create-filegrc 0.6.5 → 0.7.1

package/src/defaults.js

@@ -7,13 +7,8 @@ const PROGRAM_LEAD_ID = "person-program-lead";
 const POLICY_OWNER_APPOINTMENT_ID = "appointment-policy-owner";
 const OVERSIGHT_TEAM_ID = "team-security-risk-oversight";
 const INFORMATION_SECURITY_POLICY_ID = "policy-information-security";
-const DATA_POLICY_ID = "policy-data-protection-handling";
 const RETENTION_SCHEDULE_ID = "document-data-retention-schedule";
-const ROLE_TRAINING_IDS = [
-  "training-secure-development",
-  "training-privileged-sensitive-roles",
-  "training-anti-bribery-high-risk-roles"
-];
+const SECURITY_PLAN_ID = "document-security-incident-recovery-plan";
 const FILEGRC_SOURCE_FAMILIES = [
   "training-acknowledgement",
   "exception-finding",
@@ -93,7 +88,7 @@ const descriptionCriteria = [
   ["DC5", "Applicable criteria and controls", "Identify the applicable trust services criteria and the controls designed to address them."],
   ["DC6", "Complementary user entity controls", "Describe controls that customers are expected to operate for the service organization's controls to work as intended."],
   ["DC7", "Subservice organizations and controls", "Describe relevant subservice organizations, how their controls are treated, and complementary controls they are expected to operate."],
-  ["DC8", "Criteria not relevant", "Identify any trust services criteria within an included category that are not relevant to the system and explain why."],
+  ["DC8", "Criteria not relevant", "Confirm that every Security Common Criterion applies. Identify any criterion from an included optional Trust Services Category that is not relevant to the system and explain the limited circumstances."],
   ["DC9", "Significant changes", "Describe significant system changes during the reporting period that could affect a report user's understanding of the system."]
 ];
 const commonCriteriaReferences = commonCriteria.map(([reference]) => reference);
@@ -109,49 +104,43 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "scheduled",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-anti-bribery-corruption"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-policy-management",
     code: "GOV-02",
-    title: "Policy management",
-    statement: "The policy owner reviews governed policies and plans at least annually and after material changes, obtains approval from a separate independent approver, and retains the approved revisions in Git.",
+    title: "Control and policy management",
+    statement: "Management selects and develops manual and technology Controls from approved objectives, commitments, risks, dependencies, and changes, and records each Control's owner, scope, procedure, operation pattern, evidence source, and implementation status. The policy owner reviews Controls, governed policies, and plans at least annually and after material changes, obtains separate approval for governed content, and retains approved revisions in Git.",
     requirements: ["CC5.1", "CC5.2", "CC5.3"],
-    activity: "Review, approve, communicate, and version policies and plans.",
+    activity: "Review Control design and evidence paths, correct gaps or approve time-bound Exceptions, and review, approve, communicate, and version governed policies and plans.",
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [
-      "policy-anti-bribery-corruption",
-      "policy-clear-desk-screen",
-      DATA_POLICY_ID,
-      INFORMATION_SECURITY_POLICY_ID,
-      "policy-mobile-computing-communications"
-    ]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-security-communication",
     code: "GOV-03",
-    title: "Security communication",
-    statement: "The organization communicates security responsibilities, approved reporting routes, material changes, and relevant control information to its workforce and outside parties.",
+    title: "Security information and communication",
+    statement: "Management obtains or generates, checks, and uses relevant and reliable information from internal and external sources to operate Controls, and communicates security responsibilities, approved reporting routes, material changes, and relevant Control information to its workforce and outside parties in time for action.",
     requirements: ["CC2.1", "CC2.2", "CC2.3"],
-    activity: "Maintain reporting routes and communicate policies, changes, and security information.",
+    activity: "Record material information sources, scope, period, ownership, and known limits; maintain reporting routes; and communicate policies, changes, and security information.",
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-workforce-expectations",
     code: "HR-01",
     title: "Workforce expectations",
-    statement: "Workers agree to applicable conduct, confidentiality, acceptable-use, and security responsibilities before receiving access and are held accountable for violations.",
-    requirements: ["CC1.4"],
-    activity: "Complete screening when appropriate, agreements, policy acknowledgement, and corrective action.",
+    statement: "Workers are screened before sensitive access when lawful and appropriate to role risk, have the competence needed for assigned duties, agree to applicable conduct, confidentiality, acceptable-use, intellectual-property, and security responsibilities before receiving access, and are held accountable for violations.",
