From f83095f00102016808a7ffd4131471926ea9ad5f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 4 Nov 2025 16:27:11 -0500
Subject: [PATCH 1/8] ENG-36 Support Intel build for mac, not just Apple
 Silicon (#1710)

* fix(portal): download relevant device agent per macOS chip on portal

* fix(portal): fix portal build issue

* fix(portal): add log for testing

* fix(portal): add log for testing

---------

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
---
 .../src/app/api/download-agent/route.ts       | 10 +++++----
 .../src/app/api/download-agent/types.ts       |  2 +-
 .../src/app/api/download-agent/utils.ts       | 21 ++++++++++++++++---
 apps/portal/src/utils/s3.ts                   |  3 ++-
 4 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/apps/portal/src/app/api/download-agent/route.ts b/apps/portal/src/app/api/download-agent/route.ts
index 8c577eccc..0e0584739 100644
--- a/apps/portal/src/app/api/download-agent/route.ts
+++ b/apps/portal/src/app/api/download-agent/route.ts
@@ -11,6 +11,7 @@ import {
   getReadmeContent,
   getScriptFilename,
 } from './scripts';
+import type { SupportedOS } from './types';
 
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic';
@@ -39,9 +40,10 @@ export async function GET(req: NextRequest) {
     orgId: string;
     employeeId: string;
     userId: string;
-    os: 'macos' | 'windows';
+    os: SupportedOS;
   };
-
+  console.log(os);
+  
   // Hardcoded device marker paths used by the setup scripts
   const fleetDevicePathMac = '/Users/Shared/.fleet';
   const fleetDevicePathWindows = 'C:\\ProgramData\\CompAI\\Fleet';
@@ -52,10 +54,10 @@ export async function GET(req: NextRequest) {
   }
 
   // For macOS, serve the DMG directly. For Windows, create a zip with script and installer.
-  if (os === 'macos') {
+  if (os === 'macos' || os === 'macos-intel') {
     try {
       // Direct DMG download for macOS
-      const macosPackageFilename = 'Comp AI Agent-1.0.0-arm64.dmg';
+      const macosPackageFilename = os === 'macos' ? 'Comp AI Agent-1.0.0-arm64.dmg' : 'Comp AI Agent-1.0.0.dmg';
       const packageKey = `macos/${macosPackageFilename}`;
 
       const getObjectCommand = new GetObjectCommand({
diff --git a/apps/portal/src/app/api/download-agent/types.ts b/apps/portal/src/app/api/download-agent/types.ts
index c7801acc8..04b7c8a55 100644
--- a/apps/portal/src/app/api/download-agent/types.ts
+++ b/apps/portal/src/app/api/download-agent/types.ts
@@ -1,4 +1,4 @@
-export type SupportedOS = 'macos' | 'windows';
+export type SupportedOS = 'macos' | 'windows' | 'macos-intel';
 
 export interface ScriptConfig {
   orgId: string;
diff --git a/apps/portal/src/app/api/download-agent/utils.ts b/apps/portal/src/app/api/download-agent/utils.ts
index bc14f8c5a..5b7841286 100644
--- a/apps/portal/src/app/api/download-agent/utils.ts
+++ b/apps/portal/src/app/api/download-agent/utils.ts
@@ -3,11 +3,17 @@ import { db } from '@db';
 import type { SupportedOS } from './types';
 
 /**
- * Detects the operating system from a User-Agent string
+ * Detects the operating system (and for macOS, the CPU architecture) from a User-Agent string.
+ *
+ * Returns:
+ * - 'windows' for Windows OS
+ * - 'macos' for Apple Silicon (ARM-based) Macs
+ * - 'macos-intel' for Intel-based Macs
  *
  * Examples of User-Agent strings:
  * - Windows: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
- * - macOS: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
+ * - macOS (Intel): "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
+ * - macOS (Apple Silicon): "Mozilla/5.0 (Macintosh; ARM Mac OS X 11_2_3) AppleWebKit/537.36"
  */
 export function detectOSFromUserAgent(userAgent: string | null): SupportedOS | null {
   if (!userAgent) return null;
@@ -19,8 +25,17 @@ export function detectOSFromUserAgent(userAgent: string | null): SupportedOS | n
     return 'windows';
   }
 
-  // Check for macOS (must check before iOS since iOS UA contains "mac")
+  // Check for macOS (and further distinguish Apple Silicon vs Intel)
   if (ua.includes('macintosh') || (ua.includes('mac os') && !ua.includes('like mac'))) {
+    // User-Agent containing 'arm' or 'apple' usually means Apple Silicon
+    if (ua.includes('arm') || ua.includes('apple')) {
+      return 'macos';
+    }
+    // 'intel' in UA indicates Intel-based mac
+    if (ua.includes('intel')) {
+      return 'macos-intel';
+    }
+    // Fallback for when arch info is missing, treat as Apple Silicon (modern default)
     return 'macos';
   }
 
diff --git a/apps/portal/src/utils/s3.ts b/apps/portal/src/utils/s3.ts
index b31a4e0ba..85ba857d2 100644
--- a/apps/portal/src/utils/s3.ts
+++ b/apps/portal/src/utils/s3.ts
@@ -1,3 +1,4 @@
+import { SupportedOS } from '@/app/api/download-agent/types';
 import { GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 
@@ -113,7 +114,7 @@ export function extractS3KeyFromUrl(url: string): string {
   return key;
 }
 
-export async function getFleetAgent({ os }: { os: 'macos' | 'windows' }) {
+export async function getFleetAgent({ os }: { os: SupportedOS }) {
   const fleetBucketName = process.env.FLEET_AGENT_BUCKET_NAME;
 
   if (!fleetBucketName) {

From b604b18a5c16db2f9b58be64f2262d70fca66d34 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 15:04:22 -0500
Subject: [PATCH 2/8] fix(portal): remove Ubuntu support help (#1715)

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
---
 .../[orgId]/components/tasks/DeviceAgentAccordionItem.tsx       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
index b28a83abf..afe8c100c 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
@@ -248,7 +248,7 @@ export function DeviceAgentAccordionItem({
               <AccordionContent className="px-4 pb-4">
                 <div className="text-muted-foreground space-y-2 text-sm">
                   <p>
-                    <strong>Operating Systems:</strong> macOS 10.14+, Windows 10+, Ubuntu 18.04+
+                    <strong>Operating Systems:</strong> macOS 10.14+, Windows 10+
                   </p>
                   <p>
                     <strong>Memory:</strong> 512MB RAM minimum

From d1288bbf52dd8f0cfc9bd20471ba651a764822fd Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 15:10:10 -0500
Subject: [PATCH 3/8] [dev] [Marfuen] mariano/tasks-stuff (#1713)

* fix: auto enable automation when publishing

* fix: show success criteria on first render

* fix(TestResultsPanel): use actual evaluation criteria for rendering

* fix(TestResultsPanel): use shared chat context for automation ID

* feat(automation): add file writing activity component and version handling

* feat(automation): enhance publish dialog with post-publish options and version testing

* fix(automation): update SWR type for automation runs data

---------

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 apps/app/package.json                         |   9 +-
 .../actions/task-automation-actions.ts        |   7 +
 .../components/PublishDialog.tsx              | 137 +++++++++++++-----
 .../message-part/file-writing-activity.tsx    |  80 ++++++++++
 .../components/chat/message-part/index.tsx    |  10 ++
 .../components/chat/message.tsx               |  60 ++++++++
 .../evaluation/EvaluationCriteriaCard.tsx     |  13 +-
 .../workflow/components/TestResultsPanel.tsx  |  15 +-
 .../components/UnifiedWorkflowCard.tsx        |  25 +++-
 .../workflow/workflow-visualizer-simple.tsx   |  16 +-
 .../hooks/use-task-automation.ts              |  20 ++-
 .../components/AutomationOverview.tsx         | 126 ++++++++++++++--
 .../overview/hooks/use-automation-runs.ts     |  27 ++++
 .../automations/[automationId]/runs/route.ts  |  39 +++++
 bun.lock                                      |  20 +--
 15 files changed, 523 insertions(+), 81 deletions(-)
 create mode 100644 apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/file-writing-activity.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/hooks/use-automation-runs.ts
 create mode 100644 apps/app/src/app/api/automations/[automationId]/runs/route.ts

diff --git a/apps/app/package.json b/apps/app/package.json
index 5d795da36..a5389f0e1 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -49,8 +49,8 @@
     "@tiptap/extension-table-cell": "^3.4.4",
     "@tiptap/extension-table-header": "^3.4.4",
     "@tiptap/extension-table-row": "^3.4.4",
-    "@trigger.dev/react-hooks": "4.0.0",
-    "@trigger.dev/sdk": "4.0.0",
+    "@trigger.dev/react-hooks": "4.0.6",
+    "@trigger.dev/sdk": "4.0.6",
     "@trycompai/db": "^1.3.7",
     "@trycompai/email": "workspace:*",
     "@types/canvas-confetti": "^1.9.0",
@@ -117,7 +117,7 @@
     "@testing-library/dom": "^10.4.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",
-    "@trigger.dev/build": "4.0.0",
+    "@trigger.dev/build": "4.0.6",
     "@types/d3": "^7.4.3",
     "@types/jspdf": "^2.0.0",
     "@types/node": "^24.0.3",
@@ -157,7 +157,7 @@
     "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
     "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/app",
     "deploy:trigger-prod": "npx trigger.dev@4.0.0 deploy",
-    "dev": "bun i && bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"next dev --turbo -p 3000\" \"bun run trigger:dev\"",
+    "dev": "bun i && bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"next dev --turbo -p 3000\" \"bunx trigger.dev@4.0.6 dev\"",
     "lint": "next lint && prettier --check .",
     "prebuild": "bun run db:generate",
     "start": "next start",
@@ -173,7 +173,6 @@
     "test:e2e:ui": "playwright test --ui",
     "test:ui": "vitest --ui",
     "test:watch": "vitest --watch",
-    "trigger:dev": "npx trigger.dev@4.0.0 dev",
     "typecheck": "tsc --noEmit"
   }
 }
\ No newline at end of file
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/actions/task-automation-actions.ts b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/actions/task-automation-actions.ts
index 13a14f103..40100081b 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/actions/task-automation-actions.ts
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/actions/task-automation-actions.ts
@@ -186,6 +186,7 @@ export async function executeAutomationScript(data: {
   orgId: string;
   taskId: string;
   automationId: string;
+  version?: number; // Optional: test specific version
 }) {
   try {
     const result = await callEnterpriseApi('/api/tasks-automations/trigger/execute', {
@@ -361,6 +362,12 @@ export async function publishAutomation(
       },
     });
 
+    // Enable automation if not already enabled
+    await db.evidenceAutomation.update({
+      where: { id: automationId },
+      data: { isEnabled: true },
+    });
+
     return {
       success: true,
       version,
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/PublishDialog.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/PublishDialog.tsx
index 49d98adb1..bda713016 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/PublishDialog.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/PublishDialog.tsx
@@ -12,10 +12,10 @@ import {
 import { Label } from '@comp/ui/label';
 import { Textarea } from '@comp/ui/textarea';
 import { Loader2 } from 'lucide-react';
-import { useParams } from 'next/navigation';
+import { useParams, useRouter } from 'next/navigation';
 import { useState } from 'react';
 import { toast } from 'sonner';
-import { publishAutomation } from '../actions/task-automation-actions';
+import { executeAutomationScript, publishAutomation } from '../actions/task-automation-actions';
 import { useAutomationVersions } from '../hooks/use-automation-versions';
 import { useSharedChatContext } from '../lib/chat-context';
 
@@ -25,6 +25,7 @@ interface PublishDialogProps {
 }
 
 export function PublishDialog({ open, onOpenChange }: PublishDialogProps) {
+  const router = useRouter();
   const { orgId, taskId } = useParams<{
     orgId: string;
     taskId: string;
@@ -33,8 +34,20 @@ export function PublishDialog({ open, onOpenChange }: PublishDialogProps) {
   const { automationIdRef } = useSharedChatContext();
   const [changelog, setChangelog] = useState('');
   const [isPublishing, setIsPublishing] = useState(false);
+  const [showPostPublishOptions, setShowPostPublishOptions] = useState(false);
+  const [publishedVersion, setPublishedVersion] = useState<number | null>(null);
   const { mutate } = useAutomationVersions();
 
+  const handleDialogChange = (newOpen: boolean) => {
+    onOpenChange(newOpen);
+    // Reset state when dialog closes
+    if (!newOpen) {
+      setChangelog('');
+      setShowPostPublishOptions(false);
+      setPublishedVersion(null);
+    }
+  };
+
   const handlePublish = async () => {
     setIsPublishing(true);
 
@@ -50,12 +63,31 @@ export function PublishDialog({ open, onOpenChange }: PublishDialogProps) {
         throw new Error(result.error || 'Failed to publish');
       }
 
-      toast.success(`Version ${result.version?.version} published successfully!`);
-      setChangelog('');
-      onOpenChange(false);
+      const versionNumber = result.version?.version;
+      toast.success(`Version ${versionNumber} published successfully!`);
+      setPublishedVersion(versionNumber || null);
 
       // Refresh versions list
       await mutate();
+
+      // Trigger a test run with the new version
+      if (versionNumber) {
+        const runResult = await executeAutomationScript({
+          orgId,
+          taskId,
+          automationId: automationIdRef.current,
+          version: versionNumber,
+        });
+
+        if (runResult.success) {
+          toast.success('Running automation with published version');
+        } else {
+          toast.error(runResult.error || 'Failed to start automation run');
+        }
+      }
+
+      // Show post-publish options instead of closing
+      setShowPostPublishOptions(true);
     } catch (error) {
       toast.error(error instanceof Error ? error.message : 'Failed to publish automation');
     } finally {
@@ -63,38 +95,73 @@ export function PublishDialog({ open, onOpenChange }: PublishDialogProps) {
     }
   };
 
+  const handleGoToOverview = () => {
+    handleDialogChange(false);
+    router.push(`/${orgId}/tasks/${taskId}/automations/${automationIdRef.current}/overview`);
+  };
+
+  const handleStayHere = () => {
+    handleDialogChange(false);
+  };
+
   return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
+    <Dialog open={open} onOpenChange={handleDialogChange}>
       <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Publish Automation</DialogTitle>
-          <DialogDescription>
-            Create a new version of this automation. The current draft will remain editable.
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="space-y-4 py-4">
-          <div className="space-y-2">
-            <Label htmlFor="changelog">Changelog (optional)</Label>
-            <Textarea
-              id="changelog"
-              placeholder="Describe what changed in this version..."
-              value={changelog}
-              onChange={(e) => setChangelog(e.target.value)}
-              rows={4}
-            />
-          </div>
-        </div>
-
-        <DialogFooter>
-          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={isPublishing}>
-            Cancel
-          </Button>
-          <Button onClick={handlePublish} disabled={isPublishing}>
-            {isPublishing && <Loader2 className="h-4 w-4 mr-2 animate-spin" />}
-            {isPublishing ? 'Publishing...' : 'Publish'}
-          </Button>
-        </DialogFooter>
+        {!showPostPublishOptions ? (
+          <>
+            <DialogHeader>
+              <DialogTitle>Publish Automation</DialogTitle>
+              <DialogDescription>
+                Create a new version of this automation. The current draft will remain editable.
+              </DialogDescription>
+            </DialogHeader>
+
+            <div className="space-y-4 py-4">
+              <div className="space-y-2">
+                <Label htmlFor="changelog">Changelog (optional)</Label>
+                <Textarea
+                  id="changelog"
+                  placeholder="Describe what changed in this version..."
+                  value={changelog}
+                  onChange={(e) => setChangelog(e.target.value)}
+                  rows={4}
+                />
+              </div>
+            </div>
+
+            <DialogFooter>
+              <Button
+                variant="outline"
+                onClick={() => handleDialogChange(false)}
+                disabled={isPublishing}
+              >
+                Cancel
+              </Button>
+              <Button onClick={handlePublish} disabled={isPublishing}>
+                {isPublishing && <Loader2 className="h-4 w-4 mr-2 animate-spin" />}
+                {isPublishing ? 'Publishing...' : 'Publish'}
+              </Button>
+            </DialogFooter>
+          </>
+        ) : (
+          <>
+            <DialogHeader>
+              <DialogTitle>Automation Published!</DialogTitle>
+              <DialogDescription>
+                Version {publishedVersion} has been published and is now running. Where would you like to go?
+              </DialogDescription>
+            </DialogHeader>
+
+            <DialogFooter className="flex-col sm:flex-row gap-2">
+              <Button variant="outline" onClick={handleStayHere} className="w-full sm:w-auto">
+                Stay Here
+              </Button>
+              <Button onClick={handleGoToOverview} className="w-full sm:w-auto">
+                Go to Overview
+              </Button>
+            </DialogFooter>
+          </>
+        )}
       </DialogContent>
     </Dialog>
   );
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/file-writing-activity.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/file-writing-activity.tsx
new file mode 100644
index 000000000..b5719beaa
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/file-writing-activity.tsx
@@ -0,0 +1,80 @@
+'use client';
+
+import { CheckCircle2, FileText, Loader2, XCircle } from 'lucide-react';
+import { useEffect, useState } from 'react';
+
+interface FileWritingActivityProps {
+  input: any;
+  state: 'input-streaming' | 'input-available' | 'output-available' | 'output-error';
+  output?: any;
+  isAnimating: boolean;
+}
+
+export function FileWritingActivity({
+  input,
+  state,
+  output,
+  isAnimating,
+}: FileWritingActivityProps) {
+  const isComplete = state === 'output-available';
+  const isError = state === 'output-error';
+  const isLoading = state === 'input-streaming' || state === 'input-available';
+  const [startTime] = useState(() => Date.now());
+  const [duration, setDuration] = useState<number | null>(null);
+  const [isExpanded, setIsExpanded] = useState(false);
+
+  // Track actual timing
+  useEffect(() => {
+    if ((isComplete || isError) && duration === null) {
+      const elapsed = Math.round((Date.now() - startTime) / 1000);
+      setDuration(elapsed);
+    }
+  }, [isComplete, isError, startTime, duration]);
+
+  const getIcon = () => {
+    if (isError) return <XCircle className="h-4 w-4 text-muted-foreground" />;
+    if (isComplete) return <CheckCircle2 className="h-4 w-4 text-muted-foreground" />;
+    if (isLoading) return <Loader2 className="h-4 w-4 animate-spin text-muted-foreground" />;
+    return <FileText className="h-4 w-4 text-muted-foreground" />;
+  };
+
+  const getTitle = () => {
+    if (isError) {
+      return duration ? `Failed to save after ${duration}s` : 'Failed to save automation';
+    }
+
+    if (isComplete && duration !== null) {
+      return `Saved in ${duration}s`;
+    }
+    return 'Creating automation...';
+  };
+
+  const getResultSummary = () => {
+    // Only show summary when complete and available
+    if (!isComplete || !output?.summary) return null;
+
+    return (
+      <div className="mt-2">
+        <p className="text-xs text-muted-foreground">{output.summary}</p>
+      </div>
+    );
+  };
+
+  return (
+    <div className="py-0.5">
+      <button
+        type="button"
+        className="flex items-center gap-2 text-xs text-muted-foreground hover:text-foreground transition-colors"
+        onClick={() => setIsExpanded(!isExpanded)}
+      >
+        <div className="w-1 h-1 rounded-full bg-muted-foreground/40" />
+        <span>{getTitle()}</span>
+      </button>
+      {isExpanded && (isComplete || isError) && output?.summary && (
+        <div className="mt-1 ml-3 text-xs text-muted-foreground/80 leading-relaxed">
+          {output.summary}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/index.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/index.tsx
index 84ad1c2a8..094f55f42 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/index.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message-part/index.tsx
@@ -3,6 +3,7 @@ import { memo } from 'react';
 import { DataPart } from '../../../lib/types/data-parts';
 import { Metadata } from '../../../lib/types/metadata';
 import { TaskAutomationToolSet } from '../../../tools/task-automation-tools';
+import { FileWritingActivity } from './file-writing-activity';
 import { PromptInfo } from './prompt-info';
 import { PromptSecret } from './prompt-secret';
 import { Reasoning } from './reasoning';
@@ -62,6 +63,15 @@ export const MessagePart = memo(function MessagePart({
         isAnimating={partIndex === 0}
       />
     );
+  } else if (part.type === 'tool-storeToS3') {
+    return (
+      <FileWritingActivity
+        input={part.input}
+        state={part.state}
+        output={part.output}
+        isAnimating={partIndex === 0}
+      />
+    );
   }
   return null;
 });
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message.tsx
index f7be9047c..54a6a4d96 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/chat/message.tsx
@@ -76,8 +76,10 @@ export const Message = memo(function Message({
     const result = [];
     let thinkingSessionCount = 0;
     let researchSessionCount = 0;
+    let fileWritingSessionCount = 0;
     let currentThinkingParts = [];
     let currentResearchParts = [];
+    let currentFileWritingParts = [];
 
     // Render parts in their ORIGINAL order, creating new sessions when needed
     for (let i = 0; i < message.parts.length; i++) {
@@ -95,6 +97,12 @@ export const Message = memo(function Message({
         continue;
       }
 
+      // Collect file writing parts for current session
+      if (part.type === 'tool-storeToS3') {
+        currentFileWritingParts.push(part);
+        continue;
+      }
+
       // When we hit other content, flush any accumulated sessions
 
       // Flush thinking session
@@ -162,6 +170,34 @@ export const Message = memo(function Message({
         currentResearchParts = [];
       }
 
+      // Flush file writing session
+      if (currentFileWritingParts.length > 0) {
+        const sessionId = fileWritingSessionCount++;
+
+        // Check if THIS session has streaming file writing
+        const thisSessionIsWriting = currentFileWritingParts.some(
+          (part) =>
+            (part as any)?.state === 'input-streaming' ||
+            (part as any)?.state === 'input-available',
+        );
+
+        if (thisSessionIsWriting) {
+          result.push(
+            <div key={`filewriting-${sessionId}-active`} className="flex items-center gap-2 py-1">
+              <span className="text-xs text-muted-foreground">Creating automation...</span>
+            </div>,
+          );
+        } else {
+          // When complete, show the saved message
+          result.push(
+            <div key={`filewriting-${sessionId}-done`} className="flex items-center gap-2 py-1">
+              <span className="text-xs text-muted-foreground">Saved</span>
+            </div>,
+          );
+        }
+        currentFileWritingParts = [];
+      }
+
       // Render all other parts (text, tools, etc.)
       result.push(
         <MessagePart
@@ -236,6 +272,30 @@ export const Message = memo(function Message({
       }
     }
 
+    if (currentFileWritingParts.length > 0) {
+      const sessionId = fileWritingSessionCount++;
+
+      // Check if THIS final session has streaming file writing
+      const finalSessionIsWriting = currentFileWritingParts.some(
+        (part) =>
+          (part as any)?.state === 'input-streaming' || (part as any)?.state === 'input-available',
+      );
+
+      if (finalSessionIsWriting) {
+        result.push(
+          <div key={`filewriting-${sessionId}-active`} className="flex items-center gap-2 py-1">
+            <span className="text-xs text-muted-foreground">Creating automation...</span>
+          </div>,
+        );
+      } else {
+        result.push(
+          <div key={`filewriting-${sessionId}-done`} className="flex items-center gap-2 py-1">
+            <span className="text-xs text-muted-foreground">Saved</span>
+          </div>,
+        );
+      }
+    }
+
     return result;
   };
 
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/evaluation/EvaluationCriteriaCard.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/evaluation/EvaluationCriteriaCard.tsx
index f582a20a4..ab14e15c3 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/evaluation/EvaluationCriteriaCard.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/evaluation/EvaluationCriteriaCard.tsx
@@ -3,9 +3,10 @@
 import { Button } from '@comp/ui/button';
 import { Textarea } from '@comp/ui/textarea';
 import { Save } from 'lucide-react';
-import { useState } from 'react';
+import { useEffect, useState } from 'react';
 import { toast } from 'sonner';
 import { updateEvaluationCriteria } from '../../actions/task-automation-actions';
+import { useTaskAutomation } from '../../hooks/use-task-automation';
 
 interface EvaluationCriteriaCardProps {
   automationId: string;
@@ -17,10 +18,18 @@ export function EvaluationCriteriaCard({
   automationId,
   initialCriteria,
 }: EvaluationCriteriaCardProps) {
+  const { automation } = useTaskAutomation();
   const [isEditing, setIsEditing] = useState(false);
   const [criteria, setCriteria] = useState(initialCriteria || '');
   const [isSaving, setIsSaving] = useState(false);
 
+  // Update local state when automation data changes
+  useEffect(() => {
+    if (automation?.evaluationCriteria) {
+      setCriteria(automation.evaluationCriteria);
+    }
+  }, [automation?.evaluationCriteria]);
+
   const handleSave = async () => {
     setIsSaving(true);
     try {
@@ -28,6 +37,8 @@ export function EvaluationCriteriaCard({
       if (result.success) {
         toast.success('Success criteria updated');
         setIsEditing(false);
+        // Emit event to trigger refresh across the app
+        window.dispatchEvent(new CustomEvent('task-automation:criteria-updated'));
       } else {
         toast.error(result.error || 'Failed to update criteria');
       }
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/TestResultsPanel.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/TestResultsPanel.tsx
index e27f2a339..44edda82c 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/TestResultsPanel.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/TestResultsPanel.tsx
@@ -6,6 +6,8 @@ import { AlertCircle, CheckCircle2, CircleX, Loader2, Sparkles, X } from 'lucide
 import { useEffect, useRef, useState } from 'react';
 import { Prism as SyntaxHighlighter } from 'react-syntax-highlighter';
 import { oneDark } from 'react-syntax-highlighter/dist/esm/styles/prism';
+import { useTaskAutomation } from '../../../hooks';
+import { useSharedChatContext } from '../../../lib';
 import type { TestResult } from '../types';
 import { ConfettiEffect } from './ConfettiEffect';
 
@@ -30,6 +32,11 @@ export function TestResultsPanel({
   const [animateSuccess, setAnimateSuccess] = useState(false);
   const containerRef = useRef<HTMLDivElement>(null);
 
+  const { automationIdRef } = useSharedChatContext();
+  const { automation } = useTaskAutomation(automationIdRef.current);
+
+  const actualEvaluationCriteria = automation?.evaluationCriteria || evaluationCriteria;
+
   // Determine overall test state
   const getTestState = () => {
     if (!result) return null;
@@ -203,7 +210,7 @@ export function TestResultsPanel({
 
               {/* Sub-nav */}
               <div className="flex items-center justify-center gap-3 text-xs mb-4">
-                {result.evaluationReason && evaluationCriteria && (
+                {result.evaluationReason && actualEvaluationCriteria && (
                   <button
                     onClick={() =>
                       setActiveSection(activeSection === 'reasoning' ? null : 'reasoning')
@@ -213,7 +220,7 @@ export function TestResultsPanel({
                     Reasoning
                   </button>
                 )}
-                {result.evaluationReason && evaluationCriteria && (
+                {result.evaluationReason && actualEvaluationCriteria && (
                   <span className="text-border">|</span>
                 )}
                 <button
@@ -285,14 +292,14 @@ export function TestResultsPanel({
 
                   {activeSection === 'reasoning' &&
                     result.evaluationReason &&
-                    evaluationCriteria && (
+                    actualEvaluationCriteria && (
                       <div className="space-y-3 text-left animate-in fade-in duration-300">
                         <div>
                           <p className="text-xs font-semibold text-muted-foreground mb-1">
                             Criteria
                           </p>
                           <p className="text-xs leading-relaxed text-foreground">
-                            {evaluationCriteria}
+                            {actualEvaluationCriteria}
                           </p>
                         </div>
                         <div>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/UnifiedWorkflowCard.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/UnifiedWorkflowCard.tsx
index ab5c048f9..a195dd8b6 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/UnifiedWorkflowCard.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/components/UnifiedWorkflowCard.tsx
@@ -4,6 +4,8 @@ import { Card, CardContent, CardHeader, CardTitle } from '@comp/ui/card';
 import { Loader2, Play, Zap } from 'lucide-react';
 import Image from 'next/image';
 import { useEffect, useState } from 'react';
+import { useTaskAutomation } from '../../../hooks/use-task-automation';
+import { useSharedChatContext } from '../../../lib/chat-context';
 import { EvaluationCriteriaCard } from '../../evaluation/EvaluationCriteriaCard';
 
 interface WorkflowStep {
@@ -42,8 +44,19 @@ export function UnifiedWorkflowCard({
   evaluationCriteria,
   automationId,
 }: Props) {
+  const { automationIdRef } = useSharedChatContext();
   const [isAnimationComplete, setIsAnimationComplete] = useState(false);
 
