filegrc 0.9.0 → 0.9.2

package/model/v6.json

@@ -1128,7 +1128,7 @@
       "pluralTitle": "Systems",
       "group": "systems-vendors",
       "collection": "systems",
-      "description": "The complete bounded system being governed or examined, including its services, boundary, information, Components, Controls, dependencies, and continuity objectives.",
+      "description": "The complete bounded system being governed or examined, including its services, boundary, information, Components, Controls, dependencies, and any applicable continuity objectives.",
       "guidance": {
         "policyBasis": "A SOC 2 program starts with the bounded System and the service commitments and system requirements the company has chosen to meet.",
         "cadence": "Define before selecting Components and Controls. Review after material service, boundary, architecture, information, continuity, or audit-scope changes.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/collection-revision.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
+  authoritativeSourceRevisionValue,
   collectionRevisionInputs,
   collectionScopeRevisionFacts
 } from "./collection-scope.js";
@@ -16,15 +17,19 @@ export function collectionRevision(loaded, resourceType, options = {}) {
     .map((input) => [input.record.id, input]));
   const authoritativeSource = loaded.resources.find(({ id }) => id === options.authoritativeSourceId);
   if (authoritativeSource) {
-    inputs.set(authoritativeSource.id, { record: authoritativeSource, value: authoritativeSource });
+    inputs.set(authoritativeSource.id, {
+      record: authoritativeSource,
+      value: authoritativeSourceRevisionValue(authoritativeSource),
+      includeContent: true
+    });
   }
   const records = [...inputs.values()]
-    .map(({ record, value }) => ({
+    .map(({ record, value, includeContent }) => ({
       id: record.id,
       revision: createHash("sha256")
         .update(JSON.stringify(canonicalRecordValue(loaded.model, record.type, value)))
         .digest("hex"),
-      contentRevisions: markdownEntries(loaded.model, record).flatMap(({ path }) => {
+      contentRevisions: (includeContent ? markdownEntries(loaded.model, record) : []).flatMap(({ path }) => {
         try {
           const content = readFileSync(resolveDataPath(loaded.root, path), "utf8");
           return [{ path, revision: createHash("sha256").update(content).digest("hex") }];

package/src/collection-scope.js

@@ -39,7 +39,7 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
 export function collectionRevisionInputs(loaded, resourceType, program) {
   const reviewed = scopedCollectionRecords(loaded, resourceType, program);
   if (!modelSupports(loaded.model, "program-scope")) {
-    return reviewed.map((record) => ({ record, value: record }));
+    return reviewed.map((record) => ({ record, value: record, includeContent: true }));
   }
   const byId = new Map(loaded.resources.map((record) => [record.id, record]));
   const records = new Map(reviewed.map((record) => [record.id, record]));
@@ -90,7 +90,9 @@ export function collectionRevisionInputs(loaded, resourceType, program) {
     record,
     value: reviewedIds.has(record.id)
       ? record
-      : dependencyRevisionValue(resourceType, record)
+      : dependencyRevisionValue(resourceType, record),
+    includeContent: reviewedIds.has(record.id)
+      || dependencyContentAffectsRevision(resourceType, record.type)
   }));
 }
 
@@ -138,9 +140,20 @@ export function collectionScopeRevisionFacts(loaded, resourceType, program) {
   return common;
 }
 
