arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/au-disp-attestation-template.md

@@ -0,0 +1,297 @@
+# DISP Member Self-Attestation Pack
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:au-disp-attestation`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:au-disp-attestation` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: organisation, DISP level sought, current attestation readiness, key gaps, target attestation date.]
+
+---
+
+## 1. Organisation Profile
+
+| Field | Value |
+|-------|-------|
+| **Legal Entity** | [Full name + ABN] |
+| **Trading Names** | [If applicable] |
+| **Primary Business Activity** | [e.g., Infrastructure Advisory] |
+| **Headcount** | [Total + by site] |
+| **Sites** | [Office locations + cloud-tenant region] |
+| **Defence Contracts in Scope** | [Active / pipeline contracts requiring DISP] |
+| **DISP Level Sought** | [Level 1 / 2 / 3] |
+| **Target Attestation Date** | [YYYY-MM-DD] |
+
+---
+
+## 2. DISP Level Sought
+
+| Aspect | Detail |
+|--------|--------|
+| **Level** | [Level 1 / 2 / 3] |
+| **Regulatory Driver** | [Specific contract / panel mandate / pipeline anticipation] |
+| **Justification** | [Why this level — types of Defence work, classified content handling] |
+| **Anticipated Defence Work** | [UNCLASSIFIED / OFFICIAL / OFFICIAL:Sensitive / PROTECTED — content categories handled] |
+
+---
+
+## 3. Security Officer Designation
+
+| Aspect | Detail |
+|--------|--------|
+| **Chief Security Officer (CSO)** | [Name + role title] |
+| **CSO Authority** | [Reporting line, signing authority, budget authority across the four security domains] |
+| **CSO Clearance Level** | [Baseline / NV1 / NV2 / PV] |
+| **Deputy CSO / Backup** | [Name + role + clearance] |
+| **CSO Contact** | [Email / phone for Defence engagement] |
+| **Vetting Status Verified** | [Yes / In progress / Not yet] |
+
+---
+
+## 4. Four Security Domains Coverage
+
+### Domain 1: Governance
+
+| Aspect | Detail |
+|--------|--------|
+| **Implementation Status** | [✅ / ⚠️ / ❌] |
+
+**Evidence**: [Security policy framework, risk management plan, audit cadence, incident management process, change control. Cite ISM applicability statement [ARC-{P}-AUISM] Domain 1 + 4]
+
+**Gaps**: [List]
+
+**Remediation**: [Actions, owners, target dates]
+
+**Sign-off**: [Accountable officer + date]
+
+---
+
+### Domain 2: Personnel Security
+
+| Aspect | Detail |
+|--------|--------|
+| **Implementation Status** | [✅ / ⚠️ / ❌] |
+| **Cleared Personnel Count** | [By clearance level — Baseline: n, NV1: n, NV2: n, PV: n] |
+| **Vetting Workflow** | [In-house / outsourced; turnaround time] |
+
+**Evidence**: [Clearance verification process, security awareness training programme, separation of duties model, off-boarding clearance debrief procedure, pre/post-leave briefing for cleared personnel. Cite ISM Domain 5]
+
+**Gaps**: [List]
+
+**Remediation**: [Actions, owners, target dates]
+
+**Sign-off**: [Accountable officer + date]
+
+---
+
+### Domain 3: Physical Security
+
+| Aspect | Detail |
+|--------|--------|
+| **Implementation Status** | [✅ / ⚠️ / ❌ / Inherited from IRAP cloud provider] |
+
+**Evidence**: [Facility access controls, ICT equipment lifecycle, secure media handling, equipment disposal. For cloud-only systems, cite cloud provider IRAP scope statement (Microsoft IRAP PROTECTED date / AWS IRAP date / GCP IRAP date) + customer-side responsibility implementation]
+
+**Gaps**: [Specific cloud-shared-responsibility gaps]
+
+**Remediation**: [Actions, owners, target dates]
+
+**Sign-off**: [Accountable officer + date]
+
+---
+
+### Domain 4: Information & Cyber Security
+
+| Aspect | Detail |
+|--------|--------|
+| **Implementation Status** | [✅ / ⚠️ / ❌] |
+| **E8 Posture Reference** | [ARC-{P}-AUE8-v*] |
+| **ISM Applicability Reference** | [ARC-{P}-AUISM-v*] |
+
+**Evidence**: [Defer to E8 posture artefact for E8 ML2 evidence; ISM applicability for additional controls. Specifically address: cryptography (Domain 12), gateway security (Domain 13), monitoring (Domain 11), BCP (cross-references E8 Strategy 8)]
+
+**Gaps**: [Beyond E8 ML2, list ISM-domain-specific gaps]
+
+**Remediation**: [Actions, owners, target dates]
+
+**Sign-off**: [Accountable officer + date]
+
+---
+
+## 5. Essential Eight ML2 Evidence Per Strategy
+
+(Summarised from `ARC-{P}-AUE8-v*` — refer to that artefact for evidence detail.)
