filegrc 0.1.0 → 0.2.0

package/model/v1.json

@@ -25,20 +25,24 @@
       {"kind":"training-acknowledgements","title":"Training and Policy Acknowledgements","sourcePrompt":"Training, signature, and workforce sources","sourceKind":"training-acknowledgement","timing":"Export after the period closes and reconcile assignments, completions, acknowledgements, exceptions, and overdue work to the workforce population.","controlCodes":["GOV-03","HR-01","HR-02"]},
       {"kind":"backup-recovery","title":"Backup Failures and Restoration Tests","sourcePrompt":"Backup, recovery, and monitoring sources","sourceKind":"backup-recovery","timing":"Export after the period closes and include scheduled jobs, failures, restorations, exercises, and follow-up work.","controlCodes":["BCP-01","BCP-02"]},
       {"kind":"exceptions-findings","title":"Security Exceptions and Control Findings","sourcePrompt":"Exception, finding, ticketing, and risk sources","sourceKind":"exception-finding","timing":"Export after the period closes and reconcile open, closed, accepted, overdue, and remediated items.","controlCodes":["MON-01","EXC-01"]}
-    ],
-    "externalEvidence": [
-      {"id":"workforce","title":"Workforce","sourceKinds":["workforce"],"controlCodes":["HR-01","HR-03","IAM-03"],"description":"Catalog the HR or workforce system that is authoritative for starts, role changes, and departures. Bring the complete workforce-change population and source reports used to reconcile access and responsibilities.","timing":"Identify the source during scoping. Preserve event records as changes occur and export the complete Type 2 population after the period closes."},
-      {"id":"training-acknowledgement","title":"Training and Acknowledgements","sourceKinds":["training-acknowledgement"],"controlCodes":["GOV-03","HR-01","HR-02"],"description":"Catalog training, signature, and acknowledgement systems. Bring assignments, content revisions, completion records, signatures, exceptions, and overdue follow-up.","timing":"Identify sources before assignments begin. Preserve signatures and completion proof as work occurs, then reconcile the complete Type 2 population to the workforce population after close."},
-      {"id":"identity-access","title":"Identity and Access","sourceKinds":["identity-access"],"controlCodes":["IAM-01","IAM-02","IAM-03"],"description":"Catalog the identity provider and each important application that enforces access. Bring identity, role, privileged-access, authentication-setting, review, and removal exports.","timing":"Identify sources during scoping. Capture configuration near the Type 1 date or at the start and end of a Type 2 period; export complete change and review populations after the Type 2 period closes."},
-      {"id":"production-change","title":"Production and Change","sourceKinds":["production-change"],"controlCodes":["CHG-01"],"description":"Catalog source control, deployment, and infrastructure-change systems. Bring protection settings, reviews, test and approval records, deployments, emergency changes, and rollback evidence.","timing":"Identify sources before the audit period. Preserve per-change evidence as changes occur and export the complete period population after a Type 2 period closes."},
-      {"id":"security-monitoring","title":"Monitoring and Incidents","sourceKinds":["security-monitoring"],"controlCodes":["LOG-01","IR-01","IR-02"],"description":"Catalog logging, alerting, incident, and case-management systems. Bring configuration, coverage, alert delivery tests, alerts, investigations, incidents, recovery work, and zero-event proof.","timing":"Capture configuration and coverage at the Type 1 date or across the Type 2 period. Preserve cases as they occur and export complete alert and incident populations after close."},
-      {"id":"vulnerability-management","title":"Vulnerability Management","sourceKinds":["vulnerability-management"],"controlCodes":["VUL-01","PEN-01"],"description":"Catalog vulnerability, dependency, scanning, penetration-test, and remediation systems. Bring scope and configuration, scan results, findings, tickets, exceptions, retests, and independent reports.","timing":"Confirm coverage before the audit period. Preserve scan and remediation evidence when generated and export the complete Type 2 population after close."},
-      {"id":"endpoint-asset","title":"Endpoints and Assets","sourceKinds":["endpoint-asset"],"controlCodes":["PHY-01","OPS-01","OPS-02","DATA-01"],"description":"Catalog device-management, endpoint-compliance, and asset-inventory systems. Bring the complete device population, assignments, security configuration, compliance status, exceptions, loss, return, and disposal records.","timing":"Identify sources before devices receive access. Capture configuration near the Type 1 date or across the Type 2 period and export the complete Type 2 population after close."},
-      {"id":"backup-recovery","title":"Backup and Recovery","sourceKinds":["backup-recovery"],"controlCodes":["BCP-01","BCP-02"],"description":"Catalog backup, recovery, and continuity systems. Bring configuration, scheduled-job history, failures, restoration results, exercises, and follow-up work.","timing":"Capture configuration at the Type 1 date or across the Type 2 period. Preserve restoration and exercise results when performed and export complete job and failure history after period close."},
-      {"id":"vendor-management","title":"Vendors","sourceKinds":["vendor-management"],"controlCodes":["VEN-01","VEN-02"],"description":"Catalog procurement, contract, and vendor-risk systems. Bring the vendor population, contracts, reviews, assurance reports, bridge coverage, incidents, and follow-up.","timing":"Identify relevant subservice organizations during scoping. Obtain current assurance reports before fieldwork and bridge coverage through the report period when a report ends earlier."},
-      {"id":"exception-finding","title":"Exceptions and Findings","sourceKinds":["exception-finding"],"controlCodes":["MON-01","EXC-01"],"description":"Catalog the repository or ticket system authoritative for control exceptions, findings, risk acceptance, remediation, verification, and overdue work.","timing":"Record items as they arise. Reconcile open and closed records to their source throughout fieldwork and export the complete Type 2 population after the period closes."}
     ]
   },
+  "evidenceSourceFamilies": [
+      {"id":"workforce","title":"Workforce System","sourceKinds":["workforce"],"controlCodes":["HR-01","HR-03","IAM-03"],"testEvidenceKind":"test-export","testPrompt":"Export a workforce-change report from the HR or workforce system containing starters, role changes, and departures.","description":"Catalog the HR or workforce system that is authoritative for starts, role changes, and departures. Bring the complete workforce-change population and source reports used to reconcile access and responsibilities.","timing":"Identify the source during scoping. Preserve event records as changes occur and export the complete Type 2 population after the period closes."},
+      {"id":"training-acknowledgement","title":"Training and Acknowledgements","sourceKinds":["training-acknowledgement"],"controlCodes":["GOV-03","HR-01","HR-02"],"testEvidenceKind":"test-export","testPrompt":"Export assignments and completions tied to a specific training or policy revision.","collectionTestRequired":false,"operationRecordTypes":["training","attestation"],"description":"FileGRC records training assignments, content revisions, completions, acknowledgements, exceptions, and overdue follow-up during Step 5.","timing":"Set up training and acknowledgement records before assignments begin. Preserve completion proof as work occurs, then reconcile the complete Type 2 population to the workforce population after close."},
+      {"id":"identity-access","title":"Identity and Access Systems","sourceKinds":["identity-access"],"controlCodes":["IAM-01","IAM-02","IAM-03"],"testEvidenceKind":"test-export","testPrompt":"Export users, roles, privileged access, or authentication settings from the identity provider or an in-scope application.","description":"Catalog the identity provider and each important application that enforces access. Bring identity, role, privileged-access, authentication-setting, review, and removal exports.","timing":"Identify sources during scoping. Capture configuration near the Type 1 date or at the start and end of a Type 2 period; export complete change and review populations after the Type 2 period closes."},
+      {"id":"production-change","title":"Production Change Systems","sourceKinds":["production-change"],"controlCodes":["CHG-01"],"testEvidenceKind":"test-capture","testPrompt":"Capture a change from the source control or deployment system showing review, testing, approval, deployment, and rollback information.","description":"Catalog source control, deployment, and infrastructure-change systems. Bring protection settings, reviews, test and approval records, deployments, emergency changes, and rollback evidence.","timing":"Identify sources before the audit period. Preserve per-change evidence as changes occur and export the complete period population after a Type 2 period closes."},
+      {"id":"security-monitoring","title":"Security Monitoring Systems","sourceKinds":["security-monitoring"],"controlCodes":["LOG-01","IR-01","IR-02"],"testEvidenceKind":"test-capture","testPrompt":"Capture logging or alert configuration and a delivered test alert from the monitoring system.","description":"Catalog logging and alerting systems. Bring configuration, coverage, alert delivery tests, alerts, investigations, and zero-event proof. FileGRC records qualifying incidents and their response during Step 5.","timing":"Capture configuration and coverage at the Type 1 date or across the Type 2 period. Preserve cases as they occur and export complete alert and incident populations after close."},
