{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://sosec.io/static/research/cis-controls-v8-1-implementation-evidence-schema-july-2026-v2.json",
  "title": "SOSEC CIS Controls v8.1 implementation evidence ledger v2",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schema",
    "schema_name",
    "artifact_version",
    "generated_at",
    "cutoff",
    "framework",
    "revision_statement",
    "provenance_classes",
    "counts",
    "shared_baseline",
    "safeguard_deltas",
    "cas_findings_reference",
    "reference_product_prds"
  ],
  "properties": {
    "schema": {
      "const": "https://sosec.io/static/research/cis-controls-v8-1-implementation-evidence-schema-july-2026-v2.json"
    },
    "schema_name": {
      "const": "sosec.cis-controls-v8.1.implementation-evidence.v2"
    },
    "artifact_version": {
      "const": "2.0.0"
    },
    "generated_at": {
      "type": "string",
      "format": "date-time"
    },
    "cutoff": {
      "const": "2026-07-31"
    },
    "framework": {
      "type": "object",
      "required": [
        "name",
        "edition",
        "controls",
        "safeguards",
        "source_set"
      ]
    },
    "revision_statement": {
      "type": "object",
      "required": [
        "withdrawn_claim",
        "v1_historical_artifact",
        "current_model"
      ]
    },
    "provenance_classes": {
      "type": "object",
      "required": [
        "cis_official",
        "sosec_analysis",
        "example_local_solution"
      ]
    },
    "counts": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "shared_baseline_rules",
        "safeguard_deltas",
        "cas_findings",
        "reference_product_prds"
      ],
      "properties": {
        "shared_baseline_rules": {
          "const": 9
        },
        "safeguard_deltas": {
          "const": 153
        },
        "cas_findings": {
          "const": 40
        },
        "reference_product_prds": {
          "const": 5
        }
      }
    },
    "shared_baseline": {
      "type": "array",
      "minItems": 9,
      "maxItems": 9,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "baseline_id",
          "title",
          "provenance",
          "requirement",
          "acceptance"
        ],
        "properties": {
          "baseline_id": {
            "type": "string",
            "pattern": "^BASE-[0-9]{2}$"
          },
          "title": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "en",
              "zh"
            ],
            "properties": {
              "en": {
                "type": "string",
                "minLength": 1
              },
              "zh": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "provenance": {
            "const": "sosec_analysis"
          },
          "requirement": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "en",
              "zh"
            ],
            "properties": {
              "en": {
                "type": "string",
                "minLength": 1
              },
              "zh": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "acceptance": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "en",
              "zh"
            ],
            "properties": {
              "en": {
                "type": "string",
                "minLength": 1
              },
              "zh": {
                "type": "string",
                "minLength": 1
              }
            }
          }
        }
      }
    },
    "safeguard_deltas": {
      "type": "array",
      "minItems": 153,
      "maxItems": 153,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "delta_id",
          "safeguard_id",
          "control",
          "title",
          "implementation_groups",
          "asset_class",
          "security_function",
          "fields",
          "source_boundary"
        ],
        "properties": {
          "delta_id": {
            "type": "string",
            "pattern": "^DELTA-CIS-[0-9]+\\.[0-9]+$"
          },
          "safeguard_id": {
            "type": "string",
            "pattern": "^[0-9]+\\.[0-9]+$"
          },
          "control": {
            "type": "integer",
            "minimum": 1,
            "maximum": 18
          },
          "title": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "en",
              "zh"
            ],
            "properties": {
              "en": {
                "type": "string",
                "minLength": 1
              },
              "zh": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "implementation_groups": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "integer",
              "minimum": 1,
              "maximum": 3
            }
          },
          "asset_class": {
            "type": "string",
            "minLength": 1
          },
          "security_function": {
            "type": "string",
            "minLength": 1
          },
          "fields": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "denominator",
              "control_point",
              "real_failure",
              "strongest_negative_test"
            ],
            "properties": {
              "denominator": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "provenance",
                  "en",
                  "zh"
                ],
                "properties": {
                  "provenance": {
                    "const": "sosec_analysis"
                  },
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              },
              "control_point": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "provenance",
                  "en",
                  "zh"
                ],
                "properties": {
                  "provenance": {
                    "const": "sosec_analysis"
                  },
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              },
              "real_failure": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "provenance",
                  "en",
                  "zh"
                ],
                "properties": {
                  "provenance": {
                    "const": "sosec_analysis"
                  },
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              },
              "strongest_negative_test": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "provenance",
                  "en",
                  "zh"
                ],
                "properties": {
                  "provenance": {
                    "const": "sosec_analysis"
                  },
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              }
            }
          },
          "source_boundary": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "provenance",
              "official_anchor",
              "cas_finding_ids"
            ],
            "properties": {
