create-filegrc 0.6.4 → 0.7.0

package/template/data/documents/document-contractor-policy-acknowledgement.md

@@ -1,24 +0,0 @@
-# Contractor Policy Acknowledgement
-
-I acknowledge that I received access to the following {{company_name}} documents:
-
-- Anti-Bribery and Corruption Policy
-- Business Continuity and Disaster Recovery Plan
-- Clear Desk and Clear Screen Policy
-- Data Protection and Handling Policy
-- Information Security Policy
-- Mobile Computing and Communications Policy
-
-I understand that I am responsible for following these documents while performing services for {{company_name}}, protecting information made available to me, and reporting suspected violations.
-
-I understand that the documents may be updated. When {{company_name}} requires a new acknowledgement, I will review the identified revisions before signing. The Git commit below identifies the exact revisions covered by this acknowledgement.
-
-This acknowledgement supplements and does not replace the applicable services, confidentiality, or data-protection agreement.
-
-Content Git commit: ___________________________________
-
-Contractor name: ____________________________________
-
-Signature: __________________________________________
-
-Date: ______________________________________________

package/template/data/documents/document-contractor-training-acknowledgement.json

@@ -1,23 +0,0 @@
-{
-  "id": "document-contractor-training-acknowledgement",
-  "type": "document",
-  "title": "Contractor Training Acknowledgement",
-  "status": "draft",
-  "documentKind": "attestation-template",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "version": "1.0",
-  "audience": [
-    "contractors"
-  ],
-  "controlIds": [
-    "control-security-training"
-  ],
-  "trainingIds": [
-    "training-security-awareness"
-  ],
-  "classificationId": "internal",
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "conditional"
-}

package/template/data/documents/document-contractor-training-acknowledgement.md

@@ -1,20 +0,0 @@
-# Contractor Training Acknowledgement
-
-I acknowledge that I completed the following {{company_name}} training:
-
-- Security Awareness and Incident Response Training
-- Other assigned training: ______________________________
-
-I understand the security responsibilities and reporting process described in the training. I had an opportunity to ask questions, and I will follow the policies and procedures that apply to the services I perform.
-
-I understand that training and policies may be updated. When {{company_name}} assigns revised or additional training, I will review the identified material and complete the required acknowledgement. The Git commit below identifies the exact training revision covered by this acknowledgement.
-
-This acknowledgement supplements and does not replace the applicable services, confidentiality, data-protection, or other written agreement.
-
-Training Git commit: __________________________________
-
-Contractor name: ____________________________________
-
-Signature: __________________________________________
-
-Date: ______________________________________________

package/template/data/documents/document-employee-handbook-acknowledgement.json

@@ -1,20 +0,0 @@
-{
-  "id": "document-employee-handbook-acknowledgement",
-  "type": "document",
-  "title": "Employee Handbook Acknowledgement",
-  "status": "draft",
-  "documentKind": "attestation-template",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "version": "1.0",
-  "audience": [
-    "employees"
-  ],
-  "controlIds": [
-    "control-workforce-expectations"
-  ],
-  "classificationId": "internal",
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "conditional"
-}

package/template/data/documents/document-employee-handbook-acknowledgement.md

@@ -1,19 +0,0 @@
-# Employee Handbook Acknowledgement
-
-I acknowledge that I received access to the current {{company_name}} Employee Handbook.
-
-I understand that I am responsible for reading the handbook, asking questions when a requirement is unclear, and following the requirements that apply to my work.
-
-I understand the reporting routes and the prohibition on retaliation for a good-faith report, accommodation request, safety concern, pay concern, or participation in a review.
-
-I understand that the handbook is not an employment contract. Local law, written employment terms, benefit plans, and approved regional supplements control when they differ from the handbook.
-
-I understand that the handbook may be updated. When {{company_name}} requires a new acknowledgement, I will review the identified revision before signing. The Git commit below identifies the exact handbook revision covered by this acknowledgement.
-
-Handbook Git commit: __________________________________
-
-Employee name: ______________________________________
-
-Signature: __________________________________________
-
-Date: ______________________________________________

package/template/data/documents/document-employee-policy-acknowledgement.json

@@ -1,20 +0,0 @@
-{
-  "id": "document-employee-policy-acknowledgement",
-  "type": "document",
-  "title": "Employee Policy Acknowledgement",
-  "status": "draft",
-  "documentKind": "attestation-template",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "version": "1.0",
-  "audience": [
-    "employees"
-  ],
-  "controlIds": [
-    "control-workforce-expectations"
-  ],
-  "classificationId": "internal",
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "conditional"
-}