+      {"id":"vulnerability-management","title":"Vulnerability Management","sourceKinds":["vulnerability-management"],"controlCodes":["VUL-01","PEN-01"],"testEvidenceKind":"test-export","testPrompt":"Export a result from the vulnerability or dependency scanner showing scope, coverage, findings, and severity.","collectionTestRequired":false,"operationRecordTypes":["vulnerability-scan","penetration-test"],"description":"FileGRC records vulnerability scans and penetration tests during Step 5. Put the scanner output or independent report in an External Evidence record and link it from the operating record rather than creating a separate collection test.","timing":"Confirm coverage before the audit period. Preserve scan and remediation evidence when generated and export the complete Type 2 population after close."},
+      {"id":"endpoint-asset","title":"Endpoint Management Systems","sourceKinds":["endpoint-asset"],"controlCodes":["PHY-01","OPS-01","OPS-02","DATA-01"],"testEvidenceKind":"test-export","testPrompt":"Export devices, security configuration, and compliance status from the endpoint-management system.","description":"Catalog device-management and endpoint-compliance systems. Bring the complete device population, security configuration, compliance status, and exceptions. FileGRC records asset ownership, custody, loss, return, and disposal during Step 5.","timing":"Identify sources before devices receive access. Capture configuration near the Type 1 date or across the Type 2 period and export the complete Type 2 population after close."},
+      {"id":"backup-recovery","title":"Backup and Recovery","sourceKinds":["backup-recovery"],"controlCodes":["BCP-01","BCP-02"],"testEvidenceKind":"test-export","testPrompt":"Export job history from the backup system showing scheduled runs, successes, failures, and follow-up.","collectionTestRequired":false,"operationRecordTypes":["backup-test","exercise"],"description":"FileGRC records restoration tests and continuity exercises during Step 5. Put backup-system output in an External Evidence record and link it from the operating record rather than creating a separate collection test.","timing":"Capture configuration at the Type 1 date or across the Type 2 period. Preserve restoration and exercise results when performed and export complete job and failure history after period close."},
+      {"id":"vendor-management","title":"Vendors","sourceKinds":["vendor-management"],"controlCodes":["VEN-01","VEN-02"],"testEvidenceKind":"test-capture","testPrompt":"Capture a completed vendor review with its contract, assurance report, risk decision, and follow-up.","collectionTestRequired":false,"operationRecordTypes":["vendor-review"],"description":"FileGRC records vendor reviews, risk decisions, supporting reports, exceptions, and follow-up during Step 5.","timing":"Identify relevant subservice organizations during scoping. Complete reviews during operation, obtain current assurance reports before fieldwork, and document bridge coverage when a report ends before the report period."},
+      {"id":"exception-finding","title":"Exceptions and Findings","sourceKinds":["exception-finding"],"controlCodes":["MON-01","EXC-01"],"testEvidenceKind":"test-export","testPrompt":"Export open and closed exceptions or findings with owners, status, dates, and remediation verification.","collectionTestRequired":false,"operationRecordTypes":["exception","finding","action-item"],"description":"FileGRC records control exceptions, findings, risk acceptance, remediation, verification, and overdue work during Step 5.","timing":"Record items as they arise. Keep their status and follow-up current, then include the complete period population in fieldwork."},
+      {"id":"data-handling","title":"Data Protection Configuration","sourceKinds":["data-handling"],"controlCodes":["DATA-02","DATA-03"],"testEvidenceKind":"test-capture","testPrompt":"Capture encryption and retention settings from an in-scope System.","description":"Catalog the systems authoritative for encryption settings and retention rules. Bring current configuration and approved schedules. Preserve completed disposal actions, exceptions, and verification during Step 5.","timing":"Confirm configuration and retention rules before the audit period. Preserve disposal evidence when work occurs and capture configuration near the Type 1 date or across the Type 2 period."},
+      {"id":"network-security","title":"Network Security Systems","sourceKinds":["network-security"],"controlCodes":["NET-01"],"testEvidenceKind":"test-capture","testPrompt":"Capture current firewall or network-access rules from the network system and confirm that remote and production access paths appear.","description":"Catalog the systems authoritative for network boundaries, firewall rules, and remote access. Bring current configuration, rule reviews, approvals, changes, and exceptions.","timing":"Confirm boundary and remote-access configuration before the audit period. Preserve rule changes as they occur and capture current configuration near the Type 1 date or across the Type 2 period."},
+      {"id":"governance","title":"Governance","sourceKinds":["governance"],"controlCodes":["GOV-01","GOV-02"],"testEvidenceKind":"test-capture","testPrompt":"Capture one completed oversight review or policy approval with the participants, decisions, dates, and follow-up work.","collectionTestRequired":false,"operationRecordTypes":["policy-review","meeting"],"description":"FileGRC records policy approvals, oversight reviews, meetings, decisions, assigned actions, and completion proof in Steps 2 and 5.","timing":"Approve policies before they take effect. Preserve oversight records and decisions when the work occurs."},
+      {"id":"risk-management","title":"Risk Management","sourceKinds":["risk-management"],"controlCodes":["RSK-01"],"testEvidenceKind":"test-export","testPrompt":"Export the risk register with owners, ratings, treatment decisions, review dates, and open actions.","collectionTestRequired":false,"operationRecordTypes":["risk-assessment","risk"],"description":"FileGRC records risk assessments, risks, treatment decisions, reviews, and follow-up during Step 5.","timing":"Complete the initial assessment while operating the program. Preserve risk changes and reviews as they occur, then include the current register in fieldwork."}
+  ],
   "commonFields": {
     "schemaVersion": {"type":"integer","required":true,"const":1,"label":"Schema version"},
     "id": {"type":"string","format":"id","required":true,"label":"ID"},
@@ -58,7 +62,7 @@
     {"id":"security-operations","title":"Security Operations"},
     {"id":"resilience","title":"Resilience"},
     {"id":"evidence","title":"Evidence"},
-    {"id":"work","title":"Findings and Work"},
+    {"id":"work","title":"Issues and Remediation"},
     {"id":"audits","title":"Audits"},
     {"id":"repository","title":"Repository"}
   ],
@@ -68,10 +72,10 @@
       "pluralTitle": "Workspace",
       "group": "repository",
       "singleton": "workspace.json",
-      "description": "Program-wide settings used by validation and rendering, including the organization, time zone, risk method, and classification scheme.",
+      "description": "Settings shared across the program: organization, SOC 2 goal, candidate period, scope, time zone, risk method, and data classifications.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies depend on these settings. Change the method or classifications with the related policies and controls.",
-        "cadence": "Review during the annual policy and risk reviews and after a material scope or methodology change.",
+        "policyBasis": "Policies, risk assessments, evidence checks, and readiness calculations use this scope and these methods. Candidate dates let management preserve evidence before the CPA firm agrees to the audit period.",
+        "cadence": "Review during the annual policy and risk reviews, before starting a candidate evidence period, and after a material scope or methodology change.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["policy-review","risk-assessment"]
       },
@@ -82,6 +86,14 @@
         "timezone": {"type":"string","format":"timezone","label":"Timezone"},
         "description": {"type":"string","label":"Description","search":true},
         "repositoryUrl": {"type":"string","label":"Repository URL"},
+        "assuranceGoal": {"type":"enum","values":["none","readiness","soc-2-type-1","soc-2-type-2"],"label":"Program goal","filter":true},
+        "candidateTypeOneAsOf": {"type":"date","label":"Management candidate Type 1 date"},
+        "candidatePeriodStart": {"type":"date","label":"Management candidate Type 2 period start"},
+        "candidatePeriodEnd": {"type":"date","label":"Management candidate Type 2 period end"},
+        "frameworkIds": {"type":"array","items":"id","relation":["framework"],"label":"Program frameworks"},
+        "requirementIds": {"type":"array","items":"id","relation":["requirement"],"label":"Program requirements"},
+        "controlIds": {"type":"array","items":"id","relation":["control"],"label":"Program controls"},
+        "systemIds": {"type":"array","items":"id","relation":["system"],"label":"Program systems"},
         "riskMethodology": {"type":"object","label":"Risk methodology"},
         "classificationDefinitions": {"type":"object","label":"Classifications"}
       },
@@ -92,16 +104,17 @@
       "pluralTitle": "Renderer settings",
       "group": "repository",
       "singleton": "renderer.json",
-      "description": "Committed settings that control optional renderer behavior without changing the underlying compliance records or Git workflow. Renderer settings are not required for SOC 2.",
+      "description": "Optional local interface settings, including onboarding visibility and manually completed Step pages. Renderer settings are not required for SOC 2 and do not change compliance records.",
       "guidance": {
-        "policyBasis": "This record configures the local renderer. It is not a SOC 2 control, policy, audit record, or substitute for evidence.",
+        "policyBasis": "Renderer settings are a FileGRC convenience, not a SOC 2 requirement, control, audit record, or substitute for evidence.",
         "cadence": "Change it when the team wants to rerun or suppress an optional renderer workflow, then review and commit the resulting diff."
