arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/at-nisg-template.md

@@ -0,0 +1,236 @@
+# Austrian NISG (NIS2 Transposition) Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:at-nisg`
+>
+> ⚠️ **Community-contributed** — not yet validated against current BMI / A-SIT / EU regulatory text. Verify all citations before relying on output. The NISG NIS2 amendment (BGBl. I Nr. 94/2025) is recent; items marked `[NEEDS VERIFICATION]` must be confirmed against current text and implementing ordinances.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:at-nisg` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Pillar | Status | Critical Gaps |
+|--------|--------|--------------|
+| Austrian Scoping | [Essential / Important / Out of scope] | [Count] |
+| Governance | [Compliant / Partial / Gap] | [Count] |
+| Risk Management | [Compliant / Partial / Gap] | [Count] |
+| Incident Reporting (GovCERT) | [Compliant / Partial / Gap] | [Count] |
+| Supply Chain | [Compliant / Partial / Gap] | [Count] |
+| Business Continuity | [Compliant / Partial / Gap] | [Count] |
+
+---
+
+## 1. Austrian Scope and Designation
+
+### 1.1 Sector Classification
+
+| NIS2 Annex | Sector / Sub-sector | Applicable | AT Competent Authority |
+|------------|---------------------|-----------|------------------------------------------------|
+| I | Energy (Electricity) | ☐ | E-Control |
+| I | Energy (Gas / Oil / Hydrogen) | ☐ | E-Control |
+| I | Transport (Air / Rail / Water / Road) | ☐ | BMK |
+| I | Banking / Financial Market | ☐ | FMA / OeNB |
+| I | Health | ☐ | BMSGPK / ELGA |
+| I | Drinking Water / Wastewater | ☐ | BMK / Land authorities |
+| I | Digital Infrastructure / ICT | ☐ | BMI / RTR |
+| I | Public Administration | ☐ | BMI (federal) / Land |
+| I | Space | ☐ | BMK |
+| II | Postal / Courier / Waste / Chemicals / Food | ☐ | Sectoral |
+| II | Manufacturing / Digital providers / Research | ☐ | Sectoral |
+
+### 1.2 Designation
+
+| Item | Value |
+|------|-------|
+| Entity Designation | [Essential / Important / Out of scope] |
+| Previous NISG 2018 status | [Betreiber wesentlicher Dienste / None] |
+| Main establishment | [AT / other EU MS] |
+| Cross-border operations | [List MS] |
+| Size threshold result | [≥250 emp / 50–250 / <50 / micro] |
+
+---
+
+## 2. Governance (NIS2 Art. 20 — as transposed)
+
+| Obligation | Status | Evidence / Gap |
+|-----------|--------|----------------|
+| Geschäftsleitung approves security measures | [Yes / Partial / No] | |
+| Management body personally liable acknowledged (NIS2 Art. 20, NISG § transposed) | [Yes / Partial / No] | |
+| Management body cyber training completed | [Yes / Partial / No] | |
+| Responsibility mapped (CISO / Sicherheitsbeauftragter) | [Yes / Partial / No] | |
+
+---
+
+## 3. Risk Management Measures (NIS2 Art. 21 — as transposed)
+
+| # | Measure | Status | Gap | Proportionality Note |
+|---|---------|--------|-----|----------------------|
+| 1 | Risk analysis policy | | | |
+| 2 | Incident handling | | | |
+| 3 | Business continuity / BCM | | | |
+| 4 | Supply chain security | | | |
+| 5 | Secure acquisition / development / maintenance | | | |
+| 6 | Policies to assess effectiveness | | | |
+| 7 | Cyber hygiene + training | | | |
+| 8 | Cryptography policy | | | |
+| 9 | HR security + access control | | | |
+| 10 | MFA + secure communications | | | |
+
+A-SIT guidance alignment (sector-agnostic security guidance, commonly referenced by BMI/sectoral authorities): [Summary]