package/template/data/documents/document-employee-policy-acknowledgement.md

@@ -1,24 +0,0 @@
-# Employee Policy Acknowledgement
-
-I acknowledge that I received access to the following {{company_name}} documents:
-
-- Anti-Bribery and Corruption Policy
-- Business Continuity and Disaster Recovery Plan
-- Clear Desk and Clear Screen Policy
-- Data Protection and Handling Policy
-- Information Security Policy
-- Mobile Computing and Communications Policy
-
-I understand that I am responsible for reading and following these documents, asking questions when a requirement is unclear, and reporting suspected violations.
-
-I understand that the documents may be updated. When {{company_name}} requires a new acknowledgement, I will review the identified revisions before signing. The Git commit below identifies the exact revisions covered by this acknowledgement.
-
-This acknowledgement does not change the terms of employment or create a contract where one does not otherwise exist.
-
-Content Git commit: ___________________________________
-
-Employee name: ______________________________________
-
-Signature: __________________________________________
-
-Date: ______________________________________________

package/template/data/documents/document-employee-training-acknowledgement.json

@@ -1,23 +0,0 @@
-{
-  "id": "document-employee-training-acknowledgement",
-  "type": "document",
-  "title": "Employee Training Acknowledgement",
-  "status": "draft",
-  "documentKind": "attestation-template",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "version": "1.0",
-  "audience": [
-    "employees"
-  ],
-  "controlIds": [
-    "control-security-training"
-  ],
-  "trainingIds": [
-    "training-security-awareness"
-  ],
-  "classificationId": "internal",
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "conditional"
-}

package/template/data/documents/document-employee-training-acknowledgement.md

@@ -1,20 +0,0 @@
-# Employee Training Acknowledgement
-
-I acknowledge that I completed the following {{company_name}} training:
-
-- Security Awareness and Incident Response Training
-- Other assigned training: ______________________________
-
-I understand the security responsibilities and reporting process described in the training. I had an opportunity to ask questions, and I will follow the policies and procedures that apply to my work.
-
-I understand that training and policies may be updated. When {{company_name}} assigns revised or additional training, I will review the identified material and complete the required acknowledgement. The Git commit below identifies the exact training revision covered by this acknowledgement.
-
-This acknowledgement confirms completion of assigned training. It does not create an employment contract or change written employment terms.
-
-Training Git commit: __________________________________
-
-Employee name: ______________________________________
-
-Signature: __________________________________________
-
-Date: ______________________________________________

