filegrc 0.11.0 → 0.12.0

package/src/policy-library/information-security-policy-v2.md

@@ -50,7 +50,7 @@ Management obtains or generates, checks, and uses relevant information from inte
 
 Everyone in scope must act honestly, protect company and customer information, follow approved security processes, disclose conflicts that could affect security decisions, and preserve accurate records. Fraud, deliberate Control bypass, false Evidence, credential sharing, unauthorized access, concealment of a security event, and retaliation for a good-faith report are prohibited.
 
-Suspected security events, Control failures, fraud, or policy violations must be reported promptly through the primary route at {{security_contact_email}} or the usable alternate route documented in the Security Incident and Recovery Plan. A person may use the alternate route when the primary route is unavailable, compromised, or involved in the concern. Management investigates credible reports, limits disclosure to people who need the information, preserves relevant records, and records corrective action.
+Suspected security events, Control failures, fraud, or policy violations must be reported promptly through the current normal Security Reporting Channel or its usable fallback. A person may use the fallback when the normal channel is unavailable, compromised, or involved in the concern. Management investigates credible reports, limits disclosure to people who need the information, preserves relevant records, and records corrective action.
 
 ## Risk Management and Compliance Policy
 

package/src/policy-library.js

@@ -15,11 +15,13 @@ const POLICY_DISPLAY_PATH = `data/${POLICY_CONTENT_PATH}`;
 const TRAINING_ID = "training-security-awareness";
 const TRAINING_CONTENT_PATH = "training/training-security-awareness.md";
 const TRAINING_DISPLAY_PATH = `data/${TRAINING_CONTENT_PATH}`;
+const ALTERNATE_REPORTING_ROUTE_ID = "reporting-route-security-alternate";
 const PRIOR_TRAINING_REVISIONS = new Set([
   "53583484d668697e78d82bc22136d78976191303a06f67d0ad2edb55ba5ee0c6",
   "0c6677c22932eb3734240125bc0f40418a13f31d0a31943f4ecd12754afed7fc",
   "9e020af0de1c137607ba4c3186f04be7a00e0d0006e7fc8c7a109e35faf353cf",
-  "bf8ac1a9e22a215ed375b590f3cba767801e2e062069e147290bad2c98fd29aa"
+  "bf8ac1a9e22a215ed375b590f3cba767801e2e062069e147290bad2c98fd29aa",
+  "7e55e8df6991d32085ca836c24e3b0015806d04523eca7ed4ee9e51043f05614"
 ]);
 const CURRENT_TRAINING_REVISION = "7e55e8df6991d32085ca836c24e3b0015806d04523eca7ed4ee9e51043f05614";
 const PRIOR_PASSWORD_MANAGER_TRAINING = "Use an approved password manager to generate and store a unique password for each account.";
@@ -37,6 +39,15 @@ const PRIOR_ENDPOINT_SETTING_TRAINING = "Company-managed devices use the automat
 const CURRENT_ENDPOINT_SETTING_TRAINING = "Company-managed devices must use the approved automatic-lock setting.";
 const PRIOR_CONFIGURATION_RECORD_TRAINING = "The applicable Controls, Components, Systems, and governed schedules record the actual tools, settings, approval paths, and evidence.";
 const CURRENT_CONFIGURATION_DOCUMENTATION_TRAINING = "Approved supporting standards, procedures, and schedules document the tools, settings, approval paths, and evidence.";
+const PRIOR_TRAINING_REPORTING_ROUTE = "Questions and incident reports should be sent to {{security_contact_email}}.";
+const PREVIOUS_TRAINING_REPORTING_ROUTE = "Questions and incident reports use the current approved security reporting route delivered with this assignment.";
+const CURRENT_TRAINING_REPORTING_ROUTE = "Questions and incident reports use the current approved security reporting channel delivered with this assignment.";
+const PRIOR_TRAINING_REPORTING_ACTION = "2. Report the event immediately to {{security_contact_email}}. If that route is unavailable, contact the current Policy Owner through an approved alternate method.";
+const PREVIOUS_TRAINING_REPORTING_ACTION = "2. Report the event immediately through the approved security reporting route delivered with this assignment. If that route is unavailable, use the current approved alternate route.";
+const CURRENT_TRAINING_REPORTING_ACTION = "2. Report the event immediately through the approved security reporting channel delivered with this assignment. If that channel is unavailable, use the current approved fallback channel.";
+const PRIOR_TRAINING_REPORTING_CONFIRMATION = "- Confirm that you know how to reach {{security_contact_email}}.";
+const PREVIOUS_TRAINING_REPORTING_CONFIRMATION = "- Confirm that you know how to use the security reporting route delivered with this assignment.";
+const CURRENT_TRAINING_REPORTING_CONFIRMATION = "- Confirm that you know how to use the security reporting channel delivered with this assignment.";
 const DOCUMENT_CONTENT_UPDATES = [
   {
     id: "document-data-retention-schedule",
@@ -59,9 +70,18 @@ const DOCUMENT_CONTENT_UPDATES = [
     id: "document-security-incident-recovery-plan",
     path: "documents/document-security-incident-recovery-plan.md",
     priorRevision: "339ff564fa0ec26503c2498e8d3c44529957113cf782aa03ddb5b4e64c8f0404",
-    additionalPriorRevisions: new Set(["51a19e22f3e0b31196371676297bfa843f96295d2f6c72e81a969ce7bafc36ae"]),
-    currentRevision: "558b6fa71eaabf4ea3cfe77eaa24f827ad66a19a059085b2090e3c4a4d79cb50",
+    additionalPriorRevisions: new Set([
+      "51a19e22f3e0b31196371676297bfa843f96295d2f6c72e81a969ce7bafc36ae",
+      "5107f5c6015089a7c64e87692976aa48f727b8c03988f93f71e8f3e5084a05ac",
+      "970b97c4f594ff54fab554460f3cf44f80ee8079e996f4d5dc1427290f8aa714"
+    ]),
+    currentRevision: "ff8b5764ba3073d7ab6678c7da607850de5a82de4383cb54417cd74d82c05305",
     replacements: [
+      ["## Reporting routes", "## Reporting channels"],
+      ["The primary reporting route is {{security_contact_email}}.", "Use the current approved primary security Reporting Route. The Reporting Route record is the source of truth for its channel, destination, owner, priority, and effective period."],
+      ["Use the current approved primary security Reporting Route. The Reporting Route record is the source of truth for its channel, destination, owner, priority, and effective period.", "Use the current approved primary security Reporting Route. If it is unavailable, use the current approved alternate Reporting Route. Those records are the source of truth for each channel, destination, owner, priority, and effective period."],
+      ["[Complete before activation: Name a usable alternate reporting route, its owner, protected location, and how workers can find it when the primary email, identity, or collaboration System is unavailable, compromised, or involved in the concern. Do not put plaintext credentials, private keys, tokens, or recovery codes in this plan.]", "[Complete before activation: Describe how workers can find the alternate Reporting Route when the primary email, identity, or collaboration System is unavailable, compromised, or involved in the concern. Do not copy the route destination here or include plaintext credentials, private keys, tokens, or recovery codes.]"],