       },
       "required": ["showOnboarding"],
       "fields": {
-        "showOnboarding": {"type":"boolean","label":"Show onboarding"}
+        "showOnboarding": {"type":"boolean","label":"Show onboarding"},
+        "completedStagePageIds": {"type":"array","items":"string","label":"Manually completed program pages"}
       },
-      "listFields": ["title","showOnboarding"]
+      "listFields": ["title","showOnboarding","completedStagePageIds"]
     },
     "person": {
       "title": "Person",
@@ -109,9 +122,9 @@
       "pluralTitle": "People",
       "group": "people-access",
       "collection": "people",
-      "description": "Minimal workforce records used for ownership, approval, training, access, attendance, and accountability without turning Git into an HR system.",
+      "description": "People who own, approve, review, or perform program work, or receive access and training. Keep detailed personnel records in the HR system.",
       "guidance": {
-        "policyBasis": "The information security policy and employee handbook require named responsibility, onboarding, training, role changes, performance review, and offboarding.",
+        "policyBasis": "The information security policy and employee handbook assign work to named people and require onboarding, training, role-change, and offboarding records.",
         "cadence": "Create before assigning work or access, update after role changes, and mark inactive at departure. Training is due within 30 days of starting and annually.",
         "sourceResourceIds": ["policy-information-security","policy-employee-handbook"],
         "obligationActivityTypes": ["training","performance-review"]
@@ -136,9 +149,9 @@
       "pluralTitle": "Service accounts",
       "group": "people-access",
       "collection": "service-accounts",
-      "description": "Non-human identities used by automation or applications, with purpose, ownership, system scope, authentication, privilege, and expiry. A separate service-account register is not required for SOC 2; use this page when non-human identities need their own inventory.",
+      "description": "Non-human identities that need separate tracking. Record the account’s purpose, owner, Systems, authentication, privilege, review, and expiry here. A separate register is not required for SOC 2.",
       "guidance": {
-        "policyBasis": "The information security policy requires important identities to be inventoried, owned, protected, reviewed, and removed when unneeded.",
+        "policyBasis": "The information security policy requires important human and non-human identities to have an owner, protection, periodic review, and prompt removal when no longer needed.",
         "cadence": "Create before use. Review privileged and production access quarterly and other important access annually; retire or expire unused accounts.",
         "sourceResourceIds": ["policy-information-security"],
         "obligationActivityTypes": ["access-review","inventory-review"]
@@ -162,10 +175,10 @@
       "pluralTitle": "Teams",
       "group": "governance",
       "collection": "teams",
-      "description": "Committees, response teams, and accountable groups used for shared ownership, governance decisions, and meeting records. A separate team register is not required for SOC 2; named people can hold these responsibilities directly.",
+      "description": "Groups that share program responsibility, such as security oversight or incident response. Team records are not required for SOC 2 when named People hold the responsibilities directly.",
       "guidance": {
-        "policyBasis": "The information security policy establishes a security and risk oversight group chaired by an external reviewer who is separate from the policy owner and control operators. The continuity plan assigns response and recovery roles.",
-        "cadence": "The security and risk oversight group meets at least quarterly. Update membership after responsibility or personnel changes, and preserve the independent chair.",
+        "policyBasis": "The information security policy establishes security and risk oversight with independent review, while the continuity plan assigns response and recovery roles. Reviewers may be internal or external.",
+        "cadence": "The security and risk oversight group meets at least quarterly. Update membership after responsibility or personnel changes, and preserve a chair who is separate from the policy owner.",
         "sourceResourceIds": ["policy-information-security","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["meeting"]
       },
@@ -186,10 +199,10 @@
       "pluralTitle": "Systems",
       "group": "systems-vendors",
       "collection": "systems",
-      "description": "Applications, services, infrastructure, business systems, and evidence sources used to define audit scope, ownership, data, vendors, recovery objectives, and authoritative reports.",
+      "description": "Applications, services, and platforms that support the scoped service, operate controls, or produce evidence. Record vendor-provided software as a System and link it to its Vendor.",
       "guidance": {
-        "policyBasis": "The information security, data handling, and continuity policies require inventories of important systems with owners, criticality, classification, scope, and recovery needs.",
-        "cadence": "Review at least annually and after material architecture, data, vendor, service, recovery, or evidence-source changes. Confirm report access and extraction instructions before each audit period closes.",
+        "policyBasis": "The information security, data handling, and continuity policies require management to know which Systems are in scope, who owns them, what data they handle, how critical they are, and where evidence comes from.",
+        "cadence": "Complete the in-scope inventory before policy approval and control implementation. Review it at least annually and after material architecture, data, vendor, service, recovery, or evidence-source changes. Test report access and extraction before the candidate period begins.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["inventory-review"]
       },
@@ -220,9 +233,9 @@
       "pluralTitle": "Assets",
       "group": "systems-vendors",
       "collection": "assets",
-      "description": "Individually managed devices, media, software, records, or other physical and logical items with an owner, custodian, criticality, and lifecycle.",
+      "description": "Important devices, media, software, records, and other items tracked through acquisition, custody, use, return, and disposal. Assets support controls but do not define the service boundary.",
       "guidance": {
-        "policyBasis": "The information security, mobile computing, and data handling policies require important assets to be inventoried, protected according to classification, and securely returned or disposed.",
+        "policyBasis": "The information security, mobile computing, and data handling policies require important assets to have owners and custodians, protection based on classification, and secure return or disposal.",
         "cadence": "Record acquisition and assignment, review the inventory annually, update custody on change, and retire assets when use ends.",
         "sourceResourceIds": ["policy-information-security","policy-mobile-computing-communications","policy-data-protection-handling"],
         "obligationActivityTypes": ["inventory-review"]
@@ -249,9 +262,9 @@
       "pluralTitle": "Documents",
       "group": "governance",
       "collection": "documents",
-      "description": "Governed charters, plans, procedures, standards, agreements, reports, and templates whose Markdown and approvals belong in Git. A general document catalog is not required for SOC 2; use it for governed material that is not a policy or another record type.",
+      "description": "Governed plans, charters, procedures, standards, reports, and templates that are not Policies or another FileGRC record type. A general document catalog is not required for SOC 2.",
       "guidance": {
-        "policyBasis": "Policies use documents for detailed procedures, plans, acknowledgements, assertions, and reports while Git supplies revision history.",
+        "policyBasis": "Policies rely on governed documents for detailed plans, procedures, charters, and reports. Git preserves the approved text and its revision history.",
         "cadence": "Follow each record's review cadence. Starter governed documents are reviewed at least annually and after material changes or use, with an approver who is separate from the owner.",
         "sourceResourceIds": ["policy-information-security","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["policy-review","continuity-review"]
@@ -281,27 +294,29 @@
       }
     },
     "evidence": {
-      "title": "Evidence",
-      "pluralTitle": "Evidence",
+      "title": "External Evidence",
+      "pluralTitle": "External Evidence",
       "group": "evidence",
       "collection": "evidence",
       "recordPath": "{id}/evidence.json",
-      "description": "Screenshots, signed forms, reports, exports, and other proof, bound to source records, dates, systems, controls, audits, files, and Git revisions. Population exports also record their exact report parameters, timezone, count, and completeness and accuracy checks.",
+      "description": "External Evidence holds exports, reports, screenshots, signed files, and approved external references collected from other Systems. Step 5 records created in FileGRC do not need a separate record here. Step 6 reviews and packages both evidence paths for the CPA firm.",
       "guidance": {
