filegrc 0.16.6 → 0.16.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.6",
+  "version": "0.16.8",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -21,7 +21,7 @@ const unorderedStringArrayFields = new Set([
   "tags"
 ]);
 
-export function applicabilityScopeRevision(record, program, resources, model) {
+export function applicabilityScopeRevision(record, program, resources, model, options = {}) {
   const selectedSystemIds = new Set(program?.systemIds || []);
   const selectedFrameworkIds = new Set(program?.frameworkIds || []);
   const selectedControlIds = new Set(program?.controlIds || []);
@@ -117,19 +117,19 @@ export function applicabilityScopeRevision(record, program, resources, model) {
     policies: resources
       .filter(({ type, id }) => type === "policy" && selectedPolicyIds.has(id))
       .sort(compareRecordIds)
-      .map((policy) => pick(policy, [
-        "id",
-        "status",
-        "policyKind",
-        "version",
-        "programRole",
-        "effectiveOn",
-        "requirementIds",
-        "audience",
-        "acknowledgementRequired",
-        "relatedDocumentIds",
-        "approvedContentRevisions"
-      ], model)),
+      .map((policy) => options.legacyPolicyStatus
+        ? pick({
+            ...policy,
+            status: options.legacyPolicyStatus === "approved" && ["in-review", "active"].includes(policy.status)
+              ? "approved" : policy.status,
+            effectiveOn: options.legacyPolicyStatus === "approved" && policy.status === "active"
+              ? undefined : policy.effectiveOn
+          }, [
+            "id", "status", "policyKind", "version", "programRole", "effectiveOn",
+            "requirementIds", "audience", "acknowledgementRequired",
+            "relatedDocumentIds", "approvedContentRevisions"
+          ], model)
+        : pick(policy, ["id", "requirementIds"], model)),
     requirements: resources
       .filter(({ type, frameworkId }) => type === "requirement" && selectedFrameworkIds.has(frameworkId))
       .sort(compareRecordIds)
@@ -165,14 +165,14 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
     && !review.scopeRevision.startsWith("filegrc:applicability-scope:")
     && Number(model?.modelVersion || 0) < 7
   ) return true;
-  return Boolean(
-    review?.scopeRevision
-    && revisionsMatch(
-      "applicability-scope",
-      review.scopeRevision,
-      applicabilityScopeRevision(record, program, resources, model)
-    )
-  );
+  if (!review?.scopeRevision) return false;
+  const matches = (revision) => revisionsMatch("applicability-scope", review.scopeRevision, revision);
+  if (matches(applicabilityScopeRevision(record, program, resources, model))) return true;
+  // Reviews written before the scope fix included Policy lifecycle fields. Accept
+  // that earlier fingerprint only when its material inputs still match.
+  if (matches(applicabilityScopeRevision(record, program, resources, model, { legacyPolicyStatus: "current" }))) return true;
+  return resources.some(({ type, status }) => type === "policy" && ["in-review", "active"].includes(status))
+    && matches(applicabilityScopeRevision(record, program, resources, model, { legacyPolicyStatus: "approved" }));
 }
 
 function pick(record, fields, model, objectType = null) {

package/src/batch-review.js

@@ -40,6 +40,8 @@ export async function scaffoldApplicabilityReview(input = process.cwd(), options
       && applicabilityReviewIsCurrent(review, requirementById.get(review.requirementId), program, loaded.resources, loaded.model)
     ))
     .map(({ requirementId }) => requirementId));
+  const requirementReviews = new Map((program.requirementApplicability || [])
+    .map((review) => [review.requirementId, review]));
   const records = loaded.resources.filter((record) => (
     REVIEWABLE_TYPES.has(record.type)
     && (!requestedType || record.type === requestedType)
@@ -56,10 +58,18 @@ export async function scaffoldApplicabilityReview(input = process.cwd(), options
       .sort((left, right) => `${left.type}:${left.title}:${left.id}`.localeCompare(`${right.type}:${right.title}:${right.id}`))
       .map((record) => {
         const constraint = soc2RequirementApplicabilityConstraint(record, program, loaded.model.modelVersion);
+        const saved = record.type === "requirement" && modelSupports(loaded.model, "program-scope")
+          ? requirementReviews.get(record.id)
+          : record.applicabilityReview;
+        const prior = saved && ["applicable", "not-applicable", "externally-managed", "zero-population"].includes(saved.decision)
+          ? saved : null;
         return {
           id: record.id,
-          decision: constraint?.requiredDecision || null,
-          rationale: constraint?.defaultRationale || null,
+          decision: constraint?.requiredDecision || prior?.decision || null,
+          rationale: constraint?.requiredDecision && constraint.requiredDecision !== prior?.decision
+            ? constraint.defaultRationale || null
+            : prior?.rationale || constraint?.defaultRationale || null,
+          reviewStatus: prior ? "stale" : "missing",
           ...(constraint ? { constraint } : {})
         };
       })

package/src/policy-library/information-security-policy-v2.md

@@ -120,6 +120,8 @@ Removable media containing Confidential or Restricted data requires owner approv
 
 The Data Retention Schedule defines the approved period and disposal method for important in-scope record classes. Supporting standards, procedures, and system records document implementation. Disposal must be suitable for the media and classification, with dated proof when the Control requires it.
 