+
+---
+
+## 4. Incident Reporting — Austrian Channel
+
+| Item | Status | Evidence / Gap |
+|------|--------|----------------|
+| Three-tier CERT reporting established: Sectoral CERT → CERT.at (BMI §5) → GovCERT (BKA §4(4), public-admin only) | | |
+| Correct reporting channel identified (non-public → CERT.at; public-admin → GovCERT) | | |
+| Sectoral CERT contact (if applicable) | | |
+| 24-hour early warning capability | | |
+| 72-hour notification capability | | |
+| Intermediate / final report process | | |
+| Cross-reporting to DSB for personal data breach | | |
+| Reporting language / form readiness (German, AT form) | | |
+| Tabletop exercise in last 12 months | | |
+
+---
+
+## 5. Supply Chain Security
+
+| Control | Status | Evidence / Gap |
+|---------|--------|----------------|
+| Supplier inventory maintained | | |
+| Third-party risk assessment | | |
+| Contractual security clauses | | |
+| Software supply chain (SBOM / patching) | | |
+| ENISA supply chain framework alignment | | |
+| Sectoral secondary rules (E-Control Verordnungen / FMA Rundschreiben) | | |
+| High-risk vendor treatment (5G / EU toolbox) | | |
+
+---
+
+## 6. Business Continuity and Resilience
+
+| Item | Status | Evidence / Gap |
+|------|--------|----------------|
+| BCP documented and current | | |
+| Backup + restore tested in last 12 months | | |
+| Crisis management procedure | | |
+| RTO defined | [Value] | |
+| RPO defined | [Value] | |
+| Alternate site / DR capability | | |
+
+---
+
+## 7. Supervision, Inspections, and Penalties
+
+| Item | Status | Notes |
+|------|--------|-------|
+| Supervisory posture | [Ex ante (Essential) / Ex post (Important)] | |
+| Lead supervisor | [BMI / sectoral] | |
+| Maximum penalty | Essential: ≥ €10M / 2% turnover; Important: ≥ €7M / 1.4% turnover (NIS2 Art. 34 floor) | |
+| Appeal pathway | BVwG | |
+| CISO / Sicherheitsbeauftragter designated | [Yes / No] | |
+
+### 7.1 Qualifizierte Stellen (§18 NISG)
+
+| Item | Status | Notes |
+|------|--------|-------|
+| Qualifizierte Stelle engaged for audit | [Yes / No / Planned] | BMI-accredited audit body |
+| Accreditation confirmed (BMI list) | [Yes / No] | |
+| Scope of assessment | [Full / Partial] | |
+| Last assessment date | [YYYY-MM-DD / N/A] | |
+| Findings remediated | [Yes / Partial / No] | |
+
+---
+
+## 8. KSÖ and National Cyber Coordination
+
+| Item | Status | Notes |
+|------|--------|-------|
+| KSÖ membership / participation | [Member / Observer / None] | Voluntary |
+| NCSC-AT (BKA) / GovCERT (BKA §4(4)) strategic contact | [Yes / No] | |
+| CERT.at (BMI §5) operative contact | [Yes / No] | BMI = SPOC + enforcement |
+| Information-sharing MoUs | [List] | |
+
+### 8.1 Cyberkrise (§§24-25 NISG)
+
+| Item | Status | Notes |
+|------|--------|-------|
+| Cyberkrise declaration awareness (BMI declares per §24) | [Yes / No] | |
+| Participation in national Cyberkrise exercises (§25) | [Yes / No / Planned] | |
+| Communication channel to BMI Cyberkrise-Koordination | [Established / Gap] | |
+| Internal escalation to Cyberkrise threshold defined | [Yes / No] | |
+| Cross-sector coordination readiness | [Yes / Partial / No] | |
+
+---
+
+## 8b. Austrian NISG Additions Beyond NIS2 Baseline
+
+| Austrian Addition | NISG Reference | NIS2 Equivalent | Compliance Status |
+|-------------------|---------------|-----------------|-------------------|
+| Qualifizierte Stellen (accredited audit bodies) | §18 | No direct equivalent (Art. 32(2) allows but doesn't mandate) | |