+      ["Use the current approved primary security Reporting Route. If it is unavailable, use the current approved alternate Reporting Route. Those records are the source of truth for each channel, destination, owner, priority, and effective period.\n\n[Complete before activation: Describe how workers can find the alternate Reporting Route when the primary email, identity, or collaboration System is unavailable, compromised, or involved in the concern. Do not copy the route destination here or include plaintext credentials, private keys, tokens, or recovery codes.]", "People send suspected security concerns through the current approved normal reporting channel, such as the security email address. If that channel is unavailable, compromised, or involved in the concern, they use the approved fallback channel. The Reporting Channel Set is the source of truth for the current destinations, responsible role, and effective period.\n\n[Complete before activation: Describe how workers can find the fallback reporting channel when the normal email, identity, or collaboration System is unavailable, compromised, or involved in the concern. Do not copy the destination here or include plaintext credentials, private keys, tokens, or recovery codes.]"],
       ["Controls, Components, Systems, Obligations, and Evidence hold the actual technical configuration and proof of operation.", "Supporting procedures, system records, and retained evidence document the actual technical configuration and operation."],
       ["If an incident raises a legal, privacy, or insurance question, the incident lead gets suitable advice at that time. FileGRC does not require pre-arranged counsel, in-house counsel, or a standing legal retainer.", "If an incident raises a legal, privacy, or insurance question, the incident lead obtains suitable advice at that time. A pre-arranged counsel relationship or standing legal retainer is required only when management determines that the organization's obligations and risk warrant one."],
       ["[Complete before activation: Link every important System and record its approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments in the System record.]", "[Complete before activation: Document every important System's approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments.]"],
@@ -565,7 +585,13 @@ async function buildPolicyLibraryPlan(loaded) {
         .replace(PRIOR_REPOSITORY_SECRET_TRAINING, CURRENT_REPOSITORY_SECRET_TRAINING)
         .replace(PRIOR_SOURCE_SECRET_TRAINING, CURRENT_SOURCE_SECRET_TRAINING)
         .replace(PRIOR_ENDPOINT_SETTING_TRAINING, CURRENT_ENDPOINT_SETTING_TRAINING)
-        .replace(PRIOR_CONFIGURATION_RECORD_TRAINING, CURRENT_CONFIGURATION_DOCUMENTATION_TRAINING);
+        .replace(PRIOR_CONFIGURATION_RECORD_TRAINING, CURRENT_CONFIGURATION_DOCUMENTATION_TRAINING)
+        .replace(PREVIOUS_TRAINING_REPORTING_ROUTE, CURRENT_TRAINING_REPORTING_ROUTE)
+        .replace(PRIOR_TRAINING_REPORTING_ROUTE, CURRENT_TRAINING_REPORTING_ROUTE)
+        .replace(PREVIOUS_TRAINING_REPORTING_ACTION, CURRENT_TRAINING_REPORTING_ACTION)
+        .replace(PRIOR_TRAINING_REPORTING_ACTION, CURRENT_TRAINING_REPORTING_ACTION)
+        .replace(PREVIOUS_TRAINING_REPORTING_CONFIRMATION, CURRENT_TRAINING_REPORTING_CONFIRMATION)
+        .replace(PRIOR_TRAINING_REPORTING_CONFIRMATION, CURRENT_TRAINING_REPORTING_CONFIRMATION);
       proposalChanges.push({
         resourceType: "training",
         resourceId: TRAINING_ID,
@@ -600,12 +626,16 @@ async function buildPolicyLibraryPlan(loaded) {
       && !documentUpdate.additionalPriorRevisions?.has(sourceRevision)) {
       skipped.push(skippedItem(documentUpdate.id, "customized", "The governed Document differs from the recognized prior starter, so FileGRC will not rewrite it."));
     } else {
+      const securityContact = source.match(/The primary reporting route is ([^\r\n]+)\./)?.[1] || null;
       const nextSource = documentUpdate.currentSourcePath
         ? materializeDocument(
             await readFile(new URL(documentUpdate.currentSourcePath, import.meta.url), "utf8"),
             loaded.workspace?.organizationName
           )
-        : documentUpdate.replacements.reduce((current, [prior, next]) => current.replace(prior, next), source);
+        : documentUpdate.replacements.reduce((current, [prior, next]) => current.replace(
+            securityContact ? prior.replaceAll("{{security_contact_email}}", securityContact) : prior,
+            securityContact ? next.replaceAll("{{security_contact_email}}", securityContact) : next
+          ), source);
       if (normalizedDocumentRevision(nextSource, loaded.workspace?.organizationName) !== documentUpdate.currentRevision) {
         throw new Error(`The ${documentUpdate.id} starter update does not produce the current governed Document.`);
       }
@@ -725,17 +755,23 @@ async function buildPolicyLibraryPlan(loaded) {
       skipped.push(skippedItem(addition.id, "missing-basis", "The recognized proposed starter Obligation needed to derive this schedule is not available."));
       continue;
     }
+    const sourceRuleId = source.activeRuleId || source.ruleIds?.[0];
+    const sourceRule = sourceRuleId ? byId.get(sourceRuleId)?.record : null;
+    const sourceSchedule = source.scheduleMode === "rule" && sourceRule?.type === "obligation-rule"
+      ? sourceRule
+      : source;
     const record = {
       id: addition.id,
       type: "obligation",
       title: addition.title,
       status: "proposed",
       activityType: addition.activityType,
-      recurrence: structuredClone(source.recurrence),
+      ...(modelSupports(loaded.model, "rolled-up-obligations") ? { scheduleMode: "legacy" } : {}),
+      recurrence: structuredClone(sourceSchedule.recurrence),
       ownerIds: [...(source.ownerIds || [])],
-      startsOn: source.startsOn,
+      startsOn: source.startsOn || sourceSchedule.effectiveAt?.slice(0, 10),
       ...(source.triggerPrompt ? { triggerPrompt: source.triggerPrompt } : {}),
-      ...(addition.window || source.window ? { window: structuredClone(addition.window || source.window) } : {}),
+      ...(addition.window || sourceSchedule.window ? { window: structuredClone(addition.window || sourceSchedule.window) } : {}),
       controlIds: [...addition.controlIds],
       policyIds: [...(source.policyIds || [])]
     };
@@ -750,6 +786,36 @@ async function buildPolicyLibraryPlan(loaded) {
     });
   }
 
