|
| 1 | +# Data Schema |
| 2 | + |
| 3 | +This file documents the file format for each entity type. All data files use YAML frontmatter followed by a markdown body. |
| 4 | + |
| 5 | +## Primary entities |
| 6 | + |
| 7 | +**Directory:** `data/examples/{primary.directory}/` (configured in `project.yml` as `entities.primary.directory`) |
| 8 | + |
| 9 | +**Example:** `requirements/access-control.md` |
| 10 | + |
| 11 | +```yaml |
| 12 | +--- |
| 13 | +id: access-control # Required. Kebab-case identifier, must match filename |
| 14 | +name: Access Control # Required. Human-readable name |
| 15 | +group: governance # Required. Must match a group name in project.yml |
| 16 | +status: active # Optional. Lifecycle state |
| 17 | +last_verified: 2026-03-25 # Optional. Date of last verification check |
| 18 | +search_terms: # Optional. Additional search keywords |
| 19 | + - authorization |
| 20 | + - permissions |
| 21 | +--- |
| 22 | +``` |
| 23 | + |
| 24 | +**Body sections:** Defined in `project.yml` under `entities.primary.body_sections`. Each section is an `## H2` heading followed by markdown content. For the example config: |
| 25 | + |
| 26 | +```markdown |
| 27 | +## Summary |
| 28 | + |
| 29 | +One paragraph describing the requirement. |
| 30 | + |
| 31 | +## What Counts |
| 32 | + |
| 33 | +- Concrete examples that satisfy this requirement |
| 34 | + |
| 35 | +## What Does Not Count |
| 36 | + |
| 37 | +- Anti-patterns or things that look similar but don't qualify |
| 38 | +``` |
| 39 | + |
| 40 | +## Container entities |
| 41 | + |
| 42 | +**Directory:** `data/examples/{container.directory}/` |
| 43 | + |
| 44 | +**Example:** `frameworks/iso-27001.md` |
| 45 | + |
| 46 | +```yaml |
| 47 | +--- |
| 48 | +name: ISO 27001 # Required. Human-readable name |
| 49 | +authority: iso # Required. ID of the authority entity |
| 50 | +jurisdiction: International # Required if scope_field is set in project.yml |
| 51 | +type: standard # Optional. Category label |
| 52 | +status: active # Required. Must match a status in project.yml |
| 53 | +enacted: 2022-10-25 # Optional. Date of enactment |
| 54 | +effective: 2022-10-25 # Optional. Date it took effect |
| 55 | +official_url: https://... # Optional. Link to official source |
| 56 | +last_verified: 2026-03-25 # Optional. Date of last verification check |
| 57 | +--- |
| 58 | +``` |
| 59 | + |
| 60 | +**Body structure:** Container files have a specific structure that the build script parses. The body has two parts separated by `---`: |
| 61 | + |
| 62 | +1. **Timeline table** (optional, when `has_timeline: true` in config) |
| 63 | +2. **Provision sections** (one or more, separated by `---`) |
| 64 | + |
| 65 | +```markdown |
| 66 | +## Timeline |
| 67 | + |
| 68 | +| Milestone | Date | Notes | |
| 69 | +|-----------|------|-------| |
| 70 | +| Published | 2022-10-25 | Initial release | |
| 71 | +| Amendment | 2024-01-15 | Updated controls | |
| 72 | + |
| 73 | +--- |
| 74 | + |
| 75 | +## Provision Title |
| 76 | + |
| 77 | +| Property | Value | |
| 78 | +|----------|-------| |
| 79 | +| Obligation | access-control | |
| 80 | +| Sections | Annex A.5-A.8 | |
| 81 | +| Status | active | |
| 82 | +| Effective | 2022-10-25 | |
| 83 | +| Verified | 2026-03-25 | |
| 84 | +| Checked | 2026-03-25 | |
| 85 | + |
| 86 | +### Requirements |
| 87 | + |
| 88 | +| Requirement | Details | |
| 89 | +|-------------|---------| |
| 90 | +| Access control policy | Define and enforce access control rules | |
| 91 | + |