+| Cyberkrise framework (national crisis declaration) | §§24-25 | Art. 9(4) crisis mgmt, less prescriptive | |
+| GovCERT for public administration (BKA) | §4(4) | Art. 10 CSIRTs (generic) | |
+| Land opt-in mechanism | §22(5-6) | No equivalent (federal-only in most MS) | |
+| Bundeskanzler designation regardless of size | §3(4) | Art. 2(2)(b-e) similar but EU-level | |
+| Sectoral CERT designation by BMI | §14 | Art. 10 CSIRTs (generic) | |
+| IKDOK / OpKoord coordination bodies | §7 | Art. 8 competent authorities (generic) | |
+| Three-tier CERT escalation (sectoral→national→GovCERT) | §14, §19 | Art. 10-11 (less structured) | |
+
+---
+
+## 9. Gap Analysis and Roadmap
+
+| Domain | Current Maturity | Target | Priority | Owner | Target Date |
+|--------|-----------------|--------|----------|-------|-------------|
+| Risk analysis | L1–L5 | L1–L5 | 🔴/🟠/🟡 | | |
+| Incident handling | L1–L5 | L1–L5 | | | |
+| BCM | L1–L5 | L1–L5 | | | |
+| Supply chain | L1–L5 | L1–L5 | | | |
+| Governance | L1–L5 | L1–L5 | | | |
+
+```mermaid
+gantt
+title NISG Remediation Roadmap
+dateFormat YYYY-MM-DD
+section Immediate
+Close high-priority gaps :active, a1, 2025-01-01, 90d
+section Short-term
+Formalise reporting channel :a2, after a1, 90d
+section Medium-term
+Maturity uplift to target :a3, after a2, 180d
+```
+
+---
+
+## External References
+
+### Document Register
+
+| DOC_ID | Source | Description |
+|--------|--------|-------------|
+| | | |
+
+### Citations
+
+| Citation | Used In | Source |
+|----------|---------|--------|
+| | | |
+
+---
+
+**Generated by**: ArcKit `/arckit:at-nisg` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/au-aescsf-template.md

@@ -0,0 +1,189 @@
+# AU AESCSF Maturity Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:au-aescsf`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Document Type: AUAESCSF -->
+<!-- Classification line, where applicable, MUST be: -->
+<!-- | Classification | UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:au-aescsf` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Summarise AESCSF scope, target maturity, current posture, highest-risk gaps, architecture evidence gaps, and top uplift priorities.]
+
+---
+
+## Energy Context and AESCSF Scope
+
+[Describe the energy sub-sector, entity role, asset or platform, market participation, operational context, and AESCSF applicability assumptions.]
+
+---
+
+## Criticality and Target Maturity Profile
+
+| Dimension | Current Position | Target / Rationale | Evidence |
+|-----------|------------------|--------------------|----------|
+| Service criticality | [Position] | [Target] | [Evidence] |
+| Safety / reliability impact | [Position] | [Target] | [Evidence] |
+| Market impact | [Position] | [Target] | [Evidence] |
+| SOCI relevance | [Position] | [Target] | [AUSOCI reference] |
+| Target AESCSF maturity | [Position] | [Target] | [Rationale] |
+
+---
+
+## Domain Maturity Assessment
+
+| AESCSF Domain / Capability Area | Current Maturity | Target Maturity | Evidence | Gap | Owner |
+|---------------------------------|------------------|-----------------|----------|-----|-------|
+| [Domain] | [Current] | [Target] | [Evidence] | [Gap] | [Owner] |
+
+---
+
+## OT/IT and Grid-Edge Findings
+
+[Summarise OT/IT boundary findings, grid-edge dependencies, DERMS / DOE / CSIP-AUS flows, telemetry, metering, vendor access, and operational constraints.]