+  if (modelSupports(loaded.model, "reporting-routes") && !byId.has(ALTERNATE_REPORTING_ROUTE_ID)) {
+    const primaryRoute = loaded.resources.find((record) => (
+      record.type === "reporting-route"
+      && record.purpose === "security-reporting"
+      && record.priority === "primary"
+    ));
+    if (primaryRoute) {
+      const record = {
+        id: ALTERNATE_REPORTING_ROUTE_ID,
+        type: "reporting-route",
+        title: "Alternate security reporting route",
+        status: "planned",
+        purpose: "security-reporting",
+        priority: "alternate",
+        channelKind: "other",
+        route: "TBD: protected alternate channel",
+        ownerIds: [...(primaryRoute.ownerIds || [])]
+      };
+      creates.push(record);
+      const displayPath = `data/reporting-routes/${record.id}.json`;
+      proposalChanges.push({
+        resourceType: "reporting-route",
+        resourceId: record.id,
+        path: displayPath,
+        summary: "Add a planned alternate route as the single source of truth for its destination, owner, and effective period.",
+        diff: fullReplacementDiff(displayPath, "", `${JSON.stringify(record, null, 2)}\n`)
+      });
+    }
+  }
+
   const proposals = proposalChanges.length ? [{
     id: INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID,
     revision: createHash("sha256").update(JSON.stringify(proposalChanges)).digest("hex"),
@@ -801,6 +867,10 @@ function normalizedPolicyRevision(source, organizationName) {
     /through the primary route at [^\r\n]+ or the usable alternate route documented/,
     "through the primary route at {{security_contact_email}} or the usable alternate route documented"
   );
+  normalized = normalized.replace(
+    "through the current primary Security Reporting Route or its current usable alternate route",
+    "through the primary route at {{security_contact_email}} or the usable alternate route documented in the Security Incident and Recovery Plan"
+  );
   return createHash("sha256").update(normalized).digest("hex");
 }
 
