arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-icam-template.md

@@ -0,0 +1,216 @@
+# ICAM Architecture (OMB M-19-17 / NIST SP 800-63-3)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-icam`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-icam` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: scope of the ICAM design, target user populations (employees, contractors, citizens, partners), federation pattern, IAL/AAL/FAL targets, and key implementation decisions (PIV vs derived credentials, login.gov vs Entra ID Gov, SAML vs OIDC).]
+
+---
+
+## 1. Identity Use Cases
+
+| Use Case ID | Description | User Population | IAL | AAL | FAL | Rationale |
+|-------------|-------------|-----------------|-----|-----|-----|-----------|
+| UC-001 | Federal employee SSO to internal apps | [Federal employees] | IAL3 | AAL3 | FAL2 | [PIV-mandated by HSPD-12; AAL3 driven by privileged data access] |
+| UC-002 | Contractor SSO to internal apps | [Contractors] | IAL3 | AAL3 | FAL2 | [PIV-I or equivalent per HSPD-12 contractor guidance] |
+| UC-003 | Public citizen account on agency portal | [Citizens] | IAL2 | AAL2 | FAL2 | [Verified citizen identity required for benefits; login.gov default] |
+| UC-004 | Partner agency federation | [Partner agency staff] | IAL3 | AAL2 | FAL2 | [Inter-agency federation; partner asserts IAL] |
+| UC-005 | Privileged administrator | [Internal IT admins] | IAL3 | AAL3 | FAL2 | [Phishing-resistant MFA; just-in-time elevation] |
+
+---
+
+## 2. Identity Proofing Flow
+
+### 2.1 Federal Employees and Contractors
+
+[For federal employees, identity proofing is performed during PIV enrolment per FIPS 201-3. Reference the agency's HSPD-12 sponsor / registrar / issuer roles. Derived PIV credentials (NIST SP 800-157) may be issued for mobile devices once the primary PIV is established.]
+
+```text
+Sponsor → Registrar (proofing — I-9 docs, biometrics) → Issuer (PIV card) → Activator → Cardholder
+```
+
+### 2.2 Public Citizens (login.gov)
+
+[Identity proofing for citizen-facing systems is performed by login.gov per GSA's IAL2 process. Agencies do not perform direct identity proofing for the public.]
+
+```text
+Citizen → login.gov account creation → IAL2 proofing (ID upload + selfie or in-person USPS PostalProof) → AAL2 authenticator binding → Agency RP receives proofed assertion
+```
+
+---
+
+## 3. Identity Provider Selection
+
+| IdP Option | Use Case | Rationale | Status |
+|-----------|----------|-----------|--------|
+| **PIV / PIV-D (agency PKI)** | Federal employees + contractors | [Mandated by HSPD-12; provides AAL3 phishing-resistant authenticator] | [Selected — primary] |
+| **login.gov** | Public citizens | [GSA-operated; IAL2 + AAL2 default; no agency-side proofing burden] | [Selected — citizen] |
+| **Microsoft Entra ID Government** | Federal employees if Microsoft-centric agency | [Tight integration with M365 GCC / GCC-High; supports FIDO2 + PIV federation] | [Conditional] |
+| **Okta Identity Cloud for Government** | Federal employees | [FedRAMP-Moderate authorised; broad SaaS connector library] | [Conditional] |
+| **Agency-internal SAML / OIDC IdP** | Bespoke internal use | [When PIV is the trust anchor but additional attribute store needed] | [Conditional] |
+
+[Document the selected IdP per use case with FedRAMP authorisation reference, supported authenticators, and any custom claims required.]