+export function authoritativeSourceRevisionValue(record) {
+  return Object.fromEntries(Object.entries(record).filter(([field]) => (
+    !authoritativeSourceBookkeepingFields.has(field)
+  )));
+}
+
+const authoritativeSourceBookkeepingFields = new Set([
+  "tags",
+  "statusTransition"
+]);
+
 const dependencyFields = {
   framework: {
-    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "informationTypeIds", "classificationId", "internetExposed"],
+    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
     requirement: ["id", "type", "title", "frameworkId", "reference", "description", "parentRequirementId"]
   },
   vendor: {
@@ -154,22 +167,29 @@ const dependencyFields = {
   },
   component: {
     system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
-    control: ["id", "type", "status", "statement", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "componentIds", "evidenceSourceComponentIds"],
-    vendor: ["id", "type", "status", "category", "criticality", "description", "standardAgreement", "agreementDocumentId", "startDate", "endDate", "classificationId", "informationTypeIds"],
+    control: ["id", "type", "status", "systemIds", "componentIds", "evidenceSourceComponentIds"],
+    vendor: ["id", "type", "status", "category", "criticality", "description", "startDate", "endDate"],
     classification: ["id", "type", "status", "rank", "description", "handlingRequirements"],
     "information-type": ["id", "type", "status", "classificationId", "description"]
   },
   "complementary-control": {
-    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "informationTypeIds", "classificationId", "internetExposed"],
-    control: ["id", "type", "status", "statement", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "componentIds", "evidenceSourceComponentIds"],
+    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
+    control: ["id", "type", "status", "statement", "activity", "systemIds", "componentIds", "evidenceSourceComponentIds"],
     vendor: ["id", "type", "status", "category", "criticality", "description", "standardAgreement", "agreementDocumentId", "startDate", "endDate", "classificationId", "informationTypeIds"],
     requirement: ["id", "type", "title", "frameworkId", "reference", "description", "parentRequirementId"],
     commitment: ["id", "type", "status", "commitmentKind", "statement", "systemIds", "requirementIds", "controlIds", "customerFacing", "effectiveOn"],
     document: ["id", "type", "status", "documentKind", "version", "effectiveOn", "approvedOn", "approvedContentRevisions", "systemIds", "controlIds", "componentIds", "classificationId"],
-    component: ["id", "type", "status", "componentKind", "description", "vendorId", "systemUses", "informationUses", "internetExposed"]
+    component: ["id", "type", "status", "componentKind", "description", "criticality", "vendorId", "systemUses", "informationUses", "internetExposed", "classificationId", "continuityObjectives"]
   }
 };
 
+const dependencyContentTypes = {
+  framework: new Set(["system"]),
+  vendor: new Set(["document"]),
+  component: new Set(["system"]),
+  "complementary-control": new Set(["system", "control", "document", "component"])
+};
+
 function dependencyRevisionValue(resourceType, record) {
   const fields = dependencyFields[resourceType]?.[record.type];
   if (!fields) return { id: record.id, type: record.type };
@@ -178,6 +198,10 @@ function dependencyRevisionValue(resourceType, record) {
     .map((field) => [field, record[field]]));
 }
 
+function dependencyContentAffectsRevision(resourceType, dependencyType) {
+  return dependencyContentTypes[resourceType]?.has(dependencyType) || false;
+}
+
 function sorted(values) {
   return [...(values || [])].sort();
 }

package/src/policy-library/information-security-policy-v2.md

@@ -242,13 +242,13 @@ Reported events receive an owner, assessment, and documented resolution or escal
 
 ## Business Continuity and Disaster Recovery Policy
 
-Each important System records approved recovery priorities and objectives, dependencies, responsible people, alternate communication and access needs, and a backup or alternate recovery approach. Management selects continuity strategies according to service commitments, business impact, data risk, dependencies, and technical capability.
+Each important System records recovery priorities, dependencies, responsible people, alternate communication and access needs, and a backup or alternate recovery approach suited to its commitments, business impact, data risk, dependencies, and technical capability. Numeric recovery targets are required only when an approved customer commitment, included Availability criterion, or management risk decision calls for them.
 
 The Security Incident and Recovery Plan records activation, communication, response, recovery, and return-to-normal responsibilities. Management tests continuity and disaster recovery on the approved schedule, records results and findings, and tracks follow-up work.
 
 ## Backup and Restoration Policy
 
-Important Systems use backups or an approved alternate recovery approach that meets their recovery objectives. Management documents backup or alternate-recovery scope, frequency, retention, encryption and access needs, monitoring, failure response, procedures, and test schedules.
+Important Systems use backups or an approved alternate recovery approach suited to their recovery needs and any approved recovery targets. Management documents backup or alternate-recovery scope, frequency, retention, encryption and access needs, monitoring, failure response, procedures, and test schedules.
 
