arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-fitaa-template.md

@@ -0,0 +1,156 @@
+# Canada FITAA Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-fitaa`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-fitaa` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the project's exposure to FITAA, the registration model adopted, the public-vs-protected severance posture, and the headline Charter §2 risk findings. Note any statutory-currency caveats — section numbers or regulations that were `<TBC at draft time>`.]
+
+## Activity Scoping
+
+| Item | Value |
+|------|-------|
+| Department / agency | [name] |
+| Service / programme | [name] |
+| Activities under review | [advocacy / convening / communications / engagement / etc.] |
+| In-scope arrangements | [arrangements with foreign principals to influence government decisions / political processes / public discourse] |
+| Excluded categories | [journalism, academic research, diplomatic activity — subject to standard FITAA exemptions, cite section `<TBC at draft time>`] |
+| Decision-tree outcome | [REGISTRABLE / NOT REGISTRABLE / MIXED — explain] |
+
+### Decision Tree (textual)
+
+1. Is there an arrangement with a foreign principal? — [Y/N]
+2. Is the arrangement intended to influence a government / political / public-discourse outcome? — [Y/N]
+3. Does an exclusion apply (journalism, academic research, diplomatic activity)? — [Y/N, cite `<TBC at draft time>`]
+4. Outcome: [REGISTRABLE / NOT REGISTRABLE / MIXED]
+
+## Arrangement Register Design
+
+| Field | Public / Protected | Source | Notes |
+|-------|--------------------|--------|-------|
+| Registrant identity | Public | Registrant submission | Verified per workflow step 2 |
+| Foreign principal | Public | Registrant submission | Identity verified |
+| Activity type | Public | Registrant submission | Controlled vocabulary |
+| Start / end dates | Public | Registrant submission | Material change → 14-day update |
+| Financial flows | Public / Protected | Registrant submission | Public bands; granular figures protected |
+| Investigative metadata | Protected | Commissioner / RCMP / CSIS | National-security exemptions per ATIP-Act §15/§16 |
+| Severance map | Protected | System-generated | Audited per `ca-atip` rules |
+
+Material-change cadence: registrants must update the register within **14 days** of a material change. The system MUST enforce a 14-day reminder + lockout if the registrant misses the window.
+
+## Registration Workflow
+
+| Step | Channel | Owner | SLA | Notes |
+|------|---------|-------|-----|-------|
+| 1. Submission | Web (bilingual) / paper fallback | Registrant | n/a | Per `ca-ola` |
+| 2. Identity verification | [identity proofing approach] | Commissioner's office | [SLA] | Risk-tiered |
+| 3. Acknowledgement + registration ID | Email + portal | System | Same business day | Bilingual |
+| 4. Public register publication | Web | System | Within `<TBC>` of acknowledgement | Severance applied |
+| 5. Material-change update | Web | Registrant | Within 14 days of change | 14-day clock |
+
+## Public Register vs Protected Investigative Data
+
+```mermaid
+flowchart LR
+    R[Registrant submission] --> V[Identity verification]
+    V --> S[Severance engine]
+    S --> P[Public register]
+    S --> I[Protected investigative store]
+    I --> C[Commissioner / RCMP / CSIS analysts]
+    P --> X[Public website search]
+```
+
+| Severance rule | Field | Public outcome | Protected outcome |
+|----------------|-------|----------------|-------------------|
+| National-security exemption | Investigative metadata | Suppressed | Visible to cleared analysts |
+| Personal-information minimisation | Granular financial figures | Bands only | Full figures |
+| Withdrawal | Withdrawn registration | Tombstone retained per `<TBC>` | Full record retained for investigative cycle |
+| Correction | Erroneous fact | Public correction notice | Audit trail preserved |
+
+Cross-reference `ca-atip` for the formal severance design and `ca-pia` for the personal-information minimisation rationale.
+
+## Commissioner Liaison Protocol
+
+| Trigger | Cadence | Contact | Artefact |
+|---------|---------|---------|----------|
+| Suspected non-registration | Ad hoc | Commissioner's office (designated liaison) | Referral memo |
+| Suspected falsification | Ad hoc | Commissioner's office + RCMP | Evidence package |
+| Routine reporting | Quarterly | Commissioner's office | Quarterly compliance report |
+| RCMP / CSIS coordination | Per `ca-soia` MOU | Departmental security officer | MOU + tasking record |
+| Annual report contribution | Annual | Commissioner's office | Departmental return |
+
+## Charter Risk Register
+
+Cross-reference `ca-charter` for the full Charter §2 expression and association analysis.