+
+---
+
+## 4. PIV Integration Architecture (Federal Employees)
+
+| Element | Selection |
+|---------|-----------|
+| **Primary credential** | [PIV card per FIPS 201-3] |
+| **Mobile credential** | [Derived PIV per NIST SP 800-157 / SP 800-157A] |
+| **Card lifecycle** | [Agency HSPD-12 issuer; revocation via OCSP / CRL] |
+| **Federation point** | [Agency SAML IdP fronting PIV; or direct PIV-Auth via PKINIT to Entra ID] |
+| **Browser support** | [Smart-card middleware: ActivClient / native macOS / Linux pcsc-lite] |
+| **Derived credential issuer** | [Agency-internal CA or commercial issuer (Entrust, IdenTrust, etc.)] |
+| **Fallback for PIV-incompatible apps** | [Reverse-proxy with PIV-to-OIDC bridge] |
+
+---
+
+## 5. login.gov Integration Architecture (Public Citizens)
+
+| Element | Selection |
+|---------|-----------|
+| **Federation protocol** | [SAML 2.0 or OIDC — OIDC preferred for new integrations] |
+| **IAL target** | [IAL1 (no proofing) / IAL2 (verified)] |
+| **AAL target** | [AAL2] |
+| **Attribute mapping** | [email, sub, given_name, family_name, ssn (IAL2), birthdate (IAL2), address (IAL2)] |
+| **Account linking strategy** | [login.gov sub claim as primary key; legacy account migration plan] |
+| **PII minimisation** | [Request only attributes the agency needs; document lawful authority for each] |
+| **Sandbox URL** | [https://idp.int.identitysandbox.gov/] |
+| **Production URL** | [https://secure.login.gov/] |
+| **Integration agreement (IAA)** | [GSA login.gov IAA reference] |
+
+---
+
+## 6. Federation Pattern
+
+| Pattern | Choice | Rationale |
+|---------|--------|-----------|
+| **Employee → Internal apps** | [SAML 2.0 / OIDC] | [SAML where SaaS support is mature; OIDC for new builds] |
+| **Citizen → Citizen-facing apps** | [OIDC] | [login.gov OIDC support; mobile-friendly] |
+| **Inter-agency federation** | [SAML 2.0] | [FICAM Trust Framework Solutions (TFS) certified] |
+| **Workload identity (service-to-service)** | [SPIFFE / mTLS / OAuth 2.0 client_credentials] | [Per Zero Trust apps & workloads pillar] |
+
+---
+
+## 7. Credential Lifecycle
+
+| Stage | Process | Owner |
+|-------|---------|-------|
+| **Issuance** | [PIV: HSPD-12 enrolment; login.gov: GSA-managed; agency: IT onboarding] | [HSPD-12 issuer / GSA / IT ops] |
+| **Activation** | [In-person PIV activation; login.gov: self-service email + phone] | [Cardholder / user] |
+| **Use** | [Daily authentication; MFA challenge per AAL] | [User] |
+| **Suspension** | [Lost-card / compromised-credential workflow; immediate OCSP revocation] | [HSPD-12 issuer / login.gov] |
+| **Revocation** | [Separation, role-change-to-non-eligible, fraud — irreversible] | [HSPD-12 issuer] |
+| **Recovery** | [Reissue per agency policy; identity proofing repeated if > 12 months elapsed] | [HSPD-12 issuer / login.gov] |
+
+---
+
+## 8. Privileged Access Management (PAM)
+
+| Capability | Implementation |
+|-----------|----------------|
+| **Break-glass accounts** | [Documented owners; checked into vault; alarm on use; quarterly review] |
+| **Just-in-time elevation** | [PAM tool with approval workflow; max session 4 hours] |
+| **MFA for privileged** | [Phishing-resistant AAL3 — PIV or FIDO2 WebAuthn only; no SMS / TOTP] |
+| **Session recording** | [Full keystroke + video for privileged sessions; retain ≥ 1 year] |
+| **Vaulted credentials** | [PAM vault — service-account creds rotated daily; never in scripts] |
+| **Logging** | [PAM logs forwarded to SIEM; SOC alert on anomalous patterns] |
+
+---
+
+## 9. Compliance to NIST SP 800-63-3
+
+### Volume A (Identity Proofing)
+
+| Requirement | IAL2 Status | IAL3 Status |
