Assurance schedules and event-trigger register
| Organisation / system scope | [Organisation] / [System or programme] |
|---|---|
| Document ID / version / status | SE / [Version] / [Draft or approved] |
| Owner / approving authority | [Named owner] / [Named approving authority] |
| Effective date / next review | [Date] / [Date or linked schedule ID] |
| Adoption decision record | [AD-01 record location and version] |
SE-01 — Schedule and trigger policy
The programme owner maintains the schedule and event-trigger register for adopted SSDLC activities and their assurance. Each entry identifies the promise, scope, event or recurrence, performer, decision authority, expected output and assessment arrangement. The register can be maintained in a document table, calendar, work queue or other repository provided these relationships remain available.
Operational work and assurance are distinct activities. A scheduled access review performs a control; an assessment of access-review records evaluates whether the promised review occurred and was effective within its scope. The same register may contain both, but each row identifies which activity it represents and who is responsible.
SE-02 — Schedule record
Schedule/trigger ID: [SE record ID] Adopted promise and scope: [Clause; version; systems or population] Activity type: [Operational work / assurance / decision review] Initiation: [Calendar recurrence / event / both] Calendar rule: [Interval; anchor date; time zone; next due] Event rule: [Observable condition; source; event detector] Response expectation: [Time from event; due-date calculation] Performer and deputy: [Names; contact route] Required inputs and output: [Records; evidence location] Decision/escalation: [Authority; overdue or failure condition] Assurance link: [AS record; assessor; method] Last occurrence and next action: [Date; result; evidence; next due]
SE-03 — Event catalogue
The owner activates the following entries for adopted promises and fills in the responsible names and response expectations. The event source may be a person, issue queue, supplier notice, system observation or another recorded channel. A row is operational only when someone is responsible for recognising the event and initiating the work.
| Event | Work to initiate | Output and responsible role |
|---|---|---|
| New system or changed purpose | Confirm scope, stakeholders, life-cycle plan and protection needs. | CH, ST, PL and RE records — system owner. |
| New or changed obligation | Assess affected policies, requirements, agreements and controls. | Obligation record, AD and CO decisions — programme owner. |
| Stakeholder concern or complaint | Record the need or issue, assess consequences and arrange a decision. | ST, RE or RI record — stakeholder contact owner. |
| Appointment, departure or role change | Transfer responsibilities, review authority and change access. | RO assignment and access evidence — role owner. |
| New supplier or dependency | Assess criticality, requirements, evidence and agreement. | SC and AC decision — supplier owner. |
| Supplier security or service change | Identify affected systems and reconsider reliance. | SC review and RI decision — supplier owner. |
| Material architecture or interface change | Review requirements, threats, privacy, resilience and assurance. | AR, TH, PR and CM records — engineering lead. |
| New information-processing purpose | Assess authority, data flows, privacy effects and notices. | PR assessment and DA inventory — privacy owner. |
| New AI tool or increased permissions | Review information use, authority boundary and verification. | AT registration and AG decision — tool owner. |
| Changed model, prompt, retrieval or dataset | Assess impact and repeat relevant evaluation. | AM lineage, AE results and CM decision — AI owner. |
| Release candidate ready | Assemble evidence and obtain the scoped release decision. | RL package and decision — release owner. |
| Deployment completed | Verify actual baseline and complete operational handover. | RL checks and OP acceptance — operations owner. |
| Vulnerability report or advisory | Assess applicability, exposure, treatment and communication. | VU record — vulnerability owner. |
| Suspected incident | Assess, coordinate response and determine obligations. | IR record — incident coordinator. |
| Essential-function disruption | Consider resilience activation and recovery decisions. | RS and IR evidence — operations owner. |
| Assurance deficiency | Assess consequence, assign correction and plan verification. | AS finding and IM action — commitment owner. |
| Deferral date or condition reached | Confirm implementation or obtain a new decision. | AD review — commitment owner. |
| Support withdrawal or retirement decision | Plan transition, continuing obligations and disposition. | RT plan — system owner. |
SE-04 — Recurring work catalogue
The owner sets the interval from the adopted commitment, risk and applicable obligations. Intervals are organisational parameters, not universal NIST frequencies. The same due date can coordinate related reviews where their scopes and outputs remain identifiable.
| Activity and promise | Evidence | Interval / owner / next due |
|---|---|---|
| Policy and adoption review — AD-07 | Current versions, decisions and implementation gaps. | [Complete] |
| Stakeholder and role review — ST-07, RO-07 | Confirmed contacts, needs, assignments and competence actions. | [Complete] |
| Risk and control monitoring — RI-06, CO-07 | Current risk decisions and control observations. | [Complete] |
| Supplier and support review — SC-06 | Assessment currency, changes and exit readiness. | [Complete] |
| Access and configuration review — EN-07, OP-04 | Actual permissions, baselines and deviations. | [Complete] |
| Recovery exercise — RS-05 | Observed restoration and essential-function results. | [Complete] |
| Vulnerability backlog review — VU-07 | Exposure, deadlines, treatments and deployment evidence. | [Complete] |
| Privacy and retention review — PR-07, DA-05 | Processing inventory, purposes, holds and disposal. | [Complete] |
| AI performance and risk review — AE-06 | Observed outcomes, drift, incidents and reassessments. | [Complete] |
| Assurance and corrective action — AS-07, IM-04 | Coverage, findings, verified closure and effectiveness. | [Complete] |
| Management review — IM-05 | Decisions, resources, changed commitments and follow-up. | [Complete] |
SE-05 — Occurrence and overdue handling
When an event occurs, the detector records its identity, time, source and affected scope and creates the required work item. The performer records completion and evidence against that occurrence. Repeated notices about the same event may be linked, but distinct affected systems or obligations remain identifiable. A recurring calendar entry is advanced only with the actual result recorded.
Overdue work is reported through the named escalation route. The authority records the consequence and decision on resources, timing or continued exposure. Rescheduling preserves the missed date and rationale. A detector or monitoring source becoming unavailable creates a coverage gap that is assessed and assigned, rather than silently disabling the trigger.
SE-06 — Schedule assurance
The assessor checks selected source events and confirms that the expected activity followed. The assessor also checks completed work against its triggering record and required evidence. Review identifies missed events, ambiguous criteria, unassigned rows, repeatedly overdue work and activities that no longer serve an adopted promise. The owner updates the register through controlled decisions.