schema_version: '1.0'
name: CERG Document Tiers
purpose: Agent-friendly adoption tiers, loading order, and deferral guidance for CERG documents.
generated: '2026-06-18'
source_of_truth: Markdown corpus and CAT-001 document catalog
status: Stable

loading_guidance:
  default_agent_start:
    - ../README.md
    - ../START-HERE.md
    - ../ADOPT-WITH-AN-AGENT.md
    - ../adoption-packs/cerg-lite/README.md
    - cerg-llm-index.json
  rule: Load the smallest tier that satisfies the task before loading full documents.

adoption_tiers:
  tier_0_orientation:
    label: Orientation
    use_when: User is new, comparing adoption paths, or using an agent.
    documents:
      - id: README
        path: ../README.md
      - id: START-HERE
        path: ../START-HERE.md
      - id: BEGINNER-GUIDE
        path: ../BEGINNER-GUIDE.md
      - id: ADOPT-WITH-AN-AGENT
        path: ../ADOPT-WITH-AN-AGENT.md
      - id: CERG-GOV-IMP-005
        path: ../governance/CERG-GOV-IMP-005_Adoption_Decision_Tree_and_Dependency_Matrix.md

  tier_1_mvc_spine:
    label: Minimum Viable CERG
    adoption_label: Required-Core
    use_when: Any organization is adopting CERG beyond evaluation.
    documents:
      - id: CERG-POL-001
        path: ../governance/CERG-POL-001_Cybersecurity_Policy.md
      - id: CERG-GOV-FRM-001
        path: ../governance/CERG-GOV-FRM-001_CERG_Framework.md
      - id: CERG-GOV-OM-001
        path: ../governance/CERG-GOV-OM-001_CERG_Operating_Model.md
      - id: CERG-GOV-CAT-001
        path: ../governance/CERG-GOV-CAT-001_Document_Catalog_and_Naming_Convention.md
      - id: CERG-GOV-RMF-001
        path: ../governance/CERG-GOV-RMF-001_Risk_Management_Framework.md
      - id: CERG-PRC-RM-001
        path: ../procedures/CERG-PRC-RM-001_Risk_Register_and_Exception_Process.md
      - id: CERG-TMPL-RM-001
        path: ../templates/CERG-TMPL-RM-001_Risk_Register_Templates_and_Reporting.md
      - id: CERG-PRC-VM-001
        path: ../procedures/CERG-PRC-VM-001_Exposure_Management_Procedure.md

  tier_2_adoption_aids:
    label: Adoption Aids
    adoption_label: Recommended
    use_when: User needs implementation sequencing, small-team consolidation, or record definitions.
    documents:
      - id: CERG-GOV-VAR-001
        path: ../governance/CERG-GOV-VAR-001_Organization_Adaptation_Profile.md
      - id: CERG-GOV-IMP-001
        path: ../governance/CERG-GOV-IMP-001_Implementation_and_Adaptation_Guide.md
      - id: CERG-GOV-IMP-002
        path: ../governance/CERG-GOV-IMP-002_Adoption_Safety_Guide.md
      - id: CERG-GOV-IMP-003
        path: ../governance/CERG-GOV-IMP-003_Small_Team_Adoption_Path.md
      - id: CERG-GOV-IMP-006
        path: ../governance/CERG-GOV-IMP-006_Role_Based_Implementation_Checklists.md
      - id: CERG-GOV-CAT-002
        path: ../governance/CERG-GOV-CAT-002_Record_Catalog.md
      - id: CERG-GOV-RAC-001
        path: ../governance/CERG-GOV-RAC-001_Consolidated_Roles_and_RACI_Instrument.md

  tier_3_standard_operating_layer:
    label: Standard Operating Layer
    adoption_label: Required-Path for Standard and Regulated
    use_when: MVC is operating and the organization is adding core security operations.
    groups:
      core_standards:
        - CERG-STD-AC-001
        - CERG-STD-AM-001
        - CERG-STD-CFG-001
        - CERG-STD-IT-001
        - CERG-STD-LM-001
        - CERG-STD-RES-001
      core_procedures:
        - CERG-PRC-AR-001
        - CERG-PRC-TPRM-001
        - CERG-PRC-AUD-001
        - CERG-PRC-CHG-001

  tier_4_conditional_overlays:
    label: Conditional Regulatory and Environment Overlays
    adoption_label: Conditional-Regulatory or Conditional-Environment
    use_when: A matching data type, environment, regulator, contract, or assessment goal exists.
    overlays:
      cmmc_cui:
        trigger: CUI, FCI, DFARS, federal contract, or CMMC assessment scope
        documents:
          - CERG-STD-CUI-001
          - CERG-PLN-CUI-001
          - CERG-TMPL-CUI-001
          - CERG-TMPL-CUI-002
      nerc_cip_ot:
        trigger: NERC-CIP, BES Cyber Systems, or critical OT environment
        documents:
          - CERG-STD-OT-001
          - CERG-PLN-CIP-001
          - CERG-STD-NET-001
      sox:
        trigger: SOX ITGC system or financial reporting scope
        documents:
          - CERG-PLN-SOX-001
          - CERG-PRC-CHG-001
          - CERG-PRC-AUD-001
      iso_27001:
        trigger: ISO 27001 readiness or certification goal
        documents:
          - CERG-PLN-ISO-001
      privacy:
        trigger: privacy, data protection, or personal data support obligations
        documents:
          - CERG-PLN-PRIV-001
          - CERG-STD-DG-001
      ai:
        trigger: sanctioned AI tools, AI-enabled SaaS, embedded AI, or built AI models
        documents:
          - CERG-STD-AI-001
          - CERG-TMPL-AI-001
          - CERG-TMPL-AI-002
          - CERG-TMPL-AI-003

  tier_5_workforce_architecture:
    label: Workforce Architecture
    adoption_label: Recommended; Required-Path for formal hiring or large teams
    use_when: Organization is formalizing roles, hiring, promotion, capacity, onboarding, or succession.
    documents:
      - CERG-GOV-JF-001
      - CERG-GOV-JF-002
      - CERG-GOV-JA-001
      - CERG-GOV-JD-001
      - CERG-GOV-WFP-001
      - CERG-GOV-ONB-001
      - CERG-GOV-TRN-001
      - CERG-GOV-PERF-001
      - CERG-GOV-SUCC-001

agent_deferral_rules:
  safe_to_defer_initially:
    - detailed job descriptions unless hiring or role design is the task
    - regulated overlays until scope is confirmed
    - advanced schemas unless automation is the task
    - standards for environments that do not exist
  do_not_defer_when_adopting:
    - risk register
    - exception process
    - named owners
    - risk acceptance authority
    - exposure management loop
    - evidence and decision record locations

agent_task_map:
  choose_adoption_path:
    load_tiers: [tier_0_orientation]
  adopt_cerg_lite:
    load_tiers: [tier_0_orientation, tier_1_mvc_spine, tier_2_adoption_aids]
  assess_regulated_scope:
    load_tiers: [tier_0_orientation, tier_1_mvc_spine, tier_4_conditional_overlays]
  workforce_design:
    load_tiers: [tier_0_orientation, tier_5_workforce_architecture]
  evaluate_extension_proposal:
    load:
      - cerg-agent-extension-roadmap.yaml
      - cerg-document-tiers.yaml
      - cerg-llm-index.json
  full_reference_review:
    load: cerg-llm-index.json
