arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/au-pspf-template.md

@@ -0,0 +1,380 @@
+# PSPF Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:au-pspf`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:au-pspf` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: entity, PSPF applicability, current self-assessment posture, key gaps, AGD reporting status.]
+
+---
+
+## Entity Profile
+
+| Field | Value |
+|-------|-------|
+| **Entity Name** | [Entity name] |
+| **Entity Type** | [Non-corporate Commonwealth / Corporate Commonwealth / Contractor / Panel Member / State Govt with flow-down] |
+| **PSPF Applicability Driver** | [Direct / Contractual flow-down — cite source] |
+| **Chief Security Officer (CSO)** | [Name + role + clearance] |
+| **CSO Authority** | [Reporting line, signing authority] |
+| **PSPF Edition Used** | [E.g., PSPF 2024 release] |
+| **Last AGD Self-Assessment Submission** | [YYYY-MM-DD] |
+| **Self-Assessed Maturity Level** | [Compliant / Substantially Compliant / Partly Compliant / Not Compliant] |
+| **Assessment Date** | [YYYY-MM-DD] |
+| **Assessor** | [Name + role] |
+
+---
+
+## Outcome 1: Security Governance
+
+### CR1: Role of accountable authority
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅ Compliant / ⚠️ Substantially Compliant / ⚠️ Partly Compliant / ❌ Not Compliant] |
+
+**Evidence**: [Accountable authority designated, security leadership, governance documents]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR2: Management structures and responsibilities
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [CSO designated, security committee, executive structures]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR3: Security planning and risk management
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Security plan, risk-management plan; cross-ref ARC-{P}-AUISM Domain 1]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR4: Security maturity monitoring
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Annual self-assessment process; AGD reporting submission]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+## Outcome 2: Information Security
+
+### CR5: Sensitive and classified information
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Classification policy, marking + handling procedures, classification training]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR6: Access to information
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Need-to-know enforcement; security-clearance verification at point of access]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR7: Safeguarding information from cyber threats
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+| **E8 Cross-Reference** | [ARC-{P}-AUE8-v*] |
+| **ISM Cross-Reference** | [ARC-{P}-AUISM-v*] |
+
+**Evidence**: [Defer to ISM applicability statement + E8 posture]
+
+**Gap**: [Beyond-E8 gaps]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR8: Sensitive and classified discussions and communications
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Approved communications channels for classified content; meeting room ratings; encrypted comms]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+## Outcome 3: Personnel Security
+
+### CR9: Eligibility and suitability
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [AGSVA clearance process; vetting workflow; cleared-personnel inventory]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR10: Ongoing assessment
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Continuous suitability programme, periodic reviews, change-of-circumstance reporting]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR11: Separation of personnel
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Off-boarding clearance debrief, access revocation cadence, return of equipment]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR12: Insider threat
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Insider threat programme, detection capability, role-based controls]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+## Outcome 4: Physical Security
+
+### CR13: Entity facilities
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌ / Inherited from cloud provider IRAP] |
+
+**Evidence**: [Physical security zones, facility ratings, access controls]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR14: Working off-site
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Remote work policy, travel security, mobile device management]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR15: Physical security risk
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Physical risk assessment, treatment plan, incident response]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+### CR16: Supporting services
+
+| Aspect | Detail |
+|--------|--------|
+| **Status** | [✅/⚠️/❌] |
+
+**Evidence**: [Cleaning, maintenance, contractor access governance, escort policy]
+
+**Gap**: [Description]
+
+**Remediation**: [Actions, owners, target dates]