+
+| Charter section | Risk | Mitigation | Residual |
+|-----------------|------|------------|----------|
+| s.2(b) Freedom of expression | Chilling effect on advocacy / journalism | Tight scoping of registrable activity; journalism exclusion clearly applied; tombstone-only public record after withdrawal | [Low / Medium / High] |
+| s.2(b) Freedom of expression | Over-broad public exposure of registrant identity | Severance engine; public bands not granular figures; option for protected-only registration in narrow categories `<TBC at draft time>` | [Low / Medium / High] |
+| s.2(d) Freedom of association | Disincentive to legitimate diaspora / civil-society engagement | Clear public-interest framing; bilingual plain-language guidance; community-engagement plan | [Low / Medium / High] |
+| s.2(d) Freedom of association | Disproportionate burden on small civil-society organisations | Tiered registration burden; small-volume exemption `<TBC>` | [Low / Medium / High] |
+
+## Compliance Schedule (registrant-side)
+
+| Trigger | Clock | Owner | Penalty exposure |
+|---------|-------|-------|------------------|
+| New registrable arrangement | 14 days from arrangement start | Registrant | FITAA offence §`<TBC at draft time>` — fine up to `<TBC>` |
+| Material change | 14 days from change | Registrant | FITAA offence §`<TBC at draft time>` — fine up to `<TBC>` |
+| End of arrangement | 14 days from end | Registrant | FITAA offence §`<TBC at draft time>` — fine up to `<TBC>` |
+| False / misleading statement | At submission | Registrant | FITAA offence §`<TBC at draft time>` — fine up to `<TBC>` and/or imprisonment |
+| Failure to register | Continuing offence | Registrant | FITAA offence §`<TBC at draft time>` — daily-accrual fine `<TBC>` |
+
+## Open Items
+
+Explicit statutory currency caveats — review and update before publication.
+
+- FITAA Regulations: status `<TBC at draft time>` — verify against Canada Gazette II at the verification date below.
+- FITAA section numbering for offences and exemptions: marked `<TBC at draft time>` throughout; reconcile against the consolidated Justice Laws text.
+- Commissioner's published guidance: identify any operational guidance issued after the verification date and incorporate.
+- ATIP-Act severance design: pending `ca-atip` artefact.
+- Charter §2 detailed analysis: pending `ca-charter` artefact.
+- Privacy Impact Assessment: pending `ca-pia` artefact.
+- Algorithmic Impact Assessment: required if registration triage uses any automated decision-making — pending `ca-aia` artefact.
+- Bilingual content review: pending `ca-ola` artefact.
+- RCMP / CSIS MOU: pending `ca-soia` artefact.
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-FITAA-2024 | Foreign Influence Transparency and Accountability Act (Bill C-70, 2024) | <https://laws-lois.justice.gc.ca/> | [YYYY-MM-DD] |
+| CA-FITAA-REG | FITAA Regulations (status: `<TBC at draft time>`) | <https://gazette.gc.ca/> | [YYYY-MM-DD] |
+| CA-OCFIT | Office of the Commissioner of Foreign Influence Transparency — published guidance | [URL when published] | [YYYY-MM-DD] |
+| CA-CHARTER | Canadian Charter of Rights and Freedoms | <https://laws-lois.justice.gc.ca/eng/const/page-12.html> | [YYYY-MM-DD] |
+| CA-ATIP-ACT | Access to Information Act | <https://laws-lois.justice.gc.ca/eng/acts/A-1/> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [FITAA-1] | CA-FITAA-2024 | Activity scoping triggers `<TBC at draft time>` | Activity Scoping |
+| [FITAA-2] | CA-FITAA-2024 | Registration obligations `<TBC at draft time>` | Arrangement Register Design |
+| [FITAA-3] | CA-FITAA-2024 | Offences and penalties `<TBC at draft time>` | Compliance Schedule |
+| [CHARTER-1] | CA-CHARTER | s.2(b) | Charter Risk Register |
+| [CHARTER-2] | CA-CHARTER | s.2(d) | Charter Risk Register |
+| [ATIP-1] | CA-ATIP-ACT | §15 (national security) | Public vs Protected severance |
+| [ATIP-2] | CA-ATIP-ACT | §16 (law enforcement) | Public vs Protected severance |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-gc-digital-standards-template.md

@@ -0,0 +1,208 @@
+# Canada GC Digital Standards Conformance Scorecard
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-gc-digital-standards`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-gc-digital-standards` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the service, the conformance posture across the 10 GC Digital Standards, the top remediation actions, the per-standard maturity headline, and any standards stuck at Initial. Note any cross-cutting concerns — accessibility shortfalls, default-private working, or unresolved ethical-AI items.]