-        "policyBasis": "The information security policy requires retained audit evidence. Acknowledgement and training workflows require signatures or repository revisions tied to the exact content reviewed.",
-        "cadence": "Collect when a control or activity operates, verify before audit use, cover the stated period, and expire or retain according to classification and record rules.",
+        "policyBasis": "The information security and data handling policies require retained proof from authoritative Systems when FileGRC's own operating records do not contain the full result.",
+        "cadence": "Before the candidate period begins, test each selected control family that relies on evidence from outside FileGRC. Once operation starts, collect external evidence whenever the control runs, keep FileGRC operating records current, verify evidence before audit use, cover the stated period, and retain it according to classification and record rules.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"]
       },
-      "required": ["status","evidenceKind","source","collectedOn","classification","collectorIds"],
+      "required": ["status","evidenceKind"],
       "oneOf": [
-        ["filePaths","externalReference","$markdown:content"]
+        {"when":{"status":["collected","verified","expired","withdrawn"]},"fields":["filePaths","externalReference","$markdown:content"]}
       ],
       "fields": {
-        "status": {"type":"enum","values":["collected","verified","expired","withdrawn"],"filter":true},
+        "status": {"type":"enum","values":["draft","collected","verified","expired","withdrawn"],"filter":true},
         "evidenceKind": {"type":"string","filter":true},
-        "source": {"type":"string","search":true},
-        "collectedOn": {"type":"date"},
-        "classification": {"type":"string","filter":true},
+        "collectionTestFamilyId": {"type":"string","label":"Collection test family","filter":true},
+        "collectionTestPrompt": {"type":"string","label":"What to collect","search":true},
+        "source": {"type":"string","search":true,"requiredWhen":{"status":["collected","verified","expired","withdrawn"]}},
+        "collectedOn": {"type":"date","requiredWhen":{"status":["collected","verified","expired","withdrawn"]}},
+        "classification": {"type":"string","filter":true,"requiredWhen":{"status":["collected","verified","expired","withdrawn"]}},
         "filePaths": {"type":"array","items":"data-path"},
         "externalReference": {"type":"object"},
         "periodStart": {"type":"date","requiredWhen":{"evidenceKind":"population-export"}},
@@ -312,13 +327,13 @@
         "populationCount": {"type":"integer","minimum":0,"label":"Population count","requiredWhen":{"evidenceKind":"population-export"}},
         "completenessValidation": {"type":"string","label":"Completeness validation","search":true,"requiredWhen":{"evidenceKind":"population-export"}},
         "accuracyValidation": {"type":"string","label":"Accuracy validation","search":true,"requiredWhen":{"evidenceKind":"population-export"}},
-        "sourceSystemId": {"type":"id","relation":["system"],"label":"Source system","requiredWhen":{"evidenceKind":"population-export"}},
+        "sourceSystemId": {"type":"id","relation":["system"],"label":"Source system","requiredWhen":{"evidenceKind":["population-export","test-export","test-capture"],"status":["collected","verified","expired","withdrawn"]}},
         "systemIds": {"type":"array","items":"id","relation":["system"]},
         "controlIds": {"type":"array","items":"id","relation":["control"]},
         "auditIds": {"type":"array","items":"id","relation":["audit"]},
-        "collectorIds": {"type":"array","items":"id","relation":["person"]},
-        "verifierIds": {"type":"array","items":"id","relation":["person"],"requiredWhen":{"status":"verified"}},
-        "verifiedOn": {"type":"date","requiredWhen":{"status":"verified"}},
+        "collectorIds": {"type":"array","items":"id","relation":["person"],"requiredWhen":{"status":["collected","verified","expired","withdrawn"]}},
+        "verifierIds": {"type":"array","items":"id","relation":["person"],"requiredWhen":{"status":"verified"},"visibleWhen":{"status":"verified"}},
+        "verifiedOn": {"type":"date","requiredWhen":{"status":"verified"},"visibleWhen":{"status":"verified"}},
         "expiresOn": {"type":"date"},
         "sourceResourceIds": {"type":"array","items":"id","relation":["*"]},
         "sourceCommit": {"type":"string"},
@@ -334,10 +349,10 @@
       "pluralTitle": "Obligations",
       "group": "work",
       "collection": "obligations",
-      "description": "Recurring or event-driven work generated from policy commitments, including meetings, reviews, scans, tests, training, and exercises. Obligation records are not required for SOC 2; they are FileGRC's scheduling layer for policy work.",
+      "description": "Reusable schedules for recurring or event-driven work. Obligations feed the Work Queue; completion records and linked Evidence prove that the work occurred. Obligations are not required for SOC 2.",
       "guidance": {
-        "policyBasis": "Obligations turn policy language into an owned schedule and link each task to its policies, controls, scope, and completion records.",
-        "cadence": "Use the recurrence and start date on each record. Create separate completion records for every period instead of overwriting the obligation.",
+        "policyBasis": "FileGRC uses Obligations to turn policy and control cadence into owned, dated work linked to its scope and required proof.",
+        "cadence": "Treat starter work as proposed until every governing policy is active and effective and, when the obligation names controls, at least one linked control is implemented. Then use the recurrence and activation date, and create a separate completion record for every period.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling","document-business-continuity-disaster-recovery"]
       },
       "required": ["status","activityType","recurrence","ownerIds"],
@@ -362,13 +377,13 @@
       }
     },
     "obligation-event": {
-      "title": "Obligation event",
-      "pluralTitle": "Obligation events",
+      "title": "Policy Event",
+      "pluralTitle": "Policy Events",
       "group": "work",
       "collection": "obligation-events",
-      "description": "One occurrence of a policy-triggering event, with its subject, applicable obligation templates, generated action checklist, owners, and completion state. Obligation-event records are not required for SOC 2; they keep event-driven policy work complete and auditable.",
+      "description": "One occurrence of an event such as hiring, departure, material change, or incident. It connects the event to the checklist generated from applicable Obligations. Policy Events are not required for SOC 2.",
       "guidance": {
-        "policyBasis": "Event runs make onboarding, offboarding, material changes, incidents, and similar policy triggers explicit and auditable.",
+        "policyBasis": "Policies require specific, time-bound actions after certain events. A Policy Event preserves the trigger, applicable checklist, owners, and completion state.",
         "cadence": "Create when the event occurs or is scheduled. Complete every generated action within its policy window, then close the event."
       },
       "required": ["status","eventType","occurredOn","obligationIds","ownerIds"],
@@ -379,7 +394,6 @@
         "occurredAt": {"type":"timestamp"},
         "subjectResourceIds": {"type":"array","items":"id","relation":["*"]},
         "obligationIds": {"type":"array","items":"id","relation":["obligation"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "completedOn": {"type":"date","requiredWhen":{"status":"complete"}}
       },
       "listFields": ["title","status","eventType","occurredOn","ownerIds"]
@@ -390,9 +404,9 @@
       "pluralTitle": "Frameworks",
       "group": "program",
       "collection": "frameworks",
-      "description": "External criteria sets and versions used to define program and audit scope.",
+      "description": "Published criteria sets and versions used to define the program and audit scope.",
       "guidance": {
-        "policyBasis": "Frameworks come from the selected audit criteria, not an internal policy. The starter includes SOC 2 Security and system-description references without licensed criteria text.",
+        "policyBasis": "The CPA examination uses the selected Framework. FileGRC’s starter references provide orientation but do not replace the publisher’s official criteria.",
         "cadence": "Add or retire a version only through a deliberate scope decision. Reconfirm the selected version when planning each audit."
       },
       "required": ["status","version"],
@@ -412,9 +426,9 @@
       "pluralTitle": "Requirements",
       "group": "program",
       "collection": "requirements",
-      "description": "Individual criterion references used to document applicability and map controls, commitments, audits, and findings.",
+      "description": "Individual criteria used to record applicability and connect the Framework to Controls, Commitments, Audits, and Findings.",
       "guidance": {
-        "policyBasis": "Requirements come from the selected framework. Controls explain how policy and actual operation address each applicable criterion. Starter descriptions are plain-language orientation only; use the publisher's official criteria for the examination.",
+        "policyBasis": "The selected Framework defines the Requirements. Controls show how management addresses each applicable criterion; the publisher’s official text remains authoritative.",
         "cadence": "Review applicability during audit planning and after material scope, service, system, or framework changes."