+
+---
+
+## PSPF Annual Self-Assessment
+
+| Aspect | Detail |
+|--------|--------|
+| **Self-Assessment Cycle** | [Annual; deadline 31 October] |
+| **Last Submission Date** | [YYYY-MM-DD] |
+| **Self-Assessed Levels** | [List per Core Requirement] |
+| **AGD Feedback** | [Notes from last submission] |
+| **Material Improvements Since Last** | [Description] |
+| **Identified Issues for Next Cycle** | [Description] |
+
+---
+
+## Compliance Summary
+
+| Outcome | CR | Title | Status | Gap Count |
+|---------|----|-------|--------|-----------|
+| 1. Governance | CR1 | Role of accountable authority | [✅/⚠️/❌] | [n] |
+| 1. Governance | CR2 | Management structures | [✅/⚠️/❌] | [n] |
+| 1. Governance | CR3 | Security planning + risk | [✅/⚠️/❌] | [n] |
+| 1. Governance | CR4 | Security maturity monitoring | [✅/⚠️/❌] | [n] |
+| 2. Information | CR5 | Sensitive/classified information | [✅/⚠️/❌] | [n] |
+| 2. Information | CR6 | Access to information | [✅/⚠️/❌] | [n] |
+| 2. Information | CR7 | Safeguarding from cyber threats | [✅/⚠️/❌] | [n] |
+| 2. Information | CR8 | Discussions + communications | [✅/⚠️/❌] | [n] |
+| 3. Personnel | CR9 | Eligibility + suitability | [✅/⚠️/❌] | [n] |
+| 3. Personnel | CR10 | Ongoing assessment | [✅/⚠️/❌] | [n] |
+| 3. Personnel | CR11 | Separation of personnel | [✅/⚠️/❌] | [n] |
+| 3. Personnel | CR12 | Insider threat | [✅/⚠️/❌] | [n] |
+| 4. Physical | CR13 | Entity facilities | [✅/⚠️/❌] | [n] |
+| 4. Physical | CR14 | Working off-site | [✅/⚠️/❌] | [n] |
+| 4. Physical | CR15 | Physical security risk | [✅/⚠️/❌] | [n] |
+| 4. Physical | CR16 | Supporting services | [✅/⚠️/❌] | [n] |
+
+**Overall PSPF Maturity**: [Compliant / Substantially Compliant / Partly Compliant / Not Compliant]
+
+---
+
+## Recommendations
+
+### Quick Wins ( < 30 days)
+
+| # | Recommendation | Outcome / CR | Effort |
+|---|---------------|--------------|--------|
+| 1 | [Recommendation] | [Outcome.CR] | [Low/Medium] |
+
+### Short-Term (30–90 days)
+
+| # | Recommendation | Outcome / CR | Effort |
+|---|---------------|--------------|--------|
+| 1 | [Recommendation] | [Outcome.CR] | [Medium/High] |
+
+### Medium-Term (90–180 days)
+
+| # | Recommendation | Outcome / CR | Effort |
+|---|---------------|--------------|--------|
+| 1 | [Recommendation] | [Outcome.CR] | [High] |
+
+---
+
+## External References
+
+## ArcKit Evidence Integration
+
+| Evidence Area | ArcKit Artefact | How It Supports PSPF Assessment | Gap / Follow-up |
+|---------------|-----------------|---------------------------------|-----------------|
+| Security boundaries | `/arckit:diagram` / ARC-*-DIAG-* | Deployment, facility, physical/logical boundary, and working-off-site evidence | [Gap / follow-up] |
+| Information classification | `/arckit:data-model` / ARC-*-DATA-* | Classification, sensitivity, retention, information ownership, and handling requirements | [Gap / follow-up] |
+| Supporting services | `/arckit:servicenow` / ARC-*-SNOW-* | ServiceNow/CMDB ownership, support groups, supporting services, incident/change workflows | [Gap / follow-up] |
+| PSPF risks | `/arckit:risk` / ARC-*-RISK-* | Core-requirement gaps, annual self-assessment findings, and treatment ownership | [Gap / follow-up] |
+| Core-requirement traceability | `/arckit:traceability` / ARC-*-TRAC-* | PSPF requirements mapped to policies, controls, owners, evidence, and actions | [Gap / follow-up] |
+| Coverage view | `/arckit:graph-report` | AUPSPF coverage across AU compliance, risk, traceability, and operations artefacts | [Gap / follow-up] |
+| Capability uplift | `/arckit:maturity-model` / ARC-*-MMOD-* | Security governance maturity baseline and uplift roadmap | [Gap / follow-up] |
+
+### Document Register
+
+| Doc ID | Filename | Type | Source | Description |
+|--------|----------|------|--------|-------------|
+| PSPF | Protective Security Policy Framework | Standard | protectivesecurity.gov.au | Primary framework |
+| AUE8 | ARC-{P}-AUE8-v* | ArcKit Artefact | projects/ | E8 cross-ref (Outcome 2) |
+| AUISM | ARC-{P}-AUISM-v* | ArcKit Artefact | projects/ | ISM cross-ref (Outcome 2) |
+| AUPIA | ARC-{P}-AUPIA-v* | ArcKit Artefact | projects/ | PIA cross-ref (Outcomes 2 + 3) |
+| AUDISP | ARC-{P}-AUDISP-v* | ArcKit Artefact | projects/ | DISP cross-ref where applicable |
+
+### Verification
+
+| Standard | URL | Verification Date |
+|----------|-----|-------------------|
+| PSPF | https://www.protectivesecurity.gov.au/ | [YYYY-MM-DD] |
+| ASD ISM | https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism | [YYYY-MM-DD] |
+
+---
+
+## Visual Evidence Decision Rule
+
+Generate companion visual artefacts only when the available evidence includes enough structure to identify real nodes and relationships. If evidence is incomplete but structurally useful, create a clearly marked draft visual with `Pending Input` labels. If structural evidence is insufficient, do not create a diagram; record a Visual Evidence Gap and list the minimum inputs needed.