+
+---
+
+## Architecture Evidence
+
+| Evidence Required | Status | Artefact / Link | Owner | Gap |
+|-------------------|--------|-----------------|-------|-----|
+| OT/IT zone and conduit diagrams | [Current / Partial / Missing] | [Diagram] | [Owner] | [Gap] |
+| IT/OT data flows | [Current / Partial / Missing] | [DFD] | [Owner] | [Gap] |
+| DERMS / DOE / CSIP-AUS flows | [Current / Partial / Missing / N/A] | [DFD / diagram] | [Owner] | [Gap] |
+| Vendor remote-access paths | [Current / Partial / Missing] | [Register / diagram] | [Owner] | [Gap] |
+| Energy data-model dependencies | [Current / Partial / Missing] | [Data model] | [Owner] | [Gap] |
+| Traceability and risk links | [Current / Partial / Missing] | [Traceability / risk] | [Owner] | [Gap] |
+
+---
+
+## IT/OT and Market Data Flows
+
+| Flow | Source | Destination | Protocol / Interface | Data | Control | Evidence |
+|------|--------|-------------|----------------------|------|---------|----------|
+| [Flow] | [Source] | [Destination] | [Interface] | [Data] | [Control] | [Evidence] |
+
+---
+
+## Energy Data Model Dependencies
+
+| Data Domain | Dependency | Owner | Classification / Sensitivity | Control / Evidence |
+|-------------|------------|-------|------------------------------|--------------------|
+| Asset / network model | [Dependency] | [Owner] | [Classification] | [Evidence] |
+| DER / grid-edge | [Dependency] | [Owner] | [Classification] | [Evidence] |
+| Metering / NMI | [Dependency] | [Owner] | [Classification] | [Evidence] |
+| Settlement / market | [Dependency] | [Owner] | [Classification] | [Evidence] |
+| Customer / billing | [Dependency] | [Owner] | [Classification] | [Evidence] |
+| Telemetry / operations | [Dependency] | [Owner] | [Classification] | [Evidence] |
+
+---
+
+## Asset, Interface, and Evidence Inventory
+
+| Register / Inventory | Source of Truth | Items in Scope | Owner | Visualisation / Scoring | Gap |
+|----------------------|-----------------|----------------|-------|-------------------------|-----|
+| OT asset inventory | [CMDB / asset register / AUOT] | [Zones, conduits, devices, control systems] | [Owner] | [Criticality / risk colour coding] | [Gap] |
+| IT / service inventory | [ServiceNow / CMDB / diagram] | [Applications, services, infrastructure CIs] | [Owner] | [Support tier / dependency score] | [Gap] |
+| Market and AEMO interface register | [Interface register / DFD] | [APIs, portals, B2B/B2M, files, telemetry] | [Owner] | [Availability / compliance status] | [Gap] |
+| DER / metering / telemetry inventory | [Data model / asset register] | [DERMS, DOE, CSIP-AUS, meters, telemetry paths] | [Owner] | [Maturity / risk heat] | [Gap] |
+| Vendor remote-access register | [Access register / AUOT / risk] | [Vendors, jump hosts, privileged sessions] | [Owner] | [Residual risk / control status] | [Gap] |
+| Evidence and control register | [Traceability / graph-report / risk] | [Controls, obligations, evidence, tests] | [Owner] | [Coverage / readiness score] | [Gap] |
+
+---
+
+## Diagram and Traceability Handoffs
+
+| Handoff | Required Update | Owner | Status |
+|---------|-----------------|-------|--------|
+| DFD | [IT/OT, market, DER, vendor access flows] | [Owner] | [Status] |
+| Diagram | [Zones, conduits, market interfaces, grid-edge context] | [Owner] | [Status] |
+| Data Model | [Energy data dependencies and ownership] | [Owner] | [Status] |
