
     ownerIds: [OVERSIGHT_TEAM_ID],
-    scopeResourceIds: ["document-business-continuity-disaster-recovery"],
-    templateResourceId: "document-business-continuity-disaster-recovery",
+    scopeResourceIds: [SECURITY_PLAN_ID],
+    templateResourceId: SECURITY_PLAN_ID,
     controlIds: ["control-continuity-exercise"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -628,7 +591,7 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence", "control-vendor-monitoring"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-emergency-contact-review",
@@ -636,7 +599,7 @@ const obligations = [
     activityType: "continuity-review",
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ["document-business-continuity-disaster-recovery"],
+    scopeResourceIds: [SECURITY_PLAN_ID],
     controlIds: ["control-continuity-exercise"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -660,7 +623,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-start-assets",
@@ -684,19 +647,7 @@ const obligations = [
     scopeResourceIds: ["training-security-awareness"],
     templateResourceId: "training-security-awareness",
     controlIds: ["control-security-training"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
-  },
-  {
-    id: "obligation-worker-start-role-training",
-    title: "Complete or document non-applicability of role-based training",
-    activityType: "role-training",
-    recurrence: event("person-started"),
-    triggerPrompt: "New employee or contractor?",
-    window: eventWindow(30),
-    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ROLE_TRAINING_IDS,
-    controlIds: ["control-security-training"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-end-access",
@@ -707,7 +658,7 @@ const obligations = [
     window: eventWindowHours(24),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-end-assets",
@@ -730,7 +681,7 @@ const obligations = [
     window: eventWindowHours(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-role-change-access",
@@ -741,19 +692,7 @@ const obligations = [
     window: eventWindow(3),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization", "control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
-  },
-  {
-    id: "obligation-worker-role-change-training",
-    title: "Complete or document non-applicability of training for the new role",
-    activityType: "role-training",
-    recurrence: event("person-role-changed"),
-    triggerPrompt: "Worker role changed?",
-    window: eventWindow(30),
-    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ROLE_TRAINING_IDS,
-    controlIds: ["control-security-training"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-personal-device-approval",
@@ -764,7 +703,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization", "control-endpoint-protection"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-personal-device-registration",
@@ -775,7 +714,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-endpoint-protection"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-access-review",
@@ -786,7 +725,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-access-contract",
@@ -797,7 +736,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-material-change-review",
@@ -808,7 +747,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-material-change-records",
@@ -819,7 +758,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-risk",
@@ -830,7 +769,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-scan",
@@ -852,7 +791,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-policy-management", "control-security-communication"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-retention",
@@ -865,7 +804,7 @@ const obligations = [
     scopeResourceIds: [RETENTION_SCHEDULE_ID],
     templateResourceId: RETENTION_SCHEDULE_ID,
     controlIds: ["control-data-retention-disposal", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-alert-path",
@@ -920,7 +859,7 @@ const obligations = [
     window: eventWindow(7),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring", "control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-data-use-change-assessment",
@@ -931,7 +870,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-incident-closure-review",
@@ -1030,7 +969,7 @@ const obligations = [
     window: eventWindow(7),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-data-retention-disposal"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-continuity-activation-review",

package/src/index.js

@@ -440,7 +440,7 @@ The generated workspace starts with foundational program records:
 