+Owners document and test how approved deletion requests and retention cutoffs apply to primary data, derived copies, local copies, Vendor-held data, and backups. Procedures identify copies that cannot be removed immediately, their access restrictions and expiry, and any legal hold or contractual limit. Owners verify completion against the approved scope before representing data as deleted.
+
 ## Cryptography, Encryption, Key, and Secrets Management Policy
 
 ### Encryption requirements
@@ -164,6 +166,8 @@ Passwords and other authenticators must meet settings approved for the System's
 - **Customer and external-user access:** MFA is required when an approved Control, customer commitment, or risk decision requires it.
 - **Exceptions:** Where required MFA is unavailable, management must approve a time-bound Exception with a risk assessment, compensating Controls, an accountable owner, and a review or expiration date.
 
+Owners document customer authentication and workforce authentication separately for each relevant System. They record whether either path uses single sign-on, where MFA is enforced, and how access is revoked. Remote-access methods are selected and approved for the System and risk; a VPN is required only when an approved Control, commitment, or risk decision calls for one.
+
 ## Endpoint, Mobile Device, BYOD, and Malware Protection Policy
 
 ### Company devices and platform protection
@@ -194,6 +198,8 @@ Owners restrict inbound, outbound, and internal network paths and management int
 
 Production, development, test, and general-user environments must be separated to the extent needed for their data, exposure, privileges, and change risk. Connections between environments require approved paths and safeguards. Wireless and other local networks used for company work require authentication and encryption appropriate to current risk and technical capability.
 
+When a service processes data for multiple customers, owners define and enforce customer-data boundaries appropriate to the architecture. They verify that access paths and material changes preserve those boundaries, and record the test method, result, and follow-up.
+
 ## Configuration Management and System Maintenance Policy
 
 Important Systems and Components use documented secure configuration expectations based on trusted guidance, technical capability, and risk. Owners change or disable unnecessary default accounts, credentials, services, ports, features, and configurations. Deviations require review and, when material, an approved Exception.
@@ -230,6 +236,8 @@ Important Systems record and protect the security and operational events needed
 
 Logs use synchronized time, restrict alteration and access, and avoid unnecessary secrets or personal data. Each System's retention period belongs in the approved Data Retention Schedule. Owners document risk-based alerts, review paths, thresholds, and response ownership in approved standards, procedures, and schedules.
 
+When an incident may require investigation, responders preserve relevant logs and their context under the incident process, with controlled access and a documented retention or hold decision.
+
 ### Monitoring and alert testing
 
 Systems with availability commitments, recovery objectives, or material operational dependencies monitor the health, capacity, failure, and service indicators needed to detect degradation. Representative alert paths are tested from generation through acknowledgement, escalation, and fallback on the approved schedule and after a material path change. This requirement does not prescribe a particular monitoring or log-management product.

package/src/policy-library.js

@@ -146,6 +146,7 @@ const DOCUMENT_CONTENT_UPDATES = [
   }
 ];
 const PRIOR_STARTER_POLICY_REVISIONS = new Set([
+  "b440eb17797624c1b456f778b12a955c871de308349e565b5d69ab6a25703673",
   "b0f9b988a8bd231fe70ce71b6a732970e709b7af7826c1b55f1532f511b6e511",
   "e87961c6a665d73e9d3cce96ab978df87579668e72ea236248680db1f69a5fa1",
   "2b50c75f4f138eebc7154a6b6e0e50b843f016c228632f7c71239ec27c18cbbf",
@@ -157,6 +158,16 @@ const PRIOR_STARTER_POLICY_REVISIONS = new Set([
 ]);
 