package/template/data/documents/document-incident-response-plan.md

@@ -1,138 +0,0 @@
-# Incident Response Plan
-
-## Purpose
-
-This plan defines how {{company_name}} identifies, declares, contains, investigates, communicates, recovers from, and learns from security incidents.
-
-## Scope
-
-This plan applies to suspected or confirmed events affecting company or customer systems, data, identities, devices, facilities, vendors, or business operations. Availability disruptions may also activate the Business Continuity and Disaster Recovery Plan.
-
-Questions and incident reports should be sent immediately to {{security_contact_email}}. If that route is unavailable or may be compromised, contact the current Policy Owner through a known alternate channel.
-
-## Definitions
-
-A **security event** is an observable occurrence that may affect the confidentiality, integrity, or availability of systems or information.
-
-A **security incident** is a security event that requires coordinated investigation, containment, recovery, or communication.
-
-A **material incident** is an incident that:
-
-- Causes or is reasonably likely to cause significant harm to customers, workers, operations, systems, or data
-- Causes a significant failure to meet a service commitment or system requirement
-- Results from a material control failure
-- Requires notice to a customer, regulator, insurer, or another outside party
-- Is designated material by the incident lead or executive sponsor based on the known facts
-
-Critical and High incidents are material unless the incident lead records why they are not. A lower-severity incident may still be material.
-
-## Severity
-
-The incident lead assigns an initial severity during triage and updates it as facts change.
-
-| Severity | General criteria | Response posture |
-| --- | --- | --- |
-| Critical | Active or widespread compromise, severe customer or operational harm, major Restricted-data exposure, or an urgent external-notification duty | Immediate executive and technical coordination with continuous ownership until contained |
-| High | Confirmed unauthorized access, material production or security-control impact, significant Confidential-data exposure, or likely material incident | Immediate coordinated response and frequent leadership updates |
-| Medium | Confirmed incident with limited scope or impact that can be contained through normal response procedures | Assigned incident lead, documented response, and escalation if impact grows |
-| Low | Security event requiring investigation or corrective work with little realized impact | Assigned owner, documented resolution, and trend review where useful |
-
-Severity considers affected data, systems, customers, privileges, duration, spread, exploitability, business impact, and notification duties. Every severity change records the reason and time.
-
-## Roles and authority
-
-These names describe response functions, not required job titles or separate Appointments. The current Policy Owner performs them by default and management delegates a function only when that matches how the organization actually responds.
-
-### Reporter
-
-Anyone may report a suspected incident. Reporters preserve available evidence, stop unsafe activity when they can do so safely, and follow response instructions. They do not need proof before reporting.
-
-### Incident lead
-
-The incident lead declares the incident, assigns severity, coordinates work, maintains the incident record, approves status changes, and decides when the incident is contained and closed. The current Policy Owner acts as incident lead until another qualified person is assigned.
-
-### Technical responders
-
-Technical responders investigate, contain, preserve evidence, remove the cause, restore service, and validate affected systems under the incident lead's direction.
-
-### System and process owners
-
-Owners explain business impact, dependencies, data, customer commitments, and recovery needs. They approve restored operation and remaining risk within their authority.
-
-### Executive sponsor
-
-The executive sponsor makes decisions beyond the incident lead's authority, accepts material residual risk, and approves material external communications.
-
-### Legal, privacy, insurance, and communications owners
-
-The responsible owners assess notification duties, preserve privilege where applicable, coordinate required third parties, and approve communications within their authority.
-
-## Reporting and declaration
-
-Report suspected phishing, malware, unauthorized access, credential exposure, data loss, unintended disclosure, security-control failure, or other security harm immediately.
-
-The incident lead records:
-
-- The report, detection time, and known occurrence time
-- Affected systems, identities, data, customers, locations, and vendors
-- Initial impact, severity, and materiality decision
-- Response participants and assigned owners
-- Evidence sources and preservation actions
-- Decisions, actions, communications, and timestamps
-- Required notifications and their owners and deadlines
-- Recovery status, remaining risk, and follow-up work
-
-An event becomes an incident when the incident lead determines that coordinated response is needed. Uncertainty is not a reason to delay containment or escalation.
-
-## Response
-
-The incident lead coordinates these activities in the order appropriate to the incident:
-
-1. Validate the report and assign an initial severity.
-2. Protect people and contain continuing harm.
-3. Preserve evidence and establish a reliable incident timeline.
-4. Identify affected systems, data, identities, customers, and dependencies.
-5. Remove the cause and close the path used by the incident.
-6. Recover systems and data through approved procedures.
-7. Validate security, integrity, monitoring, and expected operation.
-8. Complete required internal and external communications.
-9. Monitor for recurrence.
-10. Close the incident after owners accept the restored state and remaining risk.
-
-Responders may take emergency action needed to contain harm. Emergency changes must be recorded and reviewed through the normal change process after service is stable.
-
-## Evidence and investigation
-
-Responders preserve relevant messages, logs, alerts, files, system images, access records, configuration, and communications. Evidence records identify the collector, source, collection time, affected system, handling method, and integrity information available from the source.
-
-Access to incident evidence is limited to people with a response, legal, privacy, insurance, or audit need. Do not put credentials, active session material, regulated personal data, or confidential third-party reports in this repository unless its access and retention rules permit them.
-
-## Communications and notification
-
-Only authorized people communicate externally on behalf of {{company_name}}. The incident lead coordinates internal updates so responders, owners, and leadership receive the facts and decisions they need.
-
-For each potential external notice, the responsible owner records:
-
-- The triggering law, contract, policy, or commitment
-- The affected audience and known facts
-- The decision-maker and communication owner
-- The deadline and the event that started the deadline
-- The decision, approval, delivery time, and retained evidence
-
-Communications distinguish confirmed facts from estimates, avoid unsupported claims, and preserve confidentiality.
-
-## Recovery and closure
-
-Recovery follows approved system objectives and the Business Continuity and Disaster Recovery Plan when coordinated continuity work is needed. Systems do not return to service until the incident lead and system owner accept their security, integrity, monitoring, and remaining risk.
-
-Closure requires a final severity and materiality decision, an incident summary, disposition of notification duties, linked evidence, and assigned follow-up work.
-
-## Review and exercises
-
-Material incidents receive a root-cause and lessons review within one week. The review records contributing conditions, control failures, recovery results, communications, corrective actions, owners, and due dates.
-
-{{company_name}} tests this plan at least annually. Exercises cover declaration, roles, escalation, evidence, communications, recovery coordination, and lessons. Each annual exercise also tests at least one representative security alert from generation through receipt, acknowledgement, escalation, and a fallback route. Record timestamps, expected and actual recipients, failed steps, findings, and follow-up work.
-
-After a material change to monitoring, alert routing, escalation contacts, or response tooling, the owner tests the affected path within 30 days or records why the change cannot affect alert delivery or response.
-
-The policy owner reviews this plan at least annually and after a material incident or material change to systems, risks, contacts, or notification duties. Git history records approvals and changes.