+  // Use the real automation ID from ref (not "new")
+  const realAutomationId =
+    automationIdRef.current !== 'new' ? automationIdRef.current : automationId;
+
+  // Fetch automation data with the correct ID
+  const { automation } = useTaskAutomation(realAutomationId);
+
+  // Use live automation data for criteria, fallback to prop
+  const liveCriteria = automation?.evaluationCriteria || evaluationCriteria;
+
   useEffect(() => {
     // Calculate total animation time: card (1s) + expansion (1s) + all steps
     const totalAnimationTime = 2500 + steps.length * 1200;
@@ -140,14 +153,14 @@ export function UnifiedWorkflowCard({
         </Card>
       </CardContent>
 
-      {/* Evaluation Criteria Section */}
-      {evaluationCriteria !== undefined && automationId && isAnimationComplete && (
-        <div className="px-4 pb-4 pt-2">
+      {/* Evaluation Criteria Section - Show after animation */}
+      {realAutomationId && realAutomationId !== 'new' && isAnimationComplete && (
+        <div className="px-4 pb-4 pt-2 animate-in fade-in duration-500">
           <div className="max-w-[650px] mx-auto">
             <EvaluationCriteriaCard
-              automationId={automationId}
-              initialCriteria={evaluationCriteria}
-              isAiGenerated={!!evaluationCriteria}
+              automationId={realAutomationId}
+              initialCriteria={liveCriteria}
+              isAiGenerated={!!liveCriteria}
             />
           </div>
         </div>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/workflow-visualizer-simple.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/workflow-visualizer-simple.tsx
index 2d6311637..fc642e8a0 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/workflow-visualizer-simple.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/components/workflow/workflow-visualizer-simple.tsx
@@ -63,7 +63,11 @@ export function WorkflowVisualizerSimple({ className }: Props) {
   const [publishDialogOpen, setPublishDialogOpen] = useState(false);
   const [isRestoring, setIsRestoring] = useState(false);
   const [confirmRestore, setConfirmRestore] = useState<EvidenceAutomationVersion | null>(null);
-  const { automation, mutate: mutateAutomation } = useTaskAutomation();
+  const {
+    automation,
+    mutate: mutateAutomation,
+    isLoading: isLoadingAutomation,
+  } = useTaskAutomation();
   const { versions } = useAutomationVersions();
 
   // Update shared ref when automation is loaded from hook
@@ -110,8 +114,15 @@ export function WorkflowVisualizerSimple({ className }: Props) {
       // Also refresh automation data to get updated evaluationCriteria
       mutateAutomation();
     };
+    const handleCriteriaUpdated = () => {
+      mutateAutomation();
+    };
     window.addEventListener('task-automation:script-saved', handleScriptSaved);
-    return () => window.removeEventListener('task-automation:script-saved', handleScriptSaved);
+    window.addEventListener('task-automation:criteria-updated', handleCriteriaUpdated);
+    return () => {
+      window.removeEventListener('task-automation:script-saved', handleScriptSaved);
+      window.removeEventListener('task-automation:criteria-updated', handleCriteriaUpdated);
+    };
   }, [refresh, mutateAutomation]);
 
   useEffect(() => {
@@ -327,6 +338,7 @@ Please fix the automation script to resolve this error.`;
                     <WorkflowSkeleton />
                   ) : steps.length > 0 ? (
                     <UnifiedWorkflowCard
+                      key={`workflow-${automation?.id}-${automation?.evaluationCriteria ? 'with-criteria' : 'no-criteria'}`}
                       steps={steps}
                       title={title || 'Automation Workflow'}
                       onTest={handleTest}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/hooks/use-task-automation.ts b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/hooks/use-task-automation.ts
index a0d5e6cb3..55e47c508 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/hooks/use-task-automation.ts
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/hooks/use-task-automation.ts
@@ -23,15 +23,25 @@ interface UseTaskAutomationReturn {
   mutate: () => Promise<any>;
 }
 
-export function useTaskAutomation(): UseTaskAutomationReturn {
-  const { orgId, taskId, automationId } = useParams<{
+export function useTaskAutomation(overrideAutomationId?: string): UseTaskAutomationReturn {
+  const {
+    orgId,
+    taskId,
+    automationId: paramsAutomationId,
+  } = useParams<{
     orgId: string;
     taskId: string;
     automationId: string;
   }>();
 
+  // Use override ID if provided, otherwise use params
+  const automationId = overrideAutomationId || paramsAutomationId;
+
+  // Skip fetching if automationId is "new"
+  const shouldFetch = automationId && automationId !== 'new';
+
   const { data, error, isLoading, mutate } = useSWR(
-    [`automation-${automationId}`, orgId, taskId, automationId],
+    shouldFetch ? [`automation-${automationId}`, orgId, taskId, automationId] : null,
     async () => {
       const response = await api.get<{
         success: boolean;
@@ -39,13 +49,17 @@ export function useTaskAutomation(): UseTaskAutomationReturn {
       }>(`/v1/tasks/${taskId}/automations/${automationId}`, orgId);
 
       if (response.error) {
+        console.log('failed to fetch automation', response.error);
         throw new Error(response.error);
       }
 
       if (!response.data?.success) {
+        console.log('failed to fetch automation', response.data);
         throw new Error('Failed to fetch automation');
       }
 
+      console.log('response.data.automation', response.data.automation);
+
       return response.data.automation;
     },
     {
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/components/AutomationOverview.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/components/AutomationOverview.tsx
index 1d05c5609..601ba69bf 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/components/AutomationOverview.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/components/AutomationOverview.tsx
@@ -16,17 +16,22 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@comp/ui/dropdown-menu';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
 import { Textarea } from '@comp/ui/textarea';
 import { EvidenceAutomation, EvidenceAutomationRun, EvidenceAutomationVersion, Task } from '@db';
-import { ChevronRight, MoreVertical, Trash2 } from 'lucide-react';
+import { ChevronRight, Loader2, MoreVertical, Play, Trash2 } from 'lucide-react';
 import Link from 'next/link';
 import { useParams } from 'next/navigation';
-import { useMemo, useRef, useState } from 'react';
+import { useRef, useState } from 'react';
 import { toast } from 'sonner';
-import { toggleAutomationEnabled } from '../../../../automation/[automationId]/actions/task-automation-actions';
+import {
+  executeAutomationScript,
+  toggleAutomationEnabled,
+} from '../../../../automation/[automationId]/actions/task-automation-actions';
 import { DeleteAutomationDialog } from '../../../../automation/[automationId]/components/AutomationSettingsDialogs';
 import { useTaskAutomation } from '../../../../automation/[automationId]/hooks/use-task-automation';
 import { AutomationRunsCard } from '../../../../components/AutomationRunsCard';
+import { useAutomationRuns } from '../hooks/use-automation-runs';
 import { MetricsSection } from './MetricsSection';
 
 type RunWithAutomationName = EvidenceAutomationRun & {
@@ -58,13 +63,25 @@ export function AutomationOverview({
   const [isTogglingEnabled, setIsTogglingEnabled] = useState(false);
   const [editingDescription, setEditingDescription] = useState(false);
   const [descriptionValue, setDescriptionValue] = useState('');
+  const [selectedVersion, setSelectedVersion] = useState<number | null>(null);
+  const [isTestingVersion, setIsTestingVersion] = useState(false);
   const descriptionInputRef = useRef<HTMLTextAreaElement>(null);
 
   // Use the automation hook to get live data and mutate function
   const { automation: liveAutomation, mutate: mutateAutomation } = useTaskAutomation();
 
+  // Use live runs data with auto-refresh
+  const { runs: liveRuns, mutate: mutateRuns } = useAutomationRuns();
+
   // Use live data from hook if available, fallback to initial data
   const automation = liveAutomation || initialAutomation;
+  const runs = liveRuns || initialRuns;
+
+  // Set initial selected version to latest
+  const latestVersion = initialVersions.length > 0 ? initialVersions[0].version : null;
+  if (selectedVersion === null && latestVersion !== null) {
+    setSelectedVersion(latestVersion);
+  }
 
   const handleToggleEnabled = async (enabled: boolean) => {
     if (!automation?.id) return;
@@ -93,6 +110,35 @@ export function AutomationOverview({
     setTimeout(() => descriptionInputRef.current?.focus(), 0);
   };
 
+  const handleTestVersion = async () => {
+    if (!selectedVersion) return;
+
+    setIsTestingVersion(true);
+    try {
+      const result = await executeAutomationScript({
+        orgId,
+        taskId,
+        automationId: automation.id,
+        version: selectedVersion,
+      });
+
+      if (result.success) {
+        toast.success(`Testing version ${selectedVersion}`, {
+          description: 'Test started - check run history below',
+        });
+
+        // Refresh runs to show the new test
+        await mutateRuns();
+      } else {
+        toast.error(result.error || 'Failed to start test');
+      }
+    } catch (error) {
+      toast.error('Failed to start test');
+    } finally {
+      setIsTestingVersion(false);
+    }
+  };
+
   const saveDescriptionEdit = async () => {
     if (descriptionValue === (automation.description || '')) {
       setEditingDescription(false);
@@ -121,16 +167,12 @@ export function AutomationOverview({
   };
 
   // Transform runs to include automation name
-  const runsWithName = useMemo(
-    () =>
-      initialRuns.map((run) => ({
-        ...run,
-        evidenceAutomation: {
-          name: automation.name,
-        },
-      })),
-    [initialRuns, automation.name],
-  );
+  const runsWithName = runs.map((run) => ({
+    ...run,
+    evidenceAutomation: {
+      name: automation.name,
+    },
+  }));
 
   return (
     <div>
@@ -176,7 +218,7 @@ export function AutomationOverview({
       <MetricsSection
         automationName={automation.name}
         initialVersions={initialVersions}
-        initialRuns={initialRuns}
+        initialRuns={runs}
         isEnabled={automation.isEnabled}
         onToggleEnabled={handleToggleEnabled}
         isTogglingEnabled={isTogglingEnabled}
@@ -190,8 +232,61 @@ export function AutomationOverview({
           <AutomationRunsCard runs={runsWithName} />
         </div>
 
-        {/* Right Column - Details & Versions */}
+        {/* Right Column - Versions & Details */}
         <div className="space-y-6">
+          {/* Versions Card */}
+          {initialVersions.length > 0 && (
+            <Card>
+              <CardHeader>
+                <CardTitle className="text-base font-medium">Versions</CardTitle>
+              </CardHeader>
+              <CardContent>
+                <div className="space-y-3">
+                  <div className="flex items-center gap-2">
+                    <Select
+                      value={selectedVersion?.toString() || ''}
+                      onValueChange={(value) => setSelectedVersion(parseInt(value))}
+                    >
+                      <SelectTrigger className="h-9 text-sm flex-1">
+                        <SelectValue placeholder="Select version" />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {initialVersions.map((v) => (
+                          <SelectItem key={v.version} value={v.version.toString()}>
+                            v{v.version}
+                            {v.changelog &&
+                              ` - ${v.changelog.substring(0, 30)}${v.changelog.length > 30 ? '...' : ''}`}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      onClick={handleTestVersion}
+                      disabled={!selectedVersion || isTestingVersion}
+                    >
+                      {isTestingVersion ? (
+                        <>
+                          <Loader2 className="w-3.5 h-3.5 mr-1.5 animate-spin" />
+                          Testing
+                        </>
+                      ) : (
+                        <>
+                          <Play className="w-3.5 h-3.5 mr-1.5" />
+                          Test
+                        </>
+                      )}
+                    </Button>
+                  </div>
+                  <p className="text-xs text-muted-foreground">
+                    Select a version and test it to verify functionality
+                  </p>
+                </div>
+              </CardContent>
+            </Card>
+          )}
+
           <Card>
             <CardHeader>
               <div className="flex items-center justify-between">
@@ -245,6 +340,7 @@ export function AutomationOverview({
                     </p>
                   )}
                 </div>
+
                 <div className="flex flex-col gap-1">
                   <p className="text-xs font-medium text-muted-foreground">Created</p>
                   <p className="text-sm">
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/hooks/use-automation-runs.ts b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/hooks/use-automation-runs.ts
new file mode 100644
index 000000000..e576838c0
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automations/[automationId]/overview/hooks/use-automation-runs.ts
@@ -0,0 +1,27 @@
+import { EvidenceAutomationRun } from '@db';
+import { useParams } from 'next/navigation';
+import useSWR from 'swr';
+
+const fetcher = (url: string) => fetch(url).then((res) => res.json());
+
+export function useAutomationRuns() {
+  const { automationId } = useParams<{
+    automationId: string;
+  }>();
+
+  const { data, error, isLoading, mutate } = useSWR<{ runs: EvidenceAutomationRun[] }>(
+    `/api/automations/${automationId}/runs`,
+    fetcher,
+    {
+      refreshInterval: 3000, // Poll every 3 seconds
+      revalidateOnFocus: true,
+    },
+  );
+
+  return {
+    runs: data?.runs,
+    isLoading,
+    isError: !!error,
+    mutate,
+  };
+}
diff --git a/apps/app/src/app/api/automations/[automationId]/runs/route.ts b/apps/app/src/app/api/automations/[automationId]/runs/route.ts
new file mode 100644
index 000000000..55b802628
--- /dev/null
+++ b/apps/app/src/app/api/automations/[automationId]/runs/route.ts
@@ -0,0 +1,39 @@
+import { db } from '@db';
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ automationId: string }> }
+) {
+  try {
+    const { automationId } = await params;
+
+    const runs = await db.evidenceAutomationRun.findMany({
+      where: {
+        evidenceAutomationId: automationId,
+      },
+      include: {
+        evidenceAutomation: {
+          select: {
+            name: true,
+          },
+        },
+      },
+      orderBy: {
+        createdAt: 'desc',
+      },
+      take: 50,
+    });
+
+    return NextResponse.json({ success: true, runs });
+  } catch (error) {
+    console.error('Failed to fetch automation runs:', error);
+    return NextResponse.json(
+      { success: false, error: 'Failed to fetch runs' },
+      { status: 500 }
+    );
+  }
+}
+
+
+
diff --git a/bun.lock b/bun.lock
index f5d29de18..185c04e5d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -164,8 +164,8 @@
         "@tiptap/extension-table-cell": "^3.4.4",
         "@tiptap/extension-table-header": "^3.4.4",
         "@tiptap/extension-table-row": "^3.4.4",
-        "@trigger.dev/react-hooks": "4.0.0",
-        "@trigger.dev/sdk": "4.0.0",
+        "@trigger.dev/react-hooks": "4.0.6",
+        "@trigger.dev/sdk": "4.0.6",
         "@trycompai/db": "^1.3.7",
         "@trycompai/email": "workspace:*",
         "@types/canvas-confetti": "^1.9.0",
@@ -232,7 +232,7 @@
         "@testing-library/dom": "^10.4.0",
         "@testing-library/jest-dom": "^6.6.3",
         "@testing-library/react": "^16.3.0",
-        "@trigger.dev/build": "4.0.0",
+        "@trigger.dev/build": "4.0.6",
         "@types/d3": "^7.4.3",
         "@types/jspdf": "^2.0.0",
         "@types/node": "^24.0.3",
@@ -816,7 +816,7 @@
 
     "@effect/platform": ["@effect/platform@0.90.3", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.33.0", "find-my-way-ts": "^0.1.6", "msgpackr": "^1.11.4", "multipasta": "^0.2.7" }, "peerDependencies": { "effect": "^3.17.7" } }, "sha512-XvQ37yzWQKih4Du2CYladd1i/MzqtgkTPNCaN6Ku6No4CK83hDtXIV/rP03nEoBg2R3Pqgz6gGWmE2id2G81HA=="],
 
-    "@electric-sql/client": ["@electric-sql/client@1.0.0-beta.1", "", { "optionalDependencies": { "@rollup/rollup-darwin-arm64": "^4.18.1" } }, "sha512-Ei9jN3pDoGzc+a/bGqnB5ajb52IvSv7/n2btuyzUlcOHIR2kM9fqtYTJXPwZYKLkGZlHWlpHgWyRtrinkP2nHg=="],
+    "@electric-sql/client": ["@electric-sql/client@1.0.14", "", { "dependencies": { "@microsoft/fetch-event-source": "^2.0.1" }, "optionalDependencies": { "@rollup/rollup-darwin-arm64": "^4.18.1" } }, "sha512-LtPAfeMxXRiYS0hyDQ5hue2PjljUiK9stvzsVyVb4nwxWQxfOWTSF42bHTs/o5i3x1T4kAQ7mwHpxa4A+f8X7Q=="],
 
     "@emnapi/core": ["@emnapi/core@1.5.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.1.0", "tslib": "^2.4.0" } }, "sha512-sbP8GzB1WDzacS8fgNPpHlp6C9VZe+SJP3F90W9rLemaQj2PzIuTEl1qDOYQf58YIpyjViI24y9aPWCjEzY2cg=="],
 
@@ -1072,6 +1072,8 @@
 
     "@mendable/firecrawl-js": ["@mendable/firecrawl-js@1.29.3", "", { "dependencies": { "axios": "^1.11.0", "typescript-event-target": "^1.1.1", "zod": "^3.23.8", "zod-to-json-schema": "^3.23.0" } }, "sha512-+uvDktesJmVtiwxMtimq+3f5bKlsan4T7TokxOI7DbxFkApwrRNss5GYEXbInveMTz8LpGth/9Ch5BTwCqrpfA=="],
 
+    "@microsoft/fetch-event-source": ["@microsoft/fetch-event-source@2.0.1", "", {}, "sha512-W6CLUJ2eBMw3Rec70qrsEW0jOm/3twwJv21mrmj2yORiaVmVYGS4sSS5yUwvQc1ZlDLYGPnClVWmUUMagKNsfA=="],
+
     "@microsoft/tsdoc": ["@microsoft/tsdoc@0.15.1", "", {}, "sha512-4aErSrCR/On/e5G2hDP0wjooqDdauzEbIq8hIkIe5pXV0rtWJZvdCEKL0ykZxex+IxIwBp0eGeV48hQN07dXtw=="],
 
     "@monaco-editor/loader": ["@monaco-editor/loader@1.6.1", "", { "dependencies": { "state-local": "^1.0.6" } }, "sha512-w3tEnj9HYEC73wtjdpR089AqkUPskFRcdkxsiSFt3SoUc3OHpmu+leP94CXBm4mHfefmhsdfI0ZQu6qJ0wgtPg=="],
@@ -1890,13 +1892,13 @@
 
     "@tootallnate/quickjs-emscripten": ["@tootallnate/quickjs-emscripten@0.23.0", "", {}, "sha512-C5Mc6rdnsaJDjO3UpGW/CQTHtCKaYlScZTly4JIu97Jxo/odCiH0ITnDXSJPTOrEKk/ycSZ0AOgTmkDtkOsvIA=="],
 
-    "@trigger.dev/build": ["@trigger.dev/build@4.0.0", "", { "dependencies": { "@trigger.dev/core": "4.0.0", "pkg-types": "^1.1.3", "tinyglobby": "^0.2.2", "tsconfck": "3.1.3" } }, "sha512-OXTTS+pV6ZuqcCtWhiDoW/zB6lrnG1YtkGgYT+QRt+HYeYdOoVBfYfv0y8x3U4Yfiw9kznwQC/sDB1b6DiHtBA=="],
+    "@trigger.dev/build": ["@trigger.dev/build@4.0.6", "", { "dependencies": { "@trigger.dev/core": "4.0.6", "pkg-types": "^1.1.3", "tinyglobby": "^0.2.2", "tsconfck": "3.1.3" } }, "sha512-NJ7N50mNTW43h7jJ/ynsjX1xT+R7fisxVytmwnjb8ZaCgScNp1zDdzGlJjhIjiIWU7G83qpZE1H8eoqjo7tOyg=="],
 
-    "@trigger.dev/core": ["@trigger.dev/core@4.0.0", "", { "dependencies": { "@bugsnag/cuid": "^3.1.1", "@electric-sql/client": "1.0.0-beta.1", "@google-cloud/precise-date": "^4.0.0", "@jsonhero/path": "^1.0.21", "@opentelemetry/api": "1.9.0", "@opentelemetry/api-logs": "0.203.0", "@opentelemetry/core": "2.0.1", "@opentelemetry/exporter-logs-otlp-http": "0.203.0", "@opentelemetry/exporter-trace-otlp-http": "0.203.0", "@opentelemetry/instrumentation": "0.203.0", "@opentelemetry/resources": "2.0.1", "@opentelemetry/sdk-logs": "0.203.0", "@opentelemetry/sdk-trace-base": "2.0.1", "@opentelemetry/sdk-trace-node": "2.0.1", "@opentelemetry/semantic-conventions": "1.36.0", "dequal": "^2.0.3", "eventsource": "^3.0.5", "eventsource-parser": "^3.0.0", "execa": "^8.0.1", "humanize-duration": "^3.27.3", "jose": "^5.4.0", "lodash.get": "^4.4.2", "nanoid": "3.3.8", "prom-client": "^15.1.0", "socket.io": "4.7.4", "socket.io-client": "4.7.5", "std-env": "^3.8.1", "superjson": "^2.2.1", "tinyexec": "^0.3.2", "uncrypto": "^0.1.3", "zod": "3.25.76", "zod-error": "1.5.0", "zod-validation-error": "^1.5.0" } }, "sha512-VlRMN6RPeqU66e/j0fGmWTn97DY1b+ChsMDDBm62jZ3N9XtiOlDkrWNtggPoxPtyXsHuShllo/3gpiZDvhtKww=="],
+    "@trigger.dev/core": ["@trigger.dev/core@4.0.6", "", { "dependencies": { "@bugsnag/cuid": "^3.1.1", "@electric-sql/client": "1.0.14", "@google-cloud/precise-date": "^4.0.0", "@jsonhero/path": "^1.0.21", "@opentelemetry/api": "1.9.0", "@opentelemetry/api-logs": "0.203.0", "@opentelemetry/core": "2.0.1", "@opentelemetry/exporter-logs-otlp-http": "0.203.0", "@opentelemetry/exporter-trace-otlp-http": "0.203.0", "@opentelemetry/instrumentation": "0.203.0", "@opentelemetry/resources": "2.0.1", "@opentelemetry/sdk-logs": "0.203.0", "@opentelemetry/sdk-trace-base": "2.0.1", "@opentelemetry/sdk-trace-node": "2.0.1", "@opentelemetry/semantic-conventions": "1.36.0", "dequal": "^2.0.3", "eventsource": "^3.0.5", "eventsource-parser": "^3.0.0", "execa": "^8.0.1", "humanize-duration": "^3.27.3", "jose": "^5.4.0", "nanoid": "3.3.8", "prom-client": "^15.1.0", "socket.io": "4.7.4", "socket.io-client": "4.7.5", "std-env": "^3.8.1", "superjson": "^2.2.1", "tinyexec": "^0.3.2", "uncrypto": "^0.1.3", "zod": "3.25.76", "zod-error": "1.5.0", "zod-validation-error": "^1.5.0" } }, "sha512-V4w0Wmvw4fst0dbQ7LjmYuaWyLVlwNcLc6f2EB39XqoS7PVQGfRm6KCFWc0sG5x9xa/RBpusXcwmRK0C5QgW9g=="],
 
-    "@trigger.dev/react-hooks": ["@trigger.dev/react-hooks@4.0.0", "", { "dependencies": { "@trigger.dev/core": "^4.0.0", "swr": "^2.2.5" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-6AmMXoWJhjeDj+5rIhMUTW/wBT6n9JVaaUk6j+SBTtLsrecryB3+LKFse5GNdP35wX6dRtqUHtsJuPydaR/mYg=="],
+    "@trigger.dev/react-hooks": ["@trigger.dev/react-hooks@4.0.6", "", { "dependencies": { "@trigger.dev/core": "^4.0.6", "swr": "^2.2.5" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-CnTCVw85Jv3y3bUuVfh8OyNiQwakl2CTM+c7posrzkzoix+EZIpVWNCFl5LSNuRRmgXFTZtwz+FnPbC3phSyWw=="],
 
-    "@trigger.dev/sdk": ["@trigger.dev/sdk@4.0.0", "", { "dependencies": { "@opentelemetry/api": "1.9.0", "@opentelemetry/semantic-conventions": "1.36.0", "@trigger.dev/core": "4.0.0", "chalk": "^5.2.0", "cronstrue": "^2.21.0", "debug": "^4.3.4", "evt": "^2.4.13", "slug": "^6.0.0", "ulid": "^2.3.0", "uncrypto": "^0.1.3", "uuid": "^9.0.0", "ws": "^8.11.0" }, "peerDependencies": { "ai": "^4.2.0 || ^5.0.0", "zod": "^3.0.0 || ^4.0.0" }, "optionalPeers": ["ai"] }, "sha512-rq7XvY4jxCmWr6libN1egw8w0Bq0TWbbnAxCCXDScgWEszLauYmXy8WaVlJyxbwslVMHsvXP36JBFa3J3ay2yg=="],
+    "@trigger.dev/sdk": ["@trigger.dev/sdk@4.0.6", "", { "dependencies": { "@opentelemetry/api": "1.9.0", "@opentelemetry/semantic-conventions": "1.36.0", "@trigger.dev/core": "4.0.6", "chalk": "^5.2.0", "cronstrue": "^2.21.0", "debug": "^4.3.4", "evt": "^2.4.13", "slug": "^6.0.0", "ulid": "^2.3.0", "uncrypto": "^0.1.3", "uuid": "^9.0.0", "ws": "^8.11.0" }, "peerDependencies": { "ai": "^4.2.0 || ^5.0.0", "zod": "^3.0.0 || ^4.0.0" }, "optionalPeers": ["ai"] }, "sha512-jf10/JLoU2Xl8lH5CNM1220PyUHSJiRWfheZBvPh9bu8u0/AvhhJMKqeo3gQyuFjV1xd3BKrMeMULaq2Uy2olQ=="],
 
     "@trycompai/analytics": ["@trycompai/analytics@workspace:packages/analytics"],
 
@@ -3724,8 +3726,6 @@
 
     "lodash.escaperegexp": ["lodash.escaperegexp@4.1.2", "", {}, "sha512-TM9YBvyC84ZxE3rgfefxUWiQKLilstD6k7PTGt6wfbtXF8ixIJLOL3VYyV/z+ZiPLsVxAsKAFVwWlWeb2Y8Yyw=="],
 
-    "lodash.get": ["lodash.get@4.4.2", "", {}, "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ=="],
-
     "lodash.includes": ["lodash.includes@4.3.0", "", {}, "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w=="],
 
     "lodash.isboolean": ["lodash.isboolean@3.0.3", "", {}, "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg=="],

From 14a5d34a08dcd9240e8dc71940732f947745d525 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 15:10:44 -0500
Subject: [PATCH 4/8] ENG-36 Support Intel build for mac, not just Apple
 Silicon (#1714)

* fix(portal): download relevant device agent per macOS chip on portal

* fix(portal): fix portal build issue

* fix(portal): add log for testing

* fix(portal): add log for testing

* fix(portal): put a dropdown to allow users to select macOS chip type for downloading agent

* style(portal): fix prettier lint errors

---------

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 .../tasks/DeviceAgentAccordionItem.tsx        | 67 +++++++++++++++----
 .../src/app/api/download-agent/route.ts       | 20 +++---
 .../app/api/download-agent/scripts/common.ts  |  8 ++-
 apps/portal/src/utils/os.ts                   | 39 +++++++++++
 4 files changed, 109 insertions(+), 25 deletions(-)
 create mode 100644 apps/portal/src/utils/os.ts

diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
index afe8c100c..60b4693c4 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
@@ -1,13 +1,15 @@
 'use client';
 