@@ -814,6 +884,13 @@ function normalizedTrainingRevision(source, organizationName) {
   }
   const securityContact = normalized.match(/Questions and incident reports should be sent to ([^\r\n]+)\./)?.[1];
   if (securityContact) normalized = normalized.replaceAll(securityContact, "{{security_contact_email}}");
+  normalized = normalized
+    .replace(CURRENT_TRAINING_REPORTING_ROUTE, PRIOR_TRAINING_REPORTING_ROUTE)
+    .replace(PREVIOUS_TRAINING_REPORTING_ROUTE, PRIOR_TRAINING_REPORTING_ROUTE)
+    .replace(CURRENT_TRAINING_REPORTING_ACTION, PRIOR_TRAINING_REPORTING_ACTION)
+    .replace(PREVIOUS_TRAINING_REPORTING_ACTION, PRIOR_TRAINING_REPORTING_ACTION)
+    .replace(CURRENT_TRAINING_REPORTING_CONFIRMATION, PRIOR_TRAINING_REPORTING_CONFIRMATION);
+  normalized = normalized.replace(PREVIOUS_TRAINING_REPORTING_CONFIRMATION, PRIOR_TRAINING_REPORTING_CONFIRMATION);
   return createHash("sha256").update(normalized).digest("hex");
 }
 