+
+| # | Strategy | Current ML | ML2 Evidence | Gap to ML2 | Sign-off |
+|---|----------|-----------|--------------|------------|----------|
+| 1 | Application Control | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 2 | Patch Applications | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 3 | Configure MS Office Macros | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 4 | User Application Hardening | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 5 | Restrict Admin Privileges | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 6 | Patch Operating Systems | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 7 | Multi-Factor Authentication | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+| 8 | Regular Backups | [ML0–3] | [Evidence summary] | [Gap] | [Officer + date] |
+
+---
+
+## 6. ISM Applicability Highlights
+
+(Summarised from `ARC-{P}-AUISM-v*`.)
+
+| ISM Domain | Material to DISP | Implementation | Gap |
+|------------|-------------------|----------------|-----|
+| 1. Cyber Security Governance | High | [✅/⚠️/❌] | [Gap] |
+| 3. Outsourced Services (MSP boundary) | High | [✅/⚠️/❌] | [Gap] |
+| 4. Security Documentation (SSP, SRMP) | High | [✅/⚠️/❌] | [Gap] |
+| 5. Personnel Security | High (DISP-specific) | [✅/⚠️/❌] | [Gap] |
+| 10. System Management (privileged access) | High | [✅/⚠️/❌] | [Gap] |
+| 11. System Monitoring (audit retention) | High | [✅/⚠️/❌] | [Gap] |
+| 12. Cryptography | Medium | [✅/⚠️/❌] | [Gap] |
+| 15. Cloud and IaaS Considerations | High (if cloud-only) | [✅/⚠️/❌ / Inherited] | [Gap] |
+
+---
+
+## 7. Foreign Ownership, Control or Influence (FOCI) Declaration
+
+| Aspect | Detail |
+|--------|--------|
+| **Foreign Ownership > 5%** | [Yes / No — if Yes: nation, percentage, entity] |
+| **Foreign Board Members** | [Number, nationalities, role authority] |
+| **Foreign Personnel with System Access** | [Number, nationalities, access scope] |
+| **Foreign Supply-Chain Dependencies** | [Description] |
+| **FOCI Mitigation Plan** | [If applicable, summary; cite supporting documentation] |
+
+---
+
+## 8. Supply Chain Security
+
+| Tier 1 Supplier | Service | Attestation Held | Last Reviewed | Cleared for DISP Level |
+|-----------------|---------|------------------|---------------|------------------------|
+| [MSP name] | M365 admin | [SOC 2 / ISO 27001 / IRAP] | [YYYY-MM-DD] | [Level 1/2/3] |
+| [Cloud Provider] | IaaS/PaaS | [IRAP PROTECTED date] | [YYYY-MM-DD] | [Level 1/2/3] |
+| [SaaS Provider] | [Service] | [Attestation] | [YYYY-MM-DD] | [Level 1/2/3] |
+
+**Supply-Chain Risk Management Process**: [Describe vendor onboarding, ongoing review, exit procedures]
+
+---
+
+## 9. Incident Response & Reporting
+
+| Aspect | Detail |
+|--------|--------|
+| **Incident Response Plan** | [Document reference] |
+| **24-Hour Defence Notification Capability** | [✅ / ⚠️ / ❌] |
+| **OAIC NDB Scheme Integration** | [✅ / ⚠️ / ❌; cite NDB playbook ARC-{P}-AUNDB-v* if available] |
+| **Last Tabletop / Live Exercise** | [YYYY-MM-DD] |
+| **Lessons Learned Process** | [Description] |
+
+---
+
+## 10. Security Awareness Training
+
+| Aspect | Detail |
+|--------|--------|
+| **Programme Name** | [E.g., DISP-aligned cyber awareness in ELMO] |
+| **Modules** | [Mandatory / role-specific / clearance-holder additional briefings] |
+| **Completion Rate (last 12mo)** | [%] |
+| **Refresher Cadence** | [Annual / event-driven] |
+| **Cleared-Personnel Briefings** | [Pre-leave / post-leave / change-of-role] |
+
+---
+
+## 11. Annual Self-Audit Plan
+
+| Aspect | Detail |
+|--------|--------|
+| **Scope** | [Four domains coverage; specific control sample] |
+| **Methodology** | [Self-assessment + evidence review + sample testing] |
+| **Frequency** | [Annual minimum; on-major-change additional] |
+| **Evidence Retention** | [Years] |
+| **Last Audit Date** | [YYYY-MM-DD] |
+| **Next Scheduled** | [YYYY-MM-DD] |
+
+---
+
+## 12. Attestation Statement
+
+I/we attest that the information in this pack is accurate to the best of my/our knowledge as at the date below. We commit to maintaining the security posture described, completing the listed remediation actions by their target dates, and notifying Defence promptly of any material change to the four security domains.