+
+## Service Description
+
+| Item | Value |
+|------|-------|
+| Department / agency | [name] |
+| Service name | [name] |
+| Owner | [accountable role / ADM] |
+| Operator | [internal team / contractor / processor] |
+| User populations | [Canadians / federal employees / clients of programme X / etc.] |
+| Lifecycle stage | [Concept / Alpha / Beta / Live / Modification / Retirement] |
+| Key artefacts | [REQ, service-assessment, retrospectives, accessibility audits — link IDs] |
+
+## Per-Standard Assessment
+
+### Standard 1 — Design with users
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [user-research outputs, usability tests, beta findings — link artefacts] |
+| Gaps | [missing user groups, unrepresented official-language cohort, accessibility gaps in research] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 2 — Iterate and improve frequently
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [release cadence, retro outputs, A/B tests, telemetry-driven changes] |
+| Gaps | [batch releases, no feedback loop, missing CI/CD coverage] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 3 — Work in the open by default
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [open repos, public design notes, GitHub presence, blog posts, ADRs in the open] |
+| Gaps | [default-private repos, time-boxed exceptions overdue, no public roadmap] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 4 — Use open standards and solutions
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [adoption of open standards, OSS components, registers of approved technology] |
+| Gaps | [proprietary lock-in, missing open API contracts, unjustified bespoke build] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 5 — Address security and privacy risks
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [PIA, ITSG-33 controls, ATO, threat-risk assessment — cross-reference `ca-pia` and `ca-itsg-33`] |
+| Gaps | [missing PIA, expired ATO, unmitigated threats] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 6 — Build in accessibility from the start
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [WCAG 2.1 AA / 2.2 AA audit, automated and manual testing, assistive-tech reviews, departmental Accessibility Plan] |
+| Gaps | [unresolved WCAG criteria, missing manual audit, no plain-language alternatives] |
+| Remediation actions | [actions to close gaps — referencing the *Accessible Canada Act* statutory floor] |
+| Owner | [role — accessibility lead] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 7 — Empower staff to deliver better services
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [tooling access, training, multi-disciplinary teams, devolved decision rights] |
+| Gaps | [restricted tooling, classification-creep blocking productivity, decision bottlenecks] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 8 — Be good data stewards
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [data inventory, retention schedule, open-data publication, lineage documentation] |
+| Gaps | [no retention enforcement, missing PIB linkage, no open-data candidates identified] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role — data steward] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 9 — Design ethical services
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [AIA outputs, fairness testing, bias audits, ethical-review board sign-off — cross-reference `ca-aia`] |
+| Gaps | [missing AIA, no bias audit, no human-in-the-loop on automated decisions] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+### Standard 10 — Collaborate widely
+
+| Dimension | Value |
+|-----------|-------|
+| Evidence | [cross-departmental working groups, GC Notify / GC Forms / Code reuse, partnerships with provinces / academia] |
+| Gaps | [siloed delivery, no reuse of GC platforms, partner agencies excluded] |
+| Remediation actions | [actions to close gaps] |
+| Owner | [role] |
+| Target date | [YYYY-MM-DD] |
+| Maturity | [Initial / Repeatable / Defined / Measured / Optimising] |
+
+## Cross-Cutting Themes
+
+| Theme | Standards touched | Status | Action |
+|-------|-------------------|--------|--------|
+| Accessibility (WCAG 2.1 AA / 2.2 AA, *Accessible Canada Act*) | 6 | [Conformant / Partial / Non-conformant] | [audit close-out, statutory plan refresh] |
+| Open data and open code | 3, 4, 8 | [Conformant / Partial / Non-conformant] | [open repos, publish open data, justify exceptions] |
+| Ethical AI | 9 | [Conformant / Partial / Non-conformant] | [AIA via `ca-aia`, fairness testing, oversight] |
+| User research practice | 1, 2 | [Conformant / Partial / Non-conformant] | [continuous research, OL coverage, accessibility-inclusive recruitment] |
+
+## Maturity Roadmap
+