 const CONTROL_UPDATES = [
+  {
+    id: "control-access-review-offboarding",
+    prior: [{
+      activity: "Review access populations, record decisions, and remove dormant, expired, or unneeded access."
+    }],
+    next: {
+      activity: "Review complete access populations, including workers and third parties with customer-data access, record decisions, and remove dormant, expired, or unneeded access."
+    },
+    summary: "Prompt a complete customer-data access population without changing the approved review cadence."
+  },
   {
     id: "control-policy-management",
     prior: [{
@@ -283,15 +294,21 @@ const CONTROL_UPDATES = [
   },
   {
     id: "control-network-security",
-    prior: [{
-      statement: "The organization restricts network paths, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
-      activity: "Manage boundaries, firewall rules, wireless safeguards, and remote production access."
-    }],
+    prior: [
+      {
+        statement: "The organization restricts network paths, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
+        activity: "Manage boundaries, firewall rules, wireless safeguards, and remote production access."
+      },
+      {
+        statement: "The organization restricts network paths, separates production and nonproduction environments according to data and risk, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
+        activity: "Manage boundaries, environment connections, firewall rules, wireless safeguards, and remote production access."
+      }
+    ],
     next: {
       statement: "The organization restricts network paths, separates production and nonproduction environments according to data and risk, protects remote access with approved encryption and authentication, and reviews material network access rules at least annually.",
-      activity: "Manage boundaries, environment connections, firewall rules, wireless safeguards, and remote production access."
+      activity: "Document and verify customer and environment boundaries, approved network rules and deviations by source, wireless safeguards, and remote production access."
     },
-    summary: "Add risk-based production and nonproduction environment separation."
+    summary: "Prompt evidence for customer and environment boundaries and network-rule coverage."
   },
   {
     id: "control-change-management",
@@ -340,23 +357,32 @@ const CONTROL_UPDATES = [
       {
         activity: "Use continuous platform protection where supported and verify endpoint configuration, update, and compliance state on the risk-based schedule recorded in an Obligation when periodic work is needed.",
         requirementIds: ["requirement-soc2-cc6-6", "requirement-soc2-cc6-8", "requirement-soc2-cc7-1"]
+      },
+      {
+        activity: "Use continuous platform protection where supported and verify endpoint configuration, update, and compliance state on the approved risk-based schedule when periodic work is needed.",
+        requirementIds: ["requirement-soc2-cc6-6", "requirement-soc2-cc6-8", "requirement-soc2-cc7-1"]
       }
     ],
     next: {
-      activity: "Use continuous platform protection where supported and verify endpoint configuration, update, and compliance state on the approved risk-based schedule when periodic work is needed.",
+      activity: "Document protection coverage and approved deviations by device or platform class. Use continuous platform protection where supported and verify configuration, updates, and compliance on the approved risk-based schedule when periodic work is needed.",
       requirementIds: ["requirement-soc2-cc6-6", "requirement-soc2-cc6-8", "requirement-soc2-cc7-1"]
     },
-    summary: "Map endpoint malware protection to CC6.8 and keep implementation scheduling out of the Control description."
+    summary: "Prompt platform protection coverage, deviations, and verification without mandating one product."
   },
   {
     id: "control-vulnerability-management",
-    prior: [{
-      activity: "Choose scan coverage and cadence. Review the starter remediation targets of Critical 7 days, High 14 days, Medium 30 days, and Low 90 days, then record the approved targets or time-bound Exceptions."
-    }],
+    prior: [
+      {
+        activity: "Choose scan coverage and cadence. Review the starter remediation targets of Critical 7 days, High 14 days, Medium 30 days, and Low 90 days, then record the approved targets or time-bound Exceptions."
+      },
+      {
+        activity: "Choose scan coverage and cadence, define approved risk-based remediation targets, and document time-bound Exceptions when a target cannot be met."
+      }
+    ],
     next: {
-      activity: "Choose scan coverage and cadence, define approved risk-based remediation targets, and document time-bound Exceptions when a target cannot be met."
+      activity: "Define scan scope and cadence, severity criteria, risk-based remediation and patch targets, and time-bound Exceptions when a target cannot be met."
     },
-    summary: "Keep starter-selection instructions and unapproved remediation targets out of the Control description."
+    summary: "Prompt explicit scan scope, severity criteria, and approved remediation and patch targets."
   },
   {
     id: "control-logging-monitoring",
@@ -403,6 +429,16 @@ const CONTROL_UPDATES = [
       activity: "Assess service, data, access, assurance, recovery, incidents, dependencies, supplied Components, and applicable contract safeguards before access or material reliance."
     },
     summary: "Name the contract outcomes considered when a Vendor handles protected data or supports an important service."
+  },
+  {
+    id: "control-vendor-monitoring",
+    prior: [{
+      activity: "Review vendor performance, assurance, recovery, access, incidents, and contract obligations."
+    }],
+    next: {
+      activity: "Set review intervals by Vendor risk and customer-data access. Review performance, assurance, recovery, access, incidents, and contract obligations, and reassess after material change."
+    },
+    summary: "Prompt review intervals for every customer-data Vendor while keeping the interval risk-based."
   }
 ];
 
@@ -439,6 +475,16 @@ const OBLIGATION_UPDATES = [
   }
 ];
 
+const PRIOR_STARTER_RULE_RATIONALE = "Starter proposal derived from the linked Policy. Management must review the cadence, population, completion criteria, and timing before activation.";
+const OBLIGATION_RULE_RATIONALE_UPDATES = [
+  ["obligation-rule-quarterly-privileged-access-review-v1", "Cover privileged and production access. Add other customer-data access only when an approved commitment or risk decision requires quarterly review."],
+  ["obligation-rule-annual-access-review-v1", "Cover other important access, including customer-data paths not assigned to a shorter approved review schedule. Avoid counting the same access twice."],
+  ["obligation-rule-monthly-endpoint-protection-verification-v1", "Confirm device and platform classes, protection coverage, exceptions, evidence, and whether the monthly cadence fits the approved risk decision."],
+  ["obligation-rule-annual-network-access-review-v1", "Confirm the in-scope network and host rule sources, customer and environment boundaries, deviations, and review cadence."],
+  ["obligation-rule-quarterly-vulnerability-scan-v1", "Confirm scan scope, severity method, remediation and patch targets, and whether exposure or a customer commitment requires a shorter cadence, such as monthly."],
+  ["obligation-rule-annual-critical-vendor-review-v1", "Confirm the high and critical Vendor population, and set a separate review interval for other Vendors with customer-data access where needed."]
+].map(([id, guidance]) => ({ id, rationale: `${PRIOR_STARTER_RULE_RATIONALE} ${guidance}` }));
+
 const OBLIGATION_ADDITIONS = [
   {
     id: "obligation-annual-control-design-review",
@@ -760,6 +806,37 @@ async function buildPolicyLibraryPlan(loaded) {
     });
   }
 