       },
       "required": ["frameworkId","reference","applicability"],
@@ -434,9 +448,9 @@
       "pluralTitle": "Commitments",
       "group": "program",
       "collection": "commitments",
-      "description": "Customer-facing commitments, internal system requirements, and business objectives that controls and the system description must support.",
+      "description": "Customer promises, service requirements, and approved business objectives beyond the baseline Framework and Policies. Link them to the Systems and Controls that fulfill them.",
       "guidance": {
-        "policyBasis": "Policies define baseline safeguards; contracts, service descriptions, and approved business decisions supply the specific commitment.",
+        "policyBasis": "Contracts, service descriptions, and approved management decisions can create commitments that the system description and control design must address.",
         "cadence": "Create before relying on a promise, review during audit scoping, and supersede it when the service or agreement changes.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"]
       },
@@ -460,9 +474,9 @@
       "pluralTitle": "Complementary controls",
       "group": "program",
       "collection": "complementary-controls",
-      "description": "Controls expected from customers or subservice organizations and needed for the service organization's controls and commitments to work as described. A complementary-control record is not required for SOC 2 when no such dependency applies.",
+      "description": "Actions a customer or carved-out provider must perform for a linked Control to work as described. A Complementary Control record is not required for SOC 2 when no external dependency applies.",
       "guidance": {
-        "policyBasis": "The system description and vendor model define these dependencies. Internal policies still require owners to identify, communicate, and monitor them.",
+        "policyBasis": "The system description must explain relevant customer and subservice-organization responsibilities so readers understand where management’s Controls depend on others.",
         "cadence": "Review for every audit and after material customer-responsibility, vendor, contract, integration, or service changes.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"]
       },
@@ -486,14 +500,17 @@
       "pluralTitle": "Controls",
       "group": "program",
       "collection": "controls",
-      "description": "Testable operating statements that translate policies and requirements into owned activities, system scope, frequency, and expected evidence.",
+      "description": "Management’s actual safeguards and procedures, mapped to Policies, Requirements, Systems, and evidence sources. The Work Queue schedules recurring operation where configured; Evidence shows that operation occurred.",
       "guidance": {
-        "policyBasis": "Controls implement the linked policies and map that operation to applicable criteria. A policy statement alone does not prove implementation.",
-        "cadence": "Operate at the frequency on each control. Review ownership, scope, design, and evidence during annual risk and policy reviews and after material changes.",
+        "policyBasis": "Controls translate approved Policies and applicable Requirements into owned procedures that management can operate and prove. Policy text alone does not show implementation.",
+        "cadence": "Before marking a control implemented, record its owner, actual procedure in Record Markdown, system scope, cadence, authoritative evidence sources, and implementation date. FileGRC-managed controls also require enabled schedules with effective governing policies. Marking the control implemented starts eligible schedules.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["risk-assessment","policy-review"]
       },
       "required": ["status","statement","ownerIds","requirementIds","activity","operationMode","frequency"],
+      "markdown": {
+        "record": {"label":"Procedure","primary":true,"requiredWhen":{"status":"implemented"}}
+      },
       "fields": {
         "status": {"type":"enum","values":["planned","implemented","partially-implemented","not-applicable","retired"],"filter":true},
         "statement": {"type":"string","search":true},
@@ -503,9 +520,9 @@
         "controlType": {"type":"enum","values":["preventive","detective","corrective"],"filter":true},
         "operationMode": {"type":"enum","values":["manual","automated","hybrid"],"filter":true},
         "frequency": {"type":"string","filter":true},
-        "systemIds": {"type":"array","items":"id","relation":["system"]},
+        "systemIds": {"type":"array","items":"id","relation":["system"],"requiredWhen":{"status":"implemented"}},
+        "evidenceSourceIds": {"type":"array","items":"id","relation":["system"],"label":"Authoritative evidence sources","requiredWhen":{"status":"implemented"}},
         "commitmentIds": {"type":"array","items":"id","relation":["commitment"]},
-        "complementaryControlIds": {"type":"array","items":"id","relation":["complementary-control"]},
         "policyIds": {"type":"array","items":"id","relation":["policy"]},
         "riskIds": {"type":"array","items":"id","relation":["risk"]},
         "effectiveOn": {"type":"date","requiredWhen":{"status":"implemented"}},
@@ -518,9 +535,9 @@
       "pluralTitle": "Control tests",
       "group": "program",
       "collection": "control-tests",
-      "description": "Management, internal-audit, or service-auditor tests of one control's design or operation for an as-of date or period. Management-run control-test records are not required for SOC 2; the auditor performs independent testing, while these records support readiness and internal assurance.",
+      "description": "A test of one Control’s design or operation for a date or period, including method, population, samples, Evidence, result, and exceptions. Management-run Control Tests are not required for SOC 2 because the CPA firm tests independently.",
       "guidance": {
-        "policyBasis": "The information security policy requires control monitoring and audit evidence. Tests link procedures, samples, evidence, exceptions, findings, and review.",
+        "policyBasis": "The information security policy requires management to monitor Controls. The CPA firm performs its own independent testing for the SOC 2 examination.",
         "cadence": "Plan from control frequency, risk, and audit scope. Record the exact period or as-of date, link the complete population and sampled items when sampling applies, and complete review before relying on the result.",
         "sourceResourceIds": ["policy-information-security"]
       },
@@ -546,7 +563,6 @@
         "sampleEvidenceIds": {"type":"array","items":"id","relation":["evidence"]},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
         "exceptionCount": {"type":"integer","minimum":0},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
         "reviewerIds": {"type":"array","items":"id","relation":["person"]},
         "reviewedOn": {"type":"date"},
         "completedOn": {"type":"date"},
@@ -563,10 +579,10 @@
       "pluralTitle": "Findings",
       "group": "work",
       "collection": "findings",
-      "description": "Audit exceptions, control deficiencies, review issues, and other gaps that need ownership, severity, remediation, evidence, and independent verification. A finding record is not required for SOC 2 when no gap has been identified.",
+      "description": "A confirmed gap that needs tracking after a control test, review, risk assessment, security test, incident review, management meeting, or audit. Keep observations and report details in the source record’s Markdown. Create a Finding only when the gap needs its own owner, due date, remediation state, or verified closure. A Finding record is not required for SOC 2 when no confirmed gap needs tracking.",
       "guidance": {
-        "policyBasis": "The information security policy requires issues from monitoring, audits, incidents, scans, and reviews to be tracked through corrective action.",
-        "cadence": "Create when identified, assign a risk-based due date, review while open, and close only after remediation is verified.",
+        "policyBasis": "The information security policy requires confirmed issues from monitoring, audits, incidents, scans, and reviews to remain tracked until corrective action is verified.",
+        "cadence": "Create only after management confirms the gap. Use the Finding itself for straightforward remediation, add Action Items only for separate assigned tasks, and close only after remediation is verified.",
         "sourceResourceIds": ["policy-information-security"]
       },
       "required": ["status","severity","sourceResourceId","description","ownerIds"],
@@ -579,12 +595,11 @@
         "riskIds": {"type":"array","items":"id","relation":["risk"]},
         "systemIds": {"type":"array","items":"id","relation":["system"]},
         "identifiedOn": {"type":"date"},
-        "dueOn": {"type":"date"},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
+        "dueOn": {"type":"date","requiredWhen":{"status":["open","remediating","resolved"]}},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "resolvedOn": {"type":"date"},
-        "verifiedByIds": {"type":"array","items":"id","relation":["person"]},
-        "verifiedOn": {"type":"date"}
+        "resolvedOn": {"type":"date","requiredWhen":{"status":["resolved","closed"]}},
+        "verifiedByIds": {"type":"array","items":"id","relation":["person"],"requiredWhen":{"status":"closed"}},
+        "verifiedOn": {"type":"date","requiredWhen":{"status":"closed"}}
       },
       "listFields": ["title","status","severity","identifiedOn","dueOn"]
     },
@@ -593,9 +608,9 @@
       "pluralTitle": "Exceptions",
       "group": "risk",
       "collection": "exceptions",
-      "description": "Approved, time-bound departures from a policy or control, with scope, rationale, risk, compensating controls, owner, approval, and expiry. An exception record is not required for SOC 2 unless the organization approves a departure.",
+      "description": "An approved, time-bound departure from a Policy or Control. Record its scope, reason, risk, compensating Controls, owner, approval, and expiry. An Exception record is not required for SOC 2 unless a departure is approved.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require a business reason, risk assessment, compensating controls, suitable approval, and an expiration or review date.",
+        "policyBasis": "The information security and data handling policies allow departures only with a business reason, assessed risk, compensating safeguards, approval, and an expiry or review date.",
         "cadence": "Approve before the departure begins, review through its stated cadence or expiry, and close or renew it through a new risk decision.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"]
       },
@@ -612,7 +627,6 @@
         "expiresOn": {"type":"date"},
         "reviewCadence": {"type":"object"},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "closedOn": {"type":"date"}
       },
       "listFields": ["title","status","expiresOn"]
@@ -622,10 +636,10 @@
       "pluralTitle": "Action items",
       "group": "work",
       "collection": "action-items",
-      "description": "Owned follow-up work from findings, risks, incidents, meetings, reviews, tests, exceptions, audits, and other GRC activity. A separate action-item tracker is not required for SOC 2; use this page when follow-up should stay linked to its source and evidence.",
+      "description": "One owned, dated follow-up task linked to the Finding, Policy Event, Risk, Incident, review, test, meeting, Exception, or request that created it. Action Items appear in Work Queue. Use one only when work needs separate assignment, timing, and completion proof. A separate Action Item tracker is not required for SOC 2.",
       "guidance": {
-        "policyBasis": "Starter policies require material issues and review decisions to produce named owners, due dates, evidence, and tracked corrective work.",
-        "cadence": "Create when work is assigned, review until complete, record blockers, and link completion evidence before closing."