+|-------------|------------|-------------|
+| Identity evidence (strong + superior or 2× strong) | [Met / Gap] | [N/A — IAL3 via PIV] |
+| Address confirmation | [Met / Gap] | [N/A] |
+| Knowledge-based verification (where used) | [Met / Gap] | [N/A] |
+| Biometric capture (IAL3) | [N/A] | [Met / Gap] |
+| Trusted referee allowed | [Yes / No] | [Yes — supervised remote] |
+
+### Volume B (Authenticators and Lifecycle)
+
+| Requirement | AAL2 Status | AAL3 Status |
+|-------------|------------|-------------|
+| Multi-factor (something you have + something you know/are) | [Met] | [Met] |
+| Phishing resistance | [Recommended] | [Required — PIV / FIDO2 WebAuthn] |
+| Verifier-impersonation resistance | [Recommended] | [Required] |
+| Replay resistance | [Required] | [Required] |
+| Cryptographic authenticator | [Recommended] | [Required] |
+
+### Volume C (Federation Assertion)
+
+| Requirement | FAL2 Status |
+|-------------|------------|
+| Bearer assertion with audience restriction | [Met / Gap] |
+| Encrypted assertion (or transport TLS) | [Met — TLS 1.2+] |
+| Holder-of-key assertion (FAL3) | [Conditional — only where required] |
+| Replay protection on assertion | [Met] |
+
+---
+
+## 10. Compliance Crosswalk
+
+| Framework Requirement | ICAM Element Satisfying |
+|-----------------------|-------------------------|
+| OMB M-19-17 — ICAM modernisation | [Federation architecture; IdP selection] |
+| OMB M-22-09 — phishing-resistant MFA | [PIV + FIDO2 mandate] |
+| HSPD-12 | [PIV issuance per FIPS 201-3] |
+| FIPS 201-3 | [PIV card spec] |
+| NIST SP 800-63-3 | [IAL / AAL / FAL targets] |
+| NIST SP 800-157 / 157A | [Derived PIV] |
+
+---
+
+## 11. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| OMB M-19-17 | Enabling Mission Delivery through Improved Identity, Credential, and Access Management | <https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf> |
+| NIST SP 800-63-3 | Digital Identity Guidelines | <https://pages.nist.gov/800-63-3/> |
+| NIST SP 800-63A | Enrollment and Identity Proofing | <https://pages.nist.gov/800-63-3/sp800-63a.html> |
+| NIST SP 800-63B | Authentication and Lifecycle Management | <https://pages.nist.gov/800-63-3/sp800-63b.html> |
+| NIST SP 800-63C | Federation and Assertions | <https://pages.nist.gov/800-63-3/sp800-63c.html> |
+| FIPS 201-3 | Personal Identity Verification (PIV) of Federal Employees and Contractors | <https://doi.org/10.6028/NIST.FIPS.201-3> |
+| NIST SP 800-157 | Derived PIV Credentials | <https://doi.org/10.6028/NIST.SP.800-157> |
+| login.gov developer docs | login.gov developer documentation | <https://developers.login.gov/> |
+| FICAM | Federal Identity, Credential, and Access Management | <https://www.idmanagement.gov/> |
+
+---
+
+## 12. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| ICAM Programme Lead | [Name] | [Signature] | [YYYY-MM-DD] |
+| CISO | [Name] | [Signature] | [YYYY-MM-DD] |
+| Privacy Officer (SAOP) | [Name] | [Signature] | [YYYY-MM-DD] |
+| CIO | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-icam` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-nist-800-53-template.md

@@ -0,0 +1,222 @@
+# NIST SP 800-53 Rev 5 Tailored Control Set
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-nist-800-53`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-nist-800-53` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: scope of the tailored control set, the baseline selected (Low / Moderate / High), the catalog used (FedRAMP Rev 5 vs Agency Rev 5), summary of inherited vs implemented controls, and any significant tailoring decisions (controls added, removed, or compensated).]