+import { detectOSFromUserAgent, SupportedOS } from '@/utils/os';
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from '@comp/ui/accordion';
 import { Button } from '@comp/ui/button';
 import { Card, CardContent, CardHeader, CardTitle } from '@comp/ui/card';
 import { cn } from '@comp/ui/cn';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
 import type { Member } from '@db';
 import { CheckCircle2, Circle, Download, Loader2, XCircle } from 'lucide-react';
 import Image from 'next/image';
-import { useState } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 import { toast } from 'sonner';
 import type { FleetPolicy, Host } from '../../types';
 
@@ -23,9 +25,12 @@ export function DeviceAgentAccordionItem({
   fleetPolicies = [],
 }: DeviceAgentAccordionItemProps) {
   const [isDownloading, setIsDownloading] = useState(false);
+  const [detectedOS, setDetectedOS] = useState<SupportedOS | null>(null);
 
-  // Detect OS from user agent
-  const isMacOS = typeof window !== 'undefined' && navigator.userAgent.includes('Mac');
+  const isMacOS = useMemo(
+    () => detectedOS === 'macos' || detectedOS === 'macos-intel',
+    [detectedOS],
+  );
 
   const hasInstalledAgent = host !== null;
   const allPoliciesPass =
@@ -55,12 +60,22 @@ export function DeviceAgentAccordionItem({
 
       // Now trigger the actual download using the browser's native download mechanism
       // This will show in the browser's download UI immediately
-      const downloadUrl = `/api/download-agent?token=${encodeURIComponent(token)}`;
+      const downloadUrl = `/api/download-agent?token=${encodeURIComponent(token)}&os=${detectedOS}`;
 
       // Method 1: Using a temporary link (most reliable)
       const a = document.createElement('a');
       a.href = downloadUrl;
-      a.download = isMacOS ? 'Comp AI Agent-1.0.0-arm64.dmg' : 'compai-device-agent.zip';
+
+      // Set filename based on OS and architecture
+      if (isMacOS) {
+        a.download =
+          detectedOS === 'macos'
+            ? 'Comp AI Agent-1.0.0-arm64.dmg'
+            : 'Comp AI Agent-1.0.0-intel.dmg';
+      } else {
+        a.download = 'compai-device-agent.zip';
+      }
+
       document.body.appendChild(a);
       a.click();
       document.body.removeChild(a);
@@ -95,6 +110,14 @@ export function DeviceAgentAccordionItem({
     }
   };
 
+  useEffect(() => {
+    const detectOS = async () => {
+      const os = await detectOSFromUserAgent();
+      setDetectedOS(os);
+    };
+    detectOS();
+  }, []);
+
   return (
     <AccordionItem value="device-agent" className="border rounded-xs">
       <AccordionTrigger className="px-4 hover:no-underline [&[data-state=open]]:pb-2">
@@ -129,15 +152,31 @@ export function DeviceAgentAccordionItem({
                   <p className="mt-1">
                     Click the download button below to get the Device Agent installer.
                   </p>
-                  <Button
-                    size="sm"
-                    variant="default"
-                    onClick={handleDownload}
-                    disabled={isDownloading || hasInstalledAgent}
-                    className="gap-2 mt-2"
-                  >
-                    {getButtonContent()}
-                  </Button>
+                  <div className="flex items-center gap-2 mt-2">
+                    {isMacOS && !hasInstalledAgent && (
+                      <Select
+                        value={detectedOS || 'macos'}
+                        onValueChange={(value: 'macos' | 'macos-intel') => setDetectedOS(value)}
+                      >
+                        <SelectTrigger className="w-[136px]">
+                          <SelectValue />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="macos">Apple Silicon</SelectItem>
+                          <SelectItem value="macos-intel">Intel</SelectItem>
+                        </SelectContent>
+                      </Select>
+                    )}
+                    <Button
+                      size="sm"
+                      variant="default"
+                      onClick={handleDownload}
+                      disabled={isDownloading || hasInstalledAgent}
+                      className="gap-2"
+                    >
+                      {getButtonContent()}
+                    </Button>
+                  </div>
                 </li>
                 {!isMacOS && (
                   <li>
diff --git a/apps/portal/src/app/api/download-agent/route.ts b/apps/portal/src/app/api/download-agent/route.ts
index 0e0584739..e342f1713 100644
--- a/apps/portal/src/app/api/download-agent/route.ts
+++ b/apps/portal/src/app/api/download-agent/route.ts
@@ -21,6 +21,11 @@ export const maxDuration = 60;
 export async function GET(req: NextRequest) {
   const searchParams = req.nextUrl.searchParams;
   const token = searchParams.get('token');
+  const os = searchParams.get('os');
+
+  if (!os) {
+    return new NextResponse('Missing OS', { status: 400 });
+  }
 
   if (!token) {
     return new NextResponse('Missing download token', { status: 400 });
@@ -36,14 +41,12 @@ export async function GET(req: NextRequest) {
   // Delete token after retrieval (one-time use)
   await kv.del(`download:${token}`);
 
-  const { orgId, employeeId, os } = downloadInfo as {
+  const { orgId, employeeId } = downloadInfo as {
     orgId: string;
     employeeId: string;
     userId: string;
-    os: SupportedOS;
   };
-  console.log(os);
-  
+
   // Hardcoded device marker paths used by the setup scripts
   const fleetDevicePathMac = '/Users/Shared/.fleet';
   const fleetDevicePathWindows = 'C:\\ProgramData\\CompAI\\Fleet';
@@ -57,7 +60,8 @@ export async function GET(req: NextRequest) {
   if (os === 'macos' || os === 'macos-intel') {
     try {
       // Direct DMG download for macOS
-      const macosPackageFilename = os === 'macos' ? 'Comp AI Agent-1.0.0-arm64.dmg' : 'Comp AI Agent-1.0.0.dmg';
+      const macosPackageFilename =
+        os === 'macos' ? 'Comp AI Agent-1.0.0-arm64.dmg' : 'Comp AI Agent-1.0.0.dmg';
       const packageKey = `macos/${macosPackageFilename}`;
 
       const getObjectCommand = new GetObjectCommand({
@@ -118,15 +122,15 @@ export async function GET(req: NextRequest) {
     });
 
     // Add script file
-    const scriptFilename = getScriptFilename(os);
+    const scriptFilename = getScriptFilename(os as SupportedOS);
     archive.append(script, { name: scriptFilename, mode: 0o755 });
 
     // Add README
-    const readmeContent = getReadmeContent(os);
+    const readmeContent = getReadmeContent(os as SupportedOS);
     archive.append(readmeContent, { name: 'README.txt' });
 
     // Get package from S3 and stream it
-    const packageFilename = getPackageFilename(os);
+    const packageFilename = getPackageFilename(os as SupportedOS);
     const windowsPackageFilename = 'fleet-osquery.msi';
     const packageKey = `windows/${windowsPackageFilename}`;
 
diff --git a/apps/portal/src/app/api/download-agent/scripts/common.ts b/apps/portal/src/app/api/download-agent/scripts/common.ts
index dbe01eeac..415745cf4 100644
--- a/apps/portal/src/app/api/download-agent/scripts/common.ts
+++ b/apps/portal/src/app/api/download-agent/scripts/common.ts
@@ -1,15 +1,17 @@
 import type { SupportedOS } from '../types';
 
 export function getScriptFilename(os: SupportedOS): string {
-  return os === 'macos' ? 'run_me_first.command' : 'run_me_first.bat';
+  return os === 'macos' || os === 'macos-intel' ? 'run_me_first.command' : 'run_me_first.bat';
 }
 
 export function getPackageFilename(os: SupportedOS): string {
-  return os === 'macos' ? 'compai-device-agent.pkg' : 'compai-device-agent.msi';
+  return os === 'macos' || os === 'macos-intel'
+    ? 'compai-device-agent.pkg'
+    : 'compai-device-agent.msi';
 }
 
 export function getReadmeContent(os: SupportedOS): string {
-  if (os === 'macos') {
+  if (os === 'macos' || os === 'macos-intel') {
     return `Installation Instructions for macOS:
 
 1. First, run the setup script by double-clicking "run_me_first.command"
diff --git a/apps/portal/src/utils/os.ts b/apps/portal/src/utils/os.ts
new file mode 100644
index 000000000..4d028d269
--- /dev/null
+++ b/apps/portal/src/utils/os.ts
@@ -0,0 +1,39 @@
+export type SupportedOS = 'macos' | 'windows' | 'macos-intel';
+
+export async function detectOSFromUserAgent(): Promise<SupportedOS | null> {
+  try {
+    const ua = navigator.userAgent.toLowerCase();
+
+    // Detect Windows
+    if (ua.includes('win')) {
+      return 'windows';
+    }
+
+    // Detect macOS
+    if (ua.includes('mac')) {
+      // Try modern userAgentData API first (Chrome, Edge)
+      if ('userAgentData' in navigator && navigator.userAgentData) {
+        const data: { architecture?: string } = await (
+          navigator.userAgentData as {
+            getHighEntropyValues: (hints: string[]) => Promise<{ architecture?: string }>;
+          }
+        ).getHighEntropyValues(['architecture']);
+
+        if (data.architecture === 'arm') return 'macos';
+        if (data.architecture === 'x86') return 'macos-intel';
+      }
+
+      // Fallback to userAgent string parsing
+      if (ua.includes('arm64')) return 'macos';
+      if (ua.includes('intel')) return 'macos-intel';
+
+      // Default to macos if we can't determine architecture
+      return 'macos';
+    }
+
+    return null;
+  } catch (error) {
+    console.error('Error detecting OS:', error);
+    return null;
+  }
+}

From 25e05f023645e99d1ece0e2ac66da9e50b58dfe9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 16:24:50 -0500
Subject: [PATCH 5/8] chore(db): add new frameworks, requirements, and task
 templates for compliance (#1717)

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 .../FrameworkEditorControlTemplate.json       |  35 +
 .../primitives/FrameworkEditorFramework.json  |  54 +-
 .../FrameworkEditorPolicyTemplate.json        | 126 ++--
 .../FrameworkEditorRequirement.json           | 648 ++++++++++++++++++
 .../FrameworkEditorTaskTemplate.json          | 609 +++++++++++-----
 ...mplateToFrameworkEditorPolicyTemplate.json | 124 ++++
 ...lTemplateToFrameworkEditorRequirement.json | 512 ++++++++++++++
 ...TemplateToFrameworkEditorTaskTemplate.json | 266 ++++++-
 8 files changed, 2139 insertions(+), 235 deletions(-)

diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json b/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json
index 47a58a94d..2fa9ccda2 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json
@@ -306,5 +306,40 @@
     "description": "ISO Controls",
     "createdAt": "2025-09-01 13:23:28.289",
     "updatedAt": "2025-09-01 13:23:28.289"
+  },
+  {
+    "id": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "name": "PCI",
+    "description": "PCI Controls",
+    "createdAt": "2025-09-10 21:18:19.912",
+    "updatedAt": "2025-09-10 21:18:19.912"
+  },
+  {
+    "id": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "name": "ISO 42001",
+    "description": "Additional ISO 42001 Controls",
+    "createdAt": "2025-09-18 15:30:51.512",
+    "updatedAt": "2025-09-18 15:30:51.512"
+  },
+  {
+    "id": "frk_ct_68e1364141d03b5e6d70e728",
+    "name": "NEN 7510",
+    "description": "NEN 7510 Controls",
+    "createdAt": "2025-10-04 14:59:12.925",
+    "updatedAt": "2025-10-04 14:59:12.925"
+  },
+  {
+    "id": "frk_ct_68e8079750107bcc63fc79d9",
+    "name": "Encrypted Data at Rest",
+    "description": "The organization encrypts all production databases containing customer data at rest",
+    "createdAt": "2025-10-09 19:05:59.357",
+    "updatedAt": "2025-10-09 19:05:59.357"
+  },
+  {
+    "id": "frk_ct_68e80a11f225cb2253e31fa0",
+    "name": "Organization Structure & Reporting Lines",
+    "description": "Management establishes, with board oversight, structures, reporting lines, authorities, and responsibilities",
+    "createdAt": "2025-10-09 19:16:33.433",
+    "updatedAt": "2025-10-09 19:16:33.433"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json b/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json
index 696d5e49d..716dfcca2 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json
@@ -26,15 +26,6 @@
     "updatedAt": "2025-05-14 19:20:44.920",
     "visible": false
   },
-  {
-    "id": "frk_681ef4bb8eeb2b60d2d9d187",
-    "name": "PCI DSS",
-    "description": "PCI DSS",
-    "version": "4.0.1",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920",
-    "visible": false
-  },
   {
     "id": "frk_683f3102f9ae801df35d47b4",
     "name": "Test",
@@ -97,5 +88,50 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-09-01 16:51:38.334",
     "visible": true
+  },
+  {
+    "id": "frk_681ef4bb8eeb2b60d2d9d187",
+    "name": "PCI v0",
+    "description": "PCI DSS",
+    "version": "4.0.1",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2025-09-18 20:17:28.309",
+    "visible": false
+  },
+  {
+    "id": "frk_68c1ead24950f84849db81bb",
+    "name": "PCI DSS",
+    "description": "PCI DSS",
+    "version": "1.0.0",
+    "createdAt": "2025-09-10 21:17:05.591",
+    "updatedAt": "2025-09-18 20:17:36.981",
+    "visible": true
+  },
+  {
+    "id": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "ISO 42001",
+    "description": "Global standard for AI management, guiding organizations to use AI safely, ethically, and effectively.",
+    "version": "1.0.0",
+    "createdAt": "2025-09-18 13:50:34.016",
+    "updatedAt": "2025-09-18 21:09:24.202",
+    "visible": true
+  },
+  {
+    "id": "frk_68d12ec2791043b5a1555950",
+    "name": "Example PCI",
+    "description": "Example PCI Framework",
+    "version": "1.0.0",
+    "createdAt": "2025-09-22 11:10:57.835",
+    "updatedAt": "2025-09-22 11:10:57.835",
+    "visible": false
+  },
+  {
+    "id": "frk_68e135d0212b3b6cd39ceb94",
+    "name": "NEN 7510",
+    "description": "Dutch information security standard for the healthcare",
+    "version": "1.0.0",
+    "createdAt": "2025-10-04 14:57:19.666",
+    "updatedAt": "2025-10-07 20:22:47.176",
+    "visible": true
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json b/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json
index 10e08d1d3..41b2b7028 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json
@@ -1,14 +1,4 @@
 [
-  {
-    "id": "frk_pt_685e4010bde64520b9abaf1d",
-    "name": "Compliance & Regulatory Monitoring",
-    "description": "atalogues all legal, regulatory, and contractual obligations, links them to controls and evidence, and tracks enquiries and gaps to closure.",
-    "frequency": "yearly",
-    "department": "gov",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identify applicable laws, standards, and contractual commitments for {{COMPANY}} and keep proof of conformance in Comp AI. Protect {{DATA}} processed in {{CRITICAL}} and stored in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All products, data processing activities, jurisdictions of operation, and contractual obligations. Applies to {{LOCATION}} staff and contractors using {{DEVICES}} and workloads hosted in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain governance to identify applicable requirements, track associated controls, and retain evidence for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, include HIPAA Privacy, Security, and Breach Notification Rules and retain documentation for 6 years; track BAAs and subcontractors.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Regulatory Obligations List", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a plain-language list of relevant legal, regulatory, and industry requirements (include contracts, SLAs, DPAs, BAAs) relevant to {{INDUSTRY}}, {{CRITICAL}}, {{GEO}}, and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Mark each entry Applies or N/A with a short justification.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review the list semi-annually or upon market expansion.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure each entry references internal controls and owners to support audit requests.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Explicitly indicate HIPAA applicability and BAA status for each vendor or service handling ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Register", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For every applicable requirement, record: Internal Control Reference and Evidence Link.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence examples: access-control configuration, {{DEVICES}} baseline and encryption status, {{CRITICAL}} security configuration and audit logs, and records showing how {{DATA}} is handled and retained in {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Refresh evidence at least annually; schedule reminders before links expire.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag any missing or stale evidence as a Gap.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store evidence in a tamper-resistant location with version/date; keep change history for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include HIPAA-specific artifacts such as risk analysis, training logs, sanctions policy, and incident/breach documentation links.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Regulator & Customer Liaison", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use a dedicated email alias forwarding to compliance contacts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Acknowledge external compliance enquiries within 48 hours during the business hours of our {{LOCATION}} team.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log date, question, and resolution reference in the Compliance Register.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain enquiry and response records to demonstrate communication control and oversight.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For OCR or HIPAA-related enquiries, follow documented response procedures and coordinate with Privacy and Security Officers; align with breach notice timelines where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Evidence Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a 30-minute annual sweep to update links and close gaps. For teams over {{EMPLOYEES}} employees, add a mid-year spot check focused on access reviews and {{CRITICAL}} security baselines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record the review date in the register header.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Time the sweep to precede audit evidence requests; confirm availability of attachments and access permissions.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Verify HIPAA evidence remains current within the 12-month cadence and documented within the 6-year retention window.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No evidence older than 12 months; zero gaps open beyond 30 days. Prioritize controls tied to {{DATA}}, {{CRITICAL}}, {{GEO}}, and {{INDUSTRY}}.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deferred items require documented justification and target date approved by senior management. Note any residual risk to {{DATA}} and compensating controls in the device policy or hosting environment.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unanswered enquiries or overdue gaps are escalated to the next management meeting and added to the work backlog.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "After each audit or major customer questionnaire, adjust evidence format and register structure to streamline future requests. When {{GEO}} changes, update the obligations list and register entries.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:54:08.199",
-    "updatedAt": "2025-08-19 18:23:31.407"
-  },
   {
     "id": "frk_pt_685e426ccbb0de15a90cf446",
     "name": "Remote Access & BYOD",
@@ -19,26 +9,6 @@
     "createdAt": "2025-06-27 07:04:11.567",
     "updatedAt": "2025-08-19 18:23:48.629"
   },
-  {
-    "id": "frk_pt_685e462046667f75a50a2c3e",
-    "name": "Vendor & Third-Party Risk",
-    "description": "Inventories vendors, tiers them by data impact, conducts due diligence, embeds security clauses in contracts, and monitors attestations and incidents.",
-    "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:19:59.742",
-    "updatedAt": "2025-08-19 18:24:04.729"
-  },
-  {
-    "id": "frk_pt_685e3f7b4ebcb27b60c51434",
-    "name": "Information Security & Privacy Governance",
-    "description": "Assigns clear ownership and management accountability for security and privacy, keeps policies current, and measures compliance through regular reviews.",
-    "frequency": "yearly",
-    "department": "admin",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define clear ownership for security and privacy at {{COMPANY}} and ensure decisions are documented.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personnel, contractors, information systems, SaaS/IaaS services hosted in {{CRITICAL}}, and company-managed {{DEVICES}}. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain governance to identify applicable requirements, assign ownership, and retain artifacts for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, document responsibilities under the Security Rule and retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Governance Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Designate a Security & Privacy Owner (SPO) and a documented backup. Ensure coverage across {{LOCATION}} time zones.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record names in the Comp AI platform.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-confirm role assignments at least annually and after role changes.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document the SPO’s scope, authority, and reporting line; keep a dated record of annual role reconfirmation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Name a Security Official responsible for developing and implementing policies (164.308(a)(2)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Management Accountability", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "SPO presents a concise security status during scheduled management reviews.", "type": "text"}, {"type": "hardBreak"}, {"text": "For teams over {{EMPLOYEES}} employees, hold reviews at least quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Senior management signs an annual statement acknowledging ultimate responsibility for security and privacy.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allocate at least one measurable security improvement task per sprint or work cycle, prioritized to protect {{DATA}} in {{CRITICAL}} and stored in {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record management reviews, decisions, and assigned actions with due dates in Comp AI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure management oversight of Security Rule activities and document sanctions, if applied, per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store all policies in Comp AI; the SPO verifies access and link integrity annually. Note storage and retention locations in {{GEO}} where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain version control with change logs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Merge or retire overlapping policies to keep each document brief.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track effective dates and owners; preserve prior versions for audit sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain policy documents and revisions for 6 years (164.316(b)(2)(i)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Awareness", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "New personnel read this policy set and electronically acknowledge before receiving system access to {{CRITICAL}} from {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Distribute security awareness training annually, tailored to {{INDUSTRY}} risks and the handling of {{DATA}}; record completion for the {{LOCATION}} workforce.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track completion status and follow up on overdue training within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access (164.308(a)(5)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual check that policies exist, the SPO and backup are documented, annual sign-off is filed, and the awareness log is current for the {{EMPLOYEES}} workforce.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document deviations in a “Security-Decisions” log with reason and expiry, including any residual risk to {{DATA}} and compensating controls in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing logs or overdue actions are corrected within two weeks or escalated at the next management review.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Audit and incident lessons feed into the next scheduled policy refresh. Update roles and training focus when {{GEO}} or {{INDUSTRY}} obligations change.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:51:38.574",
-    "updatedAt": "2025-08-19 18:24:16.390"
-  },
   {
     "id": "frk_pt_685e453cad89de25e5aebf4a",
     "name": "Acceptable Use & Workstation Security",
@@ -109,16 +79,6 @@
     "createdAt": "2025-06-27 07:08:04.684",
     "updatedAt": "2025-08-19 18:26:03.456"
   },
-  {
-    "id": "frk_pt_685e458a49e1eff0af54e3d2",
-    "name": "Security & Privacy Awareness Training",
-    "description": "Delivers onboarding and annual refresher training, role-based modules, simulated phishing, and tracks completion metrics.",
-    "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Equip personnel at {{COMPANY}} to recognize and respond to security and privacy risks, with emphasis on protecting {{DATA}} accessed via {{CRITICAL}} and handled on {{DEVICES}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees, contractors, interns, and third-party staff with system access. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain training governance and artifacts to support auditor sampling for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access; retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Curriculum", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Core topics: data classification, phishing, password/MFA, incident reporting, privacy basics related to {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include scenarios relevant to {{INDUSTRY}} and usage of {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include content aligned to in-scope Trust Services Criteria.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Cover minimum necessary, ePHI handling, and reporting obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Onboarding Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Complete baseline training within the first week of access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sign electronic acknowledgement; system access to {{CRITICAL}} or {{DATA}} is suspended until completed.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record completion date and acknowledgement in HR/LMS.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure workforce with ePHI access completes Security Rule training before ePHI access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing & Role-Based Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide refresher micro-modules or lunch-and-learns at least annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deliver specialised modules for engineers (secure coding), support (PII/{{DATA}} handling), and other roles as needed in {{LOCATION}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track overdue items and follow up within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide periodic updates relevant to systems processing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Phishing & Social-Engineering Exercises", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct simulated phishing tests quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Users who fall for a phish complete remedial training within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Report aggregate outcomes to management and incorporate lessons into content.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Emphasise verification of identity and secure communication when ePHI may be involved.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Records & Metrics", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track completion in an HR or LMS system; retain logs three years and store in {{GEO}} where residency applies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report completion rate and phishing-failure rate to management quarterly.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve sampling evidence (rosters, timestamps, content versions).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain HIPAA-related training records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "≥ 95% training completion before due date; phishing failure rate trending downward. For teams over {{EMPLOYEES}} employees, expand sampling and target coaching for repeat failures.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Short-term deferral allowed for leave of absence; complete training within two weeks of return.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access restrictions or HR action for repeated failures or missed deadlines.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Revise curriculum based on incident trends, employee feedback, threat landscape changes, {{INDUSTRY}} developments, and {{GEO}} obligations.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:17:30.077",
-    "updatedAt": "2025-08-19 18:26:23.580"
-  },
   {
     "id": "frk_pt_685e42c38c3267d391674ce3",
     "name": "Change & Release Management",
@@ -169,6 +129,46 @@
     "createdAt": "2025-06-27 06:58:08.164",
     "updatedAt": "2025-08-19 18:27:41.229"
   },
+  {
+    "id": "frk_pt_685e4010bde64520b9abaf1d",
+    "name": "Compliance & Regulatory Monitoring",
+    "description": "Catalogues all legal, regulatory, and contractual obligations, links them to controls and evidence, and tracks enquiries and gaps to closure.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identify applicable laws, standards, and contractual commitments for {{COMPANY}} and keep proof of conformance in Comp AI. Protect {{DATA}} processed in {{CRITICAL}} and stored in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All products, data processing activities, jurisdictions of operation, and contractual obligations. Applies to {{LOCATION}} staff and contractors using {{DEVICES}} and workloads hosted in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain governance to identify applicable requirements, track associated controls, and retain evidence for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, include HIPAA Privacy, Security, and Breach Notification Rules and retain documentation for 6 years; track BAAs and subcontractors.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Regulatory Obligations List", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a plain-language list of relevant legal, regulatory, and industry requirements (include contracts, SLAs, DPAs, BAAs) relevant to {{INDUSTRY}}, {{CRITICAL}}, {{GEO}}, and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Mark each entry Applies or N/A with a short justification.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review the list semi-annually or upon market expansion.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure each entry references internal controls and owners to support audit requests.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Explicitly indicate HIPAA applicability and BAA status for each vendor or service handling ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Register", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For every applicable requirement, record: Internal Control Reference and Evidence Link.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence examples: access-control configuration, {{DEVICES}} baseline and encryption status, {{CRITICAL}} security configuration and audit logs, and records showing how {{DATA}} is handled and retained in {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Refresh evidence at least annually; schedule reminders before links expire.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag any missing or stale evidence as a Gap.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store evidence in a tamper-resistant location with version/date; keep change history for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include HIPAA-specific artifacts such as risk analysis, training logs, sanctions policy, and incident/breach documentation links.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Regulator & Customer Liaison", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use a dedicated email alias forwarding to compliance contacts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Acknowledge external compliance enquiries within 48 hours during the business hours of our {{LOCATION}} team.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log date, question, and resolution reference in the Compliance Register.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain enquiry and response records to demonstrate communication control and oversight.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For OCR or HIPAA-related enquiries, follow documented response procedures and coordinate with Privacy and Security Officers; align with breach notice timelines where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Evidence Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a 30-minute annual sweep to update links and close gaps. For teams over {{EMPLOYEES}} employees, add a mid-year spot check focused on access reviews and {{CRITICAL}} security baselines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record the review date in the register header.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Time the sweep to precede audit evidence requests; confirm availability of attachments and access permissions.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Verify HIPAA evidence remains current within the 12-month cadence and documented within the 6-year retention window.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No evidence older than 12 months; zero gaps open beyond 30 days. Prioritize controls tied to {{DATA}}, {{CRITICAL}}, {{GEO}}, and {{INDUSTRY}}.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deferred items require documented justification and target date approved by senior management. Note any residual risk to {{DATA}} and compensating controls in the device policy or hosting environment.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unanswered enquiries or overdue gaps are escalated to the next management meeting and added to the work backlog.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "After each audit or major customer questionnaire, adjust evidence format and register structure to streamline future requests. When {{GEO}} changes, update the obligations list and register entries.", "type": "text"}]}],
+    "createdAt": "2025-06-27 06:54:08.199",
+    "updatedAt": "2025-09-01 18:25:55.923"
+  },
+  {
+    "id": "frk_pt_685e462046667f75a50a2c3e",
+    "name": "Vendor & Third-Party Risk",
+    "description": "Inventories vendors, tiers them by data impact, conducts due diligence, embeds security clauses in contracts, and monitors attestations and incidents.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors (processors) that process personal data of EU/EEA data subjects on behalf of {{COMPANY}}, including subprocessors and the designated EU Representative (if applicable). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Third parties that process or host {{DATA}} for {{COMPANY}} must demonstrate equivalent security controls, preferably NEN 7510 or ISO 27001 certification. Establish data processing agreements and periodically review supplier compliance.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a list of all vendors that process personal data, including:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Type of personal data processed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lawful basis for processing", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether vendor acts as processor, subprocessor, or EU Representative", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Location of processing (EU/EEA or third country with transfer mechanism)", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track Data Processing Agreements (DPAs) with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For Critical and High vendors that process personal data:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify GDPR-compliant DPA is signed before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm vendor provides appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assess cross-border data transfers and ensure valid transfer mechanism (e.g., SCCs, adequacy decision).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record evidence of review and approval.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The DPA must at minimum require the processor to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process personal data only on documented instructions from {{COMPANY}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure confidentiality and train personnel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain prior written authorization for subprocessors and flow down equivalent obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist {{COMPANY}} in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist with security, breach notification, and DPIAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or securely delete personal data at contract termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make available all information necessary to demonstrate compliance and allow audits.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify {{COMPANY}} without undue delay of any personal data breach.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review DPAs for all processors at least annually. Maintain a review log with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date DPA signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures, regulatory actions, and changes in subprocessors or transfer mechanisms. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or confirmation of secure deletion of all personal data, unless retention is required by law. Capture timelines and format. Confirm termination of all subprocessors handling {{COMPANY}}’s personal data. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors processing personal data have a signed GDPR-compliant DPA on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of DPAs are reviewed at least annually and logged with next review date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of cross-border transfers have a documented lawful transfer mechanism.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors provide breach reporting without undue delay. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}],
+    "createdAt": "2025-06-27 07:19:59.742",
+    "updatedAt": "2025-10-05 01:57:26.869"
+  },
+  {
+    "id": "frk_pt_685e3f7b4ebcb27b60c51434",
+    "name": "Information Security & Privacy Governance",
+    "description": "Assigns clear ownership and management accountability for security and privacy, keeps policies current, and measures compliance through regular reviews.",
+    "frequency": "yearly",
+    "department": "admin",
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define clear ownership for security and privacy at {{COMPANY}} and ensure decisions are documented.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "This policy also establishes the framework for. information security in accordance with ", "type": "text"}, {"text": "NEN 7510 - Information Security in Healthcare", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", ensuring the confidentiality, integrity, and availability (CIA) of health and personal information processed by {{COMPANY}}", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personnel, contractors, information systems, SaaS/IaaS services hosted in {{CRITICAL}}, and company-managed {{DEVICES}}. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain governance to identify applicable requirements, assign ownership, and retain artifacts for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, document responsibilities under the Security Rule and retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where health or patient information (personal data within the meaning of the GDPR/AVG) is processed, document responsibilities, ensure secure handling, and maintain records of processing in accordance with Dutch healthcare regulations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Governance Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Designate a Security & Privacy Owner (SPO) and a documented backup. Ensure coverage across {{LOCATION}} time zones.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record names in the Comp AI platform.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-confirm role assignments at least annually and after role changes.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document the SPO’s scope, authority, and reporting line; keep a dated record of annual role reconfirmation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Name a Security Official responsible for developing and implementing policies (164.308(a)(2)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Assign accountability for implementing and maintaining NEN 7510 controls, including risk management, access security, training, and compliance with Dutch legal obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Management Accountability", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "SPO presents a concise security status during scheduled management reviews.", "type": "text"}, {"type": "hardBreak"}, {"text": "For teams over {{EMPLOYEES}} employees, hold reviews at least quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Senior management signs an annual statement acknowledging ultimate responsibility for security and privacy.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allocate at least one measurable security improvement task per sprint or work cycle, prioritized to protect {{DATA}} in {{CRITICAL}} and stored in {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record management reviews, decisions, and assigned actions with due dates in Comp AI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure management oversight of Security Rule activities and document sanctions, if applied, per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Conduct annual management reviews that address the outcomes of risk assessments, incidents, and improvement actions required by NEN 7510. Risk registers, relevant metrics, and mitigation decisions must be recorded and tracked to completion.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store all policies in Comp AI; the SPO verifies access and link integrity annually. Note storage and retention locations in {{GEO}} where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain version control with change logs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Merge or retire overlapping policies to keep each document brief.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track effective dates and owners; preserve prior versions for audit sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain policy documents and revisions for 6 years (164.316(b)(2)(i)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all NEN 7519-relevant documents (policies, risk assessments, incident records, and management reviews) are retained for the defined retention period and remain traceable for internal and external audits.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Awareness", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "New personnel read this policy set and electronically acknowledge before receiving system access to {{CRITICAL}} from {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Distribute security awareness training annually, tailored to {{INDUSTRY}} risks and the handling of {{DATA}}; record completion for the {{LOCATION}} workforce.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track completion status and follow up on overdue training within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access (164.308(a)(5)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Deliver role-based awareness and training covering information security in healthcare, including protection of patient data, secure system use, and staff responsibilities under NEN 7510. Reassess training needs annually and after significant changes in technology or regulation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual check that policies exist, the SPO and backup are documented, annual sign-off is filed, and the awareness log is current for the {{EMPLOYEES}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain compliance with the ", "type": "text"}, {"text": "General Data Protection Regulation (GDPR/AVG)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", the ", "type": "text"}, {"text": "Dutch Medical Treatment Contracts Act (WGBO)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", and the ", "type": "text"}, {"text": "NEN 7510 suite", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", including ", "type": "text"}, {"text": "NEN7512", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (secure data transmission) and ", "type": "text"}, {"text": "NEN 7513", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (logging and audit trail requirements).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document deviations in a “Security-Decisions” log with reason and expiry, including any residual risk to {{DATA}} and compensating controls in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing logs or overdue actions are corrected within two weeks or escalated at the next management review.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Audit and incident lessons feed into the next scheduled policy refresh. Update roles and training focus when {{GEO}} or {{INDUSTRY}} obligations change.", "type": "text"}]}],
+    "createdAt": "2025-06-27 06:51:38.574",
+    "updatedAt": "2025-10-05 01:48:08.435"
+  },
+  {
+    "id": "frk_pt_685e458a49e1eff0af54e3d2",
+    "name": "Security & Privacy Awareness Training",
+    "description": "Delivers onboarding and annual refresher training, role-based modules, simulated phishing, and tracks completion metrics.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Equip personnel at {{COMPANY}} to recognize and respond to security and privacy risks, with emphasis on protecting {{DATA}} accessed via {{CRITICAL}} and handled on {{DEVICES}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees, contractors, interns, and third-party staff with system access. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain training governance and artifacts to support auditor sampling for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access; retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security training for New Hires and at least once every 12 months.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Curriculum", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Core topics: data classification, phishing, password/MFA, incident reporting, privacy basics related to {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include scenarios relevant to {{INDUSTRY}} and usage of {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include content aligned to in-scope Trust Services Criteria.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Cover minimum necessary, ePHI handling, and reporting obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Training includes awareness of ", "type": "text"}, {"text": "threats and vulnerabilities that may impact the security of cardholder data (CHD) and sensitive authentication data (SAD)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ". This includes, but is not limited to: phishing, spear-phishing, business email compromise, social engineering (phone, chat, in-person pretexting), malware delivery vectors, and insider threats.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Onboarding Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Complete baseline training within the first week of access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sign electronic acknowledgement; system access to {{CRITICAL}} or {{DATA}} is suspended until completed.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record completion date and acknowledgement in HR/LMS.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure workforce with ePHI access completes Security Rule training before ePHI access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "The awareness training program will be ", "type": "text"}, {"text": "reviewed at least annually", "type": "text", "marks": [{"type": "bold"}]}, {"text": " and updated as needed to address emerging threats, vulnerabilities, or changes in PCI DSS or {{INDUSTRY}} regulations. Updates will be logged, version-controlled, and communicated to employees using multiple channels (e.g., LMS, email, intranet).", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing & Role-Based Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide refresher micro-modules or lunch-and-learns at least annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deliver specialised modules for engineers (secure coding), support (PII/{{DATA}} handling), and other roles as needed in {{LOCATION}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track overdue items and follow up within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide periodic updates relevant to systems processing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Security reminders and education will be delivered via multiple communication methods such as classroom sessions, online training, email bulletins, posters, intranet content, and phishing simulation platforms. All personnel must ", "type": "text"}, {"text": "acknowledge at least once every 12 months", "type": "text", "marks": [{"type": "bold"}]}, {"text": " that they have read and understood {{COMPANY}}’s Information Security Policy and associated procedures. Electronic signatures or LMS acknowledgments are acceptable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Phishing & Social-Engineering Exercises", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct simulated phishing tests quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Users who fall for a phish complete remedial training within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Report aggregate outcomes to management and incorporate lessons into content.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Emphasise verification of identity and secure communication when ePHI may be involved.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Records & Metrics", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track completion in an HR or LMS system; retain logs three years and store in {{GEO}} where residency applies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report completion rate and phishing-failure rate to management quarterly.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve sampling evidence (rosters, timestamps, content versions).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain HIPAA-related training records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "≥ 95% training completion before due date; phishing failure rate trending downward. For teams over {{EMPLOYEES}} employees, expand sampling and target coaching for repeat failures.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Short-term deferral allowed for leave of absence; complete training within two weeks of return.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access restrictions or HR action for repeated failures or missed deadlines.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Revise curriculum based on incident trends, employee feedback, threat landscape changes, {{INDUSTRY}} developments, and {{GEO}} obligations.", "type": "text"}]}],
+    "createdAt": "2025-06-27 07:17:30.077",
+    "updatedAt": "2025-09-10 19:43:20.239"
+  },
   {
     "id": "frk_pt_685e4508d8c0d14ae873e644",
     "name": "Physical Security & Environmental",
@@ -239,24 +239,54 @@
     "createdAt": "2025-06-27 07:03:31.937",
     "updatedAt": "2025-08-19 18:29:18.519"
   },
+  {
+    "id": "frk_pt_685e43e23b78127274355980",
+    "name": "Incident Response & Breach Notification",
+    "description": "Defines detection, triage, containment, communication, legal notification, and post-incident lessons with clear team roles.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure security and privacy incidents are identified, contained, reported, and resolved quickly, and that required notifications are issued on time.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All information assets, personnel, third-party services, and physical locations.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain documented procedures, incident tickets, evidence, notifications, and post-incident reviews for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Implement Security Incident Procedures (164.308(a)(6)) and the Breach Notification Rule (45 CFR 164.400–414). Retain HIPAA documentation for 6 years; Business Associates notify Covered Entities without unreasonable delay and no later than 60 days of discovery.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Detection & Reporting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security tools forward real-time alerts to an incident channel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anyone discovering suspicious activity must report to security within one hour.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log every alert or report in the incident tracker with date/time.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure alerting integrates with on-call; track acknowledgement and response times in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Flag incidents involving ePHI and begin breach-risk assessment per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Incident Response Team & Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign Incident Commander, Technical Lead, Communications Lead, and Scribe; publish roster with 24 × 7 contacts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain runbooks for malware, data breach, DDoS, and cloud compromise scenarios.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep current on-call rosters and role handoffs in the ticket.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Engage Privacy/Security Officers for suspected ePHI incidents and coordinate with affected Business Associates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Containment & Eradication", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Isolate affected systems within 30 minutes of confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Capture forensics where feasible; patch, clean, or rebuild before re-connect.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document actions and timestamps in the tracker.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve logs and evidence; record containment start/stop and recovery steps.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Limit access to ePHI during containment; document safeguards applied.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Breach Notification & Communications", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify management immediately for incidents involving personal or regulated data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Draft customer/regulator notices within applicable legal timeframes (for example, GDPR 72 hours to authorities; HIPAA notifications without unreasonable delay and no later than 60 days).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Route all external statements through Communications Lead and legal counsel.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Archive notifications, approvals, and distribution lists with the incident record.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Perform breach-risk assessment, determine reportability, and document notifications to individuals, HHS, and (if applicable) media.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Post-Incident Review & Lessons Learned", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a root-cause post-mortem within 10 business days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record corrective actions, owners, and due dates; track to closure.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Attach the post-incident review and remediation evidence to the ticket; verify control improvements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Update risk analysis and any affected procedures that impact ePHI safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track mean time to detect (MTTD), mean time to contain (MTTC), and breach-notification deadlines; review quarterly.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process deviations allowed only if required to protect life, safety, or critical systems; document afterward.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unreported or mishandled incidents escalate to executive review and may trigger disciplinary action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update runbooks and tooling after each post-mortem or external audit finding.", "type": "text"}]}],
+    "createdAt": "2025-06-27 07:10:25.721",
+    "updatedAt": "2025-08-19 18:29:33.133"
+  },
   {
     "id": "frk_pt_685e43997555c7ab39983c21",
     "name": "Logging, Monitoring & Audit",