 Backup or recovery access is limited to authorized people and protected from the failures it is intended to address. Restoration or alternate recovery is validated on the approved schedule and after material change when prior results no longer represent the System. Policy adoption does not assert that every System uses daily backups or a fixed retention period.
 

package/src/policy-library.js

@@ -6,7 +6,7 @@ import { serializeWorkspaceMutation } from "./mutation.js";
 import { resolveDataPath } from "./paths.js";
 import { loadWorkspace } from "./workspace.js";
 
-export const INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID = "consolidated-information-security-policy-v3";
+export const INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID = "consolidated-information-security-policy-v4";
 export const STRONG_AUTHENTICATION_LIBRARY_PROPOSAL_ID = INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID;
 
 const POLICY_ID = "policy-information-security";
@@ -42,28 +42,33 @@ const DOCUMENT_CONTENT_UPDATES = [
     id: "document-data-retention-schedule",
     path: "documents/document-data-retention-schedule.md",
     priorRevision: "45a408e8139bd57f42dda5ca5ae5c8cd4480b4e7bf08834f60058148a3a63475",
-    currentRevision: "d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90",
+    additionalPriorRevisions: new Set(["d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90"]),
+    currentRevision: "dd11857ae7d881f176bd93947ef3031c33c75ee41e3c0435198fd60c67a94cf7",
     replacements: [
       ["FileGRC detects the bracketed prompts as approval blockers. Remove each prompt only after replacing it with a reviewed fact.", "Remove each bracketed prompt only after replacing it with a reviewed fact."],
-      ["Record the authority, scope, owner, start date, and release decision outside this public template.", "Record the authority, scope, owner, start date, and release decision in controlled legal-hold records."]
+      ["Record the authority, scope, owner, start date, and release decision outside this public template.", "Record the authority, scope, owner, start date, and release decision in controlled legal-hold records."],
+      ["| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery objectives] | [Complete before approval: expiration or disposal action] | [Complete before approval: continuity objective or risk decision] |", "| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery needs] | [Complete before approval: expiration or disposal action] | [Complete before approval: recovery need, commitment, or risk decision] |"]
     ],
-    summary: "Keep FileGRC prompt handling in document guidance and make the Retention Schedule standalone."
+    summary: "Keep FileGRC prompt handling in document guidance, make the Retention Schedule standalone, and avoid assuming numeric recovery objectives."
   },
   {
     id: "document-security-incident-recovery-plan",
     path: "documents/document-security-incident-recovery-plan.md",
     priorRevision: "339ff564fa0ec26503c2498e8d3c44529957113cf782aa03ddb5b4e64c8f0404",
-    currentRevision: "51a19e22f3e0b31196371676297bfa843f96295d2f6c72e81a969ce7bafc36ae",
+    additionalPriorRevisions: new Set(["51a19e22f3e0b31196371676297bfa843f96295d2f6c72e81a969ce7bafc36ae"]),
+    currentRevision: "558b6fa71eaabf4ea3cfe77eaa24f827ad66a19a059085b2090e3c4a4d79cb50",
     replacements: [
       ["Controls, Components, Systems, Obligations, and Evidence hold the actual technical configuration and proof of operation.", "Supporting procedures, system records, and retained evidence document the actual technical configuration and operation."],
       ["If an incident raises a legal, privacy, or insurance question, the incident lead gets suitable advice at that time. FileGRC does not require pre-arranged counsel, in-house counsel, or a standing legal retainer.", "If an incident raises a legal, privacy, or insurance question, the incident lead obtains suitable advice at that time. A pre-arranged counsel relationship or standing legal retainer is required only when management determines that the organization's obligations and risk warrant one."],
       ["[Complete before activation: Link every important System and record its approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments in the System record.]", "[Complete before activation: Document every important System's approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments.]"],
+      ["[Complete before activation: Document every important System's approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments.]", "[Complete before activation: Identify every important System's recovery priority, dependencies, owner, backup or alternate recovery approach, and critical customer commitments. Record numeric recovery targets only when an approved commitment, included Availability criterion, or risk decision requires them.]"],
       ["For each important System, the applicable Control, Component, System, and Obligation records must identify:", "Supporting recovery documentation for each important System must identify:"],
       ["- Restore-validation method and governed schedule", "- Restore-validation method and approved schedule"],
+      ["- Dependencies, fallback paths, and validation steps", "- Dependencies, fallback paths, and validation steps\n- Any recovery targets required by an approved commitment, included Availability criterion, or risk decision"],
       ["[Confirm or replace before activation: The starter proposal for important production data is a daily backup, 30-day retention period, and annual restore validation. Record the approved choice for every important System in its Control, Component, System, Retention Schedule, and Obligation records.]", "[Confirm or replace before activation: The proposed starting point for important production data is a daily backup, 30-day retention period, and annual restore validation. Document the approved choice for every important System in its recovery procedures and the Data Retention Schedule.]"],
       ["on the approved governed schedule", "on the approved schedule"]
     ],
-    summary: "Express incident and recovery requirements as a standalone plan and keep FileGRC record-entry guidance outside it."
+    summary: "Express incident and recovery requirements as a standalone plan, keep FileGRC record-entry guidance outside it, and make numeric recovery targets conditional."
   },
   {
     id: "document-soc2-management-representation",
@@ -108,7 +113,8 @@ const PRIOR_STARTER_POLICY_REVISIONS = new Set([
   "18f5e7b7e417b494a5cd241751269b3aafeb3ad9129002308c84c1c84419ee31",
   "432ba5797c2d23e02a6b09d07f1a33db29337b4bcb3ee7d68ce8495dc7c7c01c",
   "6775e6907c2a094c5f48090b12af14cb78b20d1e45178cbb5d3bf02cabde59c6",
-  "992ef090273ae9bd25e729fe4a7a20817926f345cf7a01f242b877f319c4e342"
+  "992ef090273ae9bd25e729fe4a7a20817926f345cf7a01f242b877f319c4e342",
+  "355cad2754691f7a11ec10ae6ef0a6abeab6c428c51b49d32dfa3c12a2262e96"
 ]);
 