+
+---
+
+## 1. Baseline Selection
+
+| Field | Value |
+|-------|-------|
+| **FIPS 199 High-Water Mark** | [LOW / MODERATE / HIGH — cross-ref `ARC-{P}-FISMA-v*`] |
+| **Selected Control Baseline** | [Low / Moderate / High] |
+| **Baseline Source** | [NIST SP 800-53B / FedRAMP Rev 5 / Agency Overlay] |
+| **Catalog Version** | [NIST SP 800-53 Rev 5.1.1 / FedRAMP Rev 5 Baselines vNN] |
+| **Total Controls in Baseline** | [Count] |
+| **Tailoring Rationale** | [Brief narrative — why this baseline matches the system's risk profile and mission] |
+
+---
+
+## 2. FedRAMP vs Agency Baseline
+
+| Aspect | Selection | Rationale |
+|--------|-----------|-----------|
+| **Catalog tailored against** | [FedRAMP Rev 5 / Agency Rev 5 / Hybrid] | [Why] |
+| **CSP-hosted?** | [Yes — CSP name / No] | [If CSP-hosted and pursuing FedRAMP authorisation, the FedRAMP baseline is the canonical tailoring source.] |
+| **Agency-specific overlay applied** | [Yes — overlay reference / No] | [E.g., DoD CC SRG IL2/IL4/IL5, IRS Pub 1075, CJIS, HHS ePHI] |
+
+---
+
+## 3. Control Family Summary
+
+| Family Code | Family Name | Baseline Controls | Implemented | Inherited | Hybrid | Not Applicable | Planned |
+|-------------|------------|-------------------|-------------|-----------|--------|----------------|---------|
+| AC | Access Control | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| AT | Awareness and Training | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| AU | Audit and Accountability | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| CA | Assessment, Authorization, and Monitoring | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| CM | Configuration Management | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| CP | Contingency Planning | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| IA | Identification and Authentication | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| IR | Incident Response | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| MA | Maintenance | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| MP | Media Protection | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| PE | Physical and Environmental Protection | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| PL | Planning | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| PM | Program Management | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| PS | Personnel Security | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| PT | PII Processing and Transparency | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| RA | Risk Assessment | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| SA | System and Services Acquisition | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| SC | System and Communications Protection | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| SI | System and Information Integrity | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+| SR | Supply Chain Risk Management | [Count] | [Count] | [Count] | [Count] | [Count] | [Count] |
+
+---
+
+## 4. Tailoring Matrix
+
+| Control ID | Control Title | Baseline | Implementation Status | Inheritance Source | Parameter Assignments | Compensating Controls | Notes |
+|-----------|---------------|----------|----------------------|--------------------|----------------------|----------------------|-------|
+| AC-2 | Account Management | [Mod] | [Implemented] | [N/A] | [Account types: Individual, Shared, Service, Application] | [None] | [Cross-ref ICAM artefact] |
+| AC-2(2) | Automated Temporary and Emergency Account Management | [Mod] | [Implemented] | [N/A] | [Org-defined period: 30 days] | [None] | [Inactive accounts disabled at 30 days] |
+| AC-17 | Remote Access | [Mod] | [Hybrid] | [CSP: AWS GovCloud — VPN substrate] | [Authorised remote access: VPN, BeyondCorp] | [None] | [Customer responsibility: device posture] |
+| AU-2 | Event Logging | [Mod] | [Implemented] | [Partial — CSP logs network plane] | [Auditable events: §AU-2.a] | [None] | [Cross-ref ConMon plan] |
+| AU-6 | Audit Record Review, Analysis, and Reporting | [Mod] | [Implemented] | [N/A] | [Review frequency: daily; reporting: weekly to SOC] | [None] | [SIEM-driven; alerts triaged in-platform] |
+| CM-6 | Configuration Settings | [Mod] | [Implemented] | [N/A] | [Common Secure Configurations: DISA STIG / CIS Benchmarks Level 1] | [None] | [Compliance scanner: quarterly] |
+| CP-9 | System Backup | [Mod] | [Inherited] | [CSP: AWS Backup cross-region] | [Frequency: daily; retention: 90 days] | [None] | [Customer validates restore quarterly] |
+| IA-2(1) | MFA to Privileged Accounts | [Mod] | [Implemented] | [N/A] | [Phishing-resistant authenticator required] | [None] | [Cross-ref Zero Trust Identity pillar] |
+| IR-4 | Incident Handling | [Mod] | [Implemented] | [N/A] | [IR Plan: ARC-{P}-IR-v*] | [None] | [US-CERT reporting: 1 hour] |
+| RA-5 | Vulnerability Monitoring and Scanning | [Mod] | [Implemented] | [N/A] | [Scan frequency: weekly authenticated; monthly external] | [None] | [Cross-ref ConMon] |
+| SC-7 | Boundary Protection | [Mod] | [Hybrid] | [CSP: AWS WAF / Shield] | [Egress filtering: deny-by-default] | [None] | [Customer responsibility: WAF rules] |
+| SI-2 | Flaw Remediation | [Mod] | [Implemented] | [N/A] | [Patch windows: High = 30 days, Med = 90 days] | [None] | [Tracked via vulnerability-management platform] |
+
+[Continue for every control in the baseline. For inherited controls, identify the FedRAMP-authorised CSP and the customer responsibility carry-over per the CRM.]