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| Chief Security Officer | | | |
+| Director / Managing Director | | | |
+| Date of Attestation | | | [YYYY-MM-DD] |
+| Re-Attestation Due | | | [YYYY-MM-DD] |
+
+---
+
+## 13. External References
+
+### Upstream ArcKit Evidence
+
+| Evidence Area | ArcKit Artefact | How It Supports DISP Attestation | Gap / Follow-up |
+|---------------|-----------------|----------------------------------|-----------------|
+| Operational ownership | `/arckit:servicenow` / ARC-*-SNOW-* | ServiceNow/CMDB CIs, support groups, incident queues, change controls, supplier access | [Gap / follow-up] |
+| Residual risks | `/arckit:risk` / ARC-*-RISK-* | DISP gaps, risk acceptance, treatment ownership, renewal risks | [Gap / follow-up] |
+| Claim provenance | `/arckit:traceability` / ARC-*-TRAC-* | DISP claims mapped to AU artefacts, policies, controls, owners, and evidence records | [Gap / follow-up] |
+| Coverage view | `/arckit:graph-report` | AUDISP coverage across AU compliance, risk, traceability, and operations artefacts | [Gap / follow-up] |
+| Capability uplift | `/arckit:maturity-model` / ARC-*-MMOD-* | Governance, personnel, physical, cyber, and supplier maturity roadmap | [Gap / follow-up] |
+
+| Artefact | Doc-ID | Cross-Reference |
+|----------|--------|-----------------|
+| ASD Essential Eight Posture | `ARC-{P}-AUE8-v*` | E8 maturity evidence per Strategy in section 6 |
+| ASD ISM Applicability | `ARC-{P}-AUISM-v*` | ISM control coverage per domain in section 6 |
+| Privacy Impact Assessment | `ARC-{P}-AUPIA-v*` | APP 11 personal-information protection evidence |
+| Notifiable Data Breach Playbook | `ARC-{P}-AUNDB-v*` | Incident-response capability evidence |
+| PSPF Compliance Assessment | `ARC-{P}-AUPSPF-v*` | Physical / personnel / governance security evidence |
+| DTA Digital Service Standard | `ARC-{P}-AUDSS-v*` | Service-design assurance evidence (where applicable) |
+| AI Assurance Assessment | `ARC-{P}-AUAIA-v*` | AI-system risk-control evidence (where applicable) |
+
+### Document Register
+
+| Doc ID | Filename | Type | Source | Description |
+|--------|----------|------|--------|-------------|
+| DISP | DISP Membership Pack | Standard | defence.gov.au | DISP application + evidence framework — edition [DATE] |
+| AUE8 | ARC-{P}-AUE8-v* | ArcKit Artefact | projects/ | Essential Eight evidence |
+| AUISM | ARC-{P}-AUISM-v* | ArcKit Artefact | projects/ | ISM applicability evidence |
+| AUPIA | ARC-{P}-AUPIA-v* | ArcKit Artefact | projects/ | Privacy Act + APP 11 evidence |
+| AUNDB | ARC-{P}-AUNDB-v* | ArcKit Artefact | projects/ | NDB playbook evidence (if available) |
+| ASDISM | ASD Information Security Manual | Standard | cyber.gov.au | Underlying control framework |
+| E8MM | ASD Essential Eight Maturity Model | Standard | cyber.gov.au | E8 ML2 minimum reference |
+
+### Verification
+
+| Standard | URL | Verification Date |
+|----------|-----|-------------------|
+| DISP | https://www.defence.gov.au/business-industry/programs/defence-industry-security-program | [YYYY-MM-DD] |
+| ASD ISM | https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism | [YYYY-MM-DD] |
+| ASD E8 | https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model | [YYYY-MM-DD] |
+
+---
+
+## Visual Evidence Decision Rule
+
+Generate companion visual artefacts only when the available evidence includes enough structure to identify real nodes and relationships. If evidence is incomplete but structurally useful, create a clearly marked draft visual with `Pending Input` labels. If structural evidence is insufficient, do not create a diagram; record a Visual Evidence Gap and list the minimum inputs needed.