 const CONTROL_UPDATES = [
@@ -325,6 +331,28 @@ const CONTROL_UPDATES = [
     },
     summary: "Add conditional service-health and capacity monitoring without prescribing a monitoring product."
   },
+  {
+    id: "control-backup-restoration",
+    prior: [{
+      statement: "Each important System has backup scope, frequency, retention, monitoring, and restore validation that meet its approved recovery objectives, or a documented alternate recovery approach when backups are not the chosen safeguard.",
+      activity: "Record System recovery objectives and backup or alternate recovery procedures, monitor the chosen safeguards, and validate recovery on the approved schedule."
+    }],
+    next: {
+      statement: "Each important System has risk-based backup or alternate recovery scope, frequency, retention, monitoring, and restore validation suited to its recovery needs and any approved recovery targets.",
+      activity: "Record backup or alternate recovery procedures, monitor the chosen safeguards, and validate recovery on the approved schedule."
+    },
+    summary: "Keep backup and recovery risk-based without requiring numeric recovery targets for Security-only scope."
+  },
+  {
+    id: "control-continuity-exercise",
+    prior: [{
+      activity: "Maintain the plan, contacts, recovery objectives, exercises, results, and follow-up work."
+    }],
+    next: {
+      activity: "Maintain the plan, contacts, recovery priorities, exercises, results, and follow-up work."
+    },
+    summary: "Keep continuity exercises focused on recovery priorities without assuming numeric recovery targets."
+  },
   {
     id: "control-vendor-due-diligence",
     prior: [{
@@ -566,7 +594,8 @@ async function buildPolicyLibraryPlan(loaded) {
       skipped.push(skippedItem(documentUpdate.id, "current", "The governed Document already contains the current standalone starter language."));
       continue;
     }
-    if (sourceRevision !== documentUpdate.priorRevision) {
+    if (sourceRevision !== documentUpdate.priorRevision
+      && !documentUpdate.additionalPriorRevisions?.has(sourceRevision)) {
       skipped.push(skippedItem(documentUpdate.id, "customized", "The governed Document differs from the recognized prior starter, so FileGRC will not rewrite it."));
       continue;
     }