+    requirements: ["CC1.4", "CC1.5"],
+    activity: "Record the role-based screening decision, confirm competence and authority, complete agreements and policy acknowledgement, and take corrective action when needed.",
     controlType: "preventive",
     operationMode: "manual",
-    operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-anti-bribery-corruption"]
+    operationPattern: "mixed",
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-security-training",
@@ -163,37 +152,25 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
-  },
-  {
-    id: "control-performance-review",
-    code: "HR-03",
-    title: "Workforce performance review",
-    statement: "Managers conduct a documented performance review at least annually and address responsibilities, conduct, and corrective action as appropriate to each worker's role.",
-    requirements: ["CC1.5"],
-    activity: "Complete and retain annual performance reviews and resulting corrective work.",
-    controlType: "detective",
-    operationMode: "manual",
-    operationPattern: "scheduled",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-risk-assessment",
     code: "RSK-01",
     title: "Risk assessment and treatment",
-    statement: "The organization assesses information security risk at least annually and after material changes, assigns owners and responses, and reviews high and critical risks at least quarterly.",
+    statement: "The organization defines security objectives and risk tolerance, assesses information security, fraud, misconduct, dependency, and change risk at least annually and after material changes, assigns owners and responses, and reviews high and critical risks at least quarterly.",
     requirements: ["CC3.1", "CC3.2", "CC3.3", "CC3.4", "CC9.1"],
-    activity: "Identify threats and changes, score risk, select treatment, and track review dates.",
+    activity: "Confirm objectives and risk tolerance, identify internal and external threats, fraud and misconduct scenarios, dependencies, and changes, score risk, select treatment, and track review dates.",
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-monitoring-remediation",
     code: "MON-01",
     title: "Control monitoring and remediation",
-    statement: "Management reviews control operation, incidents, test results, exceptions, and findings, then assigns and tracks corrective work through completion.",
+    statement: "Management reviews Control operation, source information, incidents, test results, Exceptions, and findings at least quarterly and after significant failures, then communicates deficiencies and assigns, tracks, and verifies corrective work through completion.",
     requirements: ["CC4.1", "CC4.2"],
     activity: "Review control evidence and track deficiencies, owners, due dates, and verification.",
     controlType: "detective",
@@ -211,19 +188,19 @@ const controls = [
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-strong-authentication",
     code: "IAM-02",
     title: "Strong authentication",
-    statement: "Important systems use approved authentication settings, protected unique credentials, and multi-factor authentication for administrative, production, source-control, email, identity, and sensitive-data access when supported.",
+    statement: "Important Systems use approved strong-authentication settings, unique identities, protected credentials, changed or disabled default credentials, and separate administrative identities or roles when technically supported and appropriate to risk. Multi-factor authentication is required for workforce and administrative access to production, source control, email, identity, and Systems that provide access to Confidential or Restricted data. Customer and external-user authentication requirements follow approved Controls, customer commitments, and risk decisions. Where required MFA is unavailable, management approves a time-bound Exception with a risk assessment, compensating Controls, an accountable owner, and a review or expiration date.",
     requirements: ["CC6.1", "CC6.2", "CC6.6"],
-    activity: "Configure and monitor authentication, credential storage, and privileged roles.",
+    activity: "Configure and monitor authentication, credential and recovery-material protection, default credentials, privileged identities or roles, customer requirements, and approved MFA Exceptions.",
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "continuous",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-access-review-offboarding",
@@ -235,7 +212,7 @@ const controls = [
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-physical-workspace-security",
@@ -247,7 +224,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "continuous",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-clear-desk-screen", "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-data-classification-inventory",
@@ -259,19 +236,19 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-encryption-transmission",
     code: "DATA-02",
     title: "Encryption and secure transmission",
-    statement: "Confidential and Restricted data is encrypted in transit over untrusted networks and at rest in approved systems and on devices, with protected key access.",