+
+---
+
+**Generated by**: ArcKit `/arckit:au-pspf` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/au-soci-cirmp-template.md

@@ -0,0 +1,206 @@
+# SOCI Act / Critical Infrastructure Risk Management Program Pack
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:au-soci-cirmp`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line, where applicable, MUST be: -->
+<!-- | Classification | UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET | -->
+<!-- Note: SOCI protected information is distinct from PSPF PROTECTED classification. -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:au-soci-cirmp` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Summarise likely SOCI applicability, critical asset context, CIRMP readiness, highest material risks, reporting obligations, and immediate evidence gaps.]
+
+---
+
+## Critical Asset and Responsible Entity Context
+
+| Field | Value |
+|-------|-------|
+| **Asset / System Name** | [Name] |
+| **SOCI Sector** | [Communications / Financial services and markets / Data storage or processing / Defence industry / Higher education and research / Energy / Food and grocery / Healthcare and medical / Space technology / Transport / Water and sewerage / To be confirmed] |
+| **Asset Class** | [Asset class / threshold / to be confirmed] |
+| **Responsible Entity** | [Entity] |
+| **Operator** | [Entity] |
+| **Direct Interest Holders** | [Known / to be confirmed] |
+| **Regulator** | [CISC / sector regulator / other] |
+| **Board / Governing Body** | [Board / council / governing body] |
+| **Protected Information Handling Required** | [Yes / No / To be confirmed] |
+| **Assessment Date** | [YYYY-MM-DD] |
+
+---
+
+## SOCI Applicability Assessment
+
+| Obligation Area | Applies? | Evidence | Gap / Legal Confirmation Needed |
+|-----------------|----------|----------|---------------------------------|
+| Critical asset registration | [Yes / No / Unclear] | [Evidence] | [Gap] |
+| Responsible entity obligations | [Yes / No / Unclear] | [Evidence] | [Gap] |
+| Written CIRMP | [Yes / No / Unclear] | [Evidence] | [Gap] |
+| Annual CIRMP report | [Yes / No / Unclear] | [Evidence] | [Gap] |
+| Cyber incident reporting | [Yes / No / Unclear] | [Evidence] | [Gap] |
+| Protected information obligations | [Yes / No / Unclear] | [Evidence] | [Gap] |
+| Government assistance powers awareness | [Yes / No / Unclear] | [Evidence] | [Gap] |
+
+---
+
+## ArcKit Architecture and Data Evidence Map
+
+| Evidence Area | ArcKit Artefact | How It Supports CIRMP | Gap / Follow-up |
+|---------------|-----------------|-----------------------|-----------------|
+| Architecture diagrams | `/arckit:diagram` / ARC-*-DIAG-* | Critical components, boundaries, deployment zones, third parties, and operational dependencies | [Gap / follow-up] |
+| Data flow diagrams | `/arckit:dfd` / ARC-*-DFD-* | Protected information flows, operational data flows, external entities, stores, and reporting pathways | [Gap / follow-up] |
+| Data model | `/arckit:data-model` / ARC-*-DATA-* | Protected information, personal information, critical data, classification, retention, and owners | [Gap / follow-up] |
+| ServiceNow / CMDB | `/arckit:servicenow` / ARC-*-SNOW-* | CMDB CIs, service dependencies, support groups, SLAs, incident queues, and change controls | [Gap / follow-up] |
+| Risk register | `/arckit:risk` / ARC-*-RISK-* | Material risks, residual risks, treatments, and risk owners | [Gap / follow-up] |
+| Traceability matrix | `/arckit:traceability` / ARC-*-TRAC-* | Mapping from SOCI obligations to requirements, evidence, owners, controls, and actions | [Gap / follow-up] |
+| Graph report | `/arckit:graph-report` | Coverage view across AU compliance, architecture, risk, traceability, and operations artefacts | [Gap / follow-up] |