package/src/program-path.js

@@ -3,7 +3,7 @@ export const RESOURCE_INSTRUCTIONS = {
   person: "Record each person’s actual organizational job title. Keep named program authority, such as CISO, DPO, Policy Owner, or team chair, in dated Appointment records.",
   appointment: "Record one person’s dated appointment to a named organizational or program responsibility. Scope it to the workspace, a team, or the records governed by that appointment.",
   team: "Review the starter Security and Risk Oversight team, including its members and chair. Membership and chairs are authoritative on the Team record.",
-  system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and continuity objectives.",
+  system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and any applicable continuity objectives.",
   component: "Add a Component only when it materially delivers a selected System, supports a Control, produces authoritative Evidence, or supports relevant operations. Give every System use a role and rationale.",
   vendor: "Catalog material external provider relationships. Link a supplied Component when it meets the Component inclusion rules, but do not mirror every Vendor into a Component.",
   classification: "Define an ordered information-handling category used by inventory and Evidence Artifacts.",

package/src/program-readiness.js

@@ -632,6 +632,8 @@ async function policiesStage(scope, records, byId, readMarkdown, model) {
     const source = await readMarkdown(document);
     const placeholderCount = openPlaceholderCount(source);
     const isSecurityIncidentRecoveryPlan = document.id === "document-security-incident-recovery-plan";
+    const systemContinuityObjectivesRequired = isSecurityIncidentRecoveryPlan
+      && scope.requirements.some(isAvailabilityRequirement);
     const systemsWithCompleteContinuityObjectives = scope.systems.filter(({ continuityObjectives }) => (
       Number.isInteger(continuityObjectives?.recoveryTimeHours)
       && Number.isInteger(continuityObjectives?.recoveryPointHours)
@@ -646,7 +648,10 @@ async function policiesStage(scope, records, byId, readMarkdown, model) {
       linkedControls: (document.controlIds || []).some((id) => scope.controls.some((control) => control.id === id)),
       contentComplete: substantiveMarkdown(source) && placeholderCount === 0,
       ...(isSecurityIncidentRecoveryPlan
-        ? { systemContinuityObjectives: systemsWithCompleteContinuityObjectives.length === scope.systems.length && scope.systems.length > 0 }
+        ? {
+            systemContinuityObjectives: !systemContinuityObjectivesRequired
+              || systemsWithCompleteContinuityObjectives.length === scope.systems.length && scope.systems.length > 0
+          }
         : {})
     };
     const missing = Object.entries(checks)
@@ -665,10 +670,13 @@ async function policiesStage(scope, records, byId, readMarkdown, model) {
         placeholderCount,
         ...(isSecurityIncidentRecoveryPlan
           ? {
+              systemContinuityObjectivesRequired,
               continuityObjectiveSystemIds: systemsWithCompleteContinuityObjectives.map(({ id }) => id),
-              missingContinuityObjectiveSystemIds: scope.systems
-                .filter(({ id }) => !systemsWithCompleteContinuityObjectives.some((system) => system.id === id))
-                .map(({ id }) => id)
+              missingContinuityObjectiveSystemIds: systemContinuityObjectivesRequired
+                ? scope.systems
+                  .filter(({ id }) => !systemsWithCompleteContinuityObjectives.some((system) => system.id === id))
+                  .map(({ id }) => id)
+                : []
             }
           : {}),
         commands: [
@@ -1582,6 +1590,10 @@ function isDescriptionRequirement(requirement) {
     || /^DC\d+/i.test(requirement?.reference || "");
 }
 
+function isAvailabilityRequirement(requirement) {
+  return /^A1\./i.test(requirement?.reference || "");
+}
+
 function isSecurityRequirement(requirement) {
   const tags = requirement?.tags || [];
   return tags.includes("security") || tags.includes("common-criteria") || /^CC\d+(?:\.|$)/i.test(requirement?.reference || "");