+    statement: "Confidential and Restricted data is encrypted in transit over untrusted networks and at rest in approved Systems and on devices, with named key ownership, protected key access, and risk-based key lifecycle controls.",
     requirements: ["CC6.1", "CC6.7"],
-    activity: "Configure encryption and approved transfer methods based on classification.",
+    activity: "Configure encryption and approved transfer methods based on classification, and control key generation, storage, distribution, rotation, revocation, and recovery as applicable.",
     controlType: "preventive",
     operationMode: "automated",
     operationPattern: "continuous",
-    policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-data-retention-disposal",
@@ -282,16 +259,16 @@ const controls = [
     activity: "Apply approved retention and disposal methods to active, local, backup, and vendor-held copies.",
     controlType: "preventive",
     operationMode: "hybrid",
-    operationPattern: "event-driven",
-    policies: [DATA_POLICY_ID, INFORMATION_SECURITY_POLICY_ID]
+    operationPattern: "mixed",
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-inventory-configuration",
     code: "OPS-01",
     title: "System inventory and secure configuration",
-    statement: "The organization maintains inventories of important systems, company and approved personal devices, service accounts, vendors, and data stores, with owners, lifecycle state, and secure configuration expectations.",
+    statement: "The organization maintains inventories of important Systems, Components, company and approved personal devices, software, service accounts, Vendors, and data stores, with owners, lifecycle state, and secure configuration expectations. Unsupported or unneeded important assets are upgraded, isolated, replaced, or retired according to risk.",
     requirements: ["CC6.1", "CC7.1"],
-    activity: "Maintain inventories, baselines, ownership, classification, and approved deviations.",
+    activity: "Maintain inventories, baselines, ownership, classification, lifecycle decisions, secure retirement, and approved deviations.",
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "mixed",
@@ -302,44 +279,44 @@ const controls = [
     code: "OPS-02",
     title: "Endpoint protection",
     statement: "Devices that access company systems use approved configuration, encryption, screen locking, supported software, security updates, and continuous malware protection when supported.",
-    requirements: ["CC6.6", "CC7.1"],
-    activity: "Manage endpoint safeguards and perform a full or equivalent malware scan at least monthly.",
+    requirements: ["CC6.6", "CC6.8", "CC7.1"],
+    activity: "Use continuous platform protection where supported and verify endpoint configuration, update, and compliance state on the approved risk-based schedule when periodic work is needed.",
     controlType: "preventive",
     operationMode: "automated",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-network-security",
     code: "NET-01",
     title: "Network and remote-access security",
-    statement: "The organization restricts network paths, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
+    statement: "The organization restricts network paths, separates production and nonproduction environments according to data and risk, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
     requirements: ["CC6.6", "CC6.7"],
-    activity: "Manage boundaries, firewall rules, wireless safeguards, and remote production access.",
+    activity: "Manage boundaries, environment connections, firewall rules, wireless safeguards, and remote production access.",
     controlType: "preventive",
     operationMode: "hybrid",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-change-management",
     code: "CHG-01",
     title: "Change management",
-    statement: "Material software and infrastructure changes are recorded, reviewed, tested, approved, deployed through an authorized process, and recoverable; emergency changes receive later review.",
+    statement: "Source and deployment paths protect against unauthorized changes and malicious software. Material software and infrastructure changes are recorded, receive a security design or threat analysis suited to their risk, are tested, approved, deployed through an authorized process, and are recoverable. Review is independent when practical; a small team records a risk-appropriate compensating or post-deployment review, or an approved Exception, when independent pre-deployment review is not possible.",
     requirements: ["CC6.8", "CC8.1"],
-    activity: "Record the reason, author, reviewer, test result, deployment, and rollback method.",
+    activity: "Record the reason, author, risk, security analysis when applicable, reviewer or compensating review, test result, deployment, communication, and rollback method.",
     controlType: "preventive",
     operationMode: "hybrid",
-    operationPattern: "event-driven",
+    operationPattern: "mixed",
     policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-vulnerability-management",
     code: "VUL-01",
     title: "Vulnerability management",
