## CERG Style Compliance Tracker | | | |---|---| | **Document ID** | CERG-GOV-STY-002 | | **Version** | 1.01 | | **Status** | Approved | | **Classification** | Public | | **Owner** | Governance Pillar Leader (Document Control) | | **Parent Policy** | [`CERG-POL-001`](CERG-POL-001_Cybersecurity_Policy.md) - Cybersecurity Policy | | **Review Cycle** | Quarterly | | **Frameworks** | NIST CSF 2.0 | | **Regulations** | Cross-cutting | | **Environments** | All CERG-managed documentation | --- **Purpose:** Track known STY-001 and governance compliance gaps across the CERG corpus. **Owner:** Governance Pillar Leader (Document Control) ## Known Contradictions Resolved The following contradictions existed in the corpus at the time of the June 2026 review. Each has been resolved as documented below. | Contradiction | Artifacts | Resolution | Fixed In | |--------------|-----------|------------|----------| | IR documents included in repo but IR is not CERG-owned | PLN-IR-001, PRC-IR-002, OM-001 §3.4 | Marked IR docs as ADJACENT FUNCTION (External Interface status, IR team owner, "included for cross-reference only" banners at top) | Commit fb71eeb | | Approved status with Pending approvers | 36 documents across all families | Set all "Approved By" to CISO (per user convention). Pending is now only possible in Draft documents. | Commit 20606a3 | | Per-role documents owned by Governance per CAT-001 §4.2 says Pillar Leaders | 32 per-role JD files | Updated file Owner fields to match CAT-001 delegation (Engineering → Engineering PL, Risk → Risk PL, etc.). | Commit 5c2c105 | | Risk acceptance expiration defaults not defined | RMF-001, PRC-RM-001 | Added default expiration durations per severity (Critical 30d, High 90d, Medium 180d, Low 365d) in IMP-002 §5. | Commit 3d9305c | | FLOW-001 timeout-bypass may conflict with RMF-001 approval authority | FLOW-001 §2 principle 10, RMF-001 §9.7 | Noted as intentional design: timeout-bypass includes documented rationale requirement and does not apply to statutory/regulatory approval decisions. | Noted in errors.md | | Self-service closure defined in FLOW-001 but not referenced in PRC-RM-001 | FLOW-001 F-04, PRC-RM-001 | PRC-RM-001 references F-04 for finding treatment. Update on next PRC-RM-001 review cycle. | Deferred to next PRC-RM-001 review | --- **Generated:** 2026-06-11 **Status:** Approved tracker — items are resolved by amending the affected document on its next scheduled review --- ## Known Compliance Gaps ### Missing Document Control Sections (STY-001 §7.5) The following Approved documents lack a Document Control section, which STY-001 requires for every artifact: | Document ID | Document | Status | Scheduled Fix | |-------------|----------|--------|---------------| | CERG-GOV-OM-001 | CERG Operating Model | Approved | Next annual review (2027) | | CERG-PLN-IR-001 | Incident Response Plan | Approved | Next annual review (2027) | | CERG-PRC-RM-001 | Risk Register and Exception Process | Approved | Next semi-annual review | | CERG-PRC-VM-001 | Exposure Management Procedure | Approved | Next semi-annual review | | CERG-GOV-TAX-001 | Risk Taxonomy | Approved | Next annual review (2027) | **Remediation:** On the document's next scheduled review, append a Document Control section following the STY-001 §7.5 format (see §7.5 template below). Add a revision history entry noting the addition. ### Metadata Table Format Inconsistencies (STY-001 §3) | Issue | Affected Documents | Impact | |-------|-------------------|--------| | 2-column metadata format instead of standard 3-column | POL-001 | Minor — functionally equivalent; differs visually from other docs | | Minimal 4-field metadata table | CMX-001, TAX-001, FRM-001 | Minor — missing fields compared to the 11-field STY-001 standard | | Inline bold-text metadata (no table) | RMF-001 | Minor — unique format in the corpus | **Remediation:** Convert to standard 3-column, 11-field format on next review. See cerg-framework skill reference for the safe conversion pattern. ### Document Control Section Numbering STY-001 §7.5 states "Document Control is always the last section" but does not specify a section number. As a result, Document Control appears as §8 in some documents, §9 in others, §10 in STY-001 itself, and §13 in RMF-001. This is not a compliance gap (STY-001 does not mandate a specific number) but contributes to visual inconsistency. ### 4-Part Document IDs Per-role job description documents use 4-part IDs (e.g., `CERG-GOV-JD-SECENG-001`) where the standard naming convention (§2) specifies 3-part IDs (`CERG-TYPE-DOMAIN-NNN`). The DOC_ID_PATTERN in cerg-validate.py was extended on 2026-06-11 to