01 — Quick Reference
Menu map
| Group | Models |
|---|---|
| Systems & Controls | Entity · InformationSystem · ControlDomain · ControlObjective · Control |
| Assessment & Evidence | AssessmentCycle · ControlAssessment · EvidenceRequirement · EvidenceSubmission |
| Deficiencies & Remediation | ControlDeficiency · RemediationPlan · RemediationAction · Retest |
| Assurance & Closure | RiskAcceptance · AssuranceDecision · ClosureRequest · ClosureApproval · StatusHistory |
Every model (18) — one line each
| Model | It records | Key foreign keys |
|---|---|---|
| Entity | An audited organisation | — |
| InformationSystem | A system in scope | Entity |
| ControlDomain | A grouping of objectives | — |
| ControlObjective | What controls must achieve | ControlDomain |
| Control | A control on a system | InformationSystem, ControlObjective |
| AssessmentCycle | A testing cycle | — |
| ControlAssessment | A control tested in a cycle | AssessmentCycle, Control |
| EvidenceRequirement | Required evidence | Control, ControlAssessment |
| EvidenceSubmission | Evidence provided | Control, ControlAssessment, ControlDeficiency, EvidenceRequirement, (self: supersedes) |
| ControlDeficiency | A gap found by assessment | InformationSystem, Control, ControlAssessment |
| RemediationPlan | The plan to fix it | ControlDeficiency |
| RemediationAction | A remediation action | RemediationPlan |
| Retest | An independent retest | ControlDeficiency, Control |
| RiskAcceptance | Interim risk acceptance | ControlDeficiency |
| AssuranceDecision | An authorised decision | ControlDeficiency |
| ClosureRequest | A request to close | ControlDeficiency |
| ClosureApproval | The closure outcome | ClosureRequest |
| StatusHistory | A deficiency state transition | ControlDeficiency |
Status vocabularies
- Deficiency status: OPEN → ACKNOWLEDGED → REMEDIATION_IN_PROGRESS → READY_FOR_RETEST → RETEST_IN_PROGRESS → RESOLVED → CLOSED · plus ACCEPTED
- System criticality: LOW · MEDIUM · HIGH · CRITICAL
- System lifecycle: PLANNED · ACTIVE · LEGACY · REPLACEMENT_IN_PROGRESS · RETIRED
- Control type / nature / frequency: PREVENTIVE·DETECTIVE·CORRECTIVE / MANUAL·AUTOMATED·IT_DEPENDENT_MANUAL / CONTINUOUS·DAILY·WEEKLY·MONTHLY·QUARTERLY·ANNUAL·EVENT_DRIVEN
- Control effectiveness: NOT_ASSESSED · EFFECTIVE · PARTIALLY_EFFECTIVE · INEFFECTIVE · NOT_APPLICABLE
- Assessment status: PLANNED · IN_PROGRESS · COMPLETE
- Deficiency severity: LOW · MEDIUM · HIGH · CRITICAL
- Action status: NOT_STARTED · IN_PROGRESS · BLOCKED · COMPLETED · CANCELLED
- Evidence status: DRAFT · SUBMITTED · RETURNED · ACCEPTED · SUPERSEDED
- Retest outcome: NOT_TESTED · PASSED · PARTIAL · FAILED · NOT_APPLICABLE
- Risk-acceptance status: NOT_REQUESTED · PENDING · APPROVED · REJECTED · EXPIRED
- Closure outcome: APPROVED · REJECTED · DEFERRED
Demo data set (32 rows)
Entity 1 · InformationSystem 1 · ControlDomain 2 · ControlObjective 2 · Control 2 · AssessmentCycle 1 · ControlAssessment 2 · EvidenceRequirement 1 · EvidenceSubmission 2 · ControlDeficiency 2 · RemediationPlan 2 · RemediationAction 2 · Retest 2 · RiskAcceptance 1 · AssuranceDecision 1 · ClosureRequest 1 · ClosureApproval 1 · StatusHistory 6.
Reseed from empty: python apps/iscrm/scripts/seed_data.py (skips if data already present).
Local run
python server/run.py iscrm # http://localhost:5073