-    statement: "The organization monitors for vulnerabilities and scans internet-facing and production systems at least quarterly and after material changes when practical. Critical, High, Medium, and Low vulnerabilities are remediated within 7, 14, 30, and 30 days unless an approved exception applies.",
+    statement: "The organization monitors for vulnerabilities, chooses scan coverage and cadence based on exposure and risk, and assigns each confirmed vulnerability an approved risk-based remediation target or time-bound Exception.",
     requirements: ["CC7.1", "CC7.2", "CC7.3"],
-    activity: "Identify, validate, prioritize, remediate, or approve time-bound exceptions for vulnerabilities.",
+    activity: "Choose scan coverage and cadence, define approved risk-based remediation targets, and document time-bound Exceptions when a target cannot be met.",
     controlType: "detective",
     operationMode: "hybrid",
     operationPattern: "mixed",
@@ -349,9 +326,9 @@ const controls = [
     id: "control-penetration-testing",
     code: "PEN-01",
     title: "Penetration testing",
-    statement: "An independent penetration test evaluates the external attack surface of the in-scope service at least annually, with findings tracked to resolution or approved risk treatment.",
+    statement: "Management records whether independent penetration testing is needed for the in-scope service, then documents its scope and cadence from exposure, change, customer commitments, and risk decisions. Findings are tracked to resolution or approved risk treatment.",
     requirements: ["CC7.1", "CC7.2"],
-    activity: "Define scope, perform independent testing, review results, and track findings.",
+    activity: "Review and record applicability and cadence. When testing is required, define its scope and independence, perform the test, review results, and track findings.",
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "scheduled",
@@ -361,9 +338,9 @@ const controls = [
     id: "control-logging-monitoring",
     code: "LOG-01",
     title: "Logging and monitoring",
-    statement: "Important systems record security and operational events, protect and retain security logs for at least 12 months, and provide risk-based alerting, quarterly review, annual end-to-end alert-path testing, and testing after material alerting changes.",
+    statement: "Important Systems record and protect security and operational events, retain them according to the approved Data Retention Schedule, and use risk-based alerting, review, and alert-path testing. Systems with availability commitments, recovery objectives, or material operational dependencies also monitor the health, capacity, failure, and service indicators needed to detect degradation.",
     requirements: ["CC7.2", "CC7.3"],
-    activity: "Collect, protect, alert on, test, and review important log output and access.",
+    activity: "Collect, protect, alert on, test, and review important log output, access, and applicable health, capacity, failure, and service indicators.",
     controlType: "detective",
     operationMode: "hybrid",
     operationPattern: "mixed",
@@ -379,7 +356,7 @@ const controls = [
     controlType: "corrective",
     operationMode: "hybrid",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-incident-exercise",
@@ -397,9 +374,9 @@ const controls = [
     id: "control-backup-restoration",
     code: "BCP-01",
     title: "Backup and restoration",
-    statement: "Important production data is backed up at least daily and retained for at least 30 days unless an approved stronger objective applies, with failures monitored and restoration tested annually.",
+    statement: "Each important System has backup scope, frequency, retention, monitoring, and restore validation that meet its approved recovery objectives, or a documented alternate recovery approach when backups are not the chosen safeguard.",
     requirements: ["CC7.5", "CC9.1"],
-    activity: "Protect and monitor backups, then test retrieval and use of restored data.",
+    activity: "Record System recovery objectives and backup or alternate recovery procedures, monitor the chosen safeguards, and validate recovery on the approved schedule.",
     controlType: "corrective",
     operationMode: "hybrid",
     operationPattern: "scheduled",
@@ -421,13 +398,13 @@ const controls = [
     id: "control-vendor-due-diligence",
     code: "VEN-01",
     title: "Vendor due diligence and contracting",
-    statement: "Vendors receive access to Confidential or Restricted data only after risk-based security and privacy review and suitable contractual safeguards.",
+    statement: "New Vendors receive risk-based security and privacy review and suitable contractual safeguards before access to Confidential or Restricted data or material reliance by an important service. Applicable contracts address permitted use and confidentiality, security responsibilities, incident notice, access and subprocessor restrictions, continuity, data return or deletion, termination, and assurance rights. Vendors that predate Policy adoption receive a documented transition review, deadline, or approved risk acceptance.",
     requirements: ["CC9.2"],
-    activity: "Assess service, data, access, assurance, recovery, incidents, and contract terms before access.",
+    activity: "Assess service, data, access, assurance, recovery, incidents, dependencies, supplied Components, and applicable contract safeguards before access or material reliance.",