+| ServiceNow / CMDB | [CIs, service dependencies, owners, support criticality] | [Owner] | [Status] |
+| Traceability | [Requirements, controls, evidence, obligations] | [Owner] | [Status] |
+| Risk | [Maturity gaps and treatment actions] | [Owner] | [Status] |
+| Graph Report | [Coverage, cross-reference density, missing evidence links] | [Owner] | [Status] |
+
+---
+
+## AESCSF Anti-Pattern Register
+
+| Anti-Pattern | Evidence | Impact | Treatment |
+|--------------|----------|--------|-----------|
+| [Anti-pattern] | [Evidence] | [Impact] | [Treatment] |
+
+---
+
+## Federal Baseline Cross-Reference
+
+| Artefact | Reference | How Used | Gap / Follow-up |
+|----------|-----------|----------|-----------------|
+| AUE8 | [ARC-{P}-AUE8-v*] | [Enterprise cyber baseline] | [Gap] |
+| AUISM | [ARC-{P}-AUISM-v*] | [Control evidence] | [Gap] |
+| AUOT | [ARC-{P}-AUOT-v*] | [OT evidence] | [Gap] |
+| AUSOCI | [ARC-{P}-AUSOCI-v*] | [Critical-infrastructure evidence] | [Gap] |
+
+---
+
+## Maturity Gaps and Risk Treatment
+
+| Gap | Risk | Treatment | Owner | Due Date | Residual Risk |
+|-----|------|-----------|-------|----------|---------------|
+| [Gap] | [Risk] | [Treatment] | [Owner] | [Date] | [Residual risk] |
+
+---
+
+## Uplift Roadmap
+
+| Horizon | Action | Owner | Evidence Update | Success Measure |
+|---------|--------|-------|-----------------|-----------------|
+| Immediate | [Action] | [Owner] | [Artefact] | [Measure] |
+| 30-90 days | [Action] | [Owner] | [Artefact] | [Measure] |
+| 90-180 days | [Action] | [Owner] | [Artefact] | [Measure] |
+| Strategic | [Action] | [Owner] | [Artefact] | [Measure] |
+
+---
+
+## External References
+
+| Ref | Source | Version / Publication Date | Access Date | Relevance |
+|-----|--------|----------------------------|-------------|-----------|
+| AESCSF | AEMO Australian Energy Sector Cyber Security Framework | [Version / date verified] | [YYYY-MM-DD] | Authoritative AESCSF anchor |
+| AEMO-CYBER | AEMO cyber security resources | [Date verified] | [YYYY-MM-DD] | Energy-sector cyber context |
+| AEMO-SYSTEMS | AEMO energy systems and interfaces | [Date verified] | [YYYY-MM-DD] | Market and operator interface context |
+| CISC-SOCI | CISC SOCI Act 2018 guidance | [Date verified] | [YYYY-MM-DD] | Critical-infrastructure cross-reference |
+| ASD-E8 | ASD Essential Eight | [Version / date verified] | [YYYY-MM-DD] | Enterprise cyber baseline |
+| ASD-ISM | ASD Information Security Manual | [Edition / date verified] | [YYYY-MM-DD] | Control evidence baseline |
+
+---
+
+## Document Register
+
+| Item | Value |
+|------|-------|
+| Document Type | AUAESCSF |
+| Template Origin | Community |
+| Command | `/arckit:au-aescsf` |
+| AESCSF Version / Publication Date Verified | [Version / date] |
+| AEMO Access Date | [YYYY-MM-DD] |
+| AEMO Availability Notes | [Available / unavailable / partial; record attempts] |
+| Qualified Review Required | [Energy cyber / OT / legal / regulatory / operational risk reviewer] |
+
+---
+
+**Generated by**: ArcKit `/arckit:au-aescsf` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/au-ai-assurance-template.md

@@ -0,0 +1,243 @@
+# AI Assurance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:au-ai-assurance`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:au-ai-assurance` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: AI system, deployment phase, regulatory frameworks in scope, overall assurance posture, key gaps.]