accept these IDs. Future documents should use flat domain codes per the convention; the 4-part format is accepted for the workforce architecture family. --- ## STY-001 §7.5 Template — Document Control Section For reference when remediating the missing sections above: ``` ## N. Document Control | Field | Value | |---|---| | **Document ID** | | | **Version** | X.X | | **Status** | [Draft / For Review / Approved / Retired] | | **Effective Date** | YYYY-MM-DD | | **Classification** | [Public / Internal / Restricted] | | **Owner** | [Role Name] | | **Approved By** | CISO | | **Parent Policy** | [`CERG-POL-001`](CERG-POL-001_Cybersecurity_Policy.md) - Cybersecurity Policy | | **Review Cycle** | [Annual / Semi-Annual / Quarterly] | | **Next Scheduled Review** | YYYY-MM-DD | | **Frameworks** | [Applicable frameworks] | | **Regulations** | [Applicable regulations] | | **Environments** | [Applicable environments] | ### Revision History | **Version** | **Date** | **Author** | **Change Summary** | |---|---|---|---| | X.X | YYYY-MM-DD | [Author] | [Summary] | ### Review Triggers - [Trigger 1] - [Trigger 2] [Owner] owns this document. [Owner] is responsible for initiating reviews, managing the revision cycle, and obtaining approval for all changes. ### Related Documents | **Document** | **ID** | **Relationship** | |---|---|---| | [Document Name] | [``](../filename.md) | [Relationship] | ``` --- --- ## Known Contradictions Resolved The following contradictions existed in the corpus at the time of the June 2026 review. Each has been resolved as documented below. | Contradiction | Artifacts | Resolution | Fixed In | |--------------|-----------|------------|----------| | IR documents included in repo but IR is not CERG-owned | PLN-IR-001, PRC-IR-002, OM-001 §3.4 | Marked IR docs as ADJACENT FUNCTION (External Interface status, IR team owner, "included for cross-reference only" banners at top) | Commit fb71eeb | | Approved status with Pending approvers | 36 documents across all families | Set all "Approved By" to CISO (per user convention). Pending is now only possible in Draft documents. | Commit 20606a3 | | Per-role documents owned by Governance per CAT-001 §4.2 says Pillar Leaders | 32 per-role JD files | Updated file Owner fields to match CAT-001 delegation (Engineering → Engineering PL, Risk → Risk PL, etc.). | Commit 5c2c105 | | Risk acceptance expiration defaults not defined | RMF-001, PRC-RM-001 | Added default expiration durations per severity (Critical 30d, High 90d, Medium 180d, Low 365d) in IMP-002 §5. | Commit 3d9305c | | FLOW-001 timeout-bypass may conflict with RMF-001 approval authority | FLOW-001 §2 principle 10, RMF-001 §9.7 | Noted as intentional design: timeout-bypass includes documented rationale requirement and does not apply to statutory/regulatory approval decisions. | Noted in errors.md | | Self-service closure defined in FLOW-001 but not referenced in PRC-RM-001 | FLOW-001 F-04, PRC-RM-001 | PRC-RM-001 references F-04 for finding treatment. Update on next PRC-RM-001 review cycle. | Deferred to next PRC-RM-001 review | ## Compliance by the Numbers | Metric | Count | |--------|-------| | Total CERG documents | 72 governed markdown files | | Documents with Document Control section | 67 (93%) | | Documents missing Document Control section | 5 (7%) — tracked above | | Documents using non-standard metadata format | 5 (7%) — tracked above | | Documents created 2026-06-11 needing style review | 34 (all in roles/) | --- ## Document Control | | | |---|---| | **Document ID** | CERG-GOV-STY-002 | | **Version** | 1.01 | | **Status** | Approved | | **Classification** | Public | | **Owner** | Governance Pillar Leader (Document Control) | | **Approved By** | CISO | | **Parent Policy** | [CERG-POL-001](CERG-POL-001_Cybersecurity_Policy.md) - Cybersecurity Policy | | **Review Cycle** | Quarterly | | **Next Scheduled Review** | 2026-09-17 | | **Frameworks** | NIST CSF 2.0 | | **Regulations** | Cross-cutting | | **Environments** | All CERG-managed documentation | ### Revision History | **Version** | **Date** | **Author** | **Change Summary** | |---|---|---|---| | 1.01 | 2026-06-17 | Governance Pillar Leader | Added Document Control section. | ### Review Triggers - Quarterly review cycle - New document added to corpus - Style guide (STY-001) updated ### Related Documents | **Document** | **ID** | **Relationship** | |---|---|---| | Document Authoring and Style Guide | [CERG-GOV-STY-001](CERG-GOV-STY-001_Document_Authoring_and_Style_Guide.md) | Parent style guide | | Document Catalog | [CERG-GOV-CAT-001](CERG-GOV-CAT-001_Document_Catalog_and_Naming_Convention.md) | Catalog reference |