+  for (const { id, rationale } of OBLIGATION_RULE_RATIONALE_UPDATES) {
+    const entry = byId.get(id);
+    const obligation = entry ? byId.get(entry.record.obligationId)?.record : null;
+    const displayPath = `data/obligation-rules/${id}.json`;
+    if (!entry || entry.record.type !== "obligation-rule" || !obligation || obligation.type !== "obligation") {
+      skipped.push(skippedItem(id, "missing", `The starter ${id} Obligation Rule is not present.`));
+      continue;
+    }
+    if (entry.record.rationale === rationale) {
+      skipped.push(skippedItem(id, "current", "The Obligation Rule already contains the current starter guidance."));
+      continue;
+    }
+    if (entry.record.status !== "proposed" || obligation.status !== "proposed") {
+      skipped.push(skippedItem(id, "operating", "Only proposed Obligations and Rules are eligible for starter-library guidance updates."));
+      continue;
+    }
+    if (entry.record.rationale !== PRIOR_STARTER_RULE_RATIONALE || !obligation.ruleIds?.includes(id)) {
+      skipped.push(skippedItem(id, "customized", "The Obligation Rule differs from a recognized prior starter, so FileGRC will not rewrite it."));
+      continue;
+    }
+    updates.push({ ...entry.record, rationale });
+    expectedRevisions[id] = entry.revision;
+    proposalChanges.push({
+      resourceType: "obligation-rule",
+      resourceId: id,
+      path: displayPath,
+      summary: "Add scope and cadence checks to the unchanged proposed starter rule.",
+      diff: replacementDiff(displayPath, [["rationale", entry.record.rationale, rationale]])
+    });
+  }
+
   for (const addition of modelSupports(loaded.model, "program-scope") ? OBLIGATION_ADDITIONS : []) {
     if (byId.has(addition.id)) {
       skipped.push(skippedItem(addition.id, "present", "An Obligation with this ID already exists, so FileGRC will not replace it."));

package/src/program-readiness.js

@@ -493,12 +493,17 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const requirementById = new Map(records
     .filter(({ type }) => type === "requirement")
     .map((record) => [record.id, record]));
-  const v4Decisions = new Map((workspace?.requirementApplicability || [])
+  const reviewedRequirements = (workspace?.requirementApplicability || [])
     .filter((decision) => (
       requirementById.has(decision.requirementId)
       && applicabilityReviewIsCurrent(decision, requirementById.get(decision.requirementId), workspace, records, model)
-    ))
-    .map((decision) => [decision.requirementId, decision.decision]));
+    ));
+  const v4Decisions = new Map(reviewedRequirements.map((decision) => [decision.requirementId, decision.decision]));
+  const staleRequirementIds = new Set((workspace?.requirementApplicability || [])
+    .filter((decision) => requirementById.has(decision.requirementId)
+      && ["applicable", "not-applicable"].includes(decision.decision)
+      && !v4Decisions.has(decision.requirementId))
+    .map(({ requirementId }) => requirementId));
   const applicableRequirements = records.filter((record) => (
     record.type === "requirement"
     && scope.frameworks.some((framework) => framework.id === record.frameworkId)
@@ -514,6 +519,8 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const selectedTrustServicesRequirements = scope.requirements.filter((requirement) => !isDescriptionRequirement(requirement));
   const unresolvedDescriptionRequirements = unresolvedRequirements.filter(isDescriptionRequirement);
   const unresolvedTrustServicesRequirements = unresolvedRequirements.filter((requirement) => !isDescriptionRequirement(requirement));
+  const staleRequirements = unresolvedRequirements.filter(({ id }) => staleRequirementIds.has(id));
+  const missingDecisionRequirements = unresolvedRequirements.filter(({ id }) => !staleRequirementIds.has(id));
   const uncoveredRequirements = scope.requirements.filter((requirement) => (
     !isDescriptionRequirement(requirement)
     && !scope.controls.some((control) => (control.requirementIds || []).includes(requirement.id))
@@ -541,6 +548,8 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const invalidMandatoryDecisions = mandatoryRequirements.filter((requirement) => (
     v4Decisions.get(requirement.id) !== "applicable"
   ));
+  const invalidMandatoryStaleCount = invalidMandatoryDecisions.filter(({ id }) => staleRequirementIds.has(id)).length;
+  const invalidMandatoryOtherCount = invalidMandatoryDecisions.length - invalidMandatoryStaleCount;
   const criteriaComplete = Boolean(
     scope.frameworks.length
     && scope.requirements.length
@@ -564,11 +573,13 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
             ...missingRequiredDescriptionReferences
           ].join(", ")}.`
         : invalidMandatoryDecisions.length
-          ? `Mark all 33 Security Common Criteria and all nine Description Criteria applicable for this SOC 2 Program. ${invalidMandatoryDecisions.length} required ${invalidMandatoryDecisions.length === 1 ? "decision is" : "decisions are"} missing, undetermined, or not applicable.`
-          : `Resolve the program criteria and Controls. ${unresolvedTrustServicesRequirements.length} Trust Services applicability decisions and ${unresolvedDescriptionRequirements.length} Description Criteria decisions remain undetermined, ${missingRequirements.length} applicable criteria are not selected, and ${uncoveredRequirements.length} selected applicable Trust Services criteria have no selected Control. Description Criteria govern the system description and do not map to Controls.`,
+          ? `Mark all 33 Security Common Criteria and all nine Description Criteria applicable for this SOC 2 Program. ${invalidMandatoryDecisions.length} required ${invalidMandatoryDecisions.length === 1 ? "decision needs" : "decisions need"} attention: ${invalidMandatoryStaleCount} prior reviews are stale and ${invalidMandatoryOtherCount} are missing, undetermined, or not applicable.`
+          : `Resolve the program criteria and Controls. ${missingDecisionRequirements.length} applicability decisions are missing or undetermined and ${staleRequirements.length} prior reviews are stale. ${unresolvedTrustServicesRequirements.length} Trust Services criteria and ${unresolvedDescriptionRequirements.length} Description Criteria need current decisions, ${missingRequirements.length} applicable criteria are not selected, and ${uncoveredRequirements.length} selected applicable Trust Services criteria have no selected Control. Description Criteria govern the system description and do not map to Controls.`,
     workspace || { type: "workspace" },
     {
       unresolvedRequirementIds: unresolvedRequirements.map(({ id }) => id),
+      staleRequirementIds: staleRequirements.map(({ id }) => id),
+      missingDecisionRequirementIds: missingDecisionRequirements.map(({ id }) => id),
       missingRequirementIds: missingRequirements.map(({ id }) => id),
       uncoveredRequirementIds: uncoveredRequirements.map(({ id }) => id),
       invalidMandatoryRequirementIds: invalidMandatoryDecisions.map(({ id }) => id),

