The rulebook

Every verdict cites a row below. The rulebook is hashed into each run — and any amendment lands in the changelog and changes that hash. Rule changes are visible, never silent.

Control matrix · 16 rows · ISO/IEC 27001:2022 × SOC 2

6.1 ScreeningCC1.4 (competent individuals — background checks as a point of focus)R-6.1-aR-6.1-bR-6.1-c

The auditor expects: Checks completed before start, scope proportionate, consent obtained; any start-before-clearance covered by an approved exception

Status logic: Complete & clear ≤ start → C; pending at start with approved exception → C; pending at start with a *draft* exception / documented rationale but no formal approval → NI; pending at start with nothing, or no order at all → NC

evidence: Consent form; vendor order + per-component status; HRIS start date; REG-SEC-02 exception record; related correspondence · sources: drive, bgcheck, hris

6.2 Terms and conditions of employmentCC1.1 (integrity & ethical values), CC2.2 (internal communication of responsibilities), CC5.3 (policies and procedures deployed)R-6.2-a

The auditor expects: Contract states security responsibilities

Status logic: Present & signed → C; missing → NC

evidence: Signed offer letter with TPL-03 clauses · sources: drive

6.6 Confidentiality or non-disclosure agreementsCC1.1, CC2.2, CC5.3R-6.6-a

The auditor expects: NDA signed by every person, incl. contractors, before access

Status logic: Signed ≤ start → C; signed after start → NC; unsigned envelope → NI

evidence: Signed NDA · sources: drive

5.16 Identity managementCC6.1, CC6.2R-5.16-a

The auditor expects: Unique identity, created from an authorised record, contractor expiry set

Status logic: Match → C; created without HRIS record or contractor without expiry → NC

evidence: Workspace audit `CREATE_USER`; directory; HRIS record · sources: workspace, hris

5.10 Acceptable use of information and other associated assetsCC1.1, CC2.2, CC5.3R-5.10-a

The auditor expects: AUP acknowledged

Status logic: ≤ start+1d → C; missing → NC; old version → NI

evidence: HRIS acknowledgement (policy id, version, timestamp) · sources: hris

5.15 Access control / 5.18 Access rightsCC6.2, CC6.3R-5.18-a

The auditor expects: Access authorised by manager before provisioning; least privilege

Status logic: Approved (approver≠requester) before provisioning → C; approver blank → NI; no ticket / self-approved → NC ; contractor ticket with no expiry set → NC even when properly approved (TPL-05 makes expiry mandatory for contractors; POL-AC-01 §2.3)

evidence: Access-request ticket with approver, timestamps; provisioning log · sources: tickets, workspace

8.2 Privileged access rightsCC6.3 (least privilege, segregation of duties)R-8.2-a

The auditor expects: Privileged roles dual-approved and reviewed

Status logic: Both approvals → C; one approval → NI; none / no ticket → NC

evidence: Workspace `ASSIGN_ROLE` for Super Admin; ticket with manager + security approval · sources: workspace, tickets

6.3 Information security awareness, education and trainingCC1.4 (training), CC2.2R-6.3-a

The auditor expects: Training completed within policy window, with record

Status logic: Completed ≤ start+30d with date & score → C; completed but no date/score → NI; not completed and overdue → NC

evidence: LMS completion (date, score) · sources: lms

5.9 Inventory of information and other associated assetsCC6.1R-5.9-a

The auditor expects: Device assigned and accepted

Status logic: Both → C; register only → NI ; remote worker on own device (per SOW) with no company asset and no approved exception in REG-SEC-02 → NI (POL-HR-01 §3.6; ask for the exception record, do not assume)

evidence: Asset register `assigned`; signed TPL-04 · sources: assets, drive

5.18 Access rights (removal)CC6.2 (credentials removed when no longer authorised), CC6.3R-5.18-b

The auditor expects: Access removed within policy window

Status logic: ≤ 24 h → C; > 24 h or still active → NC

evidence: HRIS termination date; Workspace `SUSPEND_USER` timestamp; directory status · sources: hris, workspace

5.18 Access rights (other systems)CC6.2, CC6.3R-5.18-c

The auditor expects: Removal evidenced per system

Status logic: Closed with attachment → C; closed without attachment → NI; open → NC

evidence: Offboarding subtasks with attachments · sources: tickets

5.11 Return of assetsCC6.5R-5.11-a

The auditor expects: All assets returned, wiped before reuse

Status logic: All returned and recorded on a signed form → C; a signed form exists but rows are blank/partial, or the laptop is returned+wiped and only accessories remain 'assigned' → NI (query to IT, not a finding); items outstanding past 5 working days with NO return form at all → NC

evidence: TPL-07 signed; asset register `returned`/`wiped` · sources: drive, assets

6.5 Responsibilities after termination or change of employmentCC1.1, CC2.2, CC5.3R-6.5-a

The auditor expects: Obligations communicated at exit

Status logic: Signed → C; unsigned → NI; missing → NC

evidence: TPL-06 signed with reminder box ticked · sources: drive

6.5 + 5.18CC6.2, CC9.2 (vendor/business-partner management)R-6.5-b

The auditor expects: Contract end triggers same offboarding

Status logic: Executed → C; no end date / account active → NC

evidence: HRIS end date; offboarding ticket; Workspace status · sources: hris, tickets, workspace

5.18 Access rights (quarterly user-access review)CC6.2, CC6.3R-5.18-d

The auditor expects: Every in-scope system reviewed each quarter by its owner against a dated export; each account decided; revokes actioned

Status logic: On time, owner-signed, export attached, no undecided, revokes actioned → C; on time but no export / undecided accounts / unactioned revokes → NI; missing, late, or signed by non-owner → NC

evidence: Review record (TPL-08) with attachment, decisions, sign-off; revocation tickets · sources: reviews, tickets, hris

6.4 Disciplinary processCC1.5 (accountability), CC5.3R-6.4-a

The auditor expects: Documented process exists and is applied

Status logic: Policy current + case log queried → C

evidence: POL-HR-01 §3.4; HR case log (nil return acceptable) · sources: drive, hris

Amendment log

# Rulebook changelog

## 2026-08-27 — status_logic consistency amendments (rules_version bump)
Matrix-vs-engine audit triggered by full-run disagreements (the amendment process
itself is the control: rule changes are visible, never silent):
- **R-5.18-a**: added the contractor-expiry branch (mismatch EV-0028 — the published
  status_logic omitted a branch the reference engine enforces per POL-AC-01 §2.3 / TPL-05).
- **R-5.9-a**: added the remote/own-device/exception branch (mismatch EV-0030;
  POL-HR-01 §3.6).
- **R-5.11-a**: clarified NI-vs-NC precedence when a return form exists but rows are
  blank (mismatch EV-0050).
No engine logic changed; the matrix now states what the engine always enforced.