package/template/data/policies/policy-anti-bribery-corruption.json

@@ -1,19 +0,0 @@
-{
-  "id": "policy-anti-bribery-corruption",
-  "type": "policy",
-  "title": "Anti-Bribery and Corruption Policy",
-  "status": "draft",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "policyKind": "corporate-conduct",
-  "version": "1.0",
-  "audience": [
-    "employees",
-    "contractors",
-    "agents"
-  ],
-  "acknowledgementRequired": true,
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "conditional"
-}

package/template/data/policies/policy-anti-bribery-corruption.md

@@ -1,87 +0,0 @@
-# Anti-Bribery and Corruption Policy
-
-## Purpose
-
-{{company_name}} conducts business honestly and complies with applicable anti-bribery and anti-corruption laws. No business result justifies offering, requesting, accepting, or concealing an improper payment or benefit.
-
-## Scope
-
-This policy applies to employees, contractors, officers, directors, agents, consultants, and third parties acting for {{company_name}}.
-
-## Prohibited conduct
-
-Covered persons must not directly or indirectly:
-
-- Offer, promise, authorize, give, request, or accept anything of value to improperly influence a decision.
-- Reward someone for misusing a position of trust.
-- Use a third party to do something this policy prohibits.
-- Make facilitation or expediting payments, except when necessary to prevent an immediate threat to health or safety.
-- Create false, incomplete, misleading, or undisclosed records.
-- Retaliate against someone who raises a concern in good faith.
-
-"Anything of value" includes money, gifts, meals, travel, entertainment, discounts, services, employment opportunities, charitable contributions, political contributions, and benefits provided to a recipient's family or associates.
-
-## Government officials
-
-Interactions with government officials require added care. The term includes elected and appointed officials, employees of government agencies or state-controlled entities, political candidates, public international organizations, and anyone acting in an official capacity.
-
-No payment, gift, or benefit may be offered to a government official to obtain or retain business, avoid a requirement, influence an official act, or secure an improper advantage.
-
-## Gifts, meals, travel, and entertainment
-
-Business courtesies must:
-
-- Have a legitimate business purpose.
-- Be reasonable, infrequent, and appropriate to the circumstances.
-- Comply with the recipient's rules and applicable law.
-- Never consist of cash or a cash equivalent.
-- Never be intended to influence a pending decision.
-- Be recorded accurately when {{company_name}} pays for them.
-
-The policy owner must approve any courtesy that could reasonably appear improper.
-
-## Political and charitable contributions
-
-Company funds, property, or services may not be used for political contributions without written approval from the policy owner and confirmation that the contribution is lawful.
-
-Charitable contributions must have a documented charitable purpose and may not benefit a decision-maker personally or act as a substitute for an improper payment.
-
-## Third parties
-
-Before engaging an agent, consultant, reseller, or other intermediary who may interact with customers or officials on {{company_name}}'s behalf, the responsible owner must:
-
-1. Perform risk-based due diligence.
-2. Confirm the service and compensation are commercially reasonable.
-3. Use a written agreement describing the service and requiring lawful conduct.
-4. Approve and retain invoices and supporting records.
-5. Monitor for unusual requests, payment methods, or relationships.
-
-Warning signs must be resolved before engagement or payment. Examples include:
-
-- A request for payment to an unrelated person, unusual account, or country unrelated to the work.
-- Vague services, excessive commissions, or invoices that do not match the agreement.
-- A close relationship with a government official or decision-maker.
-- Refusal to complete due diligence or sign appropriate contract terms.
-- A request to hide a person's identity, role, or the purpose of a transaction.
-
-## Books and records
-
-Transactions must be recorded promptly, accurately, and with enough detail to explain their purpose. Undisclosed accounts, false descriptions, fabricated invoices, and off-book transactions are prohibited.
-
-## Reporting
-
-Report questions, suspected violations, requests for improper payments, or inaccurate records to the current Policy Owner at {{security_contact_email}}. Reports may be made without first notifying a manager.
-
-{{company_name}} prohibits retaliation against anyone who reports a concern or participates in an investigation in good faith.
-
-## Investigations and enforcement
-
-{{company_name}} will review credible reports promptly and limit disclosure to people who need the information. Covered persons must preserve relevant records and cooperate honestly.
-
-Violations may result in removal of authority, termination of a contract or employment relationship, recovery of funds, and referral to authorities when appropriate.
-
-## Training and review
-
-People in higher-risk roles complete assigned anti-bribery training within 30 days of starting those duties or changing into a covered role. Covered roles include work involving sales, procurement, payments, gifts or hospitality, government interaction, higher-risk locations, or third parties acting for {{company_name}}. The onboarding or role-change checklist records the training assignment or why it does not apply.
-
-This policy is reviewed at least annually and after a material legal, geographic, or business change.