| 92 | +### Talking Point |
| 93 | + |
| 94 | +> "A single quoted sentence for use in summaries or presentations." |
| 95 | +
|
| 96 | +### Sources |
| 97 | + |
| 98 | +- [Source Name](https://source-url.com) |
| 99 | + |
| 100 | +--- |
| 101 | + |
| 102 | +## Another Provision Title |
| 103 | + |
| 104 | +(same structure as above) |
| 105 | +``` |
| 106 | + |
| 107 | +**Important format requirements:** |
| 108 | + |
| 109 | +- The `| Property | Value |` table is required for each provision. The `Obligation` row links this provision to a primary entity by ID. |
| 110 | +- Provision sections are separated by `---` (horizontal rule). |
| 111 | +- The `### Requirements` table is optional but recommended. |
| 112 | +- The `### Talking Point` must be a blockquote with the text in double quotes. |
| 113 | +- The `### Sources` section uses markdown link syntax. |
| 114 | + |
| 115 | +## Authority entities |
| 116 | + |
| 117 | +**Directory:** `data/examples/{authority.directory}/` |
| 118 | + |
| 119 | +**Example:** `organizations/iso.md` |
| 120 | + |
| 121 | +```yaml |
| 122 | +--- |
| 123 | +id: iso # Required. Kebab-case identifier |
| 124 | +name: International Organization for Standardization # Required. Full name |
| 125 | +jurisdiction: International # Optional. Geographic scope |
| 126 | +website: https://www.iso.org # Optional. Official website |
| 127 | +last_verified: 2026-03-25 # Optional. Verification date |
| 128 | +--- |
| 129 | +``` |
| 130 | + |
| 131 | +**Body:** A list of container IDs that this authority produces: |
| 132 | + |
| 133 | +```markdown |
| 134 | +## Regulations |
| 135 | + |
| 136 | +- iso-27001 |
| 137 | +- iso-42001 |
| 138 | +``` |
| 139 | + |
| 140 | +The heading name should match your container entity's plural name (e.g., "Regulations", "Products", "Frameworks"). |
| 141 | + |
| 142 | +## Mapping file |
| 143 | + |
| 144 | +**Path:** `data/examples/mapping/index.yml` (configured in `project.yml` as `mapping.file`) |
| 145 | + |
| 146 | +The mapping file connects containers to primaries through secondary (provision) entities: |
| 147 | + |
| 148 | +```yaml |
| 149 | +- id: iso-27001-access-control # Unique provision ID |
| 150 | + regulation: iso-27001 # Container file name (without .md) |
| 151 | + authority: iso # Authority ID |
| 152 | + source_heading: Information Security Controls (Annex A) # Must match an ## H2 in the container file |
| 153 | + obligations: # List of primary entity IDs this provision maps to |
| 154 | + - access-control |
| 155 | +``` |
| 156 | +
|
| 157 | +The `regulation` field should use your container entity name from config (the field name comes from `project.yml`). The `obligations` field should use your primary entity name from config. |
| 158 | + |
| 159 | +## File naming |
| 160 | + |
| 161 | +- All files use kebab-case: `access-control.md`, `iso-27001.md` |
| 162 | +- The filename (without `.md`) is used as the entity ID for primaries and authorities |
| 163 | +- Container files use the `name` frontmatter field (lowercased, spaces replaced with hyphens) as their ID |
| 164 | + |
| 165 | +## Adding new entities |
| 166 | + |
| 167 | +1. Create the `.md` file in the appropriate directory |
| 168 | +2. Add YAML frontmatter with required fields |
| 169 | +3. If adding a container, create corresponding mapping entries in `mapping/index.yml` |
| 170 | +4. Run `node scripts/validate.js` to check cross-references |
| 171 | +5. Run `node scripts/build.js` to generate the site |
0 commit comments