     "description": "Centralises and protects logs, sets real-time alerting for critical events, retains audit trails, and reviews metrics and samples monthly.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide trustworthy evidence for security, troubleshooting, and compliance at {{COMPANY}} by collecting and analysing relevant logs from {{CRITICAL}} systems and services that handle {{DATA}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Application, system, network, authentication, and cloud-provider logs across all environments. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may access central logging tools.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Operate centralised logging and alerting for in-scope systems and retain configurations, alerts, reports, and tickets for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable audit controls for systems handling ePHI, protect log integrity and access, and retain required HIPAA documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Collection & Centralisation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Forward logs to a central, access-controlled SIEM or log service hosted in {{CRITICAL}}; archive per {{GEO}} residency where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include timestamp, user, event type, and source IP for security-relevant events.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tag events with environment and application identifiers.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all in-scope systems forward logs; keep forwarding and parser configurations under version control.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable and retain audit logs on systems accessing ePHI; restrict who can view ePHI-related logs (managed {{DEVICES}} only).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Retention & Protection", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain security logs at least 90 days online and 1 year in archive; store archives in {{GEO}} when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict write access to the logging system; prohibit log tampering or deletion.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect archived logs with access controls and integrity checks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store archived logs in access-controlled repositories; preserve integrity for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain audit records for ePHI systems per policy and retain HIPAA Security Rule documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Real-Time Alerting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Create alerts for key events: failed admin logins, privilege escalations, critical errors, and anomalous access to {{CRITICAL}}/{{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Send alerts to the on-call channel and maintain documented runbooks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Define alert SLAs and escalation paths; track acknowledgement and resolution in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Alert on anomalous access patterns involving ePHI and unsuccessful logins on ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Audit & Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review alert metrics and random log samples monthly; include sources tied to {{CRITICAL}} and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Produce a quarterly audit report summarizing anomalies and actions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain review notes, reports, and remediation tickets for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document investigations and outcomes for events affecting ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Clock Synchronization", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sync all servers and {{DEVICES}} to a trusted NTP source; alert on drift greater than 5 s.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record NTP configuration and drift monitoring in system baselines.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure timestamps are accurate for ePHI audit trails.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Central platform receives ≥ 95% of target logs; alert queue triaged within SLA. For teams over {{EMPLOYEES}} employees, expand quarterly sampling across {{CRITICAL}} tiers.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Systems unable to forward logs must export daily and upload; document in the asset list, noting any {{GEO}} constraints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging gaps greater than 24 h or unreviewed alerts are escalated to incident response.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add new log sources and refine alert logic based on incident learnings, {{INDUSTRY}} risks, and any residency or transfer changes affecting {{GEO}}.", "type": "text"}]}],
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide trustworthy evidence for security, troubleshooting, and compliance at {{COMPANY}} by collecting and analysing relevant logs from {{CRITICAL}} systems and services that handle {{DATA}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Application, system, network, authentication, and cloud-provider logs across all environments. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may access central logging tools.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Operate centralised logging and alerting for in-scope systems and retain configurations, alerts, reports, and tickets for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable audit controls for systems handling ePHI, protect log integrity and access, and retain required HIPAA documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Collection & Centralisation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Forward logs to a central, access-controlled SIEM or log service hosted in {{CRITICAL}}; archive per {{GEO}} residency where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include timestamp, user, event type, and source IP for security-relevant events.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tag events with environment and application identifiers.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all in-scope systems forward logs; keep forwarding and parser configurations under version control.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable and retain audit logs on systems accessing ePHI; restrict who can view ePHI-related logs (managed {{DEVICES}} only).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Retention & Protection", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain security logs at least 90 days online and 1 year in archive; store archives in {{GEO}} when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict write access to the logging system; prohibit log tampering or deletion.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect archived logs with access controls and integrity checks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store archived logs in access-controlled repositories; preserve integrity for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain audit records for ePHI systems per policy and retain HIPAA Security Rule documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Real-Time Alerting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Create alerts for key events: failed admin logins, privilege escalations, critical errors, and anomalous access to {{CRITICAL}}/{{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Send alerts to the on-call channel and maintain documented runbooks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Define alert SLAs and escalation paths; track acknowledgement and resolution in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Alert on anomalous access patterns involving ePHI and unsuccessful logins on ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "All personnel report security or privacy incidents immediately to the SPO. Maintain logs of user access to healthcare systems in accordance with NEN 7513. Conduct incident reviews and feed lessons learned into the continual improvement cycle.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Audit & Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review alert metrics and random log samples monthly; include sources tied to {{CRITICAL}} and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Produce a quarterly audit report summarizing anomalies and actions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain review notes, reports, and remediation tickets for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document investigations and outcomes for events affecting ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Clock Synchronization", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sync all servers and {{DEVICES}} to a trusted NTP source; alert on drift greater than 5 s.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record NTP configuration and drift monitoring in system baselines.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure timestamps are accurate for ePHI audit trails.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Central platform receives ≥ 95% of target logs; alert queue triaged within SLA. For teams over {{EMPLOYEES}} employees, expand quarterly sampling across {{CRITICAL}} tiers.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Systems unable to forward logs must export daily and upload; document in the asset list, noting any {{GEO}} constraints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging gaps greater than 24 h or unreviewed alerts are escalated to incident response.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add new log sources and refine alert logic based on incident learnings, {{INDUSTRY}} risks, and any residency or transfer changes affecting {{GEO}}.", "type": "text"}]}],
     "createdAt": "2025-06-27 07:09:12.690",
-    "updatedAt": "2025-08-19 18:29:05.410"
+    "updatedAt": "2025-10-05 01:55:26.246"
   },
   {
-    "id": "frk_pt_685e43e23b78127274355980",
-    "name": "Incident Response & Breach Notification",
-    "description": "Defines detection, triage, containment, communication, legal notification, and post-incident lessons with clear team roles.",
+    "id": "frk_pt_68cc576eab0b1748940253fa",
+    "name": "AI Policy Control Framework",
+    "description": "The AI Policy Control Framework establishes principles, roles, and processes to ensure the responsible development, use, and oversight of AI systems, aligning them with organizational policies, regulatory obligations, and ethical standards.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure security and privacy incidents are identified, contained, reported, and resolved quickly, and that required notifications are issued on time.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All information assets, personnel, third-party services, and physical locations.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain documented procedures, incident tickets, evidence, notifications, and post-incident reviews for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Implement Security Incident Procedures (164.308(a)(6)) and the Breach Notification Rule (45 CFR 164.400–414). Retain HIPAA documentation for 6 years; Business Associates notify Covered Entities without unreasonable delay and no later than 60 days of discovery.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Detection & Reporting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security tools forward real-time alerts to an incident channel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anyone discovering suspicious activity must report to security within one hour.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log every alert or report in the incident tracker with date/time.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure alerting integrates with on-call; track acknowledgement and response times in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Flag incidents involving ePHI and begin breach-risk assessment per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Incident Response Team & Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign Incident Commander, Technical Lead, Communications Lead, and Scribe; publish roster with 24 × 7 contacts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain runbooks for malware, data breach, DDoS, and cloud compromise scenarios.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep current on-call rosters and role handoffs in the ticket.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Engage Privacy/Security Officers for suspected ePHI incidents and coordinate with affected Business Associates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Containment & Eradication", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Isolate affected systems within 30 minutes of confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Capture forensics where feasible; patch, clean, or rebuild before re-connect.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document actions and timestamps in the tracker.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve logs and evidence; record containment start/stop and recovery steps.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Limit access to ePHI during containment; document safeguards applied.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Breach Notification & Communications", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify management immediately for incidents involving personal or regulated data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Draft customer/regulator notices within applicable legal timeframes (for example, GDPR 72 hours to authorities; HIPAA notifications without unreasonable delay and no later than 60 days).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Route all external statements through Communications Lead and legal counsel.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Archive notifications, approvals, and distribution lists with the incident record.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Perform breach-risk assessment, determine reportability, and document notifications to individuals, HHS, and (if applicable) media.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Post-Incident Review & Lessons Learned", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a root-cause post-mortem within 10 business days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record corrective actions, owners, and due dates; track to closure.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Attach the post-incident review and remediation evidence to the ticket; verify control improvements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Update risk analysis and any affected procedures that impact ePHI safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track mean time to detect (MTTD), mean time to contain (MTTC), and breach-notification deadlines; review quarterly.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process deviations allowed only if required to protect life, safety, or critical systems; document afterward.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unreported or mishandled incidents escalate to executive review and may trigger disciplinary action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update runbooks and tooling after each post-mortem or external audit finding.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:10:25.721",
-    "updatedAt": "2025-08-19 18:29:33.133"
+    "content": [{"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The purpose of this policy is to establish a consistent governance framework for the responsible development, deployment, and use of Artificial Intelligence (AI) systems. It ensures that AI is aligned with the organization’s strategic objectives, complies with applicable laws and standards, and upholds ethical principles such as fairness, accountability, transparency, and respect for individual and societal impacts.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "This policy applies to all employees, contractors, partners, and third parties who are involved in the design, acquisition, development, deployment, monitoring, or use of AI systems on behalf of the organization. It covers AI systems developed in-house, procured from vendors, or integrated into existing business processes, and extends across the entire AI system life cycle, from design and training data acquisition through deployment, monitoring, maintenance, and decommissioning.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "1. ", "type": "text"}, {"text": "AI Governance & Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.2.2, A.2.3, A.2.4)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Documented overarching AI policy (objectives, principles, scope of AI use, governance framework).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Alignment with existing policies (security, privacy, compliance, risk).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Formal review cycle (annual + ad hoc).", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "2. ", "type": "text"}, {"text": "AI Roles, Responsibility & Accountability", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Governance Roles & Committees", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.3.2)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign AI roles: AI Owner, AI Risk Officer, Model Developers, AI Ethics/Review Committee.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clear accountability for AI lifecycle stages.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Concern Reporting & Whistleblowing", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Extension of ", "type": "text"}, {"text": "Sanctions & Disciplinary", "type": "text", "marks": [{"type": "italic"}]}, {"text": " + ", "type": "text"}, {"text": "Awareness Training", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Safe channels for employees to report AI-related risks, ethical concerns, or unintended harms.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Part of training & awareness modules.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "3. ", "type": "text"}, {"text": "AI Resources & Competency", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Resource Management", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.4.2–A.4.6)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document ", "type": "text"}, {"text": "data, tooling, compute, and human resources", "type": "text", "marks": [{"type": "bold"}]}, {"text": " relevant to AI.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain inventory of AI system dependencies/frameworks (TensorFlow, PyTorch, APIs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define ", "type": "text"}, {"text": "competency requirements", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (skills/training) for AI staff.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "4. ", "type": "text"}, {"text": "AI Risk & Impact Assessments", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Risk & Impact Assessment Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.5.2–A.5.5)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process for assessing individual, societal, and organizational impacts of AI systems.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain findings as part of enterprise ", "type": "text"}, {"text": "risk register", "type": "text", "marks": [{"type": "bold"}]}, {"text": ".", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Required for new AI systems, major updates, and periodic reviews.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "5. ", "type": "text"}, {"text": "AI Lifecycle Management", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Development & Design Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Secure SDLC", "type": "text", "marks": [{"type": "italic"}]}, {"text": ", ", "type": "text"}, {"text": "Change & Release Management", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define ", "type": "text"}, {"text": "responsible AI objectives", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (fairness, transparency, explainability, robustness).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lifecycle processes: design → development → validation → deployment → monitoring → decommissioning.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verification & validation of AI models (bias, accuracy, robustness testing).", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Deployment & Operations", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Logging, Monitoring & Audit", "type": "text", "marks": [{"type": "italic"}]}, {"text": " + ", "type": "text"}, {"text": "Incident Response", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Model performance monitoring, drift detection, bias monitoring.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Event logging for AI actions/decisions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rollback/retraining protocols.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI System Documentation", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.6.2.7)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Documentation prepared for stakeholders: purpose, design, limitations, and risks.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tailored for regulators, customers, users.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "6. ", "type": "text"}, {"text": "AI Data Governance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Data Governance Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.7.2–A.7.6)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data requirements defined: quality, provenance, preparation, retention, lawful basis.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Dataset acquisition vetting (bias, representativeness, licensing).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Continuous validation of dataset integrity & relevance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Links to ", "type": "text"}, {"text": "Data Classification & Handling", "type": "text", "marks": [{"type": "italic"}]}, {"text": " and ", "type": "text"}, {"text": "Privacy & Data Subject Rights", "type": "text", "marks": [{"type": "italic"}]}, {"text": ".", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "7. ", "type": "text"}, {"text": "AI Transparency & Stakeholder Communications", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Transparency & Communications", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.8.2–A.8.5)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "User-facing documentation: explanation of AI system purpose, limitations, intended use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Stakeholder reporting: regulatory disclosures, public summaries, accountability dashboards.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI incident communication: tailored protocols for affected users & regulatory bodies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Channels for external stakeholders to report adverse impacts.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "8. ", "type": "text"}, {"text": "Responsible Use of AI", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Responsible AI Use Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.9.2–A.9.4)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define acceptable vs prohibited AI uses (alignment with ethics principles).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Establish “intended use” framework tied to AI model documentation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct user education on ethical/responsible AI use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Embed into ", "type": "text"}, {"text": "Acceptable Use Policy (AUP)", "type": "text", "marks": [{"type": "italic"}]}, {"text": ".", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "9. ", "type": "text"}, {"text": "Third-Party AI Governance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Vendor & Third-Party Risk", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Vendor & Third-Party Risk", "type": "text", "marks": [{"type": "italic"}]}, {"text": ", ", "type": "text"}, {"text": "Third-Party Processor", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI-specific clauses in contracts (responsible AI dev/use, explainability, performance guarantees).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require supplier AI transparency (model cards/evaluation reports).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI accountability mapping: shared responsibilities between org ↔ vendor ↔ customer.", "type": "text"}]}]}]}]}]}],
+    "createdAt": "2025-09-18 19:03:10.246",
+    "updatedAt": "2025-09-18 19:06:12.956"
+  },
+  {
+    "id": "frk_pt_68bb155d6b8eaafd14904188",
+    "name": "Third-Party Processors (Vendors)",
+    "description": "Ensures all third-party vendors adhere to sign GDPR Data Processing Agreements",
+    "frequency": "yearly",
+    "department": "admin",
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors (processors) that process personal data of EU/EEA data subjects on behalf of {{COMPANY}}, including subprocessors and the designated EU Representative (if applicable). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a list of all vendors that process personal data, including:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Type of personal data processed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lawful basis for processing", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether vendor acts as processor, subprocessor, or EU Representative", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Location of processing (EU/EEA or third country with transfer mechanism)", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track Data Processing Agreements (DPAs) with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For Critical and High vendors that process personal data:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify GDPR-compliant DPA is signed before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm vendor provides appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assess cross-border data transfers and ensure valid transfer mechanism (e.g., SCCs, adequacy decision).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record evidence of review and approval.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The DPA must at minimum require the processor to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process personal data only on documented instructions from {{COMPANY}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure confidentiality and train personnel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain prior written authorization for subprocessors and flow down equivalent obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist {{COMPANY}} in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist with security, breach notification, and DPIAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or securely delete personal data at contract termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make available all information necessary to demonstrate compliance and allow audits.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify {{COMPANY}} without undue delay of any personal data breach.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review DPAs for all processors at least annually. Maintain a review log with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date DPA signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures, regulatory actions, and changes in subprocessors or transfer mechanisms. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or confirmation of secure deletion of all personal data, unless retention is required by law. Capture timelines and format. Confirm termination of all subprocessors handling {{COMPANY}}’s personal data. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors processing personal data have a signed GDPR-compliant DPA on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of DPAs are reviewed at least annually and logged with next review date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of cross-border transfers have a documented lawful transfer mechanism.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors provide breach reporting without undue delay. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}],
+    "createdAt": "2025-09-05 16:52:44.802",
+    "updatedAt": "2025-09-05 17:17:12.446"
+  },
+  {
+    "id": "frk_pt_68e3f39e77b0a823add09bf5",
+    "name": "Code of Business Conduct",
+    "description": "The Code of Business Conduct outlines the ethical standards and professional behaviors expected of all employees. It serves as a guide to ensure integrity, compliance, and responsibility in all business activities and interactions.",
+    "frequency": "yearly",
+    "department": "hr",
+    "content": [{"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Set clear expectations for ethical behavior, professionalism, and compliance across all {{COMPANY}} activities.", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect trust with customers, partners, regulators, and one another while upholding {{INDUSTRY}} standards.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Applies to all {{COMPANY}} employees, contractors, and third parties operating on behalf of {{COMPANY}} in {{GEO}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "Covers conduct, data protection, decision-making, and use of company systems and resources.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Our Principles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Act with integrity", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Be honest, fair, and transparent in all interactions with customers, partners, regulators, and colleagues.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect trust", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Safeguard all customer PII, financial records, property data, credit-bureau information, and compliance documentation.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer first", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure that decisions improve the accuracy, speed, and fairness of lending and service outcomes—not just short-term performance.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Comply with the law", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Follow applicable financial-services, data-protection, anti-bribery, anti-money-laundering, competition, and employment laws.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No retaliation", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Speaking up about ethical or compliance concerns is encouraged and protected from retaliation.", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Professional Conduct", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respect and inclusion", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Harassment, discrimination, or bullying of any kind is strictly prohibited—promote an inclusive and respectful workplace.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conflicts of interest", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disclose any outside employment, investments, family relationships, or gifts that could influence business decisions.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Fair dealing", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Never misrepresent {{COMPANY}} or competitors, or engage in unfair or deceptive business practices.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Communications and social media", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only authorized representatives may speak publicly on behalf of {{COMPANY}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "Never disclose confidential or customer information in public or social-media channels.", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Data Protection & Security", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access control", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use company-managed accounts with SSO and MFA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply least-privilege access and review access quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Shared or generic accounts are prohibited.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Device security", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Devices must enable disk encryption, auto-lock, strong passcodes, and current OS/patches.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Install company MDM/endpoint protection when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store customer data only in approved, encrypted applications; never on local drives unless explicitly authorized and encrypted.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data handling", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect only the minimum data required for business needs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify and label sensitive data appropriately.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use anonymized or synthetic data for development and testing whenever possible.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incident response", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Immediately report any suspected data loss, breach, or unauthorized access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The Security Lead coordinates containment, notification, and post-incident review per regulatory requirements.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retention and deletion", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain data only as long as legally or contractually required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Securely delete data when no longer needed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respond promptly to data-subject requests (access, correction, deletion).", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Reporting Concerns", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Raise ethical or conduct concerns with your manager or compliance contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anonymous reporting options are available upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No retaliation will occur for good-faith reports or participation in investigations.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Violations may result in access restrictions, disciplinary action (including termination), and, where required, reporting to regulatory authorities.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "This Code is reviewed at least annually; all updates will be communicated in writing.", "type": "text"}]}]}]}],
+    "createdAt": "2025-10-06 16:51:41.945",
+    "updatedAt": "2025-10-06 17:09:34.333"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json b/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json
index 9d69372ed..8b7833c14 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json
@@ -7837,5 +7837,653 @@
     "identifier": "1",
     "createdAt": "2025-09-01 13:27:39.721",
     "updatedAt": "2025-09-01 13:27:39.721"
+  },
+  {
+    "id": "frk_rq_68c1eafed7ef7c22cc3ba9db",
+    "frameworkId": "frk_68c1ead24950f84849db81bb",
+    "name": "PCI Requirement",
+    "description": "Everything related to PCI",
+    "identifier": "",
+    "createdAt": "2025-09-10 21:17:50.456",
+    "updatedAt": "2025-09-10 21:17:50.456"
+  },
+  {
+    "id": "frk_rq_68cc0e89f26cd9c83ed5e882",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Understanding the needs and expectations of interested parties",
+    "description": "\"The organization shall determine:\r\n\r\n— the interested parties that are relevant to the AI management system;\r\n— the relevant requirements of these interested parties;\r\n— which of these requirements will be addressed through the AI management system.\"",
+    "identifier": "ISO/IEC 42001:2023 Clause 4.2",
+    "createdAt": "2025-09-18 13:52:08.493",
+    "updatedAt": "2025-09-18 13:52:08.493"
+  },
+  {
+    "id": "frk_rq_68cc0eadde4caac33efff2ce",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Determining the scope of the AI management system",
+    "description": "\"The organization shall determine the boundaries and applicability of the AI management system to establish its scope.\r\n\r\nWhen determining this scope, the organization shall consider:\r\n\r\n— the external and internal issues referred to in 4.1;\r\n— the requirements referred to in 4.2.\r\n\r\nThe scope shall be available as documented information.\r\n\r\nThe scope of the AI management system shall determine the organization’s activities with respect to this document’s requirements on the AI management system, leadership, planning, support, operation, performance, evaluation, improvement, controls and objectives.\"",
+    "identifier": "ISO/IEC 42001:2023 Clause 4.3",
+    "createdAt": "2025-09-18 13:52:45.221",
+    "updatedAt": "2025-09-18 13:52:45.221"
+  },
+  {
+    "id": "frk_rq_68cc0ecd7ec7814948c7f618",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI management system",
+    "description": "The organization shall establish, implement, maintain, continually improve and document an AI management system, including the processes needed and their interactions, in accordance with the requirements of this document.",
+    "identifier": "ISO/IEC 42001:2023 Clause 4.4",
+    "createdAt": "2025-09-18 13:53:17.221",
+    "updatedAt": "2025-09-18 13:53:17.221"
+  },
+  {
+    "id": "frk_rq_68cc0e5eddc90f9619ae850d",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Understanding the organization and its context  ",
+    "description": "\"The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended result(s) of its AI management system.\r\n\r\nThe organization shall consider the intended purpose of the AI systems that are developed, provided or used by the organization. The organization shall determine its roles with respect to these AI systems\"",
+    "identifier": "ISO/IEC 42001:2023 Clause 4.1",
+    "createdAt": "2025-09-18 13:51:25.644",
+    "updatedAt": "2025-09-18 13:53:54.032"
+  },
+  {
+    "id": "frk_rq_68cc0f7b1fe3d0eba7057907",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Leadership and commitment",
+    "description": "Top management shall demonstrate leadership and commitment with respect to the AI management\r\nsystem by:\r\n\r\n— ensuring that the AI policy (see 5.2) and AI objectives (see 6.2) are established and are compatible with the strategic direction of the organization\r\n— ensuring the integration of the AI management system requirements into the organization’s business processes\r\n— ensuring that the resources needed for the AI management system are available\r\n— communicating the importance of effective AI management and of conforming to the AI management system requirements\r\n— ensuring that the AI management system achieves its intended result(s);\r\n— directing and supporting persons to contribute to the effectiveness of the AI management system\r\n— promoting continual improvement;\r\n— supporting other relevant roles to demonstrate their leadership as it applies to their areas of responsibility.",
+    "identifier": "ISO/IEC 42001:2023 Clause 5.1",
+    "createdAt": "2025-09-18 13:56:11.042",
+    "updatedAt": "2025-09-18 13:56:11.042"
+  },
+  {
+    "id": "frk_rq_68cc0f9de0890c314f870108",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Policy",
+    "description": "Top management shall establish an AI policy that:\r\na) is appropriate to the purpose of the organization\r\nb) provides a framework for setting AI objectives (see 6.2);\r\nc) includes a commitment to meet applicable requirements\r\nd) includes a commitment to continual improvement of the AI management system\r\n\r\nThe AI policy shall:\r\n— be available as documented information\r\n— refer as relevant to other organizational policies;\r\n— be communicated within the organization\r\n— be available to interested parties, as appropriate",
+    "identifier": "ISO/IEC 42001:2023 Clause 5.2",
+    "createdAt": "2025-09-18 13:56:45.087",
+    "updatedAt": "2025-09-18 13:56:45.087"
+  },
+  {
+    "id": "frk_rq_68cc0fb516f402f740147419",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Organizational roles, responsibilities and authorities",
+    "description": "Top management shall ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization.\r\nTop management shall assign the responsibility and authority for:\r\na) ensuring that the AI management system conforms to the requirements of this document;\r\nb) reporting on the performance of the AI management system to top management.",
+    "identifier": "ISO/IEC 42001:2023 Clause 5.3",
+    "createdAt": "2025-09-18 13:57:08.649",
+    "updatedAt": "2025-09-18 13:57:08.649"
+  },
+  {
+    "id": "frk_rq_68cc0fd04f279d7a96eacc6f",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Actions to address risks and opportunities (General)",
+    "description": "When planning for the AI management system, the organization shall consider the issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed to:\r\n\r\n— give assurance that the AI management system can achieve its intended result(s);\r\n— prevent or reduce undesired effects;\r\n— achieve continual improvement\r\n\r\nThe organization shall establish and maintain AI risk criteria that support:\r\n— distinguishing acceptable from non-acceptable risks\r\n— performing AI risk assessments\r\n— conducting AI risk treatment\r\n— assessing AI risk impacts.\r\n\r\nThe organization shall determine the risks and opportunities according to:\r\n\r\n— the domain and application context of an AI system;\r\n— the intended use;\r\n— the external and internal context described in 4.1\r\n\r\nThe organization shall plan:\r\n\r\na) actions to address these risks and opportunities;\r\n\r\nb) how to:\r\n1) integrate and implement the actions into its AI management system processes;\r\n2) evaluate the effectiveness of these actions.",
+    "identifier": "ISO/IEC 42001:2023 Clause 6.1.1",
+    "createdAt": "2025-09-18 13:57:35.538",
+    "updatedAt": "2025-09-18 13:57:35.538"
+  },
+  {
+    "id": "frk_rq_68cc0ff05be924f5d0d58a6f",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI risk assessment",
+    "description": "The organization shall define and establish an AI risk assessment process that:\r\n\r\na) is informed by and aligned to the AI policy (see 5.2) and AI objectives\r\nb) is designed such that repeated AI risk assessments can produce consistent, valid and comparable results;\r\nc) identifies risks that aid or prevent achieving its AI objectives\r\nd) analyses the AI risks to:\r\n1) assess the potential consequences to the organization, individuals and societies that would result if the identified risks were to materialize\r\n2) assess, where applicable, the realistic likelihood of the identified risks\r\n3) determine the levels of risk\r\ne) evaluates the AI risks to:\r\n1) compare the results of the risk analysis with the risk criteria\r\n2) prioritize the assessed risks for risk treatment.\r\n\r\nThe organization shall retain documented information about the AI risk assessment process.",
+    "identifier": "ISO/IEC 42001:2023 Clause 6.1.2",
+    "createdAt": "2025-09-18 13:58:08.309",
+    "updatedAt": "2025-09-18 13:58:08.309"
+  },
+  {
+    "id": "frk_rq_68cc10611c3b98926aaf2cd5",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Planning of Changes",
+    "description": "When the organization determines the need for changes to the AI management system, the changes shall be carried out in a planned manner.",
+    "identifier": "ISO/IEC 42001:2023 Clause 6.3",
+    "createdAt": "2025-09-18 14:00:00.872",
+    "updatedAt": "2025-09-18 14:00:00.872"
+  },
+  {
+    "id": "frk_rq_68cc124496843ba357887e21",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Awareness",
+    "description": "Persons doing work under the organization’s control shall be aware of:\r\n\r\n— the AI policy (see 5.2);\r\n— their contribution to the effectiveness of the AI management system, including the benefits of improved AI performance;\r\n— the implications of not conforming with the AI management system requirements.",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.3",
+    "createdAt": "2025-09-18 14:08:04.278",
+    "updatedAt": "2025-09-18 14:08:04.278"
+  },
+  {
+    "id": "frk_rq_68cc1023e32bf22413738e2f",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI risk treatment",
+    "description": "Taking the risk assessment results into account, the organization shall define an AI risk treatment process to:\r\na) select appropriate AI risk treatment options\r\nb) determine all controls that are necessary to implement the AI risk treatment options chosen and compare the controls with those in Annex A to verify that no necessary controls have been omitted\r\nc) consider the controls from Annex A that are relevant for the implementation of the AI risk treatment options\r\nd) identify if additional controls are necessary beyond those in Annex A in order to implement all risk treatment options\r\ne) consider the guidance in Annex B for the implementation of controls determined in b) and c)\r\nf) produce a statement of applicability that contains the necessary controls [see b), c) and d)] and provide justification for inclusion and exclusion of controls. Justification for exclusion can include where the controls are not deemed necessary by the risk assessment and where they are not required by (or are subject to exceptions under) applicable external requirements\r\ng) formulate an AI risk treatment plan.\r\n\r\nThe organization shall obtain approval from the designated management for the AI risk treatment plan and for acceptance of the residual AI risks. The necessary controls shall be:\r\n— aligned to the objectives in 6.2\r\n— available as documented information\r\n— communicated within the organization\r\n— available to interested parties, as appropriate",
+    "identifier": "ISO/IEC 42001:2023 Clause 6.1.3",
+    "createdAt": "2025-09-18 13:58:58.502",
+    "updatedAt": "2025-09-18 13:58:58.502"
+  },
+  {
+    "id": "frk_rq_68cc1037f2716f51a47b2a2c",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system impact assessment",
+    "description": "The organization shall define a process for assessing the potential consequences for individuals and societies that can result from the development, provision or use of AI systems.\r\n\r\nThe AI system impact assessment shall determine the potential consequences an AI system’s deployment, intended use and foreseeable misuse has on individuals and societies.\r\n\r\nThe impact assessment should take into account the specific technical and societal context where the AI system is deployed and applicable jurisdictions.\r\n\r\nThe result of the system impact assessment shall be documented. Where appropriate, the result of the system impact assessment can be made available to relevant interested parties as defined by the organization.\r\n\r\nThe organization shall consider an AI system impact assessment results in the risk assessment (see 6.1.2). A.5 in Table A.1 provides controls for assessing impacts of AI systems.",
+    "identifier": "ISO/IEC 42001:2023 Clause 6.1.4",
+    "createdAt": "2025-09-18 13:59:19.049",
+    "updatedAt": "2025-09-18 13:59:19.049"
+  },
+  {
+    "id": "frk_rq_68cc104bfdfae778fc876c94",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI objectives and planning to achieve them",
+    "description": "The organization shall establish AI objectives at relevant functions and levels:\r\n\r\nThe AI objectives shall:\r\na) be consistent with the AI policy (see 5.2);\r\nb) be measurable (if practicable);\r\nc) take into account applicable requirements;\r\nd) be monitored;\r\ne) be communicated;\r\nf) be updated as appropriate;\r\ng) be available as documented information;\r\n\r\nWhen planning how to achieve its AI objectives, the organization shall determine:\r\n— what will be done;\r\n— what resources will be required;\r\n— who will be responsible;\r\n— when it will be completed;\r\n— how the results will be evaluated.",
+    "identifier": "ISO/IEC 42001:2023 Clause 6.2",
+    "createdAt": "2025-09-18 13:59:38.703",
+    "updatedAt": "2025-09-18 13:59:38.703"
+  },
+  {
+    "id": "frk_rq_68cc106d0cdb75961110d7bd",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Resources",
+    "description": "\"The organization shall determine and provide the resources needed for the establishment,\r\nimplementation, maintenance and continual improvement of the AI management system.\"",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.1",
+    "createdAt": "2025-09-18 14:00:13.212",
+    "updatedAt": "2025-09-18 14:00:13.212"
+  },
+  {
+    "id": "frk_rq_68cc108f1697a1687b11d500",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Competence",
+    "description": "The organization shall:\r\n\r\n— determine the necessary competence of person(s) doing work under its control that affects its AI performance;\r\n— ensure that these persons are competent on the basis of appropriate education, training or experience;\r\n— where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken.\r\n\r\nAppropriate documented information shall be available as evidence of competence",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.2",
+    "createdAt": "2025-09-18 14:00:46.785",
+    "updatedAt": "2025-09-18 14:00:46.785"
+  },
+  {
+    "id": "frk_rq_68cc126823caf86fae495b66",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Communication",
+    "description": "The organization shall determine the internal and external communications relevant to the AI management system including:\r\n— on what it will communicate;\r\n— when to communicate;\r\n— with whom to communicate;\r\n— how to communicate.",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.4",
+    "createdAt": "2025-09-18 14:08:40.394",
+    "updatedAt": "2025-09-18 14:08:40.394"
+  },
+  {
+    "id": "frk_rq_68cc131dece6bc88bea70bea",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Operational planning and control",
+    "description": "The organization shall plan, implement and control the processes needed to meet requirements, and to implement the actions determined in Clause 6, by:\r\n\r\n— establishing criteria for the processes;\r\n— implementing control of the processes in accordance with the criteria.\r\n\r\nThe organization should implement the controls determined according to 6.1.3 that are related to the operation of the AI management system (e.g. AI system development and usage life cycle related controls).\r\n\r\nThe effectiveness of these controls shall be monitored and corrective actions shall be considered if the intended results are not achieved. Annex A lists reference controls and Annex B provides implementation guidance for them.\r\n\r\nDocumented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.\r\n\r\nThe organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.\r\n\r\nThe organization shall ensure that externally provided processes, products or services that are relevant to the AI management system are controlled.",