              "provenance": {
                "const": "sosec_analysis"
              },
              "official_anchor": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "provenance",
                  "safeguard_id",
                  "control",
                  "title",
                  "implementation_groups",
                  "url",
                  "snapshot_sha256",
                  "retrieved_at"
                ],
                "properties": {
                  "provenance": {
                    "const": "cis_official"
                  },
                  "safeguard_id": {
                    "type": "string",
                    "pattern": "^[0-9]+\\.[0-9]+$"
                  },
                  "control": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 18
                  },
                  "title": {
                    "type": "object",
                    "additionalProperties": false,
                    "required": [
                      "en",
                      "zh"
                    ],
                    "properties": {
                      "en": {
                        "type": "string",
                        "minLength": 1
                      },
                      "zh": {
                        "type": "string",
                        "minLength": 1
                      }
                    }
                  },
                  "implementation_groups": {
                    "type": "array",
                    "minItems": 1,
                    "items": {
                      "type": "integer",
                      "minimum": 1,
                      "maximum": 3
                    }
                  },
                  "url": {
                    "type": "string",
                    "format": "uri"
                  },
                  "snapshot_sha256": {
                    "type": "string",
                    "pattern": "^[0-9A-F]{64}$"
                  },
                  "retrieved_at": {
                    "type": "string",
                    "format": "date-time"
                  }
                }
              },
              "cas_finding_ids": {
                "type": "array",
                "items": {
                  "type": "string",
                  "pattern": "^CAS-2026-07-31-[0-9]{3}$"
                }
              }
            }
          }
        }
      }
    },
    "cas_findings_reference": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "path",
        "schema",
        "sha256",
        "schema_sha256",
        "finding_count",
        "finding_ids"
      ],
      "properties": {
        "path": {
          "type": "string"
        },
        "schema": {
          "type": "string"
        },
        "sha256": {
          "type": "string",
          "pattern": "^[0-9A-F]{64}$"
        },
        "schema_sha256": {
          "type": "string",
          "pattern": "^[0-9A-F]{64}$"
        },
        "finding_count": {
          "const": 40
        },
        "finding_ids": {
          "type": "array",
          "minItems": 40,
          "maxItems": 40,
          "items": {
            "type": "string",
            "pattern": "^CAS-2026-07-31-[0-9]{3}$"
          }
        }
      }
    },
    "reference_product_prds": {
      "type": "array",
      "minItems": 5,
      "maxItems": 5,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "prd_id",
          "safeguard_id",
          "name",
          "provenance",
          "scenario",
          "users",
          "goals",
          "scope",
          "identity_contract",
          "data_model",
          "states",
          "transitions",
          "functional_rules",
          "exception_paths",
          "permissions_and_audit",
          "nfr",
          "acceptance_criteria",
          "release_and_rollback"
        ],
        "properties": {
          "prd_id": {
            "type": "string",
            "pattern": "^PRD-CIS-"
          },
          "safeguard_id": {
            "type": "string",
            "pattern": "^[0-9]+\\.[0-9]+$"
          },
          "name": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "en",
              "zh"
            ],
            "properties": {
              "en": {
                "type": "string",
                "minLength": 1
              },
              "zh": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "provenance": {
            "const": "example_local_solution"
          },
          "scenario": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "en",
              "zh"
            ],
            "properties": {
              "en": {
                "type": "string",
                "minLength": 1
              },
              "zh": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "users": {
            "type": "array",
            "minItems": 2,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "en",
                "zh"
              ],
              "properties": {
                "en": {
                  "type": "string",
                  "minLength": 1
                },
                "zh": {
                  "type": "string",
                  "minLength": 1
                }
              }
            }
          },
          "goals": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "en",
                "zh"
              ],
              "properties": {
                "en": {
                  "type": "string",
                  "minLength": 1
                },
                "zh": {
                  "type": "string",
                  "minLength": 1
                }
              }
            }
          },
          "scope": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "included",
              "excluded"
            ],
            "properties": {
              "included": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              },
              "excluded": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "identity_contract": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "natural_key",
              "merge_rule"
            ],
            "properties": {
              "natural_key": {
                "type": "string",
                "minLength": 1
              },
              "merge_rule": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "en",
                  "zh"
                ],
                "properties": {
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              }
            }
          },
          "data_model": {
            "type": "array",
            "minItems": 5,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "field",
                "type",
                "required",
                "source",
                "lifecycle"
              ],
              "properties": {
                "field": {