+
+---
+
+## 1. AI System Description
+
+| Field | Value |
+|-------|-------|
+| **System Name** | [System name] |
+| **Purpose** | [What the AI does and for whom] |
+| **AI Capability Type** | [Generative / Predictive / Decision-Support / Decision-Making / Agentic / Multi-Modal] |
+| **Deployment Phase** | [Research / Pilot / Production] |
+| **Foundation Model** | [Model + version + vendor — e.g., Claude Opus 4 / GPT-4 / Gemini 2.0 / open-source Llama 3] |
+| **Training-Data Sources** | [Public / proprietary / mixed; classification level] |
+| **Inference-Data Sources** | [User input / database / API / mixed] |
+| **Decisions Affecting Individuals** | [Yes — describe / No / Decision-support only] |
+| **Human-in-the-Loop Posture** | [Always / Threshold-triggered / None] |
+| **Population Affected** | [Internal users / customers / public / regulated cohort] |
+| **Assessment Date** | [YYYY-MM-DD] |
+| **AI Accountable Officer** | [Name + role] |
+
+---
+
+## 2. DTA Responsible AI Policy v2.0 Compliance
+
+| Accountability | Status | Evidence | Gap | Mitigation |
+|----------------|--------|----------|-----|------------|
+| 1. Accountability — designated AI accountable officer | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 2. Transparency — public AI use disclosure | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 3. Risk-based approach — AI risk assessment performed | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 4. Quality data + design integrity | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 5. Privacy + security (cross-ref PIA + ISM + E8) | [✅/⚠️/❌] | [Cite ARC-{P}-AUPIA, AUISM, AUE8] | [Gap] | [Action] |
+| 6. Human oversight + redress | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+
+---
+
+## 3. AU AI Ethics Principles Alignment
+
+| Principle | Status | Evidence | Gap | Mitigation |
+|-----------|--------|----------|-----|------------|
+| 1. Human, societal and environmental wellbeing | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 2. Human-centred values | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 3. Fairness | [✅/⚠️/❌] | [Cite Fairness Assessment §6] | [Gap] | [Action] |
+| 4. Privacy protection and security | [✅/⚠️/❌] | [Cite PIA + E8 + ISM] | [Gap] | [Action] |
+| 5. Reliability and safety | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 6. Transparency and explainability | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 7. Contestability | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+| 8. Accountability | [✅/⚠️/❌] | [Evidence] | [Gap] | [Action] |
+
+---
+
+## 4. AU Essential AI Practices (AI6) Alignment
+
+National AI Centre (NAIC) operational practices for safe and responsible AI adoption — see [Guidance for AI Adoption: Foundations](https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations) and the deeper [Implementation Guidance](https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance) (each practice has Getting started + Next steps prompts on the source).
+
+| # | Practice | Status | Evidence | Gap | Action |
+|---|----------|--------|----------|-----|--------|
+| 1 | Decide who is accountable | [✅/⚠️/❌/N/A] | [Cite accountable AI officer designation; cross-ref DTA Responsible AI Policy section 2] | [Gap] | [Action] |
+| 2 | Understand impacts and plan accordingly | [✅/⚠️/❌/N/A] | [Cite impact assessment / PIA where relevant] | [Gap] | [Action] |
+| 3 | Measure and manage risks | [✅/⚠️/❌/N/A] | [Cite RISK register entries; AI-specific risk methodology] | [Gap] | [Action] |
+| 4 | Share essential information | [✅/⚠️/❌/N/A] | [Cite transparency artefacts; AI use disclosure; user-facing notices] | [Gap] | [Action] |
+| 5 | Test and monitor | [✅/⚠️/❌/N/A] | [Cite testing methodology; monitoring dashboards; drift detection] | [Gap] | [Action] |
+| 6 | Maintain human control | [✅/⚠️/❌/N/A] | [Cite human-in-the-loop posture; intervention pathways; redress mechanism] | [Gap] | [Action] |
+
+**Cross-framework note**: AI6 practices align closely with the DTA Responsible AI Policy v2.0 six accountabilities (section 2 of this assessment) but are framed as adoption *practices* rather than policy *accountabilities*. Use both lenses; the differences in framing surface different evidence gaps.