package/src/program-path.js

@@ -6,12 +6,13 @@ export const RESOURCE_INSTRUCTIONS = {
   system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and any applicable continuity objectives.",
   component: "Add a Component only when it materially delivers a selected System, supports a Control, produces authoritative Evidence, or supports relevant operations. Give every System use a role and rationale.",
   vendor: "Catalog material external provider relationships. Link a supplied Component when it meets the Component inclusion rules, but do not mirror every Vendor into a Component.",
-  classification: "Define an ordered information-handling category used by inventory and Evidence Artifacts.",
+  classification: "Review the starter information-handling categories and ordering against management's actual protection decisions, then use the approved Classifications on inventory and Evidence Artifacts.",
   "information-type": "Define a stable category of information and its default Classification, then link it from Systems, Components, and Vendors.",
   framework: "Confirm the criteria framework and version used for the program.",
   requirement: "Keep the published criterion as catalog content. Record management applicability and rationale on the selected Program.",
   commitment: "Record supplemental customer promises and service requirements that shape the scope or control design. The Commitment’s systemIds and controlIds are authoritative for what fulfills it.",
   "requirement-mapping": "Record a reviewed relationship among Requirements, Commitments, and Controls. Choose the comparison method and relationship explicitly, explain the rationale, and bind the review to every mapped source revision.",
+  "reporting-route-set": "Record the normal and fallback ways people send one kind of report, including where each channel goes and the role that keeps it usable. Commit the proposal before approval, use separate approval and ongoing authority Appointments, and create a successor when either channel changes.",
   policy: "Tailor each Policy to match what the company is committing to. Clear placeholders, assign an owner and separate approver, then bind approval to the reviewed content. Approval does not prove implementation. Activate the Policy during the Step 3 cutover after reviewing its implementation gaps.",
   document: "Complete required program Documents in Step 2, assign an owner and separate approver, and bind approval to the intended values and exact Markdown. Implement the linked requirements and activate that approved revision in Step 3. Prepare Audit Documents in Step 5.",
   control: "Finish each applicable starter Control with the procedure people follow, its owner, bounded System scope, operating Components, authoritative evidence-source Components, governing Policy and Requirement mappings, and implementation date. Put calendar and event schedules in Obligations.",
@@ -56,6 +57,7 @@ export const RESOURCE_PAGE_SUMMARIES = {
   requirement: "Decide which SOC 2 criteria apply.",
   commitment: "Record customer promises that affect scope.",
   "requirement-mapping": "Review how supplemental promises relate to Requirements and Controls.",
+  "reporting-route-set": "Set the normal and fallback ways people report security concerns.",
   vendor: "List material external providers.",
   system: "Define the service boundary.",
   component: "Connect each material Component to a System.",
@@ -80,19 +82,21 @@ export const PROGRAM_PATH = [
     description: "Ownership, criteria, and service boundary",
     summary: "Name the owners, criteria, service, Systems, and providers in scope.",
     sections: [
-      { id: "ownership", title: "Program Ownership", description: "Confirm the people, appointments, and teams that own, approve, review, and operate the program.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team"], defaultOpen: true },
+      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Set a normal security reporting channel and a fallback, then commit that proposal before approval.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
       { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Record customer commitments and reviewed mappings. Keep optional criteria out until the company chooses to add them."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
       { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Create the complete bounded System and select it on the Program.", "Add only relevant Components, with a role and rationale for each System use.", "Create Vendors for material external provider relationships and link supplied Components when factual.", "Normalize Information Types and Classifications used by the System, Components, Vendors, Risks, and Evidence Artifacts."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
     ],
-    resourceTypes: ["person", "appointment", "team", "program", "framework", "requirement", "commitment", "requirement-mapping", "system", "component", "vendor", "classification", "information-type"],
+    resourceTypes: ["person", "appointment", "team", "reporting-route-set", "program", "framework", "requirement", "commitment", "requirement-mapping", "system", "component", "vendor", "classification", "information-type"],
     commands: [
       "filegrc setup",
       "filegrc guide person --json",
       "filegrc guide appointment --json",
+      "filegrc reporting-route-sets --json",
       "filegrc guide system --json",
       "filegrc guide component --json",
       "filegrc guide requirement-mapping --json",
       "filegrc review-collection vendor --scaffold",
+      "filegrc review-collection classification --scaffold",
       "filegrc review-collection information-type --scaffold",
       "filegrc list system --json"
     ]
@@ -201,11 +205,13 @@ export const PROGRAM_PATH = [
         summary: "Complete scheduled, event-driven, and assigned work by its due date.",
         instructions: "Complete recurring work, Policy Event tasks, and assigned Action Items within their allowed windows, link the requested dated proof, and resolve overdue items.",
         use: "See proposed, upcoming, blocked, due, and overdue policy work together with every open Action Item. Continuous and per-transaction Controls still operate through their Components and need dated operating records or Evidence.",
-        policyBasis: "Active and effective Policies start enabled reusable Obligations. Policy Events and source records create owned Action Items. Each occurrence or task retains its own deadline, completion record, and evidence.",
+        policyBasis: "Active and effective Policies start enabled reusable Obligations. Each calendar occurrence stays one rolled-up item whose reconciliation binds the selected population to its completion records. Policy Events and source records create owned Action Items.",
         commands: [
           "filegrc obligations --json",
+          "filegrc activate-obligation-rule RULE_ID --scaffold",
           "filegrc complete OBLIGATION_ID --scaffold --window-start YYYY-MM-DD --completed-on YYYY-MM-DD",
-          "filegrc complete OBLIGATION_ID completion-mutation.json --json"
+          "filegrc complete OBLIGATION_ID completion-mutation.json --json",
+          "filegrc reconcile-obligation OBLIGATION_ID --scaffold --window-start YYYY-MM-DD"
         ]
       }
     ],