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-vendor-monitoring",
@@ -439,7 +416,7 @@ const controls = [
     controlType: "detective",
     operationMode: "manual",
     operationPattern: "mixed",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "control-security-exceptions",
@@ -451,7 +428,7 @@ const controls = [
     controlType: "preventive",
     operationMode: "manual",
     operationPattern: "event-driven",
-    policies: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policies: [INFORMATION_SECURITY_POLICY_ID]
   }
 ];
 
@@ -463,7 +440,11 @@ const obligations = [
     recurrence: calendar("month", 3),
     ownerIds: [OVERSIGHT_TEAM_ID],
     scopeResourceIds: [OVERSIGHT_TEAM_ID],
-    controlIds: ["control-security-governance"],
+    controlIds: [
+      "control-security-governance",
+      "control-security-communication",
+      "control-monitoring-remediation"
+    ],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -473,16 +454,20 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     scopeResourceIds: [
-      "policy-anti-bribery-corruption",
-      "policy-clear-desk-screen",
-      DATA_POLICY_ID,
       INFORMATION_SECURITY_POLICY_ID,
-      "policy-mobile-computing-communications",
-      "document-business-continuity-disaster-recovery",
-      "document-incident-response-plan",
+      SECURITY_PLAN_ID,
       RETENTION_SCHEDULE_ID
     ],
-    controlIds: ["control-policy-management"],
+    controlIds: ["control-policy-management", "control-data-retention-disposal"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-annual-control-design-review",
+    title: "Annual Control design and evidence-path review",
+    activityType: "control-design-review",
+    recurrence: calendar("year", 1),
+    ownerIds: [OVERSIGHT_TEAM_ID],
+    controlIds: ["control-policy-management", "control-monitoring-remediation"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -492,7 +477,16 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
+  {
+    id: "obligation-annual-workforce-competence-review",
+    title: "Annual workforce security-role competence review",
+    activityType: "performance-review",
+    recurrence: calendar("year", 1),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-workforce-expectations"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-security-training",
@@ -507,15 +501,6 @@ const obligations = [
       "control-workforce-expectations",
       "control-security-training"
     ],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
-  },
-  {
-    id: "obligation-annual-performance-review",
-    title: "Annual workforce performance review",
-    activityType: "performance-review",
-    recurrence: calendar("year", 1),
-    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    controlIds: ["control-performance-review"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
@@ -525,7 +510,7 @@ const obligations = [
     recurrence: calendar("month", 3),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-access-review",
@@ -534,7 +519,7 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-inventory-review",
@@ -543,12 +528,12 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
-    id: "obligation-monthly-malware-scan",
-    title: "Monthly endpoint malware scan",
-    activityType: "security-scan",
+    id: "obligation-monthly-endpoint-protection-verification",
+    title: "Monthly endpoint protection configuration verification",
+    activityType: "endpoint-verification",
     recurrence: calendar("month", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-endpoint-protection"],
@@ -574,8 +559,8 @@ const obligations = [
   },
   {
     id: "obligation-annual-penetration-test",
-    title: "Annual independent penetration test",
-    activityType: "penetration-test",
+    title: "Annual penetration-testing applicability and cadence review",
+    activityType: "risk-assessment",
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-penetration-testing"],
@@ -596,8 +581,8 @@ const obligations = [
     activityType: "exercise",
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ["document-incident-response-plan"],
-    templateResourceId: "document-incident-response-plan",
+    scopeResourceIds: [SECURITY_PLAN_ID],
+    templateResourceId: SECURITY_PLAN_ID,
     controlIds: ["control-incident-exercise", "control-logging-monitoring"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -616,8 +601,8 @@ const obligations = [
     activityType: "exercise",
     recurrence: calendar("year", 1),
     ownerIds: [OVERSIGHT_TEAM_ID],
-    scopeResourceIds: ["document-business-continuity-disaster-recovery"],
-    templateResourceId: "document-business-continuity-disaster-recovery",
+    scopeResourceIds: [SECURITY_PLAN_ID],
+    templateResourceId: SECURITY_PLAN_ID,
     controlIds: ["control-continuity-exercise"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
@@ -628,7 +613,7 @@ const obligations = [
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence", "control-vendor-monitoring"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-annual-emergency-contact-review",
@@ -636,10 +621,21 @@ const obligations = [
     activityType: "continuity-review",
