Stratify
Legal and compliance

Schema

docs/compliance/isms/register/schema.md

Source updated 03. Aug. 2026

Register & document conventions

Document front matter

Every file under governance/, policies/, procedures/, and privacy/ opens with:

---
id: POL-03                 # GOV-nn governance, POL-nn policies, PRO-nn procedures, PRIV-nn privacy
title: Access Control & Identity Management Policy
owner: "ISMS Owner"        # named role, not a person's name — see register/facts.md role assignment
version: 0.1
status: draft               # draft | approved | superseded
approved: null               # date, set on approval
review_due: null             # date, set on approval = approved + 12 months unless stated otherwise
controls: ["5.15", "5.16", "5.17", "5.18", "8.2", "8.3", "8.5"]   # Annex A ids, must exist in controls.yaml
regulations: []              # e.g. ["gdpr:32", "revdsg:8"]
---

A doc's controls list is the only thing that links it back into controls.yaml — when a document is approved, update the matching control's policy_doc / procedure_docs field.

controls.yaml

Generated by tools/build_controls.py from the official ISO/IEC 27001:2022 Annex A control list (93 controls, reused from the sibling sedAI ISMS build — the Annex A list itself is generic, not company-specific) plus a hand-authored GDPR/revDSG crosswalk. The generator owns id, title, theme, crosswalk — re-run the script to fix crosswalk errors, don't hand-edit those fields (a diff would just get overwritten). Everything else (applicable, justification, owner, status, policy_doc, procedure_docs, evidence) is hand-maintained.

status values: not_started → planned → partial → implemented (or not_applicable). This is the field the Phase 0 gap analysis sets control-by-control, grounded in register/facts.md.

risks.yaml, assets.yaml, suppliers.yaml

Same idea, smaller schema — see the header comment in each file for field definitions. Seeded from real facts (facts.md's sub-processor table, personal-data tables, real infrastructure) rather than left empty, since stratify — unlike a pre-launch product — already has live production data.

Why YAML + git, not a GRC tool

ISO 27001 cl. 7.5 (control of documented information) asks for version identification, review history, and controlled distribution. Git commit history satisfies all three for free — every change to a control's status or a policy's text has an author, a timestamp, and a diff. A CI check (not yet wired — see PLAN.md open decisions) can fail a merge when review_due has passed or when a control has status: implemented but an empty evidence list.