+    "identifier": "ISO/IEC 42001:2023 Clause 8.1",
+    "createdAt": "2025-09-18 14:11:40.662",
+    "updatedAt": "2025-09-18 14:11:40.662"
+  },
+  {
+    "id": "frk_rq_68cc12d0f52f5c1d91f117f1",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Documented information (General)",
+    "description": "The organization’s AI management system shall include:\r\na) documented information required by this document;\r\nb) documented information determined by the organization as being necessary for the effectiveness of the AI management system.",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.5.1",
+    "createdAt": "2025-09-18 14:10:23.727",
+    "updatedAt": "2025-09-18 14:10:23.727"
+  },
+  {
+    "id": "frk_rq_68cc1342bdd7f557947e44a2",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI risk assessment ",
+    "description": "The organization shall perform AI risk assessments in accordance with 6.1.2 at planned intervals or when significant changes are proposed or occur.\r\n\r\nThe organization shall retain documented information of the results of all AI risk assessments.",
+    "identifier": "ISO/IEC 42001:2023 Clause 8.2",
+    "createdAt": "2025-09-18 14:12:17.819",
+    "updatedAt": "2025-09-18 14:12:17.819"
+  },
+  {
+    "id": "frk_rq_68cc13d7452ced814c6e99f0",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Management review - General",
+    "description": "Top management shall review the organization’s AI management system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness.",
+    "identifier": "ISO/IEC 42001:2023 Clause 9.3.1",
+    "createdAt": "2025-09-18 14:14:46.905",
+    "updatedAt": "2025-09-18 14:14:46.905"
+  },
+  {
+    "id": "frk_rq_68cc13f34b88f4b16f70a060",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Management review inputs",
+    "description": "The management review shall include:\r\na) the status of actions from previous management reviews;\r\nb) changes in external and internal issues that are relevant to the AI management system;\r\nc) changes in needs and expectations of interested parties that are relevant to the AI management system;\r\nd) information on the AI management system performance, including trends in:\r\n1) nonconformities and corrective actions;\r\n2) monitoring and measurement results;\r\n3) audit results;\r\ne) opportunities for continual improvement.",
+    "identifier": "ISO/IEC 42001:2023 Clause 9.3.2",
+    "createdAt": "2025-09-18 14:15:15.324",
+    "updatedAt": "2025-09-18 14:15:15.324"
+  },
+  {
+    "id": "frk_rq_68cc5a4fd31458ffff814315",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system impact assessment process",
+    "description": "The organization shall establish a process to assess the potential consequences for individuals and societies that can result from the AI system throughout its life cycle.",
+    "identifier": "ISO/IEC 42001:2023 A.5.2",
+    "createdAt": "2025-09-18 19:15:26.849",
+    "updatedAt": "2025-09-18 19:15:26.849"
+  },
+  {
+    "id": "frk_rq_68cc5a5a379347f5e3eb59bf",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Documentation of AI system impact assessments",
+    "description": "The organization shall document the results of AI system impact assessments and retain results for a defined period.",
+    "identifier": "ISO/IEC 42001:2023 A.5.3",
+    "createdAt": "2025-09-18 19:15:38.442",
+    "updatedAt": "2025-09-18 19:15:38.442"
+  },
+  {
+    "id": "frk_rq_68cc5a6ca8269484c65f9ec4",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Assessing AI system impact on individuals and groups of individuals",
+    "description": "\"The organization shall assess and document the potential impacts of AI systems to individuals or groups of individuals\r\nthroughout the system’s life cycle.\"",
+    "identifier": "ISO/IEC 42001:2023 A.5.4",
+    "createdAt": "2025-09-18 19:15:55.751",
+    "updatedAt": "2025-09-18 19:15:55.751"
+  },
+  {
+    "id": "frk_rq_68cc5a771abf96227e04340d",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Assessing societal impacts of AI systems",
+    "description": "The organization shall assess and document the potential societal impacts of their AI systems throughout their life cycle.",
+    "identifier": "ISO/IEC 42001:2023 A.5.5",
+    "createdAt": "2025-09-18 19:16:07.428",
+    "updatedAt": "2025-09-18 19:16:07.428"
+  },
+  {
+    "id": "frk_rq_68cc5a9d72bacbed2987c4b8",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Objectives for responsible development of AI system",
+    "description": "The organization shall identify and document objectives to guide the development of trustworthy AI systems, and take those objectives into account and integrate measures to achieve them in the development life cycle.",
+    "identifier": "ISO/IEC 42001:2023 A.6.1.2",
+    "createdAt": "2025-09-18 19:16:44.703",
+    "updatedAt": "2025-09-18 19:16:44.703"
+  },
+  {
+    "id": "frk_rq_68cc5aca98f03da8f8367cba",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "\"Documentation of AI system design and development\"",
+    "description": "\"The organization shall document the AI system design and development based on organizational objectives, documented\r\nrequirements and specification criteria.\"",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.3",
+    "createdAt": "2025-09-18 19:17:30.244",
+    "updatedAt": "2025-09-18 19:17:30.244"
+  },
+  {
+    "id": "frk_rq_68cc5ae5ff5cddebb560aa22",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system deployment",
+    "description": "The organization shall document a deployment plan and ensure that appropriate requirements are met prior to deployment.",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.5",
+    "createdAt": "2025-09-18 19:17:57.416",
+    "updatedAt": "2025-09-18 19:17:57.416"
+  },
+  {
+    "id": "frk_rq_68cc5af0bf60b2e58133ff53",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system operation and monitoring",
+    "description": "The organization shall define and document the necessary elements for the ongoing operation of the AI system. At the minimum, this should include system and performance monitoring, repairs, updates and support",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.6",
+    "createdAt": "2025-09-18 19:18:08.155",
+    "updatedAt": "2025-09-18 19:18:08.155"
+  },
+  {
+    "id": "frk_rq_68cc5afff58160f9f1c4dd20",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system technical documentation",
+    "description": "The organization shall determine what AI system technical documentation is needed for each relevant category of interested parties, such as users, partners, supervisory authorities, and provide the technical documentation to them in the appropriate form.",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.7",
+    "createdAt": "2025-09-18 19:18:22.876",
+    "updatedAt": "2025-09-18 19:18:22.876"
+  },
+  {
+    "id": "frk_rq_68cc5b0cffc0c85df3924feb",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system recording of event logs",
+    "description": "The organization shall determine at which phases of the AI system life cycle, record keeping of event logs should be enabled, but at the minimum when the AI system is in use.",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.8",
+    "createdAt": "2025-09-18 19:18:35.569",
+    "updatedAt": "2025-09-18 19:18:35.569"
+  },
+  {
+    "id": "frk_rq_68cc5b1b6a671e5fdb9e83f8",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Data for development and enhancement of AI system",
+    "description": "The organization shall define, document and implement data management processes related to the development of AI systems.",
+    "identifier": "ISO/IEC 42001:2023 A.7.2",
+    "createdAt": "2025-09-18 19:18:51.302",
+    "updatedAt": "2025-09-18 19:18:51.302"
+  },
+  {
+    "id": "frk_rq_68cc5b28c6250d5e578180f9",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Acquisition of data",
+    "description": "The organization shall determine and document details about the acquisition and selection of the data used in AI systems.",
+    "identifier": "ISO/IEC 42001:2023 A.7.3",
+    "createdAt": "2025-09-18 19:19:03.592",
+    "updatedAt": "2025-09-18 19:19:03.592"
+  },
+  {
+    "id": "frk_rq_68cc12e9ccf8c0f87b0ab7ed",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Creating and updating",
+    "description": "When creating and updating documented information, the organization shall ensure appropriate:\r\n\r\n— identification and description (e.g. a title, date, author or reference number);\r\n— format (e.g. language, software version, graphics) and media (e.g. paper, electronic);\r\n— review and approval for suitability and adequacy.",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.5.2",
+    "createdAt": "2025-09-18 14:10:48.775",
+    "updatedAt": "2025-09-18 14:10:48.775"
+  },
+  {
+    "id": "frk_rq_68cc12fe773e2545f63bbb68",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Control of documented information  ",
+    "description": "Documented information required by the AI management system and by this document shall be controlled to ensure:\r\n\r\na) it is available and suitable for use, where and when it is needed;\r\nb) it is adequately protected (e.g. from loss of confidentiality, improper use or loss of integrity).\r\nFor the control of documented information, the organization shall address the following activities, as applicable:\r\n— distribution, access, retrieval and use;\r\n— storage and preservation, including preservation of legibility;\r\n— control of changes (e.g. version control);\r\n— retention and disposition.\r\n\r\nDocumented information of external origin determined by the organization to be necessary for the planning and operation of the AI management system shall be identified as appropriate and controlled.",
+    "identifier": "ISO/IEC 42001:2023 Clause 7.5.3",
+    "createdAt": "2025-09-18 14:11:09.518",
+    "updatedAt": "2025-09-18 14:11:09.518"
+  },
+  {
+    "id": "frk_rq_68cc1356217bdfd8243f6ffa",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI risk treatment ",
+    "description": "The organization shall implement the AI risk treatment plan according to 6.1.3 and verify its effectiveness.\r\n\r\nWhen risk assessments identify new risks that require treatment, a risk treatment process in accordance with 6.1.3 shall be performed for these risks.\r\n\r\nWhen risk treatment options as defined by the risk treatment plan are not effective, these treatment options shall be reviewed and revalidated following the risk treatment process according to 6.1.3 and the risk treatment plan shall be updated.\r\n\r\nThe organization shall retain documented information of the results of all AI risk treatments.",
+    "identifier": "ISO/IEC 42001:2023 Clause 8.3",
+    "createdAt": "2025-09-18 14:12:38.489",
+    "updatedAt": "2025-09-18 14:12:38.489"
+  },
+  {
+    "id": "frk_rq_68cc136d293aef7e72dae81a",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system impact assessment",
+    "description": "The organization shall perform AI system impact assessments according to 6.1.4 at planned intervals or when significant changes are proposed to occur.\r\n\r\nThe organization shall retain documented information of the results of all AI system impact assessments.",
+    "identifier": "ISO/IEC 42001:2023 Clause 8.4",
+    "createdAt": "2025-09-18 14:13:01.110",
+    "updatedAt": "2025-09-18 14:13:01.110"
+  },
+  {
+    "id": "frk_rq_68cc139ce4e9397e774a970b",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Monitoring, measurement, analysis and evaluation  ",
+    "description": "The organization shall determine:\r\n— what needs to be monitored and measured;\r\n— the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;\r\n— when the monitoring and measuring shall be performed;\r\n— when the results from monitoring and measurement shall be analysed and evaluated.\r\n\r\nDocumented information shall be available as evidence of the results.\r\n\r\nThe organization shall evaluate the performance and the effectiveness of the AI management system.",
+    "identifier": "ISO/IEC 42001:2023 Clause 9.1",
+    "createdAt": "2025-09-18 14:13:48.239",
+    "updatedAt": "2025-09-18 14:13:48.239"
+  },
+  {
+    "id": "frk_rq_68cc13aebd1f91aa8a6e2288",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Internal audit - General",
+    "description": "The organization shall conduct internal audits at planned intervals to provide information on whether the AI management system:\r\n\r\na) conforms to:\r\n1) the organization’s own requirements for its AI management system;\r\n2) the requirements of this document;\r\nb) is effectively implemented and maintained.",
+    "identifier": "ISO/IEC 42001:2023 Clause 9.2.1",
+    "createdAt": "2025-09-18 14:14:06.463",
+    "updatedAt": "2025-09-18 14:14:06.463"
+  },
+  {
+    "id": "frk_rq_68cc13c78fe780fd336736f8",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Internal Audit ",
+    "description": "The organization shall plan, establish, implement and maintain (an) audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.\r\n\r\nWhen establishing the internal audit programme(s), the organization shall consider the importance of the processes concerned and the results of previous audits.\r\n\r\nThe organization shall:\r\na) define the audit objectives, criteria and scope for each audit;\r\nb) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;\r\nc) ensure that the results of audits are reported to relevant managers.\r\n\r\nDocumented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.",
+    "identifier": "ISO/IEC 42001:2023 Clause 9.2.2",
+    "createdAt": "2025-09-18 14:14:30.947",
+    "updatedAt": "2025-09-18 14:14:30.947"
+  },
+  {
+    "id": "frk_rq_68cc1424b567f1f8cb7c31f0",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Management review",
+    "description": "The results of the management review shall include decisions related to continual improvement opportunities and any need for changes to the AI management system.\r\n\r\nDocumented information shall be available as evidence of the results of management reviews.",
+    "identifier": "ISO/IEC 42001:2023 Clause 9.3.3",
+    "createdAt": "2025-09-18 14:16:03.670",
+    "updatedAt": "2025-09-18 14:16:03.670"
+  },
+  {
+    "id": "frk_rq_68cc1484d319859ad5a42fc1",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Continual improvement",
+    "description": "The organization shall continually improve the suitability, adequacy and effectiveness of the AI management system.",
+    "identifier": "ISO/IEC 42001:2023 Clause 10.1",
+    "createdAt": "2025-09-18 14:17:40.421",
+    "updatedAt": "2025-09-18 14:17:40.421"
+  },
+  {
+    "id": "frk_rq_68cc1499a406e703a08e8d8a",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Nonconformity and corrective action",
+    "description": "When a nonconformity occurs, the organization shall:\r\na) react to the nonconformity and as applicable:\r\n1) take action to control and correct it;\r\n2) deal with the consequences;\r\n\r\nb) evaluate the need for action to eliminate the cause(s) of the nonconformity, in order that it does not\r\nrecur or occur elsewhere, by:\r\n1) reviewing the nonconformity;\r\n2) determining the causes of the nonconformity;\r\n3) determining if similar nonconformities exist or can potentially occur;\r\n\r\nc) implement any action needed;\r\n\r\nd) review the effectiveness of any corrective action taken;\r\n\r\ne) make changes to the AI management system, if necessary.\r\nCorrective actions shall be appropriate to the effects of the nonconformities encountered.\r\nDocumented information shall be available as evidence of:\r\n— the nature of the nonconformities and any subsequent actions taken;\r\n— the results of any corrective action",
+    "identifier": "ISO/IEC 42001:2023 Clause 10.2",
+    "createdAt": "2025-09-18 14:18:01.175",
+    "updatedAt": "2025-09-18 14:18:01.175"
+  },
+  {
+    "id": "frk_rq_68cc58794cb877178071a215",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI Policy",
+    "description": "The organization shall document a policy for the development or use of AI systems.",
+    "identifier": "ISO/IEC 42001:2023 A.2.2",
+    "createdAt": "2025-09-18 19:07:36.841",
+    "updatedAt": "2025-09-18 19:07:36.841"
+  },
+  {
+    "id": "frk_rq_68cc588533f95e19633f1adc",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Alignment with other organizational policies",
+    "description": "The organization shall determine where other policies can be affected by or apply to, the organization’s objectives with respect to AI systems.",
+    "identifier": "ISO/IEC 42001:2023 A.2.3",
+    "createdAt": "2025-09-18 19:07:49.434",
+    "updatedAt": "2025-09-18 19:07:49.434"
+  },
+  {
+    "id": "frk_rq_68cc5893f5f46050ad0ea974",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Review of the AI policy",
+    "description": "The AI policy shall be reviewed at planned intervals or additionally as needed to ensure its continuing suitability, adequacy and effectiveness.",
+    "identifier": "ISO/IEC 42001:2023 A.2.4",
+    "createdAt": "2025-09-18 19:08:03.204",
+    "updatedAt": "2025-09-18 19:08:03.204"
+  },
+  {
+    "id": "frk_rq_68cc58aea3157dcac365d9f7",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI roles and responsibilities ",
+    "description": "Roles and responsibilities for AI shall be defined and allocated according to the needs of the organization.",
+    "identifier": "ISO/IEC 42001:2023 A.3.2",
+    "createdAt": "2025-09-18 19:08:29.943",
+    "updatedAt": "2025-09-18 19:08:29.943"
+  },
+  {
+    "id": "frk_rq_68cc58bb7fa931aabc7d29f2",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Reporting of concerns",
+    "description": "The organization shall define and put in place a process for employees of the organization to report concerns about the organization’s role with respect to an AI system throughout its life cycle.",
+    "identifier": "ISO/IEC 42001:2023 A.3.3",
+    "createdAt": "2025-09-18 19:08:42.514",
+    "updatedAt": "2025-09-18 19:08:42.514"
+  },
+  {
+    "id": "frk_rq_68cc58dc1ef78d1fe51b83be",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Resource Documentation",
+    "description": "The organization shall identify and document relevant resources required for the activities at given AI system life cycle stages and other AI-related activities relevant for the organization.",
+    "identifier": "ISO/IEC 42001:2023 A.4.2",
+    "createdAt": "2025-09-18 19:09:16.286",
+    "updatedAt": "2025-09-18 19:09:16.286"
+  },
+  {
+    "id": "frk_rq_68cc58e8ea648286acddda43",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Data resources",
+    "description": "As part of resource identification, the organization shall document information about the data resources utilized for the AI system.",
+    "identifier": "ISO/IEC 42001:2023 A.4.3",
+    "createdAt": "2025-09-18 19:09:28.453",
+    "updatedAt": "2025-09-18 19:09:28.453"
+  },
+  {
+    "id": "frk_rq_68cc58f88bcbeef356b5081c",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Tooling resources",
+    "description": "As part of resource identification, the organization shall document information about the tooling resources utilized for the AI system",
+    "identifier": "ISO/IEC 42001:2023 A.4.4",
+    "createdAt": "2025-09-18 19:09:43.798",
+    "updatedAt": "2025-09-18 19:09:43.798"
+  },
+  {
+    "id": "frk_rq_68cc5906894ada4eceff256b",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "System and computing resources",
+    "description": "As part of resource identification, the organization shall document information about the system and computing resources utilized for the AI system.",
+    "identifier": "ISO/IEC 42001:2023 A.4.5",
+    "createdAt": "2025-09-18 19:09:58.352",
+    "updatedAt": "2025-09-18 19:09:58.352"
+  },
+  {
+    "id": "frk_rq_68cc5a3a422aaca23633eba8",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Human resources",
+    "description": "\"As part of resource identification, the organization shall document information about the human resources and\r\ntheir competences utilized for the development, deployment, operation, change management, maintenance, transfer and decommissioning, as well as verification and integration of the AI system.\"",
+    "identifier": "ISO/IEC 42001:2023 A.4.6",
+    "createdAt": "2025-09-18 19:15:05.460",
+    "updatedAt": "2025-09-18 19:15:05.460"
+  },
+  {
+    "id": "frk_rq_68cc5aaaeb5095fd2da1a92c",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Processes for trustworthy AI system design and development",
+    "description": "The organization shall define and document the specific processes for the responsible design and development of the AI system.",
+    "identifier": "ISO/IEC 42001:2023 A.6.1.3",
+    "createdAt": "2025-09-18 19:16:58.318",
+    "updatedAt": "2025-09-18 19:16:58.318"
+  },
+  {
+    "id": "frk_rq_68cc5ab9b661ac977104733b",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system requirements and specification",
+    "description": "The organization shall specify and document requirements for new AI systems or material enhancements to existing systems",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.2",
+    "createdAt": "2025-09-18 19:17:12.978",
+    "updatedAt": "2025-09-18 19:17:12.978"
+  },
+  {
+    "id": "frk_rq_68cc5b347ac42a6ed8a90c67",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Quality of data for AI systems",
+    "description": "The organization shall define and document requirements for data quality and ensure that data used to develop and operate the AI system meet those requirements",
+    "identifier": "ISO/IEC 42001:2023 A.7.4",
+    "createdAt": "2025-09-18 19:19:15.784",
+    "updatedAt": "2025-09-18 19:19:15.784"
+  },
+  {
+    "id": "frk_rq_68cc5b41171a8cadfef58dd7",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Data provenance",
+    "description": "The organization shall define and document a process for recording the provenance of data used in its AI systems over the life cycles of the data and the AI system.",
+    "identifier": "ISO/IEC 42001:2023 A.7.5",
+    "createdAt": "2025-09-18 19:19:28.718",
+    "updatedAt": "2025-09-18 19:19:28.718"
+  },
+  {
+    "id": "frk_rq_68cc5b4f01de903a82db622d",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Data preparation",
+    "description": "The organization shall define and document their needs for and approaches to data preparation",
+    "identifier": "ISO/IEC 42001:2023 A.7.6",
+    "createdAt": "2025-09-18 19:19:43.022",
+    "updatedAt": "2025-09-18 19:19:43.022"
+  },
+  {
+    "id": "frk_rq_68cc5b5f0af0a89e2ddbc059",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "System documentation and information for users",
+    "description": "The organization shall determine and provide the necessary information to users of the system.",
+    "identifier": "ISO/IEC 42001:2023 A.8.2",
+    "createdAt": "2025-09-18 19:19:59.099",
+    "updatedAt": "2025-09-18 19:19:59.099"
+  },
+  {
+    "id": "frk_rq_68cc5b76ac80dbc2af7ee28b",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "External reporting",
+    "description": "The organization shall provide capabilities for interested parties to report adverse impacts of the system",
+    "identifier": "ISO/IEC 42001:2023 A.8.3",
+    "createdAt": "2025-09-18 19:20:22.048",
+    "updatedAt": "2025-09-18 19:20:22.048"
+  },
+  {
+    "id": "frk_rq_68cc5b81b072f6717d2acfc5",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Communication of incidents",
+    "description": "The organization shall determine and document a plan for communicating incidents to users of the system.",
+    "identifier": "ISO/IEC 42001:2023 A.8.4",
+    "createdAt": "2025-09-18 19:20:32.637",
+    "updatedAt": "2025-09-18 19:20:32.637"
+  },
+  {
+    "id": "frk_rq_68cc5ad9f59cea7dc12cb935",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "AI system verification and validation",
+    "description": "The organization shall define and document verification and validation measures for the AI system and specify criteria for their use.",
+    "identifier": "ISO/IEC 42001:2023 A.6.2.4",
+    "createdAt": "2025-09-18 19:17:45.085",
+    "updatedAt": "2025-09-18 19:17:45.085"
+  },
+  {
+    "id": "frk_rq_68cc5b8c4bbc9a2326ce718a",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Information for interested parties",
+    "description": "The organization shall determine and document their obligations to reporting information about the AI system to interested parties.",
+    "identifier": "ISO/IEC 42001:2023 A.8.5",
+    "createdAt": "2025-09-18 19:20:43.656",
+    "updatedAt": "2025-09-18 19:20:43.656"
+  },
+  {
+    "id": "frk_rq_68cc5b9f143db7a8e8f2fd99",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Processes for responsible use of AI systems",
+    "description": "The organization shall define and document the processes for the responsible use of AI systems",
+    "identifier": "ISO/IEC 42001:2023 A.9.2",
+    "createdAt": "2025-09-18 19:21:03.416",
+    "updatedAt": "2025-09-18 19:21:03.416"
+  },
+  {
+    "id": "frk_rq_68cc5bb1b016fed3f0f73d6f",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Objectives for responsible use of AI system",
+    "description": "The organization shall identify and document objectives to guide the responsible use of AI systems.",
+    "identifier": "ISO/IEC 42001:2023 A.9.3",
+    "createdAt": "2025-09-18 19:21:21.287",
+    "updatedAt": "2025-09-18 19:21:21.287"
+  },
+  {
+    "id": "frk_rq_68cc5bba0a7d17f5e4e79ffc",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Intended use of the AI system",
+    "description": "The organization shall ensure that the AI system is used according to the intended uses of the AI system and its accompanying documentation.",
+    "identifier": "ISO/IEC 42001:2023 A.9.4",
+    "createdAt": "2025-09-18 19:21:29.807",
+    "updatedAt": "2025-09-18 19:21:29.807"
+  },
+  {
+    "id": "frk_rq_68cc5bc95fa70354cb5631c6",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Allocating responsibilities",
+    "description": "The organization shall ensure that responsibilities within their AI system life cycle are allocated between the organization, its partners, suppliers, customers and third parties",
+    "identifier": "ISO/IEC 42001:2023 A.10.2",
+    "createdAt": "2025-09-18 19:21:45.396",
+    "updatedAt": "2025-09-18 19:21:45.396"
+  },
+  {
+    "id": "frk_rq_68cc5bd5e8781f93897c507f",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Suppliers",
+    "description": "\"The organization shall establish a process to ensure that its usage of services, products or materials provided by suppliers aligns with the organization’s approach to the\r\nresponsible development and use of AI systems.\"",
+    "identifier": "ISO/IEC 42001:2023 A.10.3",
+    "createdAt": "2025-09-18 19:21:57.138",
+    "updatedAt": "2025-09-18 19:21:57.138"
+  },
+  {
+    "id": "frk_rq_68cc5be2faf1c4c90a37c8bc",
+    "frameworkId": "frk_68cc0e2a21184ed168ab2eea",
+    "name": "Customers",
+    "description": "The organization shall ensure that its responsible approach to the development and use of AI systems considers their customer expectations and needs.",
+    "identifier": "ISO/IEC 42001:2023 A.10.4",
+    "createdAt": "2025-09-18 19:22:09.561",
+    "updatedAt": "2025-09-18 19:22:09.561"
+  },
+  {
+    "id": "frk_rq_68e135fdd2009db3cf2629ad",
+    "frameworkId": "frk_68e135d0212b3b6cd39ceb94",
+    "name": "NEN 7510",
+    "description": "NEN 7510 Requirements",
+    "identifier": "",
+    "createdAt": "2025-10-04 14:58:04.631",
+    "updatedAt": "2025-10-04 14:58:04.631"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json b/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json
index e98f6867c..ad07a2aa8 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json
@@ -1,299 +1,578 @@
 [
   {
-    "id": "frk_tt_68406b4f40c87c12ae0479ce",
-    "name": "Incident Response",
-    "description": "Keep a record of all security incidents and how they were resolved. If there haven't been any, add a comment which says \"no incidents\".",
+    "id": "frk_tt_68407ae5274a64092c305104",
+    "name": "Secure Secrets",
+    "description": "Use your cloud providers default secret manager for storing secrets. Don't commit secrets to Git and don't store secrets in code.\n\nUpload a screenshot of the secrets manager being used (don't include your actual secrets!).",
     "frequency": "yearly",
     "department": "itsm",
-    "createdAt": "2025-06-04 15:50:38.678",
-    "updatedAt": "2025-06-08 18:32:02.985"
+    "createdAt": "2025-06-04 16:57:08.693",
+    "updatedAt": "2025-06-08 23:07:56.390"
   },
   {
-    "id": "frk_tt_68406903839203801ac8041a",
-    "name": "Device List",
-    "description": "Keep and maintain a list of your devices (laptops/servers). If you install the Comp AI agent on your devices, these will be automatically tracked in-app and you can mark this task as not-relevant.\n\nFor HIPAA: Know which devices hold your patient data is going and create a maintain a system to track it",
+    "id": "frk_tt_6849c1a1038c3f18cfff47bf",
+    "name": "Utility Monitoring",
+    "description": "Maintain a list of approved privileged utilities (e.g. iptables, tcpdump, disk‑encryption tools)\n\nShow NTP/Chrony status on one Linux box and one Windows/Mac device proving they are within ±1 second of the chosen time source",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-06-04 15:40:51.392",
-    "updatedAt": "2025-06-09 02:42:32.291"
+    "department": "it",
+    "createdAt": "2025-06-11 17:49:21.226",
+    "updatedAt": "2025-06-11 17:49:21.226"
   },
   {
-    "id": "frk_tt_68406af04a4acb93083413b9",
-    "name": "Monitoring & Alerting",
-    "description": "Ensure you have logging enabled in cloud environments (e.g. Google Cloud or Vercel) and review it periodically.\n\nUpload a screenshot of an alert you received (e.g. deployment failures) recently. If you don't have any, add a comment to say no alerts received.\n\nHIPAA: Enable Audit logs wherever there is patient data to show that the data has not been secretly changed or corrupted. ",
+    "id": "frk_tt_68406951bd282273ebe286cc",
+    "name": "Employee Verification",
+    "description": "Maintain a list of reference checks you made for every new hire. Verify the identity of every new hire.\n\nFor ISO 27001: Ensure you are also storing the NDA, candidate evaluation form and access creation request with its approval evidence\n\nFor PCI: For employees with potential access to the CDE, document background verification checks (e.g., reference check, prior employment) before granting access to CHD systems.\n",
     "frequency": "yearly",
-    "department": "itsm",
-    "createdAt": "2025-06-04 15:49:03.955",
-    "updatedAt": "2025-06-09 03:33:42.294"
+    "department": "hr",
+    "createdAt": "2025-06-04 15:42:08.603",
+    "updatedAt": "2025-09-10 21:06:07.350"
+  },
+  {
+    "id": "frk_tt_68406e7abae2a9b16c2cc197",
+    "name": "Planning",
+    "description": "Make sure you have point in time recovery / backups enabled and that you test this works on an annual basis.\n\nCreate a step by step document of what you did to test the backup worked and upload this as evidence.\n\nFor ISO 42001: Include AI system recovery considerations as part of business continuity.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2025-06-04 16:04:09.896",
+    "updatedAt": "2025-09-18 16:05:16.212"
   },
   {
     "id": "frk_tt_68406a514e90bb6e32e0b107",
     "name": "Contact Information",
-    "description": "You need to show what services/software you offer and provide clear instructions on how your customers can contact you about problems, issues or complaints on your website, then ensure you are logging these requests.",
+    "description": "You need to show what services/software you offer and provide clear instructions on how your customers can contact you about problems, issues or complaints on your website, then ensure you are logging these requests.\n\nAdd the direct link to a \"Contact Us\" page, or screenshot of a contact email visible on your site for customers to contact you. ",
     "frequency": "yearly",
     "department": "it",
     "createdAt": "2025-06-04 15:46:24.989",
-    "updatedAt": "2025-06-09 15:28:58.716"
+    "updatedAt": "2025-10-13 23:16:39.485"
   },
   {
-    "id": "frk_tt_68406951bd282273ebe286cc",
-    "name": "Employee Verification",
-    "description": "Maintain a list of reference checks you made for every new hire. Verify the identity of every new hire.\n\nFor ISO 27001: Ensure you are also storing the NDA, candidate evaluation form and access creation request with its approval evidence\n",
+    "id": "frk_tt_68406f411fe27e47a0d6d5f3",
+    "name": "TLS / HTTPS",
+    "description": "Ensure TLS / HTTPS is enabled.\n\nUpload a screenshot from SSL Labs to show this is enabled.",
     "frequency": "yearly",
-    "department": "hr",
-    "createdAt": "2025-06-04 15:42:08.603",
-    "updatedAt": "2025-07-07 05:05:26.845"
+    "department": "itsm",
+    "createdAt": "2025-06-04 16:07:28.979",
+    "updatedAt": "2025-10-14 19:26:05.415"
   },
   {
-    "id": "frk_tt_684069a3a0dd8322b2ac3f03",
-    "name": "Employee Descriptions",
-    "description": "We need to make sure every employee has a clear job description. Once a year, you'll meet with each team member to confirm their job description is still accurate and that they fully understand what's expected of them.\n\nKeep a brief note from this meeting or a screenshot of the meeting invite from your calendar, showing the date and time.",
+    "id": "frk_tt_68406e353df3bc002994acef",
+    "name": "Secure Code",
+    "description": "Ensure dependabot or it's equivalent is enabled to automatically identify insecure or patched dependencies. Ensure high dependency vulnerabilities are remediated.\n\nUpload a screenshot of the security dashboard showing no open Critical/High dependency vulnerabilities after remediation.",
     "frequency": "yearly",
-    "department": "hr",
-    "createdAt": "2025-06-04 15:43:30.893",
-    "updatedAt": "2025-06-08 17:17:37.405"
+    "department": "itsm",
+    "createdAt": "2025-06-04 16:03:00.858",
+    "updatedAt": "2025-09-07 09:24:20.453"
+  },
+  {
+    "id": "frk_tt_68406af04a4acb93083413b9",
+    "name": "Monitoring & Alerting",
+    "description": "Ensure you have logging enabled in cloud environments (e.g. Google Cloud or Vercel) and review it periodically.\n\nUpload a screenshot of an alert you received (e.g. deployment failures) recently. If you don't have any, add a comment to say no alerts received.\n\nHIPAA: Enable Audit logs wherever there is patient data to show that the data has not been secretly changed or corrupted. \n\nPCI: Enable logging for all in-scope CDE systems (firewalls, servers, applications, DBs). Configure alerting for anomalies (e.g., failed logins, access to sensitive data, config changes). Retain logs for at least 1 year, with 3 months immediately available for analysis.\n\nISO 42001: Extend monitoring activities to explicitly include AI-related risks/opportunities (e.g., AI system performance degradation, data drift, unintended bias triggers). Document actions to reduce undesired AI effects.",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-06-04 15:49:03.955",
+    "updatedAt": "2025-09-18 16:03:55.086"
+  },
+  {
+    "id": "frk_tt_686b51339d7e9f8ef2081a70",
+    "name": "Data Masking",
+    "description": "Hide Sensitive fields\n\nPCI: Mask PAN when displayed outside the secure CDE, ensuring only truncated PAN is visible (first 6 / last 4). Full PAN must never be displayed",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-07-07 04:46:43.319",
+    "updatedAt": "2025-09-10 21:12:35.061"
   },
   {
     "id": "frk_tt_68406d64f09f13271c14dd01",
     "name": "Code Changes",
-    "description": "Enable branch protection on your main branch to prevent direct pushes and enforce pull requests. Ensure regression testing is done.\n\nUpload a screenshot of these settings, demonstrating the disallowed direct push and required pull request.\n\nFor ISO 27001: Show change approval with peer review, change testing evidence, rollback plan and impact assessment.",
+    "description": "Enable branch protection on your main branch to prevent direct pushes and enforce pull requests. Ensure regression testing is done.\n\nUpload a screenshot of these settings, demonstrating the disallowed direct push and required pull request.\n\nFor ISO 27001: Show change approval with peer review, change testing evidence, rollback plan and impact assessment.\n\nFor ISO 42001: Extend change management to include AI-specific changes to models, training data, and algorithms. Document review/approval for impacts on risk, ethics, and compliance.\n\nFor PCI: Demonstrate documented change control for CHD application or infrastructure code changes, including approval, testing, rollback plan, and segregation of duties.",
     "frequency": "yearly",
     "department": "gov",
     "createdAt": "2025-06-04 15:59:31.795",
-    "updatedAt": "2025-07-07 05:12:29.403"
+    "updatedAt": "2025-09-18 16:14:21.813"
   },
   {
-    "id": "frk_tt_68406f411fe27e47a0d6d5f3",
-    "name": "TLS / HTTPS",
-    "description": "Ensure TLS / HTTPS is enabled. If you're working towards. \n\nFor HIPAA and ISO 27001 compliance, your database needs to be fully encrypted.\n\nUpload a screenshot from SSL Labs to show this is enabled.",
+    "id": "frk_tt_684076a02261faf3d331289d",
+    "name": "Publish Policies",
+    "description": "Make sure all of the policies in Comp AI have been published and all employees have signed/agreed to them by visiting portal.trycomp.ai .",
     "frequency": "yearly",
-    "department": "itsm",
-    "createdAt": "2025-06-04 16:07:28.979",
-    "updatedAt": "2025-07-07 05:12:30.137"
+    "department": "gov",
+    "createdAt": "2025-06-04 16:38:56.293",
+    "updatedAt": "2025-11-01 21:31:34.464"
+  },
+  {
+    "id": "frk_tt_68406903839203801ac8041a",
+    "name": "Device List",
+    "description": "Keep and maintain a list of your devices (laptops/servers). If you install the Comp AI agent on your devices, these will be automatically tracked in-app and you can mark this task as not-relevant.\n\nFor HIPAA: Know which devices hold your patient data is going and create a maintain a system to track it\n\nComp AI device agent is located at: portal.trycomp.ai",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-06-04 15:40:51.392",
+    "updatedAt": "2025-10-02 21:19:41.259"
+  },
+  {
+    "id": "frk_tt_68b59e7a29bec89c57014868",
+    "name": "Statement of Applicability",
+    "description": "The Statement of Applicability identifies relevant ISO 27001 Annex A controls, explains their inclusion or exclusion, and shows their implementation status within the ISMS.\n\nThe Comp AI team will generate this document on behalf of the requesting team, ensuring alignment with the organization’s ISMS scope and risk assessment results.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-09-01 13:24:09.841",
+    "updatedAt": "2025-10-06 20:43:03.384"
   },
   {
     "id": "frk_tt_68406d2e86acc048d1774ea6",
     "name": "App Availability",
-    "description": "Make sure your website or app doesn't slow down or crash because too many people are using it, or if there's a problem. \n\nUpload a screenshot showing you have DDoS protection enabled / auto-scale turned on.\n\nFor ISO 27001: Show evidence of firewall configuration\n",
+    "description": "Make sure your website or app doesn't slow down or crash because too many people are using it, or if there's a problem. \n\nUpload a screenshot showing you have DDoS protection enabled / auto-scale turned on.\n\nShow evidence of firewall configuration on production databases\n",
     "frequency": "yearly",
     "department": "it",
     "createdAt": "2025-06-04 15:58:37.662",
-    "updatedAt": "2025-07-07 05:12:30.312"
-  },
-  {
-    "id": "frk_tt_68406cd9dde2d8cd4c463fe0",
-    "name": "2FA",
-    "description": "Always enable 2FA/MFA (Two-Factor Authentication/Multi-Factor Authentication) on Google Workspace, the apps you use, and wherever else it's an option.\n\nFor HIPAA: Ensure you have a break glass account for obtaining necessary electronic protected health information during an emergency",
-    "frequency": "yearly",
-    "department": "itsm",
-    "createdAt": "2025-06-04 15:57:13.287",
-    "updatedAt": "2025-07-07 05:31:41.581"
+    "updatedAt": "2025-10-06 20:24:37.179"
   },
   {
     "id": "frk_tt_68406eedf0f0ddd220ea19c2",
     "name": "Sanitized Inputs",
-    "description": "Implement input validation / sanitization via libraries like Zod, Pydantic or their equivalent or enable CodeQL.\n\nUpload a screenshot of this in use/being enforced. ",
+    "description": "Implement input validation and sanitization using libraries such as Zod, Pydantic, or equivalent. \n\nEnable a static code analysis tool such as CodeQL (or its equivalent) to automatically detect security vulnerabilities and insecure coding patterns.\n\nUpload a screenshot showing both measures in use or being enforced.",
     "frequency": "yearly",
     "department": "it",
     "createdAt": "2025-06-04 16:06:05.042",
-    "updatedAt": "2025-06-08 22:32:30.176"
+    "updatedAt": "2025-10-14 19:27:06.034"
   },
   {
-    "id": "frk_tt_68406e353df3bc002994acef",
-    "name": "Secure Code",
-    "description": "Ensure dependabot or it's equivalent is enabled to automatically identify insecure or patched dependencies.",
+    "id": "frk_tt_6840796f77d8a0dff53f947a",
+    "name": "Secure Devices",
+    "description": "Ensure all devices have BitLocker/FileVault enabled, screen lock enabled after 5 minutes (for mac) or 15 minutes (for windows) of inactivity, a minimum password length of 8+ characters, security updates are automatically installed and Anti-virus enabled (Windows Defender or MacOS XProtect). \n\nUpload screenshots of each device or install the Comp AI agent on devices.\n\nComp AI device agent is located at: portal.trycomp.ai",
     "frequency": "yearly",
     "department": "itsm",
-    "createdAt": "2025-06-04 16:03:00.858",
-    "updatedAt": "2025-06-08 22:32:18.166"
+    "createdAt": "2025-06-04 16:50:54.671",
+    "updatedAt": "2025-10-20 14:18:25.301"
   },
   {
-    "id": "frk_tt_68406ca292d9fffb264991b9",
-    "name": "Employee Access",
-    "description": "Ensure you are using an identity provider like Google Workspace and upload a screenshot of a list of your users and review their access on an annual basis\n\nMake sure that employees don't have access to software and devices or data that they don't need for their job. \n\nFor example, a sales person shouldn't have access to your production database. Upload a screenshot of what your employees have access to and their job titles.\n\nFor ISO 27001: For one sample leaver, provide an exit checklist and IT Access revocation evidence. \n\nMake sure to also have a list of privileged users in the list of roles assigned\n\n",
+    "id": "frk_tt_68b5ce9dd597ac7d650e4915",
+    "name": "Reassess Legal Basis for Processing",
+    "description": "Review and document the lawful basis for each processing activity under GDPR Article 6 (e.g., consent, contract, legal obligation, legitimate interest). Ensure justifications are clear, up to date, and communicated in privacy notices.",
     "frequency": "yearly",
-    "department": "it",
-    "createdAt": "2025-06-04 15:56:18.236",
-    "updatedAt": "2025-07-07 05:12:29.877"
+    "department": "admin",
+    "createdAt": "2025-09-01 16:49:32.603",
+    "updatedAt": "2025-09-01 16:49:32.603"
   },
   {
-    "id": "frk_tt_68407ae5274a64092c305104",
-    "name": "Secure Secrets",
-    "description": "Use your cloud providers default secret manager for storing secrets. Don't commit secrets to Git and don't store secrets in code.\n\nUpload a screenshot of the secrets manager being used (don't include your actual secrets!).",
+    "id": "frk_tt_68b5ce9b5393ae083c3beadf",
+    "name": "Appoint or Review Data Protection Officer",
+    "description": "Assess whether your organization is required to appoint a Data Protection Officer (DPO) under GDPR (e.g., large-scale monitoring or sensitive data processing). If required, formally appoint a qualified DPO and document their role, responsibilities, and reporting line. Review the necessity of the DPO role if your processing scope or risk profile changes.\n\nIf not required, mark this task as \"Not Relevant\"",
     "frequency": "yearly",
-    "department": "itsm",
-    "createdAt": "2025-06-04 16:57:08.693",
-    "updatedAt": "2025-06-08 23:07:56.390"
+    "department": "admin",
+    "createdAt": "2025-09-01 16:49:31.380",
+    "updatedAt": "2025-09-04 20:31:09.037"
   },
   {
-    "id": "frk_tt_6840796f77d8a0dff53f947a",
-    "name": "Secure Devices",
-    "description": "Ensure all devices have BitLocker/FileVault enabled, screen lock enabled after 5 minutes of inactivity, a minimum password length of 8+ characters, security updates are automatically installed and Anti-virus enabled (Windows Defender or MacOS XProtect). \n\nUpload screenshots of each device or install the Comp AI agent on devices.",
+    "id": "frk_tt_68e52b2618cb9d9722c6edfd",
+    "name": "Internal Security Audit",
+    "description": "Upload evidence of a recent internal information security audit - e.g., audit plan/scope, auditor independence, completed checklists/workpapers, final report with findings and risk ratings, and documented corrective actions. \nOptional Template link:\nhttps://docs.google.com/spreadsheets/d/12wrY9EqVhBSlHvwEeSt8YTD8drPPr2zb/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true",
     "frequency": "yearly",
     "department": "itsm",
-    "createdAt": "2025-06-04 16:50:54.671",
-    "updatedAt": "2025-06-09 15:14:41.745"
+    "createdAt": "2025-10-07 15:00:54.106",
+    "updatedAt": "2025-10-23 13:15:15.286"
   },
   {
-    "id": "frk_tt_684076a02261faf3d331289d",
-    "name": "Review Policies",
-    "description": "Make sure all of the policies in Comp AI have been approved and all employees have signed/agreed to them.",
+    "id": "frk_tt_68cc327ff5d3130a1b42420b",
+    "name": "AI MS Communication Plan",
+    "description": "Document and maintain a plan outlining internal and external communication relevant to the AI MS: what is communicated, when, to whom, and how. Retain evidence of communication execution.",
     "frequency": "yearly",
-    "department": "gov",
-    "createdAt": "2025-06-04 16:38:56.293",
-    "updatedAt": "2025-06-08 22:42:13.707"
+    "department": "hr",
+    "createdAt": "2025-09-18 16:25:34.676",
+    "updatedAt": "2025-09-18 16:25:34.676"
+  },
+  {
+    "id": "frk_tt_68c3248edf65e750909dfd07",
+    "name": "Attestation of Compliance",
+    "description": "Download and complete the AoC form. Once complete, upload the file here. \n\nFor Merchants - https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Reporting%20Template%20or%20Form/PCI-DSS-v4-0-1-ROC-AOC-Merchants.pdf\n\nFor Service Providers - https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Reporting%20Template%20or%20Form/PCI-DSS-v4-0-1-ROC-AOC-Service-Providers.pdf ",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-09-11 19:35:42.019",
+    "updatedAt": "2025-09-11 19:35:42.019"
+  },
+  {
+    "id": "frk_tt_68c332c3bc6d696bb61e7351",
+    "name": "Self-Assessment Questionnaires",
+    "description": "- SAQ A: For merchants fully outsourcing all card data functions to PCI-validated 3rd parties (you redirect customers to them; you don’t touch card data).\n\n- SAQ A-EP: For ecommerce merchants that don’t store card data but have their own payment pages/components (so they can impact security of card data).\n\n- SAQ B / B-IP: For merchants who use only stand-alone, dial-out terminals (B) or IP-connected payment devices (B-IP).\n\n- SAQ C / C-VT: For merchants with payment application systems (C) or those using web-based virtual terminals (C-VT).\n\n- SAQ D (Merchant/Service Provider): Catch-all for anyone who stores, processes, or transmits cardholder data electronically in ways not covered above. This is the most comprehensive.\n\nDownload the appropriate SAQ from: https://www.pcisecuritystandards.org/document_library/",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-09-11 20:36:18.491",
+    "updatedAt": "2025-09-11 20:36:18.491"
+  },
+  {
+    "id": "frk_tt_68b5ce9d508cacf8e4517b56",
+    "name": "Review International Data Transfers",
+    "description": "Review and document all international data transfers to ensure compliance with GDPR Chapter V. Confirm adequacy decisions, Standard Contractual Clauses (SCCs), or other safeguards are in place. Update documentation when new transfers are added or existing ones change.\n\nTemplate:\nhttps://docs.google.com/spreadsheets/d/1SQ1deyO92SkQ3djMLr_NLux4gDfkFihU/edit?usp=sharing&ouid=109990330435667333191&rtpof=true&sd=true\n\n*If no data sent into or out of the EU, mark this task as not relevant",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-09-01 16:49:32.719",
+    "updatedAt": "2025-10-22 19:18:18.470"
+  },
+  {
+    "id": "frk_tt_68cc25658bacb2ccff56adf9",
+    "name": "AI Context Register",
+    "description": "Maintain a register of internal and external issues relevant to AI systems, including organizational roles and intended purposes, as evidence of contextual awareness under Clause 4.1.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-09-18 15:29:40.748",