+| Standard | Current maturity | Target maturity | Milestone | Date | Owner |
+|----------|------------------|------------------|-----------|------|-------|
+| 1 — Design with users | [Initial / Repeatable / Defined / Measured / Optimising] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 2 — Iterate and improve frequently | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 3 — Work in the open by default | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 4 — Use open standards and solutions | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 5 — Address security and privacy risks | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 6 — Build in accessibility from the start | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 7 — Empower staff to deliver better services | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 8 — Be good data stewards | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 9 — Design ethical services | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+| 10 — Collaborate widely | [current] | [target] | [milestone] | [YYYY-MM-DD] | [role] |
+
+## Open Items
+
+| Item | Owner | Due | Status |
+|------|-------|-----|--------|
+| Close WCAG 2.1 AA / 2.2 AA audit findings | [Accessibility lead] | [YYYY-MM-DD] | [Open / Closed] |
+| Publish open repositories per Standard 3 | [Engineering lead] | [YYYY-MM-DD] | [Open / Closed] |
+| Trigger `ca-aia` if automated decision-making is in scope | [Architecture lead] | [YYYY-MM-DD] | [Open / Closed] |
+| Refresh PIA via `ca-pia` if personal information is processed | [ATIP coordinator] | [YYYY-MM-DD] | [Open / Closed] |
+| Update Accessibility Plan / progress report under the *Accessible Canada Act* | [Accessibility lead] | [YYYY-MM-DD] | [Open / Closed] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-DIGSTD | TBS Government of Canada Digital Standards | <https://www.canada.ca/en/government/system/digital-government/government-canada-digital-standards.html> | [YYYY-MM-DD] |
+| CA-PSD | TBS Policy on Service and Digital | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32603> | [YYYY-MM-DD] |
+| CA-DSD | TBS Directive on Service and Digital | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32601> | [YYYY-MM-DD] |
+| CA-DOSP | TBS Digital Operations Strategic Plan | <https://www.canada.ca/en/government/system/digital-government/government-canada-digital-operations-strategic-plans.html> | [YYYY-MM-DD] |
+| CA-ACA | Accessible Canada Act (S.C. 2019, c. 10) | <https://laws-lois.justice.gc.ca/eng/acts/A-0.6/> | [YYYY-MM-DD] |
+| CA-ACR | Accessible Canada Regulations | <https://laws-lois.justice.gc.ca/eng/regulations/SOR-2021-241/> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [DIGSTD-1] | CA-DIGSTD | Standard 1 — Design with users | Standard 1 assessment |
+| [DIGSTD-3] | CA-DIGSTD | Standard 3 — Work in the open by default | Standard 3 assessment, Cross-Cutting Themes |
+| [DIGSTD-6] | CA-DIGSTD | Standard 6 — Build in accessibility from the start | Standard 6 assessment, Cross-Cutting Themes |
+| [DIGSTD-9] | CA-DIGSTD | Standard 9 — Design ethical services | Standard 9 assessment, Cross-Cutting Themes |
+| [PSD-1] | CA-PSD | Policy on Service and Digital — accountability for the Digital Standards | Per-Standard Assessment, Important notes |
+| [DSD-1] | CA-DSD | Directive on Service and Digital — implementation requirements | Per-Standard Assessment |
+| [ACA-1] | CA-ACA | Statutory accessibility floor — accessibility plans, feedback processes, progress reports | Standard 6 assessment, Cross-Cutting Themes |
+| [ACR-1] | CA-ACR | Accessible Canada Regulations — published reporting tranches | Standard 6 assessment |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-itsg-33-template.md

@@ -0,0 +1,228 @@
+# Canada ITSG-33 Statement of Applicability
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-itsg-33`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-itsg-33` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the system, the system-level categorisation (UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET), the selected control profile (PBMM / PBMM-Cloud / Secret-High / Top-Secret-High), the headline tailoring posture, the count of Compensating Controls, the CMVP / FIPS 140-3 validation status, the supply chain posture under the *Direction on Vulnerable Suppliers*, and the authorisation status. Note any open items — pending CMVP confirmations, unresolved supplier flags, or conditions imposed by the authorising official.]
+
+## Information Asset Categorisation
+
+> Score Confidentiality (C), Integrity (I), and Availability (A) per the TBS *Standard on Security Categorization* injury-based matrix (Low / Medium / High). Aggregate to a system-level categorisation using the high-water mark across the asset inventory.