+        "policyBasis": "Policies require material issues and review decisions to produce owned, dated corrective work with proof of completion.",
+        "cadence": "Create when separate follow-up is assigned. Set a deadline, work it from Work Queue, record blockers, and link completion evidence before closing."
       },
       "required": ["status","assigneeIds","sourceResourceId"],
       "fields": {
@@ -642,11 +656,14 @@
         "dueWindowEndAt": {"type":"timestamp"},
         "overdueAt": {"type":"timestamp"},
         "dueOn": {"type":"date"},
-        "completedOn": {"type":"date"},
+        "completedOn": {"type":"date","requiredWhen":{"status":"done"}},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
         "completionResourceIds": {"type":"array","items":"id","relation":["*"]},
         "blockingResourceIds": {"type":"array","items":"id","relation":["*"]}
       },
+      "oneOf": [
+        {"fields":["dueOn","dueWindowEndAt"],"when":{"status":["open","in-progress","blocked"]}}
+      ],
       "listFields": ["title","status","priority","dueOn","assigneeIds"]
     },
     "policy": {
@@ -654,10 +671,10 @@
       "pluralTitle": "Policies",
       "group": "governance",
       "collection": "policies",
-      "description": "Approved rules and responsibilities with Markdown content, owners, approvers, audience, acknowledgement rules, related controls, and Git history.",
+      "description": "Management-approved rules for the program. Store the policy text in Markdown and its owner, separate approver, scope, status, dates, and linked Controls in the record.",
       "guidance": {
-        "policyBasis": "Policies set the program's required behavior. Control, obligation, training, document, and attestation records make those requirements operational and auditable.",
-        "cadence": "Review at least annually and after material changes. The approver must be separate from the owner. Record approval and require a new acknowledgement when a material update affects the audience.",
+        "policyBasis": "Policies state management’s required behavior. Controls, Obligations, Documents, Training, and Attestations put that behavior into operation and preserve proof.",
+        "cadence": "Move a draft through review and approval, set the effective date, link its controls, and clear organization-specific placeholders before activation. The approver is usually internal and may be external, but must be separate from the owner and from the CPA auditor role. Review at least annually and after material changes.",
         "sourceResourceIds": ["policy-information-security"],
         "obligationActivityTypes": ["policy-review"]
       },
@@ -691,9 +708,9 @@
       "pluralTitle": "Policy reviews",
       "group": "governance",
       "collection": "policy-reviews",
-      "description": "Evidence that named reviewers checked governed policies or documents, recorded the result, approved changes, and assigned follow-up work.",
+      "description": "The result of a scheduled or change-driven review of Policies or governed Documents, including reviewers, decision, evidence, and follow-up. Edit the source record separately when changes are approved.",
       "guidance": {
-        "policyBasis": "Each starter policy and the continuity plan requires review at least annually and after specified material changes.",
+        "policyBasis": "Each starter Policy and the continuity plan requires periodic review and another review after specified material changes.",
         "cadence": "Complete annually and after a triggering change, incident, disruption, or policy condition. Link the exact scope, reviewers, result, and evidence.",
         "sourceResourceIds": ["policy-information-security","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["policy-review"]
@@ -714,9 +731,7 @@
         "changesRequired": {"type":"boolean"},
         "changeSummary": {"type":"string"},
         "approverIds": {"type":"array","items":"id","relation":["person","team"]},
-        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","reviewedOn","outcome","changesRequired"]
     },
@@ -725,9 +740,9 @@
       "pluralTitle": "Attestations",
       "group": "governance",
       "collection": "attestations",
-      "description": "Per-person proof of policy acknowledgement, training completion, certification, or assigned work, tied to exact content revisions and signed evidence when needed.",
+      "description": "One person’s acknowledgement, training completion, certification, or assigned-work confirmation. Bind it to the exact content revision and signed Evidence when required.",
       "guidance": {
-        "policyBasis": "The information security, data handling, workforce, and training materials require workers to review assigned content and acknowledge applicable responsibilities.",
+        "policyBasis": "The information security policy, data handling policy, and workforce materials require people to complete assigned training and acknowledge applicable responsibilities.",
         "cadence": "Assign during onboarding, within 30 days for security training, annually for recurring training, and after material content changes that require acknowledgement.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling","policy-employee-handbook"],
         "obligationActivityTypes": ["training"]
@@ -759,9 +774,9 @@
       "pluralTitle": "Meetings",
       "group": "governance",
       "collection": "meetings",
-      "description": "Governance meeting records with schedule, chair, attendees, agenda, minutes, decisions, risks, findings, evidence, and assigned actions.",
+      "description": "One governance meeting, including its chair, attendees, agenda, minutes, decisions, raised issues, Evidence, and assigned follow-up.",
       "guidance": {
-        "policyBasis": "The information security policy requires formal security and risk oversight minutes. The continuity plan requires oversight review of exercises and unresolved risks.",
+        "policyBasis": "The information security policy requires recorded security and risk oversight. The continuity plan requires management review of exercises and unresolved risks.",
         "cadence": "Hold security and risk oversight meetings at least quarterly. Create one immutable meeting record and Markdown minutes for each occurrence.",
         "sourceResourceIds": ["policy-information-security","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["meeting"]
@@ -778,8 +793,6 @@
         "externalAttendees": {"type":"array","items":"object"},
         "decisionSummary": {"type":"string","search":true},
         "riskIds": {"type":"array","items":"id","relation":["risk"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","teamId","scheduledOn"],
@@ -794,9 +807,9 @@
       "pluralTitle": "Training",
       "group": "governance",
       "collection": "training",
-      "description": "Reusable Markdown training with audience, assignment trigger, recurrence, completion window, linked policies and controls, and passing criteria.",
+      "description": "Reusable training content and assignment rules, including audience, trigger, recurrence, completion window, passing criteria, and linked Policies and Controls. Individual completions belong in Attestations.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require security training, acknowledgements, and added role-based training where responsibilities or data warrant it.",
+        "policyBasis": "The information security and data handling policies require security training and added role-based training when a person’s responsibilities or data access warrant it.",
         "cadence": "Assign security training at onboarding, complete it within 30 days, repeat at least annually, and reassign after relevant material changes or incidents.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["training"]
@@ -823,9 +836,9 @@
       "pluralTitle": "Risks",
       "group": "risk",
       "collection": "risks",
-      "description": "Identified threats and business impacts with ownership, inherent and residual ratings, response, acceptance, affected scope, controls, and follow-up work.",
+      "description": "One identified threat or business impact that needs treatment or ongoing tracking. Record its owner, ratings, response, affected scope, Controls, acceptance, and follow-up.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require risk identification, treatment, ownership, approval, target dates, and time-bound acceptance.",
+        "policyBasis": "The information security and data handling policies require identified Risks to have an owner, rating, treatment decision, target date, and time-bound approval when accepted.",
         "cadence": "Assess the register at least annually and after material changes. Review High and Critical risks at least quarterly and accepted risks by their review date.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["risk-assessment"]
@@ -847,8 +860,6 @@
         "controlIds": {"type":"array","items":"id","relation":["control"]},
         "commitmentIds": {"type":"array","items":"id","relation":["commitment"]},
         "requirementIds": {"type":"array","items":"id","relation":["requirement"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "reviewCadence": {"type":"object"}
       },
       "listFields": ["title","status","response","inherentRating","residualRating"]
@@ -858,9 +869,9 @@
       "pluralTitle": "Risk assessments",
       "group": "risk",
       "collection": "risk-assessments",
-      "description": "Point-in-time assessment records for a defined scope, methodology, participants, systems, vendors, risks, conclusions, evidence, and approval.",
+      "description": "One approved evaluation of a defined scope using the program’s risk method. It records participants, Systems, Vendors, conclusions, Evidence, and the Risks created or reassessed.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require assessment of threats, assets, obligations, controls, likelihood, impact, treatment, and material changes.",
+        "policyBasis": "The information security and data handling policies require periodic and change-driven assessment of threats, assets, obligations, Controls, likelihood, impact, and treatment.",
         "cadence": "Complete at least annually and after a material change that could alter risk. Record new and changed risks instead of hiding them in the summary.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["risk-assessment"]
@@ -884,8 +895,6 @@
         "changedRiskIds": {"type":"array","items":"id","relation":["risk"]},
         "summary": {"type":"string","search":true},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "approvedOn": {"type":"date","requiredWhen":{"status":"complete"}},
         "sourceCommit": {"type":"string"}