package/template/data/policies/policy-clear-desk-screen.json

@@ -1,18 +0,0 @@
-{
-  "id": "policy-clear-desk-screen",
-  "type": "policy",
-  "title": "Clear Desk and Clear Screen Policy",
-  "status": "draft",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "policyKind": "information-security",
-  "version": "1.0",
-  "audience": [
-    "employees",
-    "contractors"
-  ],
-  "acknowledgementRequired": true,
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "alternative"
-}

package/template/data/policies/policy-clear-desk-screen.md

@@ -1,49 +0,0 @@
-# Clear Desk and Clear Screen Policy
-
-## Purpose
-
-{{company_name}} protects confidential information from accidental exposure, theft, and unauthorized access in offices, shared spaces, and remote work locations.
-
-## Scope
-
-This policy applies to employees and contractors who handle company, customer, workforce, or vendor information.
-
-## Clear desk requirements
-
-When a workspace is unattended:
-
-- Store confidential papers and removable media in a locked or access-controlled location.
-- Remove passwords, access codes, keys, badges, and authentication devices from view.
-- Do not leave payment information, identity documents, contracts, customer lists, or personnel records exposed.
-- Retrieve sensitive print jobs immediately.
-- Dispose of sensitive paper in an approved secure-destruction container.
-- Return shared meeting rooms and work areas to a clean state.
-- Secure portable equipment with a physical lock or security cable where practical.
-
-At the end of the workday, secure confidential material and company equipment.
-
-## Clear screen requirements
-
-- Lock the screen whenever leaving a device unattended.
-- Configure automatic screen locking after no more than 15 minutes of inactivity.
-- Position screens to reduce unnecessary viewing by visitors or the public.
-- Use a privacy screen when confidential information must be viewed in a public or shared location.
-- Close files and applications that are no longer needed.
-- Do not display passwords, secrets, or recovery codes on monitors or notes.
-- Do not leave sensitive files, shortcuts, diagrams, or other information exposed on a shared desktop or display.
-
-## Remote work
-
-Remote workers must choose a workspace where household members, visitors, and the public cannot casually view or access confidential information. Voice and video calls involving confidential matters must be conducted where they cannot be overheard.
-
-## Visitors
-
-Visitors must remain in authorized areas and be supervised where confidential information or systems are present. Hosts are responsible for clearing exposed information before a visitor arrives.
-
-## Lost material or suspected exposure
-
-Report lost papers, devices, badges, removable media, or suspected unauthorized viewing immediately to the current Policy Owner at {{security_contact_email}}.
-
-## Enforcement and review
-
-Failure to follow this policy may lead to access restrictions or disciplinary action. The policy owner reviews this policy at least annually.

package/template/data/policies/policy-data-protection-handling.json

@@ -1,22 +0,0 @@
-{
-  "id": "policy-data-protection-handling",
-  "type": "policy",
-  "title": "Data Protection and Handling Policy",
-  "status": "draft",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "policyKind": "information-security",
-  "version": "1.0",
-  "audience": [
-    "employees",
-    "contractors",
-    "vendors"
-  ],
-  "acknowledgementRequired": true,
-  "relatedDocumentIds": [
-    "document-data-retention-schedule"
-  ],
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "required"
-}