package/src/program-readiness.js

@@ -19,6 +19,7 @@ import { assessPolicyLibraryUpgrades } from "./policy-library.js";
 import { assessProgramAmendmentReadiness } from "./program-amendment.js";
 import { programComponents, resolveProgram, selectedRequirementIds } from "./program.js";
 import { assessRequirementMappingReadiness } from "./requirement-mapping.js";
+import { assessReportingRouteSets } from "./reporting-route-sets.js";
 import { assessRetentionReadiness } from "./retention.js";
 import { markdownEntries } from "./resource-markdown.js";
 import {
@@ -28,7 +29,7 @@ import {
   REQUIRED_SOC2_SECURITY_REFERENCES
 } from "./soc2.js";
 import { assessSourceCoverageReadiness } from "./source-coverage.js";
-import { currentCalendarDate } from "./time.js";
+import { currentCalendarDate, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
 
 export async function assessProgramReadiness(input, options = {}) {
@@ -60,7 +61,7 @@ export async function assessProgramReadiness(input, options = {}) {
     informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true
   }));
   controlStage.items.push(...collectionReviews
-    .filter(({ resourceType }) => ["component", "retention-schedule-item"].includes(resourceType))
+    .filter(({ resourceType }) => resourceType === "retention-schedule-item")
     .map(collectionReviewReadinessItem));
   const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
   controlStage.items.push(...governedContent.items);
@@ -81,8 +82,16 @@ export async function assessProgramReadiness(input, options = {}) {
       records,
       byId,
       loaded.model,
-      collectionReviews.filter(({ resourceType }) => ["person", "framework", "system", "vendor", "information-type"].includes(resourceType))
+      collectionReviews.filter(({ resourceType }) => ["person", "framework", "system", "component", "vendor", "classification", "information-type"].includes(resourceType)),
+      workspace?.timezone || "UTC"
     );
+  if (modelSupports(loaded.model, "reporting-route-sets")) {
+    const routeSets = await assessReportingRouteSets(loaded, {
+      programId: program.id,
+      at: timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC")
+    });
+    scopeReadinessStage.items.push(reportingRouteSetItem(routeSets));
+  }
   scopeReadinessStage.items.push(...await assessRequirementMappingReadiness(loaded));
   scopeReadinessStage.items.push(...await assessProgramAmendmentReadiness(loaded));
   const evidenceGateStages = [
@@ -102,7 +111,7 @@ export async function assessProgramReadiness(input, options = {}) {
     && program.candidateCoverage?.kind === "range"
     && coverageStart(program.candidateCoverage) <= asOf
   );
-  const obligations = planObligations(records, { asOf, through: asOf, model: loaded.model });
+  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
   const operating = evidenceReady && candidateStarted && stages.at(-1).counts.action === 0;
   const canStartCandidatePeriod = Boolean(
@@ -201,7 +210,7 @@ function programScope(program, records, byId, model, loaded) {
   };
 }
 
-function scopeStage(workspace, scope, records, byId, model, collectionReviews = []) {
+function scopeStage(workspace, scope, records, byId, model, collectionReviews = [], timezone = "UTC") {
   const items = [];
   const goal = workspace?.assuranceGoal || "none";
   items.push(item(
@@ -220,6 +229,10 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
     }
   ));
 