package/src/state.js

@@ -17,6 +17,7 @@ import { measureTiming } from "./timing.js";
 import { soc2RequirementApplicabilityConstraint } from "./soc2.js";
 import { modelSupports } from "../model/index.js";
 import { calculateRevision } from "./revisions.js";
+import { applicabilityReviewIsCurrent } from "./applicability-scope.js";
 
 const renderedMarkdownCache = new Map();
 const MAX_RENDERED_MARKDOWN_CACHE_ENTRIES = 1_000;
@@ -87,6 +88,7 @@ export async function createAppBootstrap(input = process.cwd(), options = {}) {
     obligations: { loading: true, items: [], triggers: [], counts: {} },
     collectionReviews: {},
     applicabilityConstraints: {},
+    applicabilityReviewStatuses: {},
     programReadiness: null,
     auditPreparations: {},
     workflow: { loading: true, findings: [], workItems: [], assessments: {} },
@@ -156,7 +158,8 @@ export async function createAppStateSection(input, section, options = {}) {
       applicabilityConstraints: Object.fromEntries(loaded.resources.flatMap((record) => {
         const constraint = soc2RequirementApplicabilityConstraint(record, activeProgram, loaded.model.modelVersion);
         return constraint ? [[record.id, constraint]] : [];
-      }))
+      })),
+      applicabilityReviewStatuses: assessApplicabilityReviewStatuses(loaded, activeProgram)
     };
   }
   if (section === "obligations") {
@@ -330,6 +333,7 @@ async function createAppStateUnlocked(input, options) {
     reconciliation,
     collectionReviews,
     applicabilityConstraints,
+    applicabilityReviewStatuses: assessApplicabilityReviewStatuses(loaded, activeProgram),
     programReadiness,
     auditPreparations,
     workflow,
@@ -337,6 +341,21 @@ async function createAppStateUnlocked(input, options) {
   };
 }
 
+function assessApplicabilityReviewStatuses(loaded, program) {
+  const decisions = new Map((program.requirementApplicability || []).map((review) => [review.requirementId, review]));
+  return Object.fromEntries(loaded.resources
+    .filter(({ type }) => ["requirement", "control", "commitment", "complementary-control"].includes(type))
+    .map((record) => {
+      const review = record.type === "requirement" && modelSupports(loaded.model, "program-scope")
+        ? decisions.get(record.id)
+        : record.applicabilityReview;
+      return [record.id, !review || !["applicable", "not-applicable", "externally-managed", "zero-population"].includes(review.decision)
+        ? "missing" : applicabilityReviewIsCurrent(
+        review, record, program, loaded.resources, loaded.model
+      ) ? "current" : "stale"];
+    }));
+}
+
 function serializeCollectionReviewAssessment(assessment) {
   return {
     resourceType: assessment.resourceType,

package/src/web.js

@@ -247,7 +247,8 @@ function normalizeAppState(next) {
 function blockingStateSections(route) {
   if (route.name === "home") return ["program", "obligations", "workflow"];
   if (route.name === "repository") return ["repository"];
-  if (route.name === "list" && route.type === "control") return ["program"];
+  if (route.name === "list" && ["requirement", "control", "commitment", "complementary-control"].includes(route.type)) return ["program"];
+  if (route.name === "detail" && ["program", "requirement", "control", "commitment", "complementary-control"].includes(route.type)) return ["program"];
   if (route.name === "list" && route.type === "obligation") return ["obligations"];
   if (route.name === "obligations" || route.name === "stage" && route.stageId === "run") return ["program", "obligations"];
   if (route.name === "audit-packet") return ["repository", "program", "obligations", "audits"];
@@ -416,12 +417,6 @@ function activeProgram() {
     || state.workspace;
 }
 