+| Maturity model | `/arckit:maturity-model` | Maturity view across cyber, personnel, supply chain, physical, natural hazard, and governance domains | [Gap / follow-up] |
+
+---
+
+## CIRMP Governance Model
+
+| Governance Element | Current Position | Evidence | Owner | Gap |
+|--------------------|------------------|----------|-------|-----|
+| Accountable executive | [Defined / Partial / Missing] | [Evidence] | [Owner] | [Gap] |
+| Board / governing body approval | [Defined / Partial / Missing] | [Evidence] | [Owner] | [Gap] |
+| Risk committee oversight | [Defined / Partial / Missing] | [Evidence] | [Owner] | [Gap] |
+| Annual report preparation | [Defined / Partial / Missing] | [Evidence] | [Owner] | [Gap] |
+| Evidence repository | [Defined / Partial / Missing] | [Evidence] | [Owner] | [Gap] |
+| Review cadence | [Defined / Partial / Missing] | [Evidence] | [Owner] | [Gap] |
+
+---
+
+## CIRMP Hazard Domain Assessment
+
+| Hazard Domain | Material Risks | Relevant Impact | Existing Controls | Evidence | Gap | Owner |
+|---------------|----------------|-----------------|-------------------|----------|-----|-------|
+| Cyber and information security | [Risks] | [Impact] | [Controls] | [AUE8 / AUISM / AUOT / AUPIA / AUNDB] | [Gap] | [Owner] |
+| Personnel | [Risks] | [Impact] | [Controls] | [Screening / access / training] | [Gap] | [Owner] |
+| Supply chain | [Risks] | [Impact] | [Controls] | [Supplier register / contracts / assurance] | [Gap] | [Owner] |
+| Physical security | [Risks] | [Impact] | [Controls] | [Facility controls / access logs] | [Gap] | [Owner] |
+| Natural hazards | [Risks] | [Impact] | [Controls] | [BCP / DR / resilience plan] | [Gap] | [Owner] |
+
+---
+
+## Cyber and Information Security Evidence
+
+| Evidence Source | Reference | Use in CIRMP |
+|-----------------|-----------|--------------|
+| AUE8 | [ARC-{P}-AUE8-v*] | Essential Eight cyber baseline |
+| AUISM | [ARC-{P}-AUISM-v*] | ISM control applicability and gaps |
+| AUOT | [ARC-{P}-AUOT-v* / N/A] | OT cyber evidence where the asset includes OT |
+| AUPIA | [ARC-{P}-AUPIA-v*] | Privacy and information handling evidence |
+| AUNDB | [ARC-{P}-AUNDB-v*] | Breach and incident notification process |
+| RISK | [ARC-{P}-RISK-v*] | Residual material risks and treatments |
+
+---
+
+## Personnel, Supply Chain, Physical Security, and Natural Hazard Evidence
+
+| Domain | Evidence Held | Evidence Gap | Action |
+|--------|---------------|--------------|--------|
+| Personnel | [Screening, access governance, critical worker controls] | [Gap] | [Action] |
+| Supply chain | [Major supplier list, privileged supplier access, contracts] | [Gap] | [Action] |
+| Physical security | [Physical critical components, access control, visitor process] | [Gap] | [Action] |
+| Natural hazards | [BCP, resilience plan, disaster recovery, dependency maps] | [Gap] | [Action] |
+
+---
+
+## Incident Reporting and Notification Pathways
+
+| Scenario | Reporting Trigger | Timeframe | Owner | Evidence / Procedure |
+|----------|-------------------|-----------|-------|----------------------|
+| Cyber incident with relevant impact | [Trigger] | [12-hour / 72-hour / other] | [Owner] | [Procedure] |
+| Personal information breach | [NDB trigger] | [OAIC timeframe] | [Owner] | [AUNDB reference] |
+| Physical security incident | [Trigger] | [Timeframe] | [Owner] | [Procedure] |
+| Supplier incident | [Trigger] | [Timeframe] | [Owner] | [Procedure] |
+| Protected information disclosure issue | [Trigger] | [Timeframe] | [Owner] | [Procedure] |
+
+---
+
+## Annual Report and Attestation Readiness
+
+| Requirement | Current Position | Evidence | Gap |
+|-------------|------------------|----------|-----|
+| CIRMP documented and approved | [Ready / Partial / Gap] | [Evidence] | [Gap] |
