SSDLC master registers and record templates

SSDLC master registers and record templates

RG-01 — Register operating instructions

[Organisation] maintains the following records to connect adopted promises, responsibilities, work, evidence and decisions. Registers may be combined or separated according to the repository used. Each entry retains a stable identifier and references related records by identifier and location. The owner records the effective version, date and person making a material change. Superseded decisions remain retrievable.

The programme owner assigns custodians and access arrangements for the registers. Personal contact information, vulnerability details and other sensitive content are held according to the information policy. A widely accessible index may link to restricted records without reproducing their sensitive content. The master index identifies the authoritative location so that multiple copies do not create uncertainty about the current record.

The records below are blank operating records for direct use. Duplicate an entry when another system, stakeholder, requirement, decision or occurrence needs its own record. Square-bracket fields identify information to supply. “Unresolved” records an outstanding decision; it is not a substitute for “won’t do” or “deferred until”. Implementation and assessment results are maintained separately from the adoption disposition.

RG-02 — Organisation setup record

Document owners may reference these parameters instead of repeating the same value in every document. A reference identifies the applicable version or effective period. Changes to a shared parameter identify affected documents and outstanding activities. A shared review date does not remove the separate event triggers recorded for each activity.

RG-03 — Master document and adoption index

Document record ID: [ID]
Title and local version: [Title; version; effective period]
Owner and custodian: [Names and locations]
Scope: [Organisation/system/service]
Source document: [Library ID and version, if retained]
Adoption disposition: [Will do / Won’t do / Deferred until / Unresolved]
Clause variations: [Clause IDs; separate AD records]
Decision authority and rationale: [Name; decision; reasons]
Implementation state: [Not started / partial / operating; evidence]
Already in place: [Yes / No / In part, before the decision was recorded]
Means of delivery: [System; manual process; external party — record every path that applies, each with what performs it]
Procedure and responsibility: [Document; RO records]
Schedule and assurance: [SE and AS records]
Next review and change history: [Date/event; prior versions]

RG-04 — Stakeholder and responsibility registers

Stakeholder entry ID: [ST ID]
Identity and relationship: [Person/group/organisation; capacity]
Representative: [Name; contact; authority and limits of representation]
Needs and interests: [Objectives; protection needs; affected outcomes]
Requirements and risks: [RE and RI IDs]
Participation and decisions: [Consultation; acceptance; decision rights]
Engagement schedule: [Method; owner; dates/events]
Open concerns and confirmation: [Issues; last confirmed; next review]

Responsibility entry ID: [RO ID]
Promise/activity and scope: [Clause; system; work]
Performer: [Name; role; accepted appointment]
Decision authority: [Name; delegation; limits; effective period]
Consulted/informed: [ST IDs]
Deputy and continuity: [Name; activation; contact]
Competence: [Work required; NICE release/IDs where used; evidence]
Capacity and development: [Allocation; gaps; actions; dates]
Output and timing: [Evidence; SE records]
Review: [Owner; date/event; appointment history]

The custodian checks that responsibilities refer to real work and that each decision authority has an identifiable delegation. NICE references describe the work and competence; they do not automatically grant organisational authority. Changes in personnel update open actions and access arrangements as well as the role table.

RG-05 — System and obligation registers

System entry ID: [System ID]
Purpose and scope: [Mission; functions; boundary; life-cycle stage]
Owner and sponsor: [Names; authority]
Stakeholders and interfaces: [ST IDs; connected systems; suppliers]
Information and assets: [DA and configuration references]
Operating context: [Users; locations; essential functions; assumptions]
Requirements and risk: [Baselines; RE, RI and CO records]
Current configuration and authorisation: [CM and RL references]
Operation and retirement: [OP owner; support; planned disposition]

Obligation entry ID: [Obligation ID]
Source and version: [Law/agreement/directive/policy; exact reference]
Applicability: [Jurisdiction; entity; system; processing or service]
Interpretation owner: [Person; specialist advice reference if needed]
Required outcome/action: [Requirement; timing; recipient]
Authority and decision: [Applicability decision; rationale; uncertainty]
Implementation: [RE, CO, RO and SE records]
Evidence and review: [EV/AS records; change-monitoring source]

The obligation record separates the original source from the organisation’s interpretation and implementation. Where an interpretation is unresolved, the record identifies the decision owner and consequences. A library mapping is not used as a substitute for identifying the actual obligation that applies.

RG-06 — Requirement, risk and control registers

Requirement entry ID: [RE ID]
Statement: [Required outcome; conditions; limits]
Source and rationale: [Stakeholder need; obligation; risk; derivation]
Scope and allocation: [System element; interface; owner]
Status and baseline: [Proposed/approved/superseded; version]
Acceptance: [Method; expected result; environment; authority]
Relationships: [Parent; controls; design; implementation; tests]
Decision and history: [Approver; date; change records]

Risk entry ID: [RI ID]
Objective and scope: [Outcome; system; time horizon; stakeholders]
Scenario: [Source/condition; event; consequences]
Evidence and uncertainty: [Observations; assumptions; unknowns]
Current controls: [CO IDs; implementation and effectiveness evidence]
Assessment: [Criteria version; likelihood; consequences; evaluation]
Treatment: [Actions; owners; resources; dates; verification]
Decision: [Authority; response; rationale; conditions]
Residual risk and monitoring: [Assessment; SE triggers; next review]

Control entry ID: [CO ID]
Source: [SP 800-53 Rev. 5 control/enhancement or local ID; version]
Objective and scope: [Requirements; risks; system boundary]
Selection and parameters: [Decision; values; rationale]
Responsibility: [Common/system-specific/hybrid; provider; customer work]
Implementation: [Mechanism; procedure; configuration; owner]
Assessment: [Objective; method; evidence; result; limitations]
Monitoring and outstanding work: [SE; AS; action records]