+
+---
+
+## 5. Parameter Assignments by Family
+
+### AC — Access Control
+
+| Control | Parameter | Org-Defined Value |
+|---------|-----------|-------------------|
+| AC-2(2) | Account inactivity period | [30 days] |
+| AC-2(3) | Disable accounts after inactivity | [60 days] |
+| AC-7 | Failed login attempts | [5 attempts; lockout 15 minutes] |
+| AC-11 | Session lock after inactivity | [15 minutes] |
+| AC-12 | Session termination after inactivity | [60 minutes] |
+
+### AU — Audit and Accountability
+
+| Control | Parameter | Org-Defined Value |
+|---------|-----------|-------------------|
+| AU-4 | Audit log storage capacity | [Retain online ≥ 90 days; archive ≥ 1 year] |
+| AU-5 | Audit failure response | [Alert SOC; shift to backup logging] |
+| AU-11 | Audit record retention | [3 years per NARA / agency schedule] |
+
+### CP — Contingency Planning
+
+| Control | Parameter | Org-Defined Value |
+|---------|-----------|-------------------|
+| CP-2 | Contingency plan review frequency | [Annual + after material change] |
+| CP-4 | Contingency plan testing frequency | [Annual tabletop + every 3 years functional] |
+| CP-9 | Backup frequency | [Daily incremental; weekly full] |
+
+### IA — Identification and Authentication
+
+| Control | Parameter | Org-Defined Value |
+|---------|-----------|-------------------|
+| IA-2 | MFA assurance level | [AAL2 standard users / AAL3 privileged] |
+| IA-5 | Password complexity | [NIST SP 800-63B Section 5.1.1.2] |
+
+### IR — Incident Response
+
+| Control | Parameter | Org-Defined Value |
+|---------|-----------|-------------------|
+| IR-2 | Incident response training frequency | [Annual + on role change] |
+| IR-3 | Incident response testing frequency | [Annual + after major change] |
+| IR-6 | Incident reporting timeframes | [US-CERT: 1 hour; Agency CISO: 30 minutes] |
+
+### SI — System and Information Integrity
+
+| Control | Parameter | Org-Defined Value |
+|---------|-----------|-------------------|
+| SI-2 | Flaw remediation timeframes | [Critical = 15 days; High = 30 days; Med = 90 days] |
+| SI-4 | System monitoring | [Continuous (24/7); detection signatures updated daily] |
+
+---
+
+## 6. Compensating Controls Register
+
+When a baseline control cannot be implemented as written, document the alternative.
+
+| Control ID | Reason Not Implemented | Compensating Control | Equivalent Risk Mitigation | Owner | Approval |
+|-----------|------------------------|---------------------|----------------------------|-------|----------|
+| [Control] | [Reason] | [Alternative] | [Equivalence narrative] | [Role] | [AO sign-off] |
+
+---
+
+## 7. Cloud Service Provider Inheritance
+
+### Inherited FedRAMP-Authorised Services
+
+| CSP | Service | FedRAMP Authorisation ID | Baseline | Customer Responsibility Matrix Reference |
+|-----|---------|--------------------------|----------|----------------------------------------|
+| [AWS GovCloud] | [Service] | [FR-MOD-NNNNN] | [Moderate / High] | [CRM URL / artefact] |
+| [Azure Government] | [Service] | [FR-MOD-NNNNN] | [Moderate / High] | [CRM URL / artefact] |
+
+### Customer Responsibility Matrix (Summary)
+
+| Control Family | Provider Provides | Customer Configures | Joint |
+|----------------|-------------------|---------------------|-------|
+| AC | [Authentication primitives] | [Account lifecycle, role definitions] | [SSO integration] |
+| AU | [Network plane logs] | [Application-tier logs, retention] | [Aggregation] |
+| SC | [Encryption primitives] | [Encryption-key policy, certificate management] | [WAF rules] |
+| SI | [Patching the platform] | [Patching customer workloads] | [Vulnerability disclosure] |
+
+[Full CRM mapping per inherited CSP referenced in `external/` or vendor portal.]