+  if (model.resources?.["reporting-route"] && !modelSupports(model, "reporting-route-sets")) {
+    items.push(reportingRouteItem(records, byId, currentCalendarDate(timezone), timezone));
+  }
+
   if (modelSupports(model, "program-scope")) {
     const completeComponents = scope.components.filter((component) => (
       component.status === "active"
@@ -406,6 +419,71 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   return stage("scope", "Define Scope", "Set program ownership, the management objective, service boundary, criteria, controls, and dependencies.", items);
 }
 
+function reportingRouteSetItem(assessment) {
+  const current = assessment.routeSets.find(({ effective, canceled }) => effective && !canceled);
+  const draft = assessment.routeSets.find(({ record }) => ["draft", "proposed"].includes(record.status));
+  const required = assessment.requirements.length > 0;
+  const proposed = assessment.proposedRequirements.length > 0;
+  const ready = assessment.issues.length === 0 && (!required || Boolean(current));
+  const needsAction = assessment.issues.length > 0;
+  const target = current?.record || draft?.record || { type: "reporting-route-set" };
+  let message;
+  if (needsAction) {
+    message = assessment.issues[0].message;
+  } else if (required && ready && current) {
+    message = `${current.record.title} is committed, effective, and has a current responsible Appointment. Assignments bind its Git commit.`;
+  } else if (!required && proposed && draft) {
+    message = "A draft or approved-but-inactive rule will require normal and fallback reporting channels later. Review them before that rule becomes active; this is not a current readiness gate.";
+  } else if (!required && draft) {
+    message = "No approved rule currently requires these reporting channels. Keep the draft for review or remove it; it is not a readiness gate.";
+  } else if (!required) {
+    message = "No active Policy, Document, Commitment, or Risk decision currently requires these reporting channels.";
+  } else {
+    message = assessment.issues[0]?.message || "Set the normal and fallback reporting channels, commit the proposal, approve it, and commit the approval.";
+  }
+  return item(
+    "security-reporting-route-set",
+    needsAction ? "action" : required ? ready ? "complete" : "action" : proposed && draft ? "later" : "info",
+    needsAction ? "Fix reporting channel requirements" : required ? "Approve required reporting channels" : proposed ? "Review proposed reporting channels" : "Reporting channels are not currently required",
+    message,
+    target,
+    {
+      requirements: assessment.requirements,
+      issues: assessment.issues,
+      commands: [
+        "npx filegrc reporting-route-sets --json",
+        "npx filegrc reporting-route-set --scaffold"
+      ]
+    }
+  );
+}
+
+function reportingRouteItem(records, byId, asOf, timezone = "UTC") {
+  const cutoff = new Date(timestampFromLocalDateTime(`${asOf}T23:59:59`, timezone));
+  const routes = records.filter((record) => (
+    record.type === "reporting-route"
+    && record.purpose === "security-reporting"
+    && record.status === "active"
+    && new Date(record.effectiveAt) <= cutoff
+    && (!record.endsAt || new Date(record.endsAt) > cutoff)
+  ));
+  const routeByPriority = new Map(routes.map((route) => [route.priority, route]));
+  const required = ["primary", "alternate"];
+  const ready = required.every((priority) => {
+    const route = routeByPriority.get(priority);
+    return route && currentPartyPeople(route.ownerIds || [], byId).size > 0;
+  });
+  return item(
+    "security-reporting-route",
+    ready ? "complete" : "action",
+    "Activate the primary and alternate security reporting routes",
+    ready
+      ? `The current routes are ${required.map((priority) => routeByPriority.get(priority).title).join(" and ")}. Training assignments bind the exact Git revision delivered.`
+      : "Activate one owned primary route and one independently usable alternate route before assigning training or relying on policy reporting instructions.",
+    routes[0] || records.find(({ type }) => type === "reporting-route") || { type: "reporting-route" }
+  );
+}
+
 function collectionReviewReadinessItem(assessment) {
   return item(
     `collection-review-${assessment.resourceType}`,
@@ -1377,7 +1455,7 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
     ]);
   }
 
-  const obligations = planObligations(records, { asOf, through: asOf, model });
+  const obligations = planObligations(records, { programId: workspace.id, asOf, through: asOf, model });
   const start = workspace.candidateCoverage?.kind === "range"
     ? coverageStart(workspace.candidateCoverage)
     : null;