+| CIRMP operating evidence collected | [Ready / Partial / Gap] | [Evidence] | [Gap] |
+| Material risks reviewed | [Ready / Partial / Gap] | [Evidence] | [Gap] |
+| Board / governing body approval path | [Ready / Partial / Gap] | [Evidence] | [Gap] |
+| Annual report submission owner | [Ready / Partial / Gap] | [Evidence] | [Gap] |
+
+---
+
+## Operations, CMDB, and Traceability Integration
+
+| Integration Point | Source Artefact | Target Artefact / Register | Evidence to Maintain |
+|-------------------|-----------------|----------------------------|----------------------|
+| Critical component ownership | ARC-*-DIAG-* / ARC-*-SNOW-* | CMDB CI owner, support group, SLA, and incident queue | [Owner / support / SLA] |
+| Protected-information flow | ARC-*-DFD-* / ARC-*-DATA-* | Traceability matrix and protected-information register | [Flow / entity / classification] |
+| CIRMP material risk | ARC-*-AUSOCI-* | Risk register and maturity-model assessment | [Risk ID / maturity domain] |
+| Annual report evidence | ARC-*-AUSOCI-* / ARC-*-TRAC-* | Graph-report coverage and board/governing-body evidence pack | [Evidence status / approver] |
+
+---
+
+## Cross-Sector vs Sector-Specific Obligations
+
+This artefact covers general SOCI/CIRMP obligations. Record sector-specific overlays separately.
+
+| Sector-Specific Area | In Scope Here? | Follow-up Artefact |
+|----------------------|----------------|--------------------|
+| AESCSF energy maturity | No | `/arckit:au-aescsf` when available |
+| AER ring-fencing | No | `/arckit:au-energy-compliance` when available |
+| NER / NGR obligations | No | `/arckit:au-energy-compliance` when available |
+| AEMO market/system obligations | No | `/arckit:au-energy-compliance` when available |
+| Other sector regulator obligations | No | Sector-specific overlay or custom command |
+
+---
+
+## Recommendations
+
+| Priority | Action | Owner | Due Date | Evidence Update | Residual Risk |
+|----------|--------|-------|----------|-----------------|---------------|
+| Immediate | [Action] | [Owner] | [Date] | [Artefact / register] | [Risk] |
+| 30-90 days | [Action] | [Owner] | [Date] | [Artefact / register] | [Risk] |
+| 90-180 days | [Action] | [Owner] | [Date] | [Artefact / register] | [Risk] |
+| Strategic | [Action] | [Owner] | [Date] | [Artefact / register] | [Risk] |
+
+---
+
+## External References
+
+| Ref | Source | Version / Date Verified | Relevance |
+|-----|--------|-------------------------|-----------|
+| SOCI-1 | Security of Critical Infrastructure Act 2018 (SOCI) | [Date verified] | Primary legal framework |
+| SOCI-2 | Security of Critical Infrastructure Act 2018, Federal Register of Legislation | [Compilation / date verified] | Authoritative legal text |
+| SOCI-3 | CISC Regulatory obligations | [Date verified] | Operational obligation guidance |
+| SOCI-4 | Responsible Entity CIRMP annual report guidance | [Date verified] | Annual reporting and approval expectation |
+| SOCI-5 | Protected information under the SOCI Act | [Date verified] | Protected-information handling |
+| AUE8 | ASD Essential Eight | [Version / date verified] | Cyber baseline evidence |
+| AUISM | ASD Information Security Manual | [Edition / date verified] | Control evidence cross-reference |
+
+---
+
+## Visual Evidence Decision Rule
+
+Generate companion visual artefacts only when the available evidence includes enough structure to identify real nodes and relationships. If evidence is incomplete but structurally useful, create a clearly marked draft visual with `Pending Input` labels. If structural evidence is insufficient, do not create a diagram; record a Visual Evidence Gap and list the minimum inputs needed.
+
+---
+
+**Generated by**: ArcKit `/arckit:au-soci-cirmp` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]