+
+---
+
+## 8. Continuous Monitoring Strategy Summary
+
+| Activity | Frequency | Owner | Output |
+|---------|-----------|-------|--------|
+| Authenticated vulnerability scan | [Weekly] | [SOC / SecOps] | [Scan report] |
+| External attack-surface scan | [Monthly] | [SOC] | [External scan] |
+| Configuration compliance scan | [Quarterly] | [Platform team] | [Drift report] |
+| POA&M review | [Monthly] | [ISSO] | [POA&M update] |
+| Control assessment (annual subset) | [Annual — 1/3 of controls] | [AO + 3PAO] | [Assessment report] |
+| Penetration test | [Annual] | [3PAO] | [Pentest report] |
+
+[Cross-ref `/arckit:us-fedramp-ssp` Section 13 for full ConMon plan.]
+
+---
+
+## 9. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| NIST SP 800-53 Rev 5 | Security and Privacy Controls for Information Systems and Organizations | <https://doi.org/10.6028/NIST.SP.800-53r5> |
+| NIST SP 800-53B | Control Baselines for Information Systems and Organizations | <https://doi.org/10.6028/NIST.SP.800-53B> |
+| FedRAMP Rev 5 Baselines | FedRAMP Moderate / High / Low Baselines | <https://www.fedramp.gov/baselines/> |
+| OSCAL | Open Security Controls Assessment Language | <https://pages.nist.gov/OSCAL/> |
+| FedRAMP CRM Template | Customer Responsibility Matrix Template | <https://www.fedramp.gov/documents-templates/> |
+
+---
+
+## 10. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| System Owner | [Name] | [Signature] | [YYYY-MM-DD] |
+| Information System Security Officer (ISSO) | [Name] | [Signature] | [YYYY-MM-DD] |
+| Authorising Official (AO) | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-nist-800-53` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-privacy-pia-template.md

@@ -0,0 +1,191 @@
+# Privacy Impact Assessment (E-Government Act §208)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-privacy-pia`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-privacy-pia` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: system being assessed, PII processed, lawful authority, Privacy Act applicability (SoR? new SORN required?), residual privacy risks, and SAOP sign-off status.]
+
+---
+
+## 1. System Overview
+
+| Field | Value |
+|-------|-------|
+| **System Name** | [Name] |
+| **System Acronym** | [Acronym] |
+| **Agency** | [Agency] |
+| **Bureau / Component** | [Bureau] |
+| **System Owner** | [Name + role] |
+| **Senior Agency Official for Privacy (SAOP)** | [Name + role] |
+| **Project Phase** | [Initiation / Development / Operations / Decommissioned] |
+| **Project Purpose** | [What the system does] |
+| **PIA Trigger** | [New system / Substantial change / Periodic review / Privacy Act SoR change] |
+| **Cross-ref FISMA Categorization** | [ARC-{P}-FISMA-v*] |
+| **Cross-ref AI Impact Assessment (if AI used)** | [ARC-{P}-AIIA-v*] |
+| **Assessment Date** | [YYYY-MM-DD] |
+
+---
+
+## 2. PII Inventory
+
+| Data Element | Source | Lawful Authority | Use | Disclosure | Retention | Disposal Method |
+|--------------|--------|------------------|-----|-----------|-----------|-----------------|
+| Full name | [Individual / agency partner] | [Statutory citation] | [Identity proofing; correspondence] | [Internal only; SOR routine use #1] | [Per NARA schedule N1-NNN] | [Cryptographic erasure] |
+| Social Security Number (SSN) | [Individual / IRS / SSA] | [E.g., 26 USC §6109; Pub L 93-579 §7] | [Benefits eligibility verification] | [SSA matching agreement; SOR routine use #2] | [7 years post-decision] | [Cryptographic erasure + NIST SP 800-88 sanitisation] |
+| Date of birth | [Individual] | [Statutory citation] | [Identity proofing; eligibility] | [Internal only] | [Per NARA schedule N1-NNN] | [Cryptographic erasure] |
+| Residential address | [Individual] | [Statutory citation] | [Correspondence; jurisdictional eligibility] | [USPS for mailing only] | [Per NARA schedule N1-NNN] | [Cryptographic erasure] |
+| Email address | [Individual] | [Statutory citation] | [Service notifications; account recovery] | [None — internal only] | [Per NARA schedule N1-NNN] | [Cryptographic erasure] |
+| Biometric data (facial template, fingerprint) | [Individual via login.gov / agency enrolment] | [HSPD-12 / agency-specific authority] | [Identity proofing IAL3] | [None — held only by issuer] | [Per FIPS 201-3 — lifetime of credential + N years] | [Crypto-erasure + physical destruction of biometric template store] |
+
+[Add additional rows for every PII element processed.]