+
+---
+
+**Generated by**: ArcKit `/arckit:au-disp-attestation` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/au-dss-template.md

@@ -0,0 +1,302 @@
+# DTA Digital Service Standard Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:au-dss`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:au-dss` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: service under assessment, current compliance posture against the 13 criteria, key gaps, and assessment readiness for the current phase.]
+
+---
+
+## Service Context
+
+| Field | Value |
+|-------|-------|
+| **Service Name** | [Service name] |
+| **Owning Agency** | [Department / Agency] |
+| **Service Phase** | [Discovery / Alpha / Beta / Live] |
+| **User Base** | [Public-facing / Internal / Both] |
+| **Annual Transactions** | [Volume or estimate] |
+| **Assessment Date** | [YYYY-MM-DD] |
+| **Assessor** | [Name and role] |
+
+---
+
+## Digital Service Standard Assessment
+
+### Criterion 1: Understand User Needs
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [User research conducted, methods used, findings documented, personas created]
+
+**Gaps**: [Missing research, unvalidated assumptions, user groups not covered]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 2: Have a Multidisciplinary Team
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Team composition, DDaT roles covered, decision-making authority]
+
+**Gaps**: [Missing roles, capability gaps, external dependencies]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 3: Agile and User-Centred Process
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Delivery methodology, sprint cadence, user feedback integration, iteration evidence]
+
+**Gaps**: [Waterfall dependencies, missing feedback loops]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 4: Understand Tools and Systems
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Technology landscape mapped, integration points, legacy dependencies, vendor dependencies]
+
+**Gaps**: [Unmapped systems, undocumented integrations]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 5: Make It Secure
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+| **E8 Posture Reference** | [ARC-{P}-AUE8-v{V} if available] |
+
+**Evidence**: [E8 maturity level, ISM controls, threat assessment, incident response plan, IRAP status]
+
+**Gaps**: [E8 strategies below target, missing controls, untested DR]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 6: Consistent and Responsive Design
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Design system used, responsive breakpoints, device testing coverage, brand compliance]
+
+**Gaps**: [Missing breakpoints, untested devices, inconsistent components]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 7: Protect Users' Privacy
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+| **PIA Reference** | [ARC-{P}-AUPIA-v{V} if available] |
+
+**Evidence**: [PIA completed, APP compliance, data minimisation, consent mechanisms, OAIC notification]
+
+**Gaps**: [Missing PIA, non-compliant data handling, consent gaps]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 8: Make Source Code Open
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Code repository, licence, open-source strategy, exemption justification if not open]
+
+**Gaps**: [Proprietary dependencies, missing licence, no public repo]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 9: Make It Accessible
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+| **WCAG Level** | [2.2 AA / 2.1 AA / Below AA] |
+
+**Evidence**: [Accessibility testing, assistive technology coverage, accessibility statement, audit results]
+
+**Gaps**: [WCAG failures, untested assistive technologies, missing accessibility statement]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 10: Test the Service
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Test strategy, test types (unit, integration, UAT, accessibility, performance, security), coverage metrics]
+
+**Gaps**: [Missing test types, low coverage, no performance testing]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 11: Measure Performance
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [KPIs defined, measurement tools, reporting cadence, baseline metrics]
+
+**Gaps**: [Missing KPIs, no measurement tooling, no baseline]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 12: Don't Forget the Non-Digital Experience