 - Workspace and renderer settings
 - The initial active owner
-- The two core Appointment records: an active Policy Owner plus a planned Independent Policy Reviewer assignment. Create another Appointment only when management actually delegates a named responsibility.
+- The two core Appointment records: an active Policy Owner plus a planned Independent Policy Reviewer assignment. Create another Appointment only when the company actually delegates a named responsibility.
 - A planned security and risk oversight team that still needs an independent chair
 - The filegrc Git repository as a governance system of record
 - A default 5x5 risk method and Public, Internal, Confidential, and Restricted data classifications
@@ -469,23 +469,24 @@ The generated workspace starts with the SOC 2 Security category:
 - Active framework records for the 2017 Trust Services Criteria with revised points of focus (2022) and the 2018 SOC 2 Description Criteria with revised implementation guidance (2022)
 - The 33 Common Criteria reference IDs from CC1.1 through CC9.2, without the licensed criteria text
 - The nine Description Criteria reference IDs from DC1 through DC9, without the licensed criteria text
-- Planned controls mapped to those references and the included policies
-- The two core Appointment records. Policy Owner starts active; Independent Policy Reviewer remains Ready until assigned. Program coordination, incident, recovery, executive, legal, privacy, insurance, communications, and audit-coordination functions stay with the Policy Owner unless management delegates one through a custom Appointment.
+- Planned controls mapped to those references and one required Information Security Policy
+- The two core Appointment records. Policy Owner starts active; Independent Policy Reviewer remains Ready until assigned. The Policy Owner coordinates incident, recovery, executive, communications, audit, insurance, privacy, and legal input unless the company delegates a function through a custom Appointment. FileGRC does not require in-house counsel or a standing legal retainer.
 - A security and risk oversight team chaired by an independent reviewer who may be internal or external
-- Recurring obligations for the reviews, scans, tests, training, and meetings required by the included policies
+- One Security Awareness Training record and proposed recurring obligations for reviews, scans, tests, training, and meetings
+- One combined Security Incident and Recovery Plan plus a focused Data Retention Schedule
 - A default 5x5 risk method and Public, Internal, Confidential, and Restricted data classifications
 
-Treat every planned control as a proposal until its owner, actual procedure in Record Markdown, system scope, cadence, authoritative evidence sources, implementation date, and mappings match actual practice. For a control linked to filegrc obligations, every non-retired Work Queue schedule must be enabled and its governing policies effective. Marking the control implemented starts eligible schedules. Do not mark a control implemented because a policy describes it. Add Availability, Processing Integrity, Confidentiality, or Privacy criteria only when they are in scope.
+Treat every planned Control as a proposal until its owner, actual procedure in Record Markdown, System scope, cadence, authoritative evidence sources, implementation date, and mappings match actual practice. FileGRC does not infer implementation from Policy prose. Enable the applicable Work Queue schedules during implementation; they remain dormant until the Policy is active and effective. Add Availability, Processing Integrity, Confidentiality, Privacy, employment, anti-bribery, or other broader GRC records only when the company chooses to expand the scope.
 
-The recurring obligations mirror the fixed cadences in the starter policies. They remain proposals until every governing policy is active and effective and, when they name controls, at least one linked control is implemented. Update the policy, control, and obligation together when an approved cadence changes. Create separate completion records, such as meetings, reviews, scans, tests, exercises, and attestations, for each period.`,
+The recurring Obligations contain reviewable starter defaults. They remain proposed until the company confirms their scope, owner, cadence, and proof. Enabling a schedule accepts those operational facts but does not start occurrences until the Information Security Policy is active and effective. Create separate completion records, such as meetings, reviews, scans, tests, exercises, and attestations, for each period.`,
     audit_preparation_guidance: "Preparation creates a separate system description, management assertion, and management representation document for the engagement from the local starter templates. Type 2 preparation also creates a period completeness statement and one `audit-population` record for each standard population. It is safe to run again and does not approve documents, mark controls implemented, or create evidence. Do not reuse one completed management document across engagements.",
     starter_setup: `## Finish initial setup
 
-The starter policies, controls, and obligations are proposals. They do not state that ${companyName} operates the described controls.
+The starter Policy, Controls, plan, schedule, training, and Obligations are proposals. They do not state that ${companyName} operates the described Controls.
 