+    "updatedAt": "2025-09-18 15:29:40.748"
   },
   {
     "id": "frk_tt_6840791cac0a7b780dbaf932",
     "name": "Public Policies",
-    "description": "Add a comment with links to your privacy policy / terms of service. Ensure Privacy policy has  a form for data deletion requests and make sure you are tracking and logging those requests",
+    "description": "Add a comment with links to your privacy policy / terms of service. Ensure Privacy policy has  a form for data deletion requests and make sure you are tracking and logging those requests\n\nFor GDPR:\n\nMaintain clear, transparent, and GDPR-compliant privacy notices and policies. Ensure they include lawful bases for processing, data subject rights, categories of data collected, and how data is used, shared, and retained. Update notices promptly when practices change.\n\nFor ISO 42001:\n\nEnsure policies explicitly identify how stakeholder rights and obligations (customers, regulators, society) are addressed.",
     "frequency": "yearly",
     "department": "it",
     "createdAt": "2025-06-04 16:49:31.599",
-    "updatedAt": "2025-06-09 15:28:58.942"
+    "updatedAt": "2025-09-18 15:36:20.889"
   },
   {
-    "id": "frk_tt_68406e7abae2a9b16c2cc197",
-    "name": "Planning",
-    "description": "Make sure you have point in time recovery / backups enabled and that you test this works on an annual basis.\n\nCreate a step by step document of what you did to test the backup worked and upload this as evidence.",
+    "id": "frk_tt_68cc27431d1266e3c77d7c0f",
+    "name": "Stakeholder Register / Interested Parties Log",
+    "description": "Document a register of interested parties (e.g., regulators, customers, employees, partners, societal groups), their requirements, and how the AI MS addresses them.",
     "frequency": "yearly",
-    "department": "gov",
-    "createdAt": "2025-06-04 16:04:09.896",
-    "updatedAt": "2025-06-08 22:32:18.249"
+    "department": "admin",
+    "createdAt": "2025-09-18 15:37:38.612",
+    "updatedAt": "2025-09-18 15:37:38.612"
+  },
+  {
+    "id": "frk_tt_68e52b26bf0e656af9e4e9c3",
+    "name": "Encryption at Rest",
+    "description": "Upload evidence that all data stores are encrypted at rest -cloud console screenshots showing encryption enabled on volumes/buckets/DBs and KMS/Key Vault key details (key IDs, rotation enabled).",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-10-07 15:00:53.986",
+    "updatedAt": "2025-10-07 15:00:53.986"
+  },
+  {
+    "id": "frk_tt_68b5ce9c6c1bdb171870f623",
+    "name": "Manage Third-party and EU Representative Relationships",
+    "description": "Ensure all third-party processors have GDPR-compliant Data Processing Agreements (DPAs) in place. If your organization is outside the EU but processes EU personal data, appoint an EU Representative and document the arrangement. Review contracts and representative status regularly.\n\nFor NEN 7510 - Create a spreadsheet, listing all vendors and links to their DPAs\n\nTemplate: \n\nhttps://docs.google.com/spreadsheets/d/1p_enOqnAy6B1X5slr1NLNMXUGvci0SL3/edit?usp=sharing&ouid=109990330435667333191&rtpof=true&sd=true",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-09-01 16:49:32.236",
+    "updatedAt": "2025-10-22 19:17:48.653"
+  },
+  {
+    "id": "frk_tt_68e52a484cad0014de7a628f",
+    "name": "Separation of Environments",
+    "description": "Upload proof that dev/test/staging and production are segregated - e.g., a cloud console screenshot showing separate accounts/VPCs or distinct RDS clusters/DBs, with restricted access between environments.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-10-07 14:57:11.853",
+    "updatedAt": "2025-10-23 13:15:15.440"
+  },
+  {
+    "id": "frk_tt_68406b4f40c87c12ae0479ce",
+    "name": "Incident Response",
+    "description": "Keep a record of all security incidents and how they were resolved. If there haven't been any, add a comment which says \"no incidents\".\n\nFor GDPR:\n\nMaintain a documented data breach response plan that includes detection, escalation, notification (within 72 hours), and remediation procedures. Train staff regularly on breach awareness and reporting obligations.\n\nFor PCI: \n\nMaintain and annually test the incident response plan specifically covering cardholder data incidents. Include escalation procedures, communication with payment brands/acquirers, forensic evidence handling, and responsibilities of the incident response team.",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-06-04 15:50:38.678",
+    "updatedAt": "2025-10-23 13:29:45.032"
+  },
+  {
+    "id": "frk_tt_68c8309516fdbc514404988d",
+    "name": "Board Meetings & Independence",
+    "description": "Submit the most recent board (or management) meeting agenda and minutes covering security topics. Include evidence (CVs/LinkedIn screenshots) demonstrating that board members include independent directors.\n\nFor ISO 42001:\n\nEnsure board/management reviews discuss internal and external issues relevant to the AI MS and their potential impacts. Document leadership actions (meeting records, signed commitment statements, executive communications) demonstrating that top management ensures AI policy/objectives alignment, provides resources, and promotes continual improvement.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-09-15 15:28:21.064",
+    "updatedAt": "2025-09-18 15:53:51.802"
+  },
+  {
+    "id": "frk_tt_68cc2ce9cb0d2a4774975ace",
+    "name": "AI MS Roles & Responsibilities Assignment",
+    "description": "Define and communicate responsibilities for the AI MS, including who ensures compliance with 42001 requirements and who reports AI MS performance to top management. Evidence: updated org chart, RACI matrix, role descriptions.Task Description",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2025-09-18 16:01:44.966",
+    "updatedAt": "2025-09-18 16:01:44.966"
   },
   {
     "id": "frk_tt_6849aad98c50d734dd904d98",
     "name": "Diagramming",
-    "description": "Architecture Diagram: Draw a single‑page diagram (Figma, Draw.io, Lucidchart—whatever is fastest)\n\nFor ISO 27001 and HIPAA :\n\nData Flow Diagram: Show exactly how user and sensitive data travels through your system—so you can spot risks (and impress due‑diligence teams)\n\n*If there is no sensitive data, then the data flow diagram is not needed for ISO 27001\n",
+    "description": "Architecture Diagram: Draw a single‑page diagram (Figma, Draw.io, Lucidchart—whatever is fastest)\n\nFor ISO 27001 and HIPAA :\n\nData Flow Diagram: Show exactly how user and sensitive data travels through your system—so you can spot risks (and impress due‑diligence teams)\n\n*If there is no sensitive data, then the data flow diagram is not needed for ISO 27001\n\nFor ISO 42001:\n\nDocument how internal and external issues, including the intended purpose and scope of AI systems, are reflected in the architecture and data flow diagrams. Link diagrams to AI system impact analysis, showing foreseeable AI misuse and potential effects on individuals/society.\n\nFor GDPR:\n\nMaintain an up-to-date data inventory and data flow map that identifies what personal data is collected, how it is processed, where it is stored, retention periods, and its lifecycle. Update records when systems, vendors, or processing activities change.\n\nFor PCI:\n\nMaintain current CDE network diagram and CHD data flow diagram illustrating where cardholder data enters, traverses, and is stored. Include connected systems and segmentation controls.\n",
     "frequency": "yearly",
     "department": "it",
     "createdAt": "2025-06-11 16:12:08.468",
-    "updatedAt": "2025-06-11 16:33:40.237"
+    "updatedAt": "2025-09-18 16:10:28.067"
   },
   {
-    "id": "frk_tt_6849c1a1038c3f18cfff47bf",
-    "name": "Utility Monitoring",
-    "description": "Maintain a list of approved privileged utilities (e.g. iptables, tcpdump, disk‑encryption tools)\n\nShow NTP/Chrony status on one Linux box and one Windows/Mac device proving they are within ±1 second of the chosen time source",
+    "id": "frk_tt_68cc2f30b51920e5515465e6",
+    "name": "AI System Impact Assessment Procedure",
+    "description": "Define a process to identify/assess potential consequences of AI system deployment, intended use, and foreseeable misuse on individuals and society. Document results and link them into the risk assessment process.Task Description",
     "frequency": "yearly",
     "department": "it",
-    "createdAt": "2025-06-11 17:49:21.226",
-    "updatedAt": "2025-06-11 17:49:21.226"
+    "createdAt": "2025-09-18 16:11:27.951",
+    "updatedAt": "2025-09-18 16:11:27.951"
   },
   {
-    "id": "frk_tt_686b51339d7e9f8ef2081a70",
-    "name": "Data Masking",
-    "description": "Hide Sensitive fields",
+    "id": "frk_tt_68cc2fa423533e602e4dee25",
+    "name": "AI Objectives Register",
+    "description": "Define measurable AI objectives (aligned to AI Policy and compliance requirements), assign resources/responsibility, track timelines, and record evaluation results. Ensure objectives are updated and communicated periodically.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-09-18 16:13:23.758",
+    "updatedAt": "2025-09-18 16:13:23.758"
+  },
+  {
+    "id": "frk_tt_68cc301a8fd914534ab95b11",
+    "name": "AI System Change Log",
+    "description": "Maintain a documented log of changes to the AI management system, including model retraining, policy/process updates, and governance modifications. Ensure planned manner, risk evaluation, and approvals are recorded.",
     "frequency": "yearly",
     "department": "it",
-    "createdAt": "2025-07-07 04:46:43.319",
-    "updatedAt": "2025-07-07 04:46:43.319"
+    "createdAt": "2025-09-18 16:15:22.389",
+    "updatedAt": "2025-09-18 16:15:22.389"
   },
   {
-    "id": "frk_tt_68b59e7a29bec89c57014868",
-    "name": "Statement of Applicability",
-    "description": "Statement of Applicability",
+    "id": "frk_tt_68cc30fbbeabb8a4c2f56082",
+    "name": "AI MS Resource Allocation Record",
+    "description": "Maintain documented evidence of resources allocated for the AI MS, including skills, tools, infrastructure, and support mechanisms.",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-09-01 13:24:09.841",
-    "updatedAt": "2025-09-01 13:24:09.841"
+    "department": "it",
+    "createdAt": "2025-09-18 16:19:07.327",
+    "updatedAt": "2025-09-18 16:19:07.327"
   },
   {
-    "id": "frk_tt_68b59fd5e41ed4c1d69161d6",
-    "name": "Records of Processing Activities",
-    "description": "In compliance with GDPR Article 30, ensure that controllers (and processors, where applicable) maintain up-to-date records of processing activities. These records must include:\n\n\n- The purposes of processing\n- Categories of data subjects and personal data\n- Categories of recipients (including third parties and international transfers)\n- Applicable retention periods\n- A description of security measures in place\nThis record should be documented in a structured format (e.g., register, inventory, or compliance tool) and kept readily available as evidence of compliance.",
+    "id": "frk_tt_68cc395b90e179fe3209b795",
+    "name": "AI MS Operational Control Procedure",
+    "description": "Document and implement an AI Operational Controls procedure defining process criteria, monitoring effectiveness, handling planned/unplanned changes, and control of externally-provided AI processes/services.",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-09-01 13:29:57.324",
-    "updatedAt": "2025-09-01 16:41:42.592"
+    "department": "it",
+    "createdAt": "2025-09-18 16:54:50.964",
+    "updatedAt": "2025-09-18 16:54:50.964"
   },
   {
-    "id": "frk_tt_68b5cd3678e4245e4867f07c",
-    "name": "Conduct Data Protection Impact Assessments",
-    "description": "For any processing activity that is likely to result in high risk to individuals (e.g., large-scale profiling, sensitive data processing, or new technologies), conduct a documented Data Protection Impact Assessment (DPIA). The DPIA must identify risks, assess their severity, and define mitigation measures.",
+    "id": "frk_tt_68cc3f427e309607f1ad5ba4",
+    "name": "AI Risk Treatment Implementation Record",
+    "description": "Maintain documented evidence of risk treatment implementation corresponding to the treatment plan. Record treatment effectiveness checks and revalidation if measures fail.Task Description",
     "frequency": "yearly",
     "department": "it",
-    "createdAt": "2025-09-01 16:43:34.345",
-    "updatedAt": "2025-09-01 16:43:34.345"
+    "createdAt": "2025-09-18 17:20:02.111",
+    "updatedAt": "2025-09-18 17:20:02.111"
   },
   {
-    "id": "frk_tt_68b5ce9b5393ae083c3beadf",
-    "name": "Appoint or Review Data Protection Officer",
-    "description": "Assess whether your organization is required to appoint a Data Protection Officer (DPO) under GDPR (e.g., large-scale monitoring or sensitive data processing). If required, formally appoint a qualified DPO and document their role, responsibilities, and reporting line. Review the necessity of the DPO role if your processing scope or risk profile changes.",
+    "id": "frk_tt_68cc3ffab3fb703917f51e19",
+    "name": "AI Impact Assessment Log",
+    "description": "Conduct AI system impact assessments at planned intervals or when significant changes occur. Document results showing impacts on individuals and societies, and integrate with AI risk assessments.",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-09-01 16:49:31.380",
-    "updatedAt": "2025-09-01 16:49:31.380"
+    "department": "it",
+    "createdAt": "2025-09-18 17:23:05.611",
+    "updatedAt": "2025-09-18 17:23:05.611"
   },
   {
-    "id": "frk_tt_68b5ce9c64f9e3b7410008d7",
-    "name": "Update Privacy Notices & Policies",
-    "description": "Maintain clear, transparent, and GDPR-compliant privacy notices and policies. Ensure they include lawful bases for processing, data subject rights, categories of data collected, and how data is used, shared, and retained. Update notices promptly when practices change.",
+    "id": "frk_tt_68cc4190caf0b458effcee6e",
+    "name": "AI MS Internal Audit Program",
+    "description": "Establish and maintain an internal audit program for the AI MS. Define frequency, methods, auditor roles, reporting structure, and independence. Record results as evidence.",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-09-01 16:49:31.632",
-    "updatedAt": "2025-09-01 16:49:31.632"
+    "department": "it",
+    "createdAt": "2025-09-18 17:29:51.770",
+    "updatedAt": "2025-09-18 17:29:51.770"
   },
   {
-    "id": "frk_tt_68b5ce9c5029f2a7ec6f4145",
-    "name": "Perform Security Reviews & Audits",
-    "description": "Conduct regular reviews of technical and organizational security measures to ensure they remain effective and aligned with GDPR’s accountability principle. Document findings, remediation actions, and audit results",
+    "id": "frk_tt_68cc41ad7cbd2839c0bc7104",
+    "name": "AI Internal Audit Reports",
+    "description": "Conduct AI MS audits at planned intervals. Maintain documented evidence of objectives, criteria, scope, audit reports, findings, and follow-ups.",
     "frequency": "yearly",
     "department": "it",
-    "createdAt": "2025-09-01 16:49:31.916",
-    "updatedAt": "2025-09-01 16:49:31.916"
+    "createdAt": "2025-09-18 17:30:21.049",
+    "updatedAt": "2025-09-18 17:30:21.049"
   },
   {
-    "id": "frk_tt_68b5ce9c979a280311c11af1",
-    "name": "Map and Review Data Flow & Inventory",
-    "description": "Maintain an up-to-date data inventory and data flow map that identifies what personal data is collected, how it is processed, where it is stored, retention periods, and its lifecycle. Update records when systems, vendors, or processing activities change.",
+    "id": "frk_tt_68cc459ed57b70a4cb631e72",
+    "name": "AI MS Continual Improvement Log",
+    "description": "Maintain a documented continual improvement log for the AI MS. Capture decisions, actions, and implemented changes to improve suitability, adequacy, and effectiveness. Evidence includes versioned records of updates and lessons learned.",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-09-01 16:49:32.093",
-    "updatedAt": "2025-09-01 16:49:32.093"
+    "department": "it",
+    "createdAt": "2025-09-18 17:47:10.138",
+    "updatedAt": "2025-09-18 17:47:13.649"
   },
   {
-    "id": "frk_tt_68b5ce9c6c1bdb171870f623",
-    "name": "Manage Third-party and EU Representative Relationships",
-    "description": "Ensure all third-party processors have GDPR-compliant Data Processing Agreements (DPAs) in place. If your organization is outside the EU but processes EU personal data, appoint an EU Representative and document the arrangement. Review contracts and representative status regularly.",
+    "id": "frk_tt_68d28f68f117d45c0adcba33",
+    "name": "Legal Proof of Company Registration",
+    "description": "Upload official proof of legal entity registration—e.g., a certificate of incorporation or government registry extractTask Description",
     "frequency": "yearly",
     "department": "admin",
-    "createdAt": "2025-09-01 16:49:32.236",
-    "updatedAt": "2025-09-01 16:49:32.236"
+    "createdAt": "2025-09-23 12:15:35.711",
+    "updatedAt": "2025-09-23 12:15:35.711"
   },
   {
-    "id": "frk_tt_68b5ce9cba8271d8feaf0805",
-    "name": "Handle Data Subject Rights Requests",
-    "description": "Implement and document procedures to handle data subject rights requests (e.g., access, rectification, erasure, objection, portability). Maintain logs of requests, response times, and outcomes to demonstrate compliance.",
+    "id": "frk_tt_68cc39efd7916e240451cae5",
+    "name": "AI Risk Assessment Execution (Log)",
+    "description": "Add AI related Risks to the risk register.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-09-18 16:57:19.130",
+    "updatedAt": "2025-09-24 20:04:29.461"
+  },
+  {
+    "id": "frk_tt_68dc1a3a9b92bb4ffb89e334",
+    "name": "Systems Description",
+    "description": "Provide a short paragraph giving a description of your app & any architecture around it.\n\n",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-09-30 17:58:17.967",
+    "updatedAt": "2025-09-30 17:58:17.967"
+  },
+  {
+    "id": "frk_tt_68e1d5667f2b14a9b0c2daf8",
+    "name": "NEN 7510 Risk Assessments",
+    "description": "Create and assess risks, in the risk register tab, that identifies and evaluates information‑security risks around health data. Risk examples would be:\n\n- Electronic Health Record (EHR) system - Unauthorized access via weak credentials\n\n- Patient portal data exchange - API misconfiguration causing data leakage\n\n- Third‑party telehealth vendor - Incomplete DPA and unclear responsibilities",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2025-10-05 02:18:14.360",
+    "updatedAt": "2025-10-05 02:19:43.948"
+  },
+  {
+    "id": "frk_tt_68e1d619944625cc1876540c",
+    "name": "Management Review Minutes",
+    "description": "Prove that top management reviews the performance of the ISMS - including incidents, risks, audits, supplier issues, and improvements - at planned intervals (typically annually or quarterly).",
     "frequency": "quarterly",
     "department": "admin",
-    "createdAt": "2025-09-01 16:49:32.365",
-    "updatedAt": "2025-09-01 16:49:32.365"
+    "createdAt": "2025-10-05 02:21:12.929",
+    "updatedAt": "2025-10-23 13:15:15.583"
+  },
+  {
+    "id": "frk_tt_68e52b274a7c38c62db08e80",
+    "name": "Organisation Chart",
+    "description": "Upload a hierarchical organization chart showing reporting lines, with each box including the person’s full name and job title (PDF/image or export from your HR system).\n",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2025-10-07 15:00:54.563",
+    "updatedAt": "2025-10-07 15:00:54.563"
+  },
+  {
+    "id": "frk_tt_684069a3a0dd8322b2ac3f03",
+    "name": "Employee Descriptions",
+    "description": "We need to make sure every employee has a clear job description. Once a year, you'll meet with each team member to confirm their job description is still accurate and to conduct a performance review.\n\nKeep a brief note evidencing this review, showing the date and time (e.g., an example completed review document or HR system screenshot showing date, reviewer, and employee acknowledgement). \n\nFor PCI: explicitly notate which employees in the org have access to CHD systems, ensure this access aligns with their role.  ",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2025-06-04 15:43:30.893",
+    "updatedAt": "2025-10-09 19:38:34.471"
+  },
+  {
+    "id": "frk_tt_68406cd9dde2d8cd4c463fe0",
+    "name": "2FA",
+    "description": "Always enable 2FA/MFA (Two-Factor Authentication/Multi-Factor Authentication) on Google Workspace, the apps you use, and wherever else it's an option. \n\nUpload a screenshot showing this setting enabled at the org/admin level, in addition to a screenshot of an end user being prompted for 2FA\n\nFor HIPAA: Ensure you have a break glass account for obtaining necessary electronic protected health information during an emergency\n\nFor PCI: Enable MFA for all administrative access into CDE systems, and all remote access (internal or external). Collect evidence of configurations showing MFA enforcement.",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-06-04 15:57:13.287",
+    "updatedAt": "2025-10-13 23:15:34.934"
+  },
+  {
+    "id": "frk_tt_68e80544d9734e0402cfa807",
+    "name": "Role-based Access Controls",
+    "description": "Upload proof that access is managed by roles- RBAC matrix and role definitions or use our template:\nhttps://docs.google.com/spreadsheets/d/1rN2-d0432aBn-F8x-b9YAJecmMiWenaB/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true\n",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-10-09 18:56:04.361",
+    "updatedAt": "2025-10-23 13:15:14.621"
+  },
+  {
+    "id": "frk_tt_68e52b27c4bdbf1b24051b8b",
+    "name": "Employee Performance Evaluations",
+    "description": "Employee Performance Evaluations\nUpload one recent employee performance evaluation (anonymized) - either a brief completed review or use our template:\nhttps://docs.google.com/document/d/1dzHOTXlqBORuU9ZVYcsdMJbD0QvLRYxQ/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2025-10-07 15:00:54.648",
+    "updatedAt": "2025-10-23 13:15:14.778"
+  },
+  {
+    "id": "frk_tt_68406ca292d9fffb264991b9",
+    "name": "Employee Access",
+    "description": "Ensure you are using an identity provider like Google Workspace and upload a screenshot of a list of your users and review their access on an annual basis\n\nFor ISO 27001: For one sample leaver, provide an exit checklist and IT Access revocation evidence. \n\nMake sure to also have a list of privileged users in the list of roles assigned\n\nFor ISO 42001: Update job descriptions and organizational charts to explicitly reference responsibilities and authorities for AI MS compliance and performance.\n\nFor PCI: Use an identity provider to manage user access to CDE. Ensure least privilege access; review annually and document removal for terminated staff. Maintain a list of privileged users within the CDE.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-06-04 15:56:18.236",
+    "updatedAt": "2025-10-16 22:03:59.409"
+  },
+  {
+    "id": "frk_tt_68e80545a8b432bc59eb8037",
+    "name": "Incident Response Tabletop Exercise",
+    "description": "Upload evidence of a recent incident response tabletop exercise - agenda/scenario, attendee list and roles, notes or short recording, and an after-action report with findings, owners, and due dates.\nTemplate available here:\nhttps://docs.google.com/document/d/1HwJPsGEO9rX3H0w-Nzy5AbYWh68kCsjg/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true\n",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-10-09 18:56:04.980",
+    "updatedAt": "2025-10-23 13:15:13.774"
+  },
+  {
+    "id": "frk_tt_68e805457c2dcc784e72e3cc",
+    "name": "Access Review Log",
+    "description": "Upload an access review log for key systems -showing review dates, reviewers/owners, users/roles reviewed, actions taken (removals/changes), issues found, and management sign-off. Template available here:\nhttps://docs.google.com/spreadsheets/d/1_iPQD7-tED6WpEYh2AJqL_eN1SUcfrcH/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true\n",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-10-09 18:56:04.778",
+    "updatedAt": "2025-10-23 13:15:14.157"
+  },
+  {
+    "id": "frk_tt_68e52b269db179c434734766",
+    "name": "Backup Restoration Test",
+    "description": "Provide evidence of a recent backup restoration test - either share a link to a short screen recording showing end-to-end restore and data verification, or complete this template and upload it\nTemplate link: https://docs.google.com/document/d/1uY8OmlNrUu-tXqlEg0Qi3CrNCV2ubvkP/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true\n",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-10-07 15:00:54.468",
+    "updatedAt": "2025-10-23 13:15:14.927"
+  },
+  {
+    "id": "frk_tt_68e52b26b166e2c0a0d11956",
+    "name": "Backup logs",
+    "description": "Upload backup job logs covering the last 10 consecutive days (all critical systems) - e.g., exported logs or console screenshots showing timestamps, success/failure status, destinations, retention, and any alerts/errors.Task Description",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2025-10-07 15:00:54.281",
+    "updatedAt": "2025-10-23 13:15:15.120"
+  },
+  {
+    "id": "frk_tt_6901e040a21d5e8fdc9736e8",
+    "name": "Building / Workplace Rules",
+    "description": "Email or note from your building contact (landlord, building manager, or coworking operator) that includes:\nOpening hours, how people enter (e.g, key, badge, code, staffed reception),visitor process (e.g., sign in at desk, escorted),emergency info (e.g., fire exits, alarms).\nFor a serviced office with staffed reception only -  a short email from the operator confirming hours, entry, visitor process, and emergency info is enough.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2025-10-29 09:37:04.181",
+    "updatedAt": "2025-10-29 09:37:04.181"
   },
   {
-    "id": "frk_tt_68b5ce9c0a99e71cfa722917",
-    "name": "Maintain a Breach Response Plan & Train Staff",
-    "description": "Maintain a documented data breach response plan that includes detection, escalation, notification (within 72 hours), and remediation procedures. Train staff regularly on breach awareness and reporting obligations.",
+    "id": "frk_tt_6901e041bb02b41fa3b7dca9",
+    "name": "Office Access & Door Monitoring",
+    "description": "If you use a smart lock/alarm system:\n- Access list (export or simple table): name, role, code/badge ID, date issued.\n- Revocation proof for a leaver (screenshot showing code disabled and time).\nMonthly door report+ a one-line review note (“No issues” or “1 denied at 22:14, ticket #123”)\n\nIf you use physical keys only:\n- Key register > key ID, holder, date issued/returned.\n- Revocation proof a leaver (key return form/photo; if missing, note and rekey receipt).\n- Monthly open/close log (who opened, who locked, any issues).\n\nCoworking with staffed reception:\nYour internal access list (who has the room key/code).\n- Revocation proof for leavers.\n- Monthly check: short note like “Reception manages front door; our room key activity had no issues in Sept.\"",
     "frequency": "yearly",
     "department": "admin",
-    "createdAt": "2025-09-01 16:49:32.494",
-    "updatedAt": "2025-09-01 16:49:32.494"
+    "createdAt": "2025-10-29 09:37:04.804",
+    "updatedAt": "2025-10-29 09:37:04.804"
   },
   {
-    "id": "frk_tt_68b5ce9dd597ac7d650e4915",
-    "name": "Reassess Legal Basis for Processing",
-    "description": "Review and document the lawful basis for each processing activity under GDPR Article 6 (e.g., consent, contract, legal obligation, legitimate interest). Ensure justifications are clear, up to date, and communicated in privacy notices.",
+    "id": "frk_tt_6901e0aa49fb834934748c93",
+    "name": "Visitor Control",
+    "description": "Upload a Visitor log sample for a recent week (paper scan or form export).\nPhoto of visitor badge/sticker and door/reception sign (“Visitors must be escorted”).\n\nOR if no visitors - comment below ‘No visitors’",
     "frequency": "yearly",
     "department": "admin",
-    "createdAt": "2025-09-01 16:49:32.603",
-    "updatedAt": "2025-09-01 16:49:32.603"
+    "createdAt": "2025-10-29 09:38:49.525",
+    "updatedAt": "2025-10-29 09:38:49.525"
   },
   {
-    "id": "frk_tt_68b5ce9d508cacf8e4517b56",
-    "name": "Review International Data Transfers",
-    "description": "Review and document all international data transfers to ensure compliance with GDPR Chapter V. Confirm adequacy decisions, Standard Contractual Clauses (SCCs), or other safeguards are in place. Update documentation when new transfers are added or existing ones change.",
+    "id": "frk_tt_6901e0aa6d3f2bbab1ea5b84",
+    "name": "Secure Storage",
+    "description": "Physical storage (cabinet/media):\n- Photo of locked cabinet\n- Key-holder list (names/roles)\n- Shredding proof (certificate or disposal log) - only if you store/dispose items\n",
     "frequency": "yearly",
     "department": "admin",
-    "createdAt": "2025-09-01 16:49:32.719",
-    "updatedAt": "2025-09-01 16:49:32.719"
+    "createdAt": "2025-10-29 09:38:49.804",
+    "updatedAt": "2025-10-30 10:14:09.540"
+  },
+  {
+    "id": "frk_tt_69033a6bfeb4759be36257bc",
+    "name": "Infrastructure Inventory",
+    "description": "Upload an up-to-date inventory of infrastructure assets—cloud accounts/resources (compute, DBs, storage), environments, networks, and owners - export or screenshots from AWS/GCP/Azure/CMDB showing names, tags, and last-updated date.\n\nTemplate here: https://docs.google.com/spreadsheets/d/170csMBWNcmKIkyC6TE0H3lqwv3C1e5dc/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-10-30 10:14:03.155",
+    "updatedAt": "2025-10-30 10:16:11.279"
+  },
+  {
+    "id": "frk_tt_68fa2a852e70f757188f0c39",
+    "name": "Production Firewall & No-Public-Access Controls",
+    "description": "Upload proof that production hosts enforce a deny-by-default firewall and that production databases and SSH are not reachable from the public internet - e.g., AWS Security Group screenshots (showing default-deny/least-privilege), firewall/VPC or subnet rules blocking public access, and (optional) SSH access logs showing restricted, internal-only connections.",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-10-23 13:15:49.296",
+    "updatedAt": "2025-10-30 10:14:28.363"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json
index b2680baeb..ec7a0bc14 100644
--- a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json
+++ b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json
@@ -318,5 +318,129 @@
   {
     "A": "frk_ct_683f4ef6c6a5481a377be413",
     "B": "frk_pt_685e42a3bbd08ad14de297f0"
+  },
+  {
+    "A": "frk_ct_68b59a16b172e5c360e57536",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e426ccbb0de15a90cf446"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e3f7b4ebcb27b60c51434"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e453cad89de25e5aebf4a"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e46557bc14fbddea6468a"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e40d46e7b1123022bf3e8"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e42a3bbd08ad14de297f0"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e45c938ad29ad775a2344"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e43555493efd5f79c15be"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e458a49e1eff0af54e3d2"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e42c38c3267d391674ce3"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e4319a5bb1d2d411975e6"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e4508d8c0d14ae873e644"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e4177d5da489e7c5e1b1b"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e414029124c24387beff0"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e42188e2df1c285cca159"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_683d2cbc12b93dc5c8fe3a7d"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e42445c99797321ef051a"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e43997555c7ab39983c21"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_685e43e23b78127274355980"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_pt_68bb155d6b8eaafd14904188"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_pt_68cc576eab0b1748940253fa"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_pt_685e3f7b4ebcb27b60c51434"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_pt_685e4508d8c0d14ae873e644"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_pt_685e3fc75bd72cd0745dc5d1"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_pt_685e43997555c7ab39983c21"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_pt_68e3f39e77b0a823add09bf5"
+  },
+  {
+    "A": "frk_ct_68e8079750107bcc63fc79d9",
+    "B": "frk_pt_685e4177d5da489e7c5e1b1b"
+  },
+  {
+    "A": "frk_ct_68e80a11f225cb2253e31fa0",
+    "B": "frk_pt_685e45c938ad29ad775a2344"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json
index 9ee525441..c668553d0 100644
--- a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json
+++ b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json
@@ -830,5 +830,517 @@
   {
     "A": "frk_ct_68b59e50eeb9f92ce425327c",
     "B": "frk_rq_68b59f4c9739efdb63dd807e"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_681fb2e7e7f7686a992f2119"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_681fb324d73b0fe213bb9d90"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_681fb344eb5375a96f0638a5"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_681fb369b9d4ca1e4b0bb849"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_681fbb3541096ea0270dea7b"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_681fd36a65897ebbddfbca37"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_681fbb3541096ea0270dea7b"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_681ef652e33dc1e3afc509bb"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_681f8d4ce946fa11fc187cc0"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_681fd6f7e78ded6368ec1574"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_681ef8a3821adb9293603637"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_681f954adf55082047e90c0f"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_681fd39f5e7c5474fdaf23dc"
+  },
+  {
+    "A": "frk_ct_684070c1f0091d850df02e59",
+    "B": "frk_rq_681fd39f5e7c5474fdaf23dc"
+  },
+  {
+    "A": "frk_ct_6840731ae0b857152b35ca8f",
+    "B": "frk_rq_681fd39f5e7c5474fdaf23dc"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_681fd586f08215043e6916db"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_681fbb48c90f21d5bbab7f12"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbb48c90f21d5bbab7f12"
+  },
+  {
+    "A": "frk_ct_683f4c9db20e7cf4a303af1f",
+    "B": "frk_rq_681fbb48c90f21d5bbab7f12"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_681fbb48c90f21d5bbab7f12"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_681fbb845007083d4c752cee"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_681fbbbcd4e8bb9cb2eb815d"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_681fbc03eff38d8d5c97bed9"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_681fbc1d2dedb46863e613ee"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_681fbc30934b73bebbbc411d"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbb845007083d4c752cee"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbbbcd4e8bb9cb2eb815d"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbc03eff38d8d5c97bed9"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbc1d2dedb46863e613ee"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbc30934b73bebbbc411d"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbc44fb353af100c0e2f7"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbc56b481494f649b2d5b"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_681fbb72b84b011712893e9d"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbb845007083d4c752cee"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbbbcd4e8bb9cb2eb815d"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbc03eff38d8d5c97bed9"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbc1d2dedb46863e613ee"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbc30934b73bebbbc411d"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbc44fb353af100c0e2f7"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbc56b481494f649b2d5b"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbb72b84b011712893e9d"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fbc66a1838cbdbd04be82"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_681fd70ed098315d874fafaf"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_rq_68c1eafed7ef7c22cc3ba9db"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_68cc0e5eddc90f9619ae850d"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc0e5eddc90f9619ae850d"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc0e5eddc90f9619ae850d"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc0e89f26cd9c83ed5e882"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc0ecd7ec7814948c7f618"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc0f7b1fe3d0eba7057907"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc0f9de0890c314f870108"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_68cc0fb516f402f740147419"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc0fb516f402f740147419"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_68cc0fd04f279d7a96eacc6f"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_rq_68cc0fd04f279d7a96eacc6f"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_68cc0ff05be924f5d0d58a6f"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_68cc0ff05be924f5d0d58a6f"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_68cc0ff05be924f5d0d58a6f"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_68cc1037f2716f51a47b2a2c"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc1037f2716f51a47b2a2c"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc104bfdfae778fc876c94"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc104bfdfae778fc876c94"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_68cc10611c3b98926aaf2cd5"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc10611c3b98926aaf2cd5"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_68cc106d0cdb75961110d7bd"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc106d0cdb75961110d7bd"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_68cc108f1697a1687b11d500"
+  },
+  {
+    "A": "frk_ct_683f4457b14856e700c8c25b",
+    "B": "frk_rq_68cc108f1697a1687b11d500"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc124496843ba357887e21"
+  },
+  {
+    "A": "frk_ct_683f45c5058c486f3fa5b7bc",
+    "B": "frk_rq_68cc126823caf86fae495b66"
+  },
+  {
+    "A": "frk_ct_684071e280c4e0f777b957f7",
+    "B": "frk_rq_68cc126823caf86fae495b66"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc126823caf86fae495b66"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc12d0f52f5c1d91f117f1"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_68cc131dece6bc88bea70bea"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_68cc131dece6bc88bea70bea"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc131dece6bc88bea70bea"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_68cc1342bdd7f557947e44a2"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_68cc1342bdd7f557947e44a2"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc1342bdd7f557947e44a2"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc1356217bdfd8243f6ffa"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_68cc136d293aef7e72dae81a"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc136d293aef7e72dae81a"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_68cc139ce4e9397e774a970b"
+  },
+  {
+    "A": "frk_ct_683f4b7614d209f8b6ffd477",
+    "B": "frk_rq_68cc139ce4e9397e774a970b"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc13c78fe780fd336736f8"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc13aebd1f91aa8a6e2288"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc13aebd1f91aa8a6e2288"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc13c78fe780fd336736f8"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc13aebd1f91aa8a6e2288"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc13c78fe780fd336736f8"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc13aebd1f91aa8a6e2288"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc13c78fe780fd336736f8"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc1424b567f1f8cb7c31f0"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc13d7452ced814c6e99f0"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc13f34b88f4b16f70a060"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc1424b567f1f8cb7c31f0"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc13d7452ced814c6e99f0"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc13f34b88f4b16f70a060"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_68cc1484d319859ad5a42fc1"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_68cc1484d319859ad5a42fc1"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_68cc1484d319859ad5a42fc1"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc1484d319859ad5a42fc1"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_68cc1499a406e703a08e8d8a"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5b28c6250d5e578180f9"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc58794cb877178071a215"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc58aea3157dcac365d9f7"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5ae5ff5cddebb560aa22"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5a4fd31458ffff814315"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5af0bf60b2e58133ff53"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5b0cffc0c85df3924feb"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5ab9b661ac977104733b"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5afff58160f9f1c4dd20"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5ad9f59cea7dc12cb935"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc588533f95e19633f1adc"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5bc95fa70354cb5631c6"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5a6ca8269484c65f9ec4"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5a771abf96227e04340d"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5b81b072f6717d2acfc5"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc58f88bcbeef356b5081c"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5906894ada4eceff256b"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5b5f0af0a89e2ddbc059"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5bd5e8781f93897c507f"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc58e8ea648286acddda43"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5be2faf1c4c90a37c8bc"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_rq_68cc5893f5f46050ad0ea974"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_rq_68e135fdd2009db3cf2629ad"
+  },
+  {
+    "A": "frk_ct_68e8079750107bcc63fc79d9",
+    "B": "frk_rq_683f81d974beae08683f7c65"
+  },
+  {
+    "A": "frk_ct_68e80a11f225cb2253e31fa0",
+    "B": "frk_rq_683f598fc18a528adfcdd561"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json
index b6c6a4da8..23d2b77f6 100644
--- a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json
+++ b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json
@@ -89,46 +89,286 @@
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b59fd5e41ed4c1d69161d6"
+    "B": "frk_tt_68b5ce9b5393ae083c3beadf"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5cd3678e4245e4867f07c"
+    "B": "frk_tt_68b5ce9d508cacf8e4517b56"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9b5393ae083c3beadf"
+    "B": "frk_tt_68b5ce9c6c1bdb171870f623"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9d508cacf8e4517b56"
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9dd597ac7d650e4915"
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9c0a99e71cfa722917"
+    "B": "frk_tt_6849aad98c50d734dd904d98"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9cba8271d8feaf0805"
+    "B": "frk_tt_68406e353df3bc002994acef"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9c6c1bdb171870f623"
+    "B": "frk_tt_68406af04a4acb93083413b9"
   },
   {
     "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9c979a280311c11af1"
+    "B": "frk_tt_68406d2e86acc048d1774ea6"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9c5029f2a7ec6f4145"
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406903839203801ac8041a"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9c64f9e3b7410008d7"
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406951bd282273ebe286cc"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_684069a3a0dd8322b2ac3f03"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406af04a4acb93083413b9"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406ca292d9fffb264991b9"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406d64f09f13271c14dd01"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406e353df3bc002994acef"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406e7abae2a9b16c2cc197"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406eedf0f0ddd220ea19c2"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68406f411fe27e47a0d6d5f3"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_684076a02261faf3d331289d"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_6840796f77d8a0dff53f947a"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68407ae5274a64092c305104"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_6849aad98c50d734dd904d98"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_6849c1a1038c3f18cfff47bf"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_686b51339d7e9f8ef2081a70"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68c3248edf65e750909dfd07"
+  },
+  {
+    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
+    "B": "frk_tt_68c332c3bc6d696bb61e7351"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_tt_68c8309516fdbc514404988d"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_tt_68c8309516fdbc514404988d"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc25658bacb2ccff56adf9"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68406a514e90bb6e32e0b107"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc27431d1266e3c77d7c0f"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc2ce9cb0d2a4774975ace"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc2f30b51920e5515465e6"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc2fa423533e602e4dee25"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc301a8fd914534ab95b11"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc30fbbeabb8a4c2f56082"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc327ff5d3130a1b42420b"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc395b90e179fe3209b795"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc39efd7916e240451cae5"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc3f427e309607f1ad5ba4"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc3ffab3fb703917f51e19"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc4190caf0b458effcee6e"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc41ad7cbd2839c0bc7104"
+  },
+  {
+    "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
+    "B": "frk_tt_68cc459ed57b70a4cb631e72"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68d28f68f117d45c0adcba33"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68b5ce9c6c1bdb171870f623"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68e1d5667f2b14a9b0c2daf8"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68e1d619944625cc1876540c"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68b59e7a29bec89c57014868"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68d28f68f117d45c0adcba33"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68406903839203801ac8041a"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_6840796f77d8a0dff53f947a"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_6849c1a1038c3f18cfff47bf"
+  },
+  {
+    "A": "frk_ct_68e1364141d03b5e6d70e728",
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52b2618cb9d9722c6edfd"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52b269db179c434734766"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52b26b166e2c0a0d11956"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52b274a7c38c62db08e80"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52b27c4bdbf1b24051b8b"
+  },
+  {
+    "A": "frk_ct_68b59e50eeb9f92ce425327c",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_tt_68e805457c2dcc784e72e3cc"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_tt_68e80544d9734e0402cfa807"
+  },
+  {
+    "A": "frk_ct_68e8079750107bcc63fc79d9",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_68e80a11f225cb2253e31fa0",
+    "B": "frk_tt_68e52b274a7c38c62db08e80"
+  },
+  {
+    "A": "frk_ct_68e80a11f225cb2253e31fa0",
+    "B": "frk_tt_68e52b27c4bdbf1b24051b8b"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_tt_68e52b269db179c434734766"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_tt_68e80545a8b432bc59eb8037"
   }
 ]
\ No newline at end of file