+
+---
+
+## 3. Lawful Authority
+
+| Authority Type | Citation | Applies To |
+|----------------|----------|-----------|
+| Statute | [E.g., 5 USC §301; 31 USC §3101; agency enabling statute] | [Collection of named PII elements] |
+| Executive Order | [EO citation] | [Specific elements / processing] |
+| Agency Regulation | [CFR citation] | [Specific processing] |
+| OMB Memorandum | [OMB memo citation] | [Specific processing] |
+| Privacy Act Routine Use | [SOR citation + routine use number] | [Specific disclosures] |
+
+[Document the complete legal basis for each PII collection and processing activity.]
+
+---
+
+## 4. Privacy Act (5 USC §552a) Alignment
+
+| Question | Answer |
+|----------|--------|
+| Is this a System of Records (SoR) under the Privacy Act? | [Yes / No] |
+| If Yes, applicable SORN(s) | [Agency-XX-NNN; published Federal Register YYYY-MM-DD] |
+| If Yes, are records retrieved by personal identifier? | [Yes — identifiers listed] |
+| If new SoR being created — SORN drafting plan | [Target Federal Register publication date; OMB / Congressional notice 60-day clock start date] |
+| If existing SoR being modified — modification plan | [Modified SORN draft; OMB / Congressional notice timing] |
+| Privacy Act §(e)(3) notice provided at collection? | [Yes — notice text linked / No — justification] |
+| Privacy Act §(e)(10) safeguards? | [Cross-ref security controls in 800-53 artefact] |
+| Routine uses documented? | [Yes — list / No — gap to close] |
+
+[A SORN is required for any system of records covered by the Privacy Act before any record can be collected. Plan the publication timeline accordingly.]
+
+---
+
+## 5. SORN Trigger Check (OMB M-03-22 Decision Tree)
+
+| Question | Answer |
+|----------|--------|
+| 1. Does the system collect, maintain, use, or disseminate information about individuals? | [Yes / No] |
+| 2. Is the information about *federal employees, federal contractors, or members of the public*? | [Yes / No] |
+| 3. Will records be retrieved by a personal identifier (name, SSN, biometric, employee ID)? | [Yes / No] |
+| 4. Is this system already covered by an existing published SORN? | [Yes — cite SORN / No] |
+
+**SORN Outcome**: [No new SORN required (covered by existing SORN X) / Existing SORN modification required / New SORN required] — [Rationale]
+
+---
+
+## 6. OMB M-03-22 Conformance Checklist
+
+| Privacy Principle | Status | Evidence | Gap | Action |
+|-------------------|--------|----------|-----|--------|
+| Notice | [Met / Gap] | [Notice text + posting location] | [Gap] | [Action] |
+| Choice (opt-in / opt-out where applicable) | [Met / Gap] | [Mechanism] | [Gap] | [Action] |
+| Access (individual's right to inspect their record) | [Met / Gap] | [Process + form] | [Gap] | [Action] |
+| Security (cross-ref 800-53 controls) | [Met / Gap] | [Cross-ref ARC-{P}-NIST53-v*] | [Gap] | [Action] |
+| Accountability (designated SAOP, training, audit) | [Met / Gap] | [SAOP designation; training records] | [Gap] | [Action] |
+| Data Quality (accuracy, completeness, timeliness) | [Met / Gap] | [Validation processes] | [Gap] | [Action] |
+| Transparency (publication of PIA + SORN) | [Met / Gap] | [Publication URL] | [Gap] | [Action] |
+
+---
+
+## 7. Privacy Risk Analysis
+
+| Risk ID | Risk Description | Likelihood | Impact | Mitigation | Residual Risk | Owner |
+|---------|------------------|-----------|--------|-----------|---------------|-------|