 1. Run \`npx filegrc setup\` for guided service and goal setup, or use browser onboarding. Then finish Step 1 by adding the real reviewers and operators, finishing the oversight team, and confirming applicable criteria, commitments, material vendors, and in-scope systems.
-2. Review the starter policies, appoint a reviewer who is separate from the policy owner, and activate only the policies that match current practice. The reviewer will usually be another person in the organization, but may be external.
-3. Review the starter control set and implement each applicable Control with its actual procedure, scope, cadence, and authoritative evidence source Systems. Confirm every source is active, has the required evidence role and current access owners, and includes repeatable retrieval instructions in Record Markdown. Add the implementation date, confirm any linked Work Queue schedules are enabled, then record any complementary customer or subservice controls.
+2. Tailor the Information Security Policy and have someone other than its owner approve it. Approval accepts the Policy but does not mean the Controls are implemented.
+3. Review the starter Control set, combined Security Incident and Recovery Plan, Data Retention Schedule, Security Awareness Training, and proposed Obligations. Implement each applicable Control with its actual procedure, scope, cadence, Components, and authoritative evidence sources. Enable the applicable schedules, review the Policy activation assessment, then activate the Policy at the real implementation cutover.
 4. Run \`npx filegrc program-readiness --require-ready\`, record the management candidate period start when reliable evidence collection begins, maintain risk assessments and risks, update controls when needed, use Work Queue for scheduled work, and trigger Policy Events when changes create required actions.
 5. Engage a CPA firm, record the separate firm-agreed period in an audit record, review filegrc Evidence and External Evidence, and prepare fieldwork.`
   };
@@ -522,13 +523,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.6.4",
+    version: "0.7.0",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.6.4",
+        version: "0.7.0",
         dependencies: { filegrc: versionRange }
       }
     }

package/template/AGENTS.md

@@ -206,9 +206,14 @@ npx filegrc program-readiness --require-ready --summary --json
 The Evidence Ready gate requires:
 
 1. A management goal, selected systems, criteria, and controls.
-2. Active policies with completed text, separate management approval, real approval and effective dates, and linked controls.
-3. Implemented Controls with an owner, actual procedure, scope, operation pattern, mappings, implementation date, and every required linked Work Queue schedule running.
-4. Every selected Control mapped to active authoritative Systems with the required evidence source roles, current access owners, and repeatable extraction instructions in Record Markdown.
+2. Policy content approved by someone other than its owner in Step 2, followed by active Policies with real effective dates at the Step 3 cutover.
+3. Implemented Controls with an owner, actual procedure, scope, operation pattern, mappings, implementation date, and every required linked Work Queue schedule enabled.
+4. Every selected Control mapped to active authoritative Components with the required evidence source roles, current access owners, and repeatable extraction instructions in Record Markdown.
+5. Required governed plans complete and active, with no unresolved activation blockers.
+
+A Policy says what the company commits to do by the date it takes effect. Approval means the company accepts those commitments. It does not prove the work is done. Controls and operating records describe how the company meets them and provide the proof. A Control may be implemented against an approved inactive Policy, and enabled Obligations remain dormant until that Policy is active and effective.
+
+Review `policyActivations` in Program Readiness before cutover. It shows planned or partial Controls, missing Components or evidence sources, missing schedules, unresolved Exceptions, and dates that need attention. At the end of Step 3, use the Controls-page review or `npx filegrc activate-policies --scaffold` to choose which approved Policies take effect. You can activate with a documented gap or approved Exception, but Evidence Readiness remains incomplete until every required Policy is active and operating. FileGRC does not infer technical implementation from Policy prose. Put configuration facts in Controls, Components, Systems, governed schedules, and Evidence.
 
 Onboarding does not create Evidence Artifacts. Complete authoritative source Components as part of Control implementation. For every incomplete family in Program Readiness, update the Control with its authoritative `evidenceSourceComponentIds`, then give each source Component the required evidence role, current access owners, and repeatable retrieval instructions in Record Markdown. Use `npx filegrc evidence-map --json` when you want only those source checks. During Step 4, create an Evidence Artifact only when a real artifact exists. Select its `sourceComponentId`, attach or reference the result, link the Controls and operating record it supports, record its collector and Classification, then have another person verify it before audit use.