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Assisted digital channel, phone support, in-person options, channel integration]
+
+**Gaps**: [No assisted digital, missing channels, disconnected experience]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+### Criterion 13: Encourage Everyone to Use the Digital Service
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Met / ⚠️ Partially Met / ❌ Not Met / N/A] |
+
+**Evidence**: [Channel shift strategy, take-up targets, migration plan from legacy channels]
+
+**Gaps**: [No channel shift plan, no take-up measurement]
+
+**Remediation**: [Actions, owners, dates]
+
+---
+
+## Compliance Summary
+
+| # | Criterion | Status | Gap Count |
+|---|----------|--------|-----------|
+| 1 | Understand user needs | [✅/⚠️/❌/N/A] | [n] |
+| 2 | Have a multidisciplinary team | [✅/⚠️/❌/N/A] | [n] |
+| 3 | Agile and user-centred process | [✅/⚠️/❌/N/A] | [n] |
+| 4 | Understand tools and systems | [✅/⚠️/❌/N/A] | [n] |
+| 5 | Make it secure | [✅/⚠️/❌/N/A] | [n] |
+| 6 | Consistent and responsive design | [✅/⚠️/❌/N/A] | [n] |
+| 7 | Protect users' privacy | [✅/⚠️/❌/N/A] | [n] |
+| 8 | Make source code open | [✅/⚠️/❌/N/A] | [n] |
+| 9 | Make it accessible | [✅/⚠️/❌/N/A] | [n] |
+| 10 | Test the service | [✅/⚠️/❌/N/A] | [n] |
+| 11 | Measure performance | [✅/⚠️/❌/N/A] | [n] |
+| 12 | Non-digital experience | [✅/⚠️/❌/N/A] | [n] |
+| 13 | Encourage digital use | [✅/⚠️/❌/N/A] | [n] |
+
+**Overall**: [n] Met | [n] Partially Met | [n] Not Met | [n] N/A
+
+---
+
+## Assessment Readiness
+
+| Risk | Criterion | Impact | Mitigation |
+|------|----------|--------|-----------|
+| [Risk description] | [#] | [High/Medium/Low] | [Mitigation action] |
+
+---
+
+## External References
+
+## ArcKit Evidence Integration
+
+| Evidence Area | ArcKit Artefact | How It Supports DSS Assessment | Gap / Follow-up |
+|---------------|-----------------|--------------------------------|-----------------|
+| Service architecture | `/arckit:diagram` / ARC-*-DIAG-* | Service boundaries, channels, dependencies, security zones, and user journeys | [Gap / follow-up] |
+| Service data flows | `/arckit:dfd` / ARC-*-DFD-* | Privacy, integration, non-digital channel, analytics, and reporting flows | [Gap / follow-up] |
+| Data governance | `/arckit:data-model` / ARC-*-DATA-* | Personal data, analytics, reporting, retention, and data-quality evidence | [Gap / follow-up] |
+| Live operations | `/arckit:servicenow` / ARC-*-SNOW-* | Service ownership, support groups, SLAs, incident routing, and change workflows | [Gap / follow-up] |
+| Delivery and compliance risks | `/arckit:risk` / ARC-*-RISK-* | Assessment gaps, launch risks, and remediation ownership | [Gap / follow-up] |
+| Criteria traceability | `/arckit:traceability` / ARC-*-TRAC-* | DSS criteria mapped to requirements, evidence, owners, and remediation actions | [Gap / follow-up] |
+| Coverage view | `/arckit:graph-report` | AUDSS coverage across architecture, privacy, security, risk, and traceability artefacts | [Gap / follow-up] |
+| Capability uplift | `/arckit:maturity-model` / ARC-*-MMOD-* | Service maturity across discovery, delivery, operations, and measurement | [Gap / follow-up] |
+
+### Document Register
+
+| Doc ID | Filename | Type | Source Location | Description |
+|--------|----------|------|-----------------|-------------|
+| DSS | DTA Digital Service Standard | Standard | dta.gov.au | Primary assessment framework |
+
+### Citations
+
+| Citation ID | Doc ID | Page/Section | Category | Quoted Passage |
+|-------------|--------|--------------|----------|----------------|
+| — | — | — | — | — |
+
+### Unreferenced Documents
+
+| Filename | Source Location | Reason |
+|----------|-----------------|--------|
+| — | — | — |
+
+---
+
+## Visual Evidence Decision Rule
+
+Generate companion visual artefacts only when the available evidence includes enough structure to identify real nodes and relationships. If evidence is incomplete but structurally useful, create a clearly marked draft visual with `Pending Input` labels. If structural evidence is insufficient, do not create a diagram; record a Visual Evidence Gap and list the minimum inputs needed.
+
+---
+
+**Generated by**: ArcKit `/arckit:au-dss` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]