                  "type": "string",
                  "minLength": 1
                },
                "type": {
                  "type": "string",
                  "minLength": 1
                },
                "required": {
                  "type": "boolean"
                },
                "source": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                },
                "lifecycle": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "states": {
            "type": "array",
            "minItems": 3,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "id",
                "definition"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "definition": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "transitions": {
            "type": "array",
            "minItems": 3,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "from",
                "event",
                "to",
                "guard"
              ],
              "properties": {
                "from": {
                  "type": "string",
                  "minLength": 1
                },
                "event": {
                  "type": "string",
                  "minLength": 1
                },
                "to": {
                  "type": "string",
                  "minLength": 1
                },
                "guard": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "functional_rules": {
            "type": "array",
            "minItems": 5,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "id",
                "text"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "text": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "exception_paths": {
            "type": "array",
            "minItems": 3,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "id",
                "text"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "text": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "permissions_and_audit": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "roles",
              "audit_fields"
            ],
            "properties": {
              "roles": {
                "type": "array",
                "minItems": 2,
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "role",
                    "actions",
                    "separation"
                  ],
                  "properties": {
                    "role": {
                      "type": "string",
                      "minLength": 1
                    },
                    "actions": {
                      "type": "array",
                      "minItems": 1,
                      "items": {
                        "type": "object",
                        "additionalProperties": false,
                        "required": [
                          "en",
                          "zh"
                        ],
                        "properties": {
                          "en": {
                            "type": "string",
                            "minLength": 1
                          },
                          "zh": {
                            "type": "string",
                            "minLength": 1
                          }
                        }
                      }
                    },
                    "separation": {
                      "type": "object",
                      "additionalProperties": false,
                      "required": [
                        "en",
                        "zh"
                      ],
                      "properties": {
                        "en": {
                          "type": "string",
                          "minLength": 1
                        },
                        "zh": {
                          "type": "string",
                          "minLength": 1
                        }
                      }
                    }
                  }
                }
              },
              "audit_fields": {
                "type": "array",
                "minItems": 5,
                "items": {
                  "type": "string"
                }
              }
            }
          },
          "nfr": {
            "type": "array",
            "minItems": 4,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "id",
                "category",
                "text"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "category": {
                  "type": "string"
                },
                "text": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "acceptance_criteria": {
            "type": "array",
            "minItems": 5,
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "id",
                "text"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "text": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              }
            }
          },
          "release_and_rollback": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "migration",
              "phases",
              "monitoring",
              "rollback_triggers",
              "rollback",
              "decommission"
            ],
            "properties": {
              "migration": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "en",
                  "zh"
                ],
                "properties": {
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              },
              "phases": {
                "type": "array",
                "minItems": 2,
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              },
              "monitoring": {
                "type": "array",
                "minItems": 3,
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              },
              "rollback_triggers": {
                "type": "array",
                "minItems": 2,
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "en",
                    "zh"
                  ],
                  "properties": {
                    "en": {
                      "type": "string",
                      "minLength": 1
                    },
                    "zh": {
                      "type": "string",
                      "minLength": 1
                    }
                  }
                }
              },
              "rollback": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "en",
                  "zh"
                ],
                "properties": {
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              },
              "decommission": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "en",
                  "zh"
                ],
                "properties": {
                  "en": {
                    "type": "string",
                    "minLength": 1
                  },
                  "zh": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}