-function reviewedRequirementIds() {
-  return new Set((activeProgram().requirementApplicability || [])
-    .filter(({ decision }) => ["applicable", "not-applicable"].includes(decision))
-    .map(({ requirementId }) => requirementId));
-}
-
 function renderSidebarUtility(utility, route, direct = false) {
   const directClass = direct ? "nav-direct " : "";
   if (utility === "obligation-board") return "";
@@ -2778,24 +2773,28 @@ function openNextAuditCycleDialog(prior) {
 }
 
 function controlApplicabilityPending(record) {
+  if (state.applicabilityReviewStatuses?.[record.id]) {
+    return state.applicabilityReviewStatuses[record.id] !== "current";
+  }
   if (!record.applicabilityReview) return true;
   const item = state.programReadiness?.stages?.find(({ id }) => id === "controls")?.items
     .find(({ resourceType, resourceId }) => resourceType === "control" && resourceId === record.id);
   return item?.checks?.applicability === false;
 }
 
+function applicabilityPending(record) {
+  if (state.applicabilityReviewStatuses?.[record.id]) {
+    return state.applicabilityReviewStatuses[record.id] !== "current";
+  }
+  return record.type === "control" ? controlApplicabilityPending(record)
+    : !record.applicabilityReview || record.type === "requirement" && record.applicability === "undetermined";
+}
+
 function openApplicabilityReviewDialog(type, entries) {
   const definition = state.model.resources[type];
   const reviewPoints = definition?.guidance?.reviewPoints || [];
   const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
-  const reviewedRequirements = reviewedRequirementIds();
-  const pending = entries.filter(({ record }) => (
-    type === "requirement" && modelSupports("program-scope")
-      ? !reviewedRequirements.has(record.id)
-      : type === "control"
-        ? controlApplicabilityPending(record)
-        : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
-  ));
+  const pending = entries.filter(({ record }) => applicabilityPending(record));
   const dialog = document.createElement("dialog");
   dialog.className = "commit-dialog applicability-dialog";
   dialog.setAttribute("aria-labelledby", "applicability-dialog-title");
@@ -2805,10 +2804,19 @@ function openApplicabilityReviewDialog(type, entries) {
     const decisions = constraint?.allowedDecisions || (type === "requirement"
       ? ["applicable", "not-applicable"]
       : ["applicable", "not-applicable", "externally-managed", "zero-population"]);
-    const selected = constraint?.requiredDecision || "";
+    const prior = type === "requirement" && modelSupports("program-scope")
+      ? (activeProgram().requirementApplicability || []).find(({ requirementId }) => requirementId === entry.record.id)
+      : entry.record.applicabilityReview;
+    const selected = constraint?.requiredDecision || (state.applicabilityReviewStatuses?.[entry.record.id] === "stale" ? prior?.decision : "") || "";
+    const rationale = constraint?.requiredDecision && constraint.requiredDecision !== prior?.decision
+      ? constraint.defaultRationale || ""
+      : state.applicabilityReviewStatuses?.[entry.record.id] === "stale"
+        ? prior?.rationale || constraint?.defaultRationale || ""
+        : constraint?.defaultRationale || "";
     const options = decisions.map((decision) => '<option value="' + esc(decision) + '" ' + (decision === selected ? "selected" : "") + '>' + esc(properCase(decision)) + '</option>').join("");
     const note = constraint ? '<small class="applicability-constraint">' + esc(constraint.message) + '</small>' : "";
-    return '<div class="applicability-row" data-review-id="' + esc(entry.record.id) + '"><div><strong>' + esc(entry.record.title) + '</strong><small>' + esc(entry.record.code || entry.record.id) + '</small>' + note + '</div><select name="decision"><option value="">Review later</option>' + options + '</select><input name="rationale" value="' + esc(constraint?.defaultRationale || "") + '" placeholder="Decision rationale"></div>';
+    const stale = state.applicabilityReviewStatuses?.[entry.record.id] === "stale";
+    return '<div class="applicability-row" data-review-id="' + esc(entry.record.id) + '"><div><strong>' + esc(entry.record.title) + '</strong><small>' + esc(entry.record.code || entry.record.id) + (stale ? '<small>Prior review is stale. Confirm this decision against the current scope.</small>' : '') + note + '</div><select name="decision"><option value="">Review later</option>' + options + '</select><input name="rationale" value="' + esc(rationale) + '" placeholder="Decision rationale"></div>';
   }).join("");
   const reviewChecks = reviewPoints.length
     ? '<section class="collection-review-checks"><strong>Before deciding</strong><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section>'
@@ -2816,7 +2824,7 @@ function openApplicabilityReviewDialog(type, entries) {
   const baselineNote = constrainedCount
     ? '<p class="applicability-baseline-note"><strong>' + constrainedCount + ' required baseline ' + pluralize("criterion", constrainedCount) + '.</strong> FileGRC has prefilled the only decision compatible with the selected SOC 2 Security goal and a review rationale. Leave an item at Review later only when management is not ready to record it.</p>'
     : '<p>Record only decisions reviewed against the current service scope. Leave an item at Review later when management has not decided it.</p>';
-  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Batch review</p><h2 id="applicability-dialog-title">Review ' + esc(definition.pluralTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div>' + baselineNote + reviewChecks + '<div class="form-grid review-context"><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label></div><div class="applicability-rows">' + (rows || empty("Every record already has a reviewed applicability decision.")) + '</div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status review-save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-review ' + (pending.length ? "" : "disabled") + '>Preview decisions</button></div></form>';