+
+---
+
+## 5. ISO 42001 Readiness
+
+| Clause | Topic | Readiness | Notes |
+|--------|-------|-----------|-------|
+| 4 | Context of the organisation | [✅/⚠️/❌] | [Notes] |
+| 5 | Leadership | [✅/⚠️/❌] | [Notes] |
+| 6 | Planning | [✅/⚠️/❌] | [Notes] |
+| 7 | Support | [✅/⚠️/❌] | [Notes] |
+| 8 | Operation | [✅/⚠️/❌] | [Notes] |
+| 9 | Performance evaluation | [✅/⚠️/❌] | [Notes] |
+| 10 | Improvement | [✅/⚠️/❌] | [Notes] |
+
+**Certification position**: [Targeting certification / Internal alignment only / Not pursuing]
+
+---
+
+## 6. Privacy Act AI-Decision Notification (Dec 2026)
+
+| Aspect | Detail |
+|--------|--------|
+| **Substantially-automated decisions affecting individuals** | [Yes / No] |
+| **Notification mechanism** | [Implemented / Planned for Dec 2026 / Not applicable] |
+| **What individuals are told** | [Description of notification content] |
+| **Opt-out pathway** | [Yes — describe / Not applicable] |
+| **Cross-reference** | [ARC-{P}-AUPIA-v* APP 6 + APP 11] |
+
+---
+
+## 7. Fairness Assessment
+
+| Aspect | Detail |
+|--------|--------|
+| **Methodology** | [E.g., demographic parity, equalised odds, predictive parity] |
+| **Protected Attributes Tested** | [List — race, ethnicity, gender, age, disability, geographic, socioeconomic] |
+| **Test Population Segments** | [Description] |
+| **Fairness Metrics + Results** | [Metric: result, threshold, pass/fail per segment] |
+| **Residual Fairness Risks** | [Description] |
+| **Validated by** | [Internal / External fairness specialist] |
+
+---
+
+## 8. Security of AI Training + Inference Data
+
+| Aspect | Detail |
+|--------|--------|
+| **Training-Data Classification** | [UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED — note model can memorise PII] |
+| **Inference-Data Classification** | [Same scale; consider input + output PII risk] |
+| **Prompt-Injection Defences** | [Implemented / Planned] |
+| **Model-Extraction Defences** | [Implemented / Planned] |
+| **Training-Data Sanitisation** | [Process description] |
+| **E8 Cross-Reference** | [ARC-{P}-AUE8-v* — Strategies 1, 4, 11 most relevant] |
+| **ISM Cross-Reference** | [ARC-{P}-AUISM-v* Domain 9 + 12] |
+
+---
+
+## 9. Model Lifecycle Governance
+
+| Aspect | Detail |
+|--------|--------|
+| **Version Control** | [Tooling + cadence] |
+| **Change Management** | [Process for model updates] |
+| **Drift Detection** | [Metrics + alerting] |
+| **Retraining Cadence** | [Trigger conditions] |
+| **Retirement / Sunset Criteria** | [Description] |
+| **Audit Trail** | [Inference logs retention + scope] |
+
+---
+
+## 10. Vendor / Foundation-Model Disclosure
+
+| Aspect | Detail |
+|--------|--------|
+| **Vendor Name** | [E.g., Anthropic / OpenAI / Google] |
+| **Model + Version** | [E.g., Claude Opus 4.7] |
+| **Vendor AI Policy Compliance** | [Vendor's published AI policy alignment] |
+| **Training-Data Provenance** | [Disclosed / Partially disclosed / Not disclosed] |
+| **Inference Region** | [AU / US / EU / global] |
+| **IP / Copyright Position** | [Vendor indemnification stance; user-content rights] |
+| **Data-Use Policy** | [Whether prompts/completions used for vendor training] |
+
+---
+
+## 11. Recommendations
+
+### Quick Wins ( < 30 days)
+
+| # | Recommendation | Framework | Effort |
+|---|---------------|-----------|--------|
+| 1 | [Recommendation] | [DTA / AIEP / ISO42001 / PrivacyAct] | [Low/Medium] |
+
+### Short-Term (30–90 days)
+
+| # | Recommendation | Framework | Effort |
+|---|---------------|-----------|--------|
+| 1 | [Recommendation] | [Framework] | [Medium/High] |
+
+### Medium-Term (90–180 days)