       },
@@ -897,9 +906,9 @@
       "pluralTitle": "Vendors",
       "group": "systems-vendors",
       "collection": "vendors",
-      "description": "Third parties that provide products or services, with ownership, service, criticality, data, systems, contracts, subprocessors, continuity, and review cadence.",
+      "description": "Provider companies and supplier relationships. Keep contracts, due diligence, subprocessors, continuity, and supplier risk here; record vendor software separately as Systems so Controls and Evidence can link to it.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require vendor inventory, risk-based review before access, suitable contract terms, and monitoring of important providers.",
+        "policyBasis": "The information security and data handling policies require an inventory of important providers, risk-based review before access or reliance, suitable contract terms, and ongoing monitoring.",
         "cadence": "Create before access or reliance. Review Critical and High-risk vendors at least annually and after material service changes or incidents.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["inventory-review","vendor-review"]
@@ -929,9 +938,9 @@
       "pluralTitle": "Vendor reviews",
       "group": "systems-vendors",
       "collection": "vendor-reviews",
-      "description": "Pre-access due diligence and periodic vendor reviews covering service, data, access, assurance, recovery, incidents, contracts, risks, evidence, and follow-up.",
+      "description": "One due-diligence or periodic review of a Vendor, covering the service, data, access, assurance, recovery, incidents, contracts, Risks, Evidence, and follow-up.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require review before a vendor handles sensitive data and periodic review of Critical and High-risk providers.",
+        "policyBasis": "The information security and data handling policies require review before a Vendor handles sensitive data or supports important services, plus periodic review of higher-risk providers.",
         "cadence": "Complete before access, at least annually for Critical and High-risk vendors, and after material service changes or incidents.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["vendor-review"]
@@ -948,8 +957,6 @@
         "scope": {"type":"string"},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
         "riskIds": {"type":"array","items":"id","relation":["risk"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "nextReviewConstraint": {"type":"object"}
       },
       "listFields": ["title","status","vendorIds","reviewedOn","outcome"]
@@ -959,9 +966,9 @@
       "pluralTitle": "Access grants",
       "group": "people-access",
       "collection": "access-grants",
-      "description": "One person's or service account's access to one system, including business role, privilege, request, approval, provisioning, expiry, removal, ticket, and evidence.",
+      "description": "One Person’s or Service Account’s access to one System, including business need, privilege, request, approval, provisioning, expiry, removal, ticket, and Evidence.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require unique identity, business need, least privilege, approval, authorized provisioning, and prompt removal.",
+        "policyBasis": "The information security and data handling policies require unique identity, documented business need, least privilege, approval, authorized provisioning, and prompt removal.",
         "cadence": "Record every grant and material change. Remove access at or before notice for involuntary or high-risk departures and within 24 hours for other departures.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"]
       },
@@ -993,9 +1000,9 @@
       "pluralTitle": "Access reviews",
       "group": "people-access",
       "collection": "access-reviews",
-      "description": "Point-in-time review of a defined access population, with systems, reviewers, period, grant decisions, exceptions, approval, evidence, and source revision.",
+      "description": "One review of a defined access population for a date or period, including Systems, reviewers, Access Grant decisions, exceptions, approval, Evidence, and source revision.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require owners to confirm least privilege and remove dormant, expired, excessive, or unneeded access.",
+        "policyBasis": "The information security and data handling policies require System owners to periodically confirm least privilege and remove dormant, expired, excessive, or unneeded access.",
         "cadence": "Review privileged and production access at least quarterly and other important-system access at least annually.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"],
         "obligationActivityTypes": ["access-review"]
@@ -1018,8 +1025,6 @@
         "populationCount": {"type":"integer","minimum":0},
         "exceptionCount": {"type":"integer","minimum":0},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]},
         "approvedByIds": {"type":"array","items":"id","relation":["person"]},
         "approvedOn": {"type":"date"},
         "sourceCommit": {"type":"string"}
@@ -1031,9 +1036,9 @@
       "pluralTitle": "Vulnerabilities",
       "group": "security-operations",
       "collection": "vulnerabilities",
-      "description": "Confirmed weaknesses with severity, affected systems, source, dates, external IDs, owner, due date, risk treatment, evidence, and remediation verification. A separate FileGRC vulnerability register is not required for SOC 2 when a scanner or ticket system remains the source of truth and retains usable audit evidence.",
+      "description": "One confirmed weakness that needs remediation, an approved Exception, or verified closure. A separate Vulnerability register is not required for SOC 2 when the scanner or ticket system retains complete, usable records.",
       "guidance": {
-        "policyBasis": "The information security policy requires owned, risk-based remediation or a documented exception with compensating controls and approval.",
+        "policyBasis": "The information security policy requires confirmed Vulnerabilities to receive owned, risk-based remediation or an approved Exception with compensating Controls.",
         "cadence": "Remediate Critical, High, Medium, and Low vulnerabilities within 7, 14, 30, and 30 days unless an approved exception applies.",
         "sourceResourceIds": ["policy-information-security"]
       },
@@ -1056,8 +1061,7 @@
         "remediatedOn": {"type":"date"},
         "verifiedByIds": {"type":"array","items":"id","relation":["person"]},
         "verifiedOn": {"type":"date"},
-        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","severity","systemIds","discoveredOn","dueOn"]
     },
@@ -1066,9 +1070,9 @@
       "pluralTitle": "Vulnerability scans",
       "group": "security-operations",
       "collection": "vulnerability-scans",
-      "description": "Scan activities with kind, tools, scope, systems, operator, timestamps, severity counts, resulting vulnerabilities, evidence, failure reason, and review.",
+      "description": "One vulnerability scan activity, including tool, scope, Systems, operator, time, result, resulting Vulnerabilities, Evidence, failure reason, and review.",
       "guidance": {
-        "policyBasis": "The information security policy requires monitoring for vulnerabilities and scanning internet-facing and production systems.",
+        "policyBasis": "The information security policy requires management to monitor for weaknesses and scan internet-facing and production Systems.",
         "cadence": "Scan at least quarterly and after material changes when practical. Review failures and create vulnerability or finding records for confirmed results.",
         "sourceResourceIds": ["policy-information-security"],
         "obligationActivityTypes": ["vulnerability-scan"]
@@ -1099,9 +1103,9 @@
       "pluralTitle": "Incidents",
       "group": "security-operations",
       "collection": "incidents",
-      "description": "Suspected and confirmed security or privacy events with severity, chronology, scope, ownership, evidence, affected systems and vendors, findings, and corrective work. An incident record is not required for SOC 2 when no incident has occurred.",
+      "description": "One suspected or confirmed security or privacy event, with severity, timeline, scope, owner, affected Systems and Vendors, Evidence, Findings, and corrective work. An Incident record is not required for SOC 2 when no incident occurred.",
       "guidance": {
-        "policyBasis": "The information security and data handling policies require immediate reporting, investigation, containment, recovery, evidence preservation, and notification review.",
+        "policyBasis": "The information security and data handling policies require prompt reporting, investigation, containment, recovery, evidence preservation, and review of notification duties.",
         "cadence": "Create on report or detection, update material events as they progress, and complete a retrospective within one week after a material incident.",
         "sourceResourceIds": ["policy-information-security","policy-data-protection-handling"]
       },
@@ -1123,9 +1127,7 @@
         "dataClassification": {"type":"string"},
         "riskIds": {"type":"array","items":"id","relation":["risk"]},
         "vulnerabilityIds": {"type":"array","items":"id","relation":["vulnerability"]},
-        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","severity","detectedAt","closedAt"]
     },
@@ -1134,9 +1136,9 @@
       "pluralTitle": "Exercises",
       "group": "resilience",
       "collection": "exercises",
-      "description": "Continuity, recovery, incident, privacy, and other simulations with scenario, objective, participants, scope, result, evidence, findings, and actions.",
+      "description": "One continuity, recovery, incident, or privacy simulation, including scenario, objective, participants, scope, result, Evidence, Findings, and follow-up.",
       "guidance": {
-        "policyBasis": "The information security policy requires annual incident testing. The continuity plan requires annual exercises and review after material change or disruption.",
+        "policyBasis": "The information security policy requires incident-response testing. The continuity plan requires exercises and another review after material change or disruption.",
         "cadence": "Test incident response and continuity at least annually. Repeat after a material change when the prior exercise no longer represents the environment.",
         "sourceResourceIds": ["policy-information-security","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["exercise"]