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Batch review</p><h2 id="applicability-dialog-title">' + (pending.some(({ record }) => state.applicabilityReviewStatuses?.[record.id] === "stale") ? 'Reconfirm' : 'Review') + ' ' + esc(definition.pluralTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div>' + baselineNote + reviewChecks + '<div class="form-grid review-context"><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label></div><div class="applicability-rows">' + (rows || empty("Every record already has a reviewed applicability decision.")) + '</div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status review-save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-review ' + (pending.length ? "" : "disabled") + '>Preview decisions</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
   const form = dialog.querySelector("form");
@@ -3139,18 +3147,12 @@ function renderList(main, type, params = new URLSearchParams()) {
     return { name, label: field.label || humanize(name), values };
   }).filter(({ values }) => values.length > 1);
   const createButton = !state.readOnly && !definition.singleton && !collectionNeedsFirstRecord(type) && resourceCreationAllowed(type) ? '<button class="button primary" id="new-resource">New ' + esc(definition.title.toLowerCase()) + '</button>' : "";
-  const reviewedRequirements = reviewedRequirementIds();
-  const hasPendingApplicability = entries.some(({ record }) => (
-    type === "requirement" && modelSupports("program-scope")
-      ? !reviewedRequirements.has(record.id)
-      : type === "control"
-        ? controlApplicabilityPending(record)
-        : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
-  ));
+  const hasPendingApplicability = entries.some(({ record }) => applicabilityPending(record));
+  const hasStaleApplicability = entries.some(({ record }) => state.applicabilityReviewStatuses?.[record.id] === "stale");
   const applicabilityButton = !state.readOnly
     && ["requirement", "control", "commitment", "complementary-control"].includes(type)
     && hasPendingApplicability
-    ? '<button class="button" id="review-applicability">Review applicability</button>'
+    ? '<button class="button" id="review-applicability">' + (hasStaleApplicability ? 'Reconfirm applicability' : 'Review applicability') + '</button>'
     : "";
   const guideTrigger = '<button class="guide-trigger" id="resource-guide-trigger" type="button" aria-label="About ' + esc(definition.pluralTitle) + '" aria-haspopup="dialog" aria-controls="resource-guide" aria-expanded="false"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button>';
   const listTools = '<div class="list-tools list-header-tools"><label><span class="sr-only">Filter list</span><input id="list-search" type="search" placeholder="Filter ' + esc(definition.pluralTitle.toLowerCase()) + '"></label>' +
@@ -3299,6 +3301,9 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     && !fields[name]?.content
     && !narrativeNames.has(name)
   ));
+  if (type === "program" && !Object.hasOwn(entry.record, "requirementApplicability")) {
+    visible.push(["requirementApplicability", []]);
+  }
   const content = Object.entries(entry.content);
   const narrativeContent = narrative.length
     ? '<div class="content-label"><span>Record</span></div><div class="record-prose">' + narrative.map(([name, value]) => '<section><h3>' + esc(titleCase(fields[name]?.label || humanize(name))) + '</h3><p>' + esc(value) + '</p></section>').join("") + '</div>'
@@ -3353,7 +3358,7 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     : "";
   const attachmentPanel = type === "evidence" ? evidenceAttachmentPanel(entry) : "";
   const recordFieldsPanel = visible.length
-    ? '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>'
+    ? '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type, false, entry.record) + '</dd></div>').join("") + '</dl></section>'
     : "";
   const supportPanels = renderDetailSupport({
     hasRecordBody,
@@ -3362,9 +3367,17 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     attachmentPanel
   });
   const mayDelete = !state.readOnly && !routeSetLocked && !definition.singleton;
+  const applicabilityStatus = state.applicabilityReviewStatuses?.[entry.record.id];
+  const applicabilityAction = !state.readOnly && ["requirement", "control", "commitment", "complementary-control"].includes(type)
+    && ["stale", "missing"].includes(applicabilityStatus)
+    ? '<a class="button" href="#/resources/' + encodeURIComponent(type) + '?review=1">' + (applicabilityStatus === "stale" ? "Reconfirm" : "Review") + ' applicability</a>'
+    : "";
   const recordMenu = '<details class="record-overflow"><summary aria-label="More record actions" title="More record actions"><svg viewBox="0 0 18 4" aria-hidden="true"><circle cx="2" cy="2" r="2"></circle><circle cx="9" cy="2" r="2"></circle><circle cx="16" cy="2" r="2"></circle></svg></summary><div class="record-overflow-menu" aria-label="Record actions"><button type="button" data-record-modal="info">Record info</button><button type="button" data-record-modal="connections">Connections</button><button type="button" data-record-modal="history"' + (entry.historyLoaded === false ? ' disabled' : '') + '>File history' + (entry.historyLoaded === false ? ' (loading)' : '') + '</button>' + (mayDelete ? '<div class="record-overflow-separator"></div><button class="danger-text" type="button" data-delete-resource>Delete record</button>' : '') + '</div></details>';
-  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + (type === "control" ? " detail-control" : "") + '">' + detailMain + supportPanels + '</div></div>';
+  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + applicabilityAction + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + (type === "control" ? " detail-control" : "") + '">' + detailMain + supportPanels + '</div></div>';
   main.querySelectorAll("[data-completion-requirements]").forEach((button) => button.addEventListener("click", () => openCompletionRequirementsDialog(button.dataset.completionRequirements)));
+  main.querySelector("[data-select-program-for-review]")?.addEventListener("click", () => {
+    selectProgram(entry.record.id, "#/resources/requirement?review=1");
+  });
   main.querySelector("#edit-resource")?.addEventListener("click", () => openEditor(type, entry));
   main.querySelectorAll("[data-record-modal]").forEach((button) => button.addEventListener("click", () => {
     button.closest("details")?.removeAttribute("open");
@@ -5770,17 +5783,21 @@ function openContentEditor(entry, name) {
   });
 }
 