+
+| Asset | Confidentiality (L/M/H) | Integrity (L/M/H) | Availability (L/M/H) | Aggregate (L/M/H) | Categorisation Level |
+|-------|--------------------------|-------------------|----------------------|---------------------|----------------------|
+| [Asset 1 — e.g. citizen application records] | [score + injury rationale] | [score + injury rationale] | [score + injury rationale] | [aggregate] | [UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET] |
+| [Asset 2 — e.g. payment instructions] | [score + injury rationale] | [score + injury rationale] | [score + injury rationale] | [aggregate] | [level] |
+| [Asset 3 — e.g. audit logs] | [score + injury rationale] | [score + injury rationale] | [score + injury rationale] | [aggregate] | [level] |
+| [Asset 4 — e.g. cryptographic key material] | [score + injury rationale] | [score + injury rationale] | [score + injury rationale] | [aggregate] | [level] |
+
+**System-level categorisation**: [high-water mark across the inventory] — [one-paragraph rationale]
+
+## Control Profile Selection
+
+| Selected Profile | Categorisation Rationale | Tailoring Summary | Approver |
+|------------------|--------------------------|-------------------|----------|
+| [PBMM / PBMM-Cloud / Secret-High / Top-Secret-High] | [why this profile matches the system-level categorisation] | [count of additions / removals / parameter overrides + one-line summary; full detail in the SoA below] | [Security Authority — name and role] |
+
+## Statement of Applicability
+
+> Per ITSG-33, structured by the 16 NIST SP 800-53-derived control families. Mark each control as **Applicable**, **Not Applicable**, or **Compensating Control**. Where Compensating, name the substitute control and capture the residual-risk acceptance rationale.
+
+### AC — Access Control
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| AC-* | [A / NA / C] | [parameter values, additions, removals] | [why] | [substitute + residual-risk acceptance] |
+
+### AU — Audit and Accountability
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| AU-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### CA — Security Assessment and Authorization
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| CA-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### CM — Configuration Management
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| CM-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### CP — Contingency Planning
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| CP-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### IA — Identification and Authentication
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| IA-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### IR — Incident Response
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| IR-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### MA — Maintenance
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| MA-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### MP — Media Protection
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| MP-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### PE — Physical and Environmental Protection
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| PE-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### PL — Planning
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| PL-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### PS — Personnel Security
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| PS-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### RA — Risk Assessment
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| RA-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### SA — System and Services Acquisition
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| SA-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### SC — System and Communications Protection
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| SC-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+### SI — System and Information Integrity
+
+| Control | Applicable / NA / Compensating | Tailoring | Rationale | Compensating Control (if any) |
+|---------|--------------------------------|-----------|-----------|-------------------------------|
+| SI-* | [A / NA / C] | [tailoring] | [why] | [substitute] |
+
+## Cryptographic Module Validation
+
+> Every cryptographic module protecting Protected B and above must hold a current CMVP / FIPS 140-3 certificate. Modules off the active CMVP list are findings, not negotiation items.
+
+| Module | Vendor | CMVP Certificate # | Validation Level (FIPS 140-3) | Algorithm Scope | Status (Active / Historical / Not Validated) |
+|--------|--------|--------------------|---------------------------------|-----------------|------------------------------------------------|
+| [Module 1 — e.g. TLS module on the API gateway] | [vendor] | [#xxxx] | [Level 1 / 2 / 3 / 4] | [AES-GCM, RSA-OAEP, ECDSA-P256, etc.] | [Active / Historical / Not Validated — finding if Historical or Not Validated] |
+| [Module 2 — e.g. database TDE module] | [vendor] | [#xxxx] | [Level] | [scope] | [status] |
+| [Module 3 — e.g. signing key HSM] | [vendor] | [#xxxx] | [Level] | [scope] | [status] |
+
+## Supply Chain Security
+
+> Apply the TBS *Direction on Vulnerable Suppliers* and the published sanctioned-entities list across the full inventory: prime, sub-processors, telecommunications equipment subject to PSPC restrictions, and managed services with inherited supplier dependencies.