+
+| # | Recommendation | Framework | Effort |
+|---|---------------|-----------|--------|
+| 1 | [Recommendation] | [Framework] | [High] |
+
+---
+
+## 12. External References
+
+### ArcKit Evidence Integration
+
+| Evidence Area | ArcKit Artefact | How It Supports AI Assurance | Gap / Follow-up |
+|---------------|-----------------|------------------------------|-----------------|
+| AI data and prompt flows | `/arckit:dfd` / ARC-*-DFD-* | Training, inference, prompt, output, disclosure, and feedback flows | [Gap / follow-up] |
+| AI data inventory | `/arckit:data-model` / ARC-*-DATA-* | Training, inference, prompt, output, personal, sensitive, and derived data entities | [Gap / follow-up] |
+| AI risks | `/arckit:risk` / ARC-*-RISK-* | Bias, drift, prompt injection, model extraction, privacy, and sovereignty risks | [Gap / follow-up] |
+| Obligation traceability | `/arckit:traceability` / ARC-*-TRAC-* | DTA policy, AI6, ethics, Privacy Act, and control mappings | [Gap / follow-up] |
+| Coverage view | `/arckit:graph-report` | AU assurance coverage across privacy, data, risk, and traceability artefacts | [Gap / follow-up] |
+| Capability uplift | `/arckit:maturity-model` / ARC-*-MMOD-* | AI governance and model lifecycle maturity baseline and roadmap | [Gap / follow-up] |
+
+### Document Register
+
+| Doc ID | Filename | Type | Source | Description |
+|--------|----------|------|--------|-------------|
+| DTAAI | DTA Responsible AI Policy v2.0 | Policy | digital.gov.au | Effective Dec 2025 |
+| AUAIEP | AU AI Ethics Principles | Framework | industry.gov.au | 8 voluntary principles |
+| AI6F | AU Essential AI Practices — Foundations | Operational Guidance | ai.gov.au (NAIC) | 6 essential practices for safe and responsible AI adoption |
+| AI6IG | AU Essential AI Practices — Implementation Guidance | Operational Guidance | ai.gov.au (NAIC) | Per-practice Getting started + Next steps prompts |
+| ISO42001 | ISO 42001:2023 (AS adopted Feb 2024) | Standard | standards.org.au | AI Management Systems |
+| PA88 | Privacy Act 1988 (Cth) | Legislation | legislation.gov.au | AI-decision notification Dec 2026 |
+| AUPIA | ARC-{P}-AUPIA-v* | ArcKit Artefact | projects/ | APP 6 + APP 11 cross-ref |
+| AUE8 | ARC-{P}-AUE8-v* | ArcKit Artefact | projects/ | E8 cross-ref |
+| AUISM | ARC-{P}-AUISM-v* | ArcKit Artefact | projects/ | ISM cross-ref |
+
+### Verification
+
+| Standard | URL | Verification Date |
+|----------|-----|-------------------|
+| DTA Responsible AI Policy | https://www.digital.gov.au/policy/ai/policy | [YYYY-MM-DD] |
+| AU AI Ethics Principles | https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-framework/australias-ai-ethics-principles | [YYYY-MM-DD] |
+| AU Essential AI Practices (AI6) — Foundations | https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations | [YYYY-MM-DD] |
+| AU Essential AI Practices — Implementation Guidance | https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance | [YYYY-MM-DD] |
+| Privacy Act 1988 | https://www.legislation.gov.au/Details/C2024C00301 | [YYYY-MM-DD] |
+
+---
+
+## Visual Evidence Decision Rule
+
+Generate companion visual artefacts only when the available evidence includes enough structure to identify real nodes and relationships. If evidence is incomplete but structurally useful, create a clearly marked draft visual with `Pending Input` labels. If structural evidence is insufficient, do not create a diagram; record a Visual Evidence Gap and list the minimum inputs needed.
+
+---
+
+**Generated by**: ArcKit `/arckit:au-ai-assurance` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]