+async function selectProgram(programId, destination = null) {
+  const selectionGeneration = ++programSelectionGeneration;
+  const response = await fetch("/api/state/bootstrap?programId=" + encodeURIComponent(programId));
+  if (!response.ok) throw new Error(await responseMessage(response));
+  if (selectionGeneration !== programSelectionGeneration) return;
+  state = normalizeAppState(await response.json());
+  stateSectionRequests.clear();
+  if (destination) history.replaceState(null, "", destination);
+  render();
+  loadStateForRoute();
+}
+
 function bindCommon() {
-  root.querySelector("[data-program-select]")?.addEventListener("change", async (event) => {
-    const programId = event.currentTarget.value;
-    const selectionGeneration = ++programSelectionGeneration;
-    const response = await fetch("/api/state/bootstrap?programId=" + encodeURIComponent(programId));
-    if (!response.ok) throw new Error(await responseMessage(response));
-    if (selectionGeneration !== programSelectionGeneration) return;
-    state = normalizeAppState(await response.json());
-    stateSectionRequests.clear();
-    render();
-    loadStateForRoute();
+  root.querySelector("[data-program-select]")?.addEventListener("change", (event) => {
+    selectProgram(event.currentTarget.value);
   });
   root.querySelectorAll(".nav-toggle, .nav-subgroup-toggle").forEach((button) => button.addEventListener("click", () => {
     const group = button.closest(".nav-group");
@@ -6070,14 +6087,22 @@ function conditionMatchesValues(condition, valueFor) {
 function conditionValueMatches(actual, expected) {
   return Array.isArray(expected) ? expected.includes(actual) : actual === expected;
 }
-function formatValue(value, field, type, compact = false) {
+function formatValue(value, field, type, compact = false, record = null) {
   if (value === undefined || value === null || value === "") return '<span class="muted">Not set</span>';
   const definition = fieldDefinition(type, field);
   if (type === "program" && field === "requirementApplicability" && Array.isArray(value)) {
-    const reviewed = value.filter(({ decision }) => ["applicable", "not-applicable"].includes(decision)).length;
-    const pending = value.length - reviewed;
-    const label = reviewed + " reviewed" + (pending ? " · " + pending + " to review" : "");
-    return '<a class="tag relation" href="#/resources/requirement' + (pending ? "?review=1" : "") + '">' + esc(label) + '</a>';
+    if (record && record.id !== state.selectedProgramId) {
+      return '<button class="button" type="button" data-select-program-for-review="' + esc(record.id) + '">Select this Program to review applicability</button>';
+    }
+    const frameworkIds = new Set(record?.frameworkIds || activeProgram().frameworkIds || []);
+    const requirementIds = state.resources.filter(({ record: candidate }) => (
+      candidate.type === "requirement" && frameworkIds.has(candidate.frameworkId)
+    )).map(({ record: candidate }) => candidate.id);
+    const reviewed = requirementIds.filter((id) => state.applicabilityReviewStatuses?.[id] === "current").length;
+    const stale = requirementIds.filter((id) => state.applicabilityReviewStatuses?.[id] === "stale").length;
+    const pending = requirementIds.length - reviewed - stale;
+    const label = reviewed + " reviewed" + (stale ? " · " + stale + " stale" : "") + (pending ? " · " + pending + " to review" : "");
+    return '<a class="tag relation" href="#/resources/requirement' + (stale || pending ? "?review=1" : "") + '">' + esc(label) + '</a>';
   }
   if (definition?.type === "date") return esc(formatCalendarDate(value));
   if (definition?.type === "timestamp") return esc(formatLocalDateTime(value));