From 21c259bb5c20fd3798df9c2bca3ef0883863b901 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 16:25:20 -0500
Subject: [PATCH 6/8] fix(portal): update macOS version requirements (#1716)

Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
---
 .../[orgId]/components/tasks/DeviceAgentAccordionItem.tsx       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
index 60b4693c4..a362ec4db 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
@@ -287,7 +287,7 @@ export function DeviceAgentAccordionItem({
               <AccordionContent className="px-4 pb-4">
                 <div className="text-muted-foreground space-y-2 text-sm">
                   <p>
-                    <strong>Operating Systems:</strong> macOS 10.14+, Windows 10+
+                    <strong>Operating Systems:</strong> macOS 14+, Windows 10+
                   </p>
                   <p>
                     <strong>Memory:</strong> 512MB RAM minimum

From d6b5d96a83646633fde0e6727e61a7d45a43373d Mon Sep 17 00:00:00 2001
From: Mariano Fuentes <marfuen98@gmail.com>
Date: Fri, 7 Nov 2025 11:59:06 -0500
Subject: [PATCH 7/8] Mariano/trigger version (#1718)

* chore(db): add new frameworks, requirements, and task templates for compliance

* chore: update trigger.dev to version 4.0.6 in deployment scripts
---
 .github/workflows/trigger-tasks-deploy-main.yml    | 2 +-
 .github/workflows/trigger-tasks-deploy-release.yml | 2 +-
 apps/app/package.json                              | 2 +-
 package.json                                       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/trigger-tasks-deploy-main.yml b/.github/workflows/trigger-tasks-deploy-main.yml
index bbd03d59d..7d5a975c6 100644
--- a/.github/workflows/trigger-tasks-deploy-main.yml
+++ b/.github/workflows/trigger-tasks-deploy-main.yml
@@ -36,4 +36,4 @@ jobs:
           VERCEL_ACCESS_TOKEN: ${{ secrets.VERCEL_ACCESS_TOKEN }}
           VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
           VERCEL_TEAM_ID: ${{ secrets.VERCEL_TEAM_ID }}
-        run: bunx trigger.dev@4.0.0 deploy --env staging --log-level debug
+        run: bunx trigger.dev@4.0.6 deploy --env staging --log-level debug
diff --git a/.github/workflows/trigger-tasks-deploy-release.yml b/.github/workflows/trigger-tasks-deploy-release.yml
index b5b5f158c..28b78431b 100644
--- a/.github/workflows/trigger-tasks-deploy-release.yml
+++ b/.github/workflows/trigger-tasks-deploy-release.yml
@@ -40,4 +40,4 @@ jobs:
           VERCEL_ACCESS_TOKEN: ${{ secrets.VERCEL_ACCESS_TOKEN }}
           VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
           VERCEL_TEAM_ID: ${{ secrets.VERCEL_TEAM_ID }}
-        run: bunx trigger.dev@4.0.0 deploy
+        run: bunx trigger.dev@4.0.6 deploy
diff --git a/apps/app/package.json b/apps/app/package.json
index a5389f0e1..63a720e59 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -156,7 +156,7 @@
     "db:generate": "bun run db:getschema && prisma generate",
     "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
     "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/app",
-    "deploy:trigger-prod": "npx trigger.dev@4.0.0 deploy",
+    "deploy:trigger-prod": "npx trigger.dev@4.0.6 deploy",
     "dev": "bun i && bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"next dev --turbo -p 3000\" \"bunx trigger.dev@4.0.6 dev\"",
     "lint": "next lint && prettier --check .",
     "prebuild": "bun run db:generate",
diff --git a/package.json b/package.json
index b01455c5a..d2f0475f9 100644
--- a/package.json
+++ b/package.json
@@ -63,7 +63,7 @@
     "check:env": "node scripts/check-unused-env.js",
     "clean": "git clean -xdf node_modules",
     "clean:workspaces": "turbo clean",
-    "deploy:trigger-prod": "npx trigger.dev@4.0.0 deploy",
+    "deploy:trigger-prod": "npx trigger.dev@4.0.6 deploy",
     "deps:check": "syncpack list-mismatches",
     "deps:dedupe": "syncpack fix-mismatches && bun install",
     "deps:fix": "syncpack fix-mismatches",

From 799022f4f94951bcc58f86fdf1108ce0a070a5b2 Mon Sep 17 00:00:00 2001
From: Mariano Fuentes <marfuen98@gmail.com>
Date: Fri, 7 Nov 2025 12:15:25 -0500
Subject: [PATCH 8/8] chore(app): auto-enable organization access for
 trycomp.ai emails (#1719)

---
 .../(app)/setup/actions/create-organization-minimal.ts | 10 ++++++++--
 .../src/app/(app)/setup/actions/create-organization.ts |  8 ++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts b/apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts
index c0bffebad..f0089796a 100644
--- a/apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts
+++ b/apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts
@@ -38,14 +38,20 @@ export const createOrganizationMinimal = authActionClientWithoutOrg
         };
       }
 
+      // Check if user email domain is trycomp.ai
+      const userEmail = session.user.email;
+      const isTryCompEmail = userEmail?.endsWith('@trycomp.ai') ?? false;
+
       // Create a new organization
       const newOrg = await db.organization.create({
         data: {
           name: parsedInput.organizationName,
           website: parsedInput.website,
           onboardingCompleted: false, // Explicitly set to false
-          // Local-only: default access for faster local development
-          ...(process.env.NEXT_PUBLIC_APP_ENV !== 'production' && { hasAccess: true }),
+          // Auto-enable for trycomp.ai emails or local development
+          ...((process.env.NEXT_PUBLIC_APP_ENV !== 'production' || isTryCompEmail) && {
+            hasAccess: true,
+          }),
           members: {
             create: {
               userId: session.user.id,
diff --git a/apps/app/src/app/(app)/setup/actions/create-organization.ts b/apps/app/src/app/(app)/setup/actions/create-organization.ts
index f29eee705..9df1720c2 100644
--- a/apps/app/src/app/(app)/setup/actions/create-organization.ts
+++ b/apps/app/src/app/(app)/setup/actions/create-organization.ts
@@ -34,6 +34,10 @@ export const createOrganization = authActionClientWithoutOrg
         };
       }
 
+      // Check if user email domain is trycomp.ai
+      const userEmail = session.user.email;
+      const isTryCompEmail = userEmail?.endsWith('@trycomp.ai') ?? false;
+
       // Create a new organization directly in the database
       const randomSuffix = Math.floor(100000 + Math.random() * 900000).toString();
 
@@ -41,6 +45,10 @@ export const createOrganization = authActionClientWithoutOrg
         data: {
           name: parsedInput.organizationName,
           website: parsedInput.website,
+          // Auto-enable for trycomp.ai emails or local development
+          ...((process.env.NEXT_PUBLIC_APP_ENV !== 'production' || isTryCompEmail) && {
+            hasAccess: true,
+          }),
           members: {
             create: {
               userId: session.user.id,