RG-07 — Supplier, component and data registers

Supplier entry ID: [SC ID]
Supplier/service identity: [Entity; service; contacts; locations]
Business reliance: [Systems; functions; criticality; owner]
Requirements and agreement: [AC record; accepted terms; deviations]
Assessment evidence: [Scope; date; source; customer responsibilities]
Monitoring: [Notices; reviews; events; owner]
Exit: [Portability; continuity; access; data; retained evidence]
Decision: [Authority; conditions; open risks; next review]

Component entry ID: [Component ID]
Identity: [Name; version; supplier/project; identifier]
Source and integrity: [Acquisition location; verification; unknowns]
Use: [System/build/release; purpose; direct/transitive relationship]
Modification and rights: [Changes; licence/usage conditions]
Support and vulnerability status: [Source; date; affected scope]
Owner and disposition: [Responsibility; update or retirement decision]

Data entry ID: [DA ID]
Information and provenance: [Category; source; quality; unknowns]
Purpose and authority: [Uses; obligation; processing approval]
Owner and custody: [Owner; stores; copies; suppliers]
Handling: [Classification; access; recipients; locations]
Life cycle: [Collection; transformations; correction; retention trigger]
Disposal: [Method; hold; custodian; verification; limitations]
Review and dependencies: [PR assessment; SE triggers; derived artefacts]

RG-08 — Decision, change and release registers

Decision entry ID: [Decision ID]
Question and authority: [Decision needed; decision-maker; delegation]
Context: [Scope; relevant version; stakeholders; time constraints]
Information: [Evidence; options; uncertainty; dissent]
Decision: [Disposition; rationale; conditions; date]
Actions and review: [Owners; dates; monitoring; reconsideration trigger]

Change entry ID: [CM ID]
Intent and baseline: [Requirement/issue; current configuration]
Impact: [Behaviour; access; data; suppliers; operation; assurance]
Plan: [Implementation; verification; migration; recovery; limits]
Authority: [Decision; standing or specific scope; conditions]
Execution: [Actor; time; changed items; resulting versions]
Result: [Evidence; deviations; release; closure; remaining actions]

Release entry ID: [RL ID]
Candidate and target: [Artefacts; integrity; configuration; environment]
Readiness: [Requirements; verification; validation; operations]
Open matters: [Defects; vulnerabilities; exceptions; risks; evidence gaps]
Decision: [Authority; disposition; scope; conditions; review]
Deployment: [Actual versions; checks; migration; recovery]
Handover: [Receiving owner; support; monitoring; outstanding work]

RG-09 — Schedule, assurance and evidence registers

Schedule entry ID: [SE ID]
Promise and activity: [Clause; operational/assurance/decision review]
Initiation: [Recurrence and anchor / event and source]
Timing: [Time zone; response rule; next due]
Responsibility: [Detector; performer; deputy; decision authority]
Output: [Required record; evidence; assessment link]
Occurrence: [Event/time; action; result; overdue decision]

Assurance entry ID: [AS ID]
Promise and objective: [Adopted version; scope; question assessed]
Plan: [Assessor; competence; independence; period]
Population and sample: [Eligible items; selection; coverage; limits]
Method and evidence: [Examine/interview/test; EV IDs]
Conclusion: [Result; reasoning; contradictions; confidence limits]
Finding and action: [Owner; consequence; action; verification; review]

Evidence entry ID: [EV ID]
Identity and provenance: [Source; creator; version; original/copy/extract]
Scope: [System; configuration; period; method; captured time]
Claim and relationships: [Promise; requirement; assessment; decision]
Storage and handling: [Location; permissions; integrity; sensitivity]
Currency and retention: [Review trigger; period; hold; custodian]
Limitations: [Missing context; incomplete coverage; uncertainty]

RG-10 — Exception, finding and action registers

Exception entry ID: [Exception ID]
Adopted promise: [Clause; version; normal requirement]
Departure and scope: [Instance/population/period; requested difference]
Reason and alternatives: [Constraints; options; consequences]
Authority and risk: [Decision; delegation; RI record; conditions]
Operation and expiry: [Owner; evidence; date/event; review]
Closure or extension: [Evidence; new decision; retained history]

Finding entry ID: [Finding ID]
Assessment and promise: [AS ID; clause; scope]
Observed condition: [Facts; evidence; expected condition]
Consequence and uncertainty: [Risk; affected claims; limitations]
Owner and response: [Correction; investigation; decision]
Action and closure: [IM action; dates; verification; remaining exposure]

Corrective-action entry ID: [IM ID]
Problem and cause: [Finding; evidence; contributing factors]
Scope and action: [Affected systems; immediate and systemic work]
Responsibility and resources: [Owner; authority; allocation; due date]
Completion: [Evidence; reviewer; actual date]
Effectiveness: [Expected outcome; method; observation period; result]
Closure: [Decision; remaining risk; further action]

RG-11 — Register assurance

The register custodian reviews links and assignments at the programme’s recorded interval. Review checks that active systems have owners, adopted promises have operational and assurance arrangements, due work has occurrences, and closed findings have evidence. Orphan records are investigated: a test without a requirement, a requirement without a source, a decision without authority or a release without identifiable artefacts each requires a disposition.

The review preserves valid one-to-many relationships. One promise may apply to many systems; one control may address several requirements; one evidence item may support several claims. Shared evidence is not duplicated merely to fill a table. Its applicability and limitations are recorded for each claim. Register maintenance is assessed by whether people can retrieve and use the relationships, not by the number of rows created.