     recurrence: calendar("year", 1),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ["document-business-continuity-disaster-recovery"],
+    scopeResourceIds: [SECURITY_PLAN_ID],
     controlIds: ["control-continuity-exercise"],
     policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
+  {
+    id: "obligation-worker-start-screening",
+    title: "Record the role-based screening and competence decision before sensitive access",
+    activityType: "workforce-review",
+    recurrence: event("person-started"),
+    triggerPrompt: "New employee or contractor?",
+    window: eventWindow(0),
+    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
+    controlIds: ["control-workforce-expectations"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
+  },
   {
     id: "obligation-worker-start-agreements",
     title: "Collect workforce agreements and policy acknowledgements",
@@ -660,7 +656,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-start-assets",
@@ -684,19 +680,7 @@ const obligations = [
     scopeResourceIds: ["training-security-awareness"],
     templateResourceId: "training-security-awareness",
     controlIds: ["control-security-training"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
-  },
-  {
-    id: "obligation-worker-start-role-training",
-    title: "Complete or document non-applicability of role-based training",
-    activityType: "role-training",
-    recurrence: event("person-started"),
-    triggerPrompt: "New employee or contractor?",
-    window: eventWindow(30),
-    ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ROLE_TRAINING_IDS,
-    controlIds: ["control-security-training"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-end-access",
@@ -707,7 +691,7 @@ const obligations = [
     window: eventWindowHours(24),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-end-assets",
@@ -730,7 +714,7 @@ const obligations = [
     window: eventWindowHours(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-role-change-access",
@@ -741,19 +725,18 @@ const obligations = [
     window: eventWindow(3),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization", "control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-worker-role-change-training",
-    title: "Complete or document non-applicability of training for the new role",
+    title: "Assign and complete applicable role-based security training",
     activityType: "role-training",
     recurrence: event("person-role-changed"),
     triggerPrompt: "Worker role changed?",
     window: eventWindow(30),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
-    scopeResourceIds: ROLE_TRAINING_IDS,
-    controlIds: ["control-security-training"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID, "policy-anti-bribery-corruption"]
+    controlIds: ["control-workforce-expectations", "control-security-training"],
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-personal-device-approval",
@@ -764,7 +747,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-access-authorization", "control-endpoint-protection"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-personal-device-registration",
@@ -775,7 +758,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-endpoint-protection"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, "policy-mobile-computing-communications"]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-access-review",
@@ -786,7 +769,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-access-contract",
@@ -797,7 +780,7 @@ const obligations = [
     window: eventWindow(0),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-due-diligence"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-material-change-review",
@@ -808,7 +791,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-vendor-material-change-records",
@@ -819,7 +802,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-risk",
@@ -830,7 +813,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-scan",
@@ -852,7 +835,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-policy-management", "control-security-communication"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-retention",
@@ -865,7 +848,7 @@ const obligations = [
     scopeResourceIds: [RETENTION_SCHEDULE_ID],
     templateResourceId: RETENTION_SCHEDULE_ID,
     controlIds: ["control-data-retention-disposal", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-system-change-alert-path",
@@ -920,7 +903,7 @@ const obligations = [
     window: eventWindow(7),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-vendor-monitoring", "control-access-review-offboarding"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-data-use-change-assessment",
@@ -931,7 +914,7 @@ const obligations = [
     window: eventWindow(30),
     ownerIds: [OVERSIGHT_TEAM_ID],
     controlIds: ["control-risk-assessment", "control-data-classification-inventory"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-incident-closure-review",
@@ -1030,7 +1013,7 @@ const obligations = [
     window: eventWindow(7),
     ownerIds: [POLICY_OWNER_APPOINTMENT_ID],
     controlIds: ["control-inventory-configuration", "control-data-retention-disposal"],
-    policyIds: [INFORMATION_SECURITY_POLICY_ID, DATA_POLICY_ID]
+    policyIds: [INFORMATION_SECURITY_POLICY_ID]
   },
   {
     id: "obligation-continuity-activation-review",