@@ -1159,9 +1161,7 @@
         "systemIds": {"type":"array","items":"id","relation":["system"]},
         "startedAt": {"type":"timestamp"},
         "completedAt": {"type":"timestamp"},
-        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","exerciseKind","scheduledOn","outcome"]
     },
@@ -1170,9 +1170,9 @@
       "pluralTitle": "Backup tests",
       "group": "resilience",
       "collection": "backup-tests",
-      "description": "Restore and recovery tests with systems, operators, date, timing, recovery results, reviewer, evidence, findings, and follow-up work.",
+      "description": "One restore or recovery test, including the Systems and operators involved, timing, recovery result, reviewer, Evidence, Findings, and follow-up.",
       "guidance": {
-        "policyBasis": "The information security policy and continuity plan require protected backups, failure monitoring, and proof that data can be restored and used.",
+        "policyBasis": "The information security policy and continuity plan require protected backups, monitored failures, and tested proof that important data can be restored and used.",
         "cadence": "Test restoration at least annually for important systems and after recovery changes that could invalidate prior evidence.",
         "sourceResourceIds": ["policy-information-security","document-business-continuity-disaster-recovery"],
         "obligationActivityTypes": ["backup-test"]
@@ -1189,9 +1189,7 @@
         "completedAt": {"type":"timestamp"},
         "recoveryTimeMinutes": {"type":"integer"},
         "recoveryPointMinutes": {"type":"integer"},
-        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","testDate","outcome","recoveryTimeMinutes"]
     },
@@ -1200,9 +1198,9 @@
       "pluralTitle": "Penetration tests",
       "group": "security-operations",
       "collection": "penetration-tests",
-      "description": "Internal or external penetration tests with scope, period, provider, method, result, affected systems, evidence, vulnerabilities, findings, and review.",
+      "description": "One internal or external penetration test, including provider, scope, period, method, result, affected Systems, Evidence, Vulnerabilities, Findings, and review.",
       "guidance": {
-        "policyBasis": "The information security policy requires an independent test of the in-scope service's external attack surface and tracked resolution of results.",
+        "policyBasis": "The information security policy requires independent testing of the in-scope service’s external attack surface and tracked resolution of confirmed results.",
         "cadence": "Perform at least annually and reconsider scope after material attack-surface or architecture changes.",
         "sourceResourceIds": ["policy-information-security"],
         "obligationActivityTypes": ["penetration-test"]
@@ -1224,7 +1222,6 @@
         "rulesOfEngagementDocumentId": {"type":"id","relation":["document"]},
         "methodology": {"type":"string"},
         "resultSummary": {"type":"string","search":true},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
         "vulnerabilityIds": {"type":"array","items":"id","relation":["vulnerability"]},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
         "reviewerIds": {"type":"array","items":"id","relation":["person"]},
@@ -1237,9 +1234,9 @@
       "pluralTitle": "Data requests",
       "group": "governance",
       "collection": "data-requests",
-      "description": "Privacy, contractual, or other requests concerning data, tracked by opaque reference with scope, jurisdiction, due date, decision, evidence, and completion. Data-request tracking is not required for a SOC 2 Security-only report; use it when privacy criteria, law, or contracts make the workflow relevant.",
+      "description": "One privacy, contractual, or other data request tracked by opaque reference, with scope, due date, decision, Evidence, and completion. Data Request tracking is not required for a SOC 2 Security-only report.",
       "guidance": {
-        "policyBasis": "The data handling policy requires requests to reach the responsible owner and keeps erasable personal data out of immutable Git history.",
+        "policyBasis": "The data handling policy requires applicable requests to reach a responsible owner, meet the governing deadline, and keep erasable personal data out of immutable Git history.",
         "cadence": "Create on receipt, set the deadline from applicable law or contract, verify identity outside this repository when needed, and record completion.",
         "sourceResourceIds": ["policy-data-protection-handling"]
       },
@@ -1258,8 +1255,7 @@
         "decision": {"type":"string"},
         "decisionRationale": {"type":"string"},
         "completedOn": {"type":"date"},
-        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "evidenceIds": {"type":"array","items":"id","relation":["evidence"]}
       },
       "listFields": ["title","status","requestKind","receivedOn","dueOn"]
     },
@@ -1268,10 +1264,10 @@
       "pluralTitle": "Audits",
       "group": "audits",
       "collection": "audits",
-      "description": "One SOC 2 engagement from auditor selection and scope through requests, fieldwork, evidence, findings, and the final report.",
+      "description": "One real SOC 2 engagement with a CPA firm, including the auditor-agreed scope and period, requests, fieldwork, Findings, opinion, and final report. Management’s candidate dates remain on the Workspace.",
       "guidance": {
-        "policyBasis": "An independent CPA firm performs the examination against the selected criteria. Policies, controls, operating records, and evidence show how the organization meets them.",
-        "cadence": "Engage the auditor early enough to agree on scope, timing, and evidence expectations. Create one record per engagement, using an as-of date for Type 1 or a start and end period for Type 2.",
+        "policyBasis": "A CPA firm independently examines the scoped service against the selected Framework. Management supplies the system description, Controls, operating records, and Evidence.",
+        "cadence": "Create one record after a CPA firm is engaged, or earlier only when a customer deadline makes early coordination useful. Keep management candidate dates on the workspace and record the auditor-agreed Type 1 date or Type 2 period here.",
         "sourceResourceIds": ["policy-information-security"]
       },
       "required": ["status","auditKind","frameworkIds","scope","ownerIds"],
@@ -1282,9 +1278,9 @@
         "scope": {"type":"string","search":true},
         "auditor": {"type":"object"},
         "auditorVendorId": {"type":"id","relation":["vendor"]},
-        "typeOneAsOf": {"type":"date"},
-        "periodStart": {"type":"date"},
-        "periodEnd": {"type":"date"},
+        "typeOneAsOf": {"type":"date","label":"Auditor-agreed Type 1 date"},
+        "periodStart": {"type":"date","label":"Auditor-agreed Type 2 period start"},
+        "periodEnd": {"type":"date","label":"Auditor-agreed Type 2 period end"},
         "fieldworkStart": {"type":"date"},
         "fieldworkEnd": {"type":"date"},
         "reportDate": {"type":"date"},
@@ -1305,7 +1301,6 @@
         "opinion": {"type":"enum","values":["unmodified","qualified","adverse","disclaimer","not-issued"],"filter":true},
         "opinionDate": {"type":"date"},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "findingIds": {"type":"array","items":"id","relation":["finding"]},
         "reportEvidenceId": {"type":"id","relation":["evidence"]},
         "managementResponseDocumentId": {"type":"id","relation":["document"]},
         "supplementalDocumentIds": {"type":"array","items":"id","relation":["document"]}
@@ -1317,9 +1312,9 @@
       "pluralTitle": "Audit populations",
       "group": "audits",
       "collection": "audit-populations",
-      "description": "One complete population of events or items for a Type 2 period. Management records the authoritative source, exact query, count, reconciliation, and fixed export, including when the count is zero.",
+      "description": "One complete set of control-relevant events or items for a Type 2 period, with its source System, exact query, count, reconciliation, and fixed export, including zero-event populations.",
       "guidance": {
-        "policyBasis": "Management must supply complete and accurate populations so the auditor can select samples and test controls. The linked population-export evidence remains the fixed source artifact.",
+        "policyBasis": "The CPA firm needs complete and accurate populations to select samples and test Controls. The linked population-export Evidence preserves the exact source set management supplied.",
         "cadence": "Plan at the start of the engagement, export for the exact audit period, reconcile before fieldwork, and retain proof for zero-event populations."
       },
       "required": ["status","auditId","populationKind","periodStart","periodEnd","ownerIds"],
@@ -1345,9 +1340,9 @@
       "pluralTitle": "Audit requests",
       "group": "audits",
       "collection": "audit-requests",
-      "description": "One auditor request or prepared-by-client item with engagement, reference, description, owner, due date, response, criteria, controls, evidence, and follow-up. A separate FileGRC request tracker is not required for SOC 2 when the auditor's system remains the source of truth.",
+      "description": "One auditor request or prepared-by-client item, with its Audit, owner, due date, approved response, Requirements, Controls, Evidence, and follow-up. A separate Audit Request tracker is not required for SOC 2 when the CPA firm’s portal is authoritative.",
       "guidance": {
-        "policyBasis": "Audit requests turn the engagement scope into owned deliverables and preserve the exact evidence and response supplied to the auditor.",
+        "policyBasis": "Audit Requests turn fieldwork into owned, dated deliverables and preserve the exact response and Evidence supplied to the CPA firm.",
         "cadence": "Create on receipt, assign immediately, meet the auditor due date, bind evidence to the requested period and Git revision, and close only after acceptance."
       },
       "required": ["status","auditId","requestReference","description","ownerIds"],
@@ -1365,8 +1360,7 @@
         "periodStart": {"type":"date"},
         "periodEnd": {"type":"date"},
         "evidenceIds": {"type":"array","items":"id","relation":["evidence"]},
-        "auditorNotes": {"type":"string"},
-        "actionItemIds": {"type":"array","items":"id","relation":["action-item"]}
+        "auditorNotes": {"type":"string"}
       },
       "listFields": ["requestReference","title","status","dueOn","submittedOn"],
       "markdown": {