+
+| Supplier | Tier (Prime / Sub-processor / Equipment / Managed Service) | Vulnerable Suppliers Screen (Pass / Flag / Fail) | Sanctioned-Entities Screen (Pass / Flag / Fail) | Status / Action |
+|----------|-------------------------------------------------------------|--------------------------------------------------|--------------------------------------------------|------------------|
+| [Supplier 1 — prime contractor] | [tier] | [Pass / Flag / Fail + rationale] | [Pass / Flag / Fail + rationale] | [Cleared / Mitigation in place / Blocker] |
+| [Supplier 2 — sub-processor or named third party] | [tier] | [screen] | [screen] | [status] |
+| [Supplier 3 — telecommunications or network equipment] | [tier] | [screen] | [screen] | [status] |
+| [Supplier 4 — managed service / hyperscaler / SaaS] | [tier] | [screen] | [screen] | [status] |
+
+## Continuous Monitoring Plan
+
+| Family | Control | Frequency | Tool / Evidence Source | Reporting Cadence | Owner |
+|--------|---------|-----------|------------------------|-------------------|-------|
+| AC | [Control] | [Continuous / Daily / Monthly / Quarterly / Annual] | [SIEM / IAM analytics / config-as-code repo] | [Cadence + recipients] | [Role] |
+| AU | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| CA | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| CM | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| CP | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| IA | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| IR | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| MA | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| MP | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| PE | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| PL | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| PS | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| RA | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| SA | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| SC | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+| SI | [Control] | [Frequency] | [Tool] | [Cadence] | [Role] |
+
+**Re-categorisation triggers**: [list — new data elements; new processing purposes; change of operating environment; change of supplier; security incident materially altering the threat picture; expiry of the authorisation cycle]
+
+## Authorisation Chain
+
+| Role | Holder | Authorisation Date | Conditions | Re-authorisation Trigger |
+|------|--------|--------------------|------------|--------------------------|
+| System Owner | [name] | [YYYY-MM-DD] | [conditions, if any] | [trigger — periodic + event-driven] |
+| Security Authority | [name] | [YYYY-MM-DD] | [conditions, if any] | [trigger] |
+| Authorising Official (ADM or delegate) | [name] | [YYYY-MM-DD] | [conditions imposed on go-live or operation] | [periodic re-authorisation cycle + event-driven triggers] |
+
+## Open Items
+
+| ID | Description | Owner | Due Date | Status |
+|----|-------------|-------|----------|--------|
+| OI-1 | [Outstanding tailoring decision / unfinished CMVP confirmation / unresolved supplier flag / authorisation condition] | [Role] | [YYYY-MM-DD] | [Open / In Progress / Closed] |
+| OI-2 | [item] | [owner] | [date] | [status] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-ITSG-33 | ITSG-33 — IT Security Risk Management: A Lifecycle Approach (CSE / Canadian Centre for Cyber Security) | <https://cyber.gc.ca/en/guidance/itsg-33> | [YYYY-MM-DD] |
+| CA-TBS-CAT | TBS Standard on Security Categorization | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=16578> | [YYYY-MM-DD] |
+| CA-TBS-PGS | TBS Policy on Government Security | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=16578> | [YYYY-MM-DD] |
+| CA-VULN-SUP | TBS Direction on Vulnerable Suppliers | <https://www.canada.ca/en/government/system/digital-government/online-security-privacy.html> | [YYYY-MM-DD] |
+| CA-CMVP | CMVP Active Validated Modules List | <https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules> | [YYYY-MM-DD] |
+| CA-FIPS-140-3 | FIPS 140-3 — Security Requirements for Cryptographic Modules | <https://csrc.nist.gov/publications/detail/fips/140/3/final> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [ITSG33-1] | CA-ITSG-33 | Categorisation methodology | Information Asset Categorisation |
+| [ITSG33-2] | CA-ITSG-33 | Control profiles (PBMM / PBMM-Cloud / Secret / Top Secret) | Control Profile Selection |
+| [ITSG33-3] | CA-ITSG-33 | 16-family control catalogue | Statement of Applicability |
+| [TBS-CAT-1] | CA-TBS-CAT | Injury-based C / I / A scoring matrix | Information Asset Categorisation |
+| [TBS-PGS-1] | CA-TBS-PGS | Authorisation chain and re-authorisation cycle | Authorisation Chain |
+| [VULN-SUP-1] | CA-VULN-SUP | Supplier screening obligations and scope | Supply Chain Security |
+| [CMVP-1] | CA-CMVP | Active validated modules list — modules off-list are findings | Cryptographic Module Validation |
+| [FIPS-1] | CA-FIPS-140-3 | Validation levels (1–4) and algorithm scope | Cryptographic Module Validation |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]