+| PR-001 | [Unauthorised disclosure of SSN via misconfigured S3 bucket] | [Low] | [High] | [SSE-KMS + bucket policy + drift detection + DLP scanning] | [Low] | [Platform team] |
+| PR-002 | [Aggregation enabling re-identification of de-identified records] | [Medium] | [Med] | [Differential privacy on aggregated outputs; minimum cell-size suppression] | [Low] | [Data team] |
+| PR-003 | [Cross-system data flow disclosing PII outside lawful authority] | [Low] | [High] | [Data-loss-prevention + interconnection security agreements] | [Low] | [Privacy office] |
+| PR-004 | [Retention beyond NARA schedule] | [Medium] | [Low] | [Automated retention enforcement; quarterly disposal report] | [Low] | [Records officer] |
+
+---
+
+## 8. Mitigation Tracker
+
+| Mitigation ID | Linked Risk | Mitigation Description | Target Date | Owner | Status |
+|---------------|------------|------------------------|-------------|-------|--------|
+| MT-001 | PR-001 | [Implement DLP across object storage] | [YYYY-MM-DD] | [Owner] | [Open / In Progress / Closed] |
+
+---
+
+## 9. Agency SAOP Sign-Off
+
+| Sign-Off Item | SAOP Statement |
+|---------------|----------------|
+| PII inventory complete and accurate | [Concur / Concur with conditions / Returned] |
+| Lawful authority documented for every PII element | [Concur / Concur with conditions / Returned] |
+| Privacy Act / SORN compliance confirmed | [Concur / Concur with conditions / Returned] |
+| OMB M-03-22 principles satisfied | [Concur / Concur with conditions / Returned] |
+| Privacy risks identified and mitigated to acceptable residual level | [Concur / Concur with conditions / Returned] |
+
+**SAOP Signature**: [Name + signature + date]
+
+---
+
+## 10. Public Posting Plan
+
+| Element | Status |
+|---------|--------|
+| PIA approved for public posting? | [Yes / No — partial redaction] |
+| If partial redaction, citation of exception | [E.g., 6 USC §1523(b)(3)(C) — law-enforcement-sensitive] |
+| Target publication URL | [https://www.agency.gov/privacy/pias/...] |
+| Target publication date | [YYYY-MM-DD] |
+| Linked SORN published in Federal Register | [Yes — citation / No — pending] |
+
+---
+
+## 11. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| E-Government Act of 2002 §208 | Privacy Impact Assessment requirement | <https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.pdf> |
+| OMB M-03-22 | Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 | <https://www.whitehouse.gov/wp-content/uploads/2017/11/203-M-03-22-OMB-Guidance-for-Implementing-the-Privacy-Provisions-of-the-E-Government-Act-of-2002-1.pdf> |
+| Privacy Act of 1974 | 5 USC §552a | <https://www.justice.gov/opcl/privacy-act-1974> |
+| NIST SP 800-122 | Guide to Protecting the Confidentiality of PII | <https://doi.org/10.6028/NIST.SP.800-122> |
+| OMB Circular A-108 | Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act | <https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf> |
+
+---
+
+## 12. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| System Owner | [Name] | [Signature] | [YYYY-MM-DD] |
+| Privacy Officer | [Name] | [Signature] | [YYYY-MM-DD] |
+| Senior Agency Official for Privacy (SAOP) | [Name] | [Signature] | [YYYY-MM-DD] |
+| Agency General Counsel | [Name] | [Signature] | [YYYY-MM-DD] |
+| Authorising Official (AO) | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-privacy-pia` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]