metadata provides detailed data about this log
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
owner defines the RACI roles responsible for managing the audit
responsible identifies the entities responsible for executing work to manage or mitigate the artifact
accountable identifies the entity ultimately accountable for the outcome
consulted identifies entities whose input is required when assessing or responding to the artifact
informed identifies entities that should be notified about changes to the artifact status
criteria defines the acceptable state for the audited resource
reference-id identifies an element from a MappingReference in the artifact's metadata
results records audit results against the criteria
description explains the result in detail
criteria-reference maps this result to specific criteria entries
reference-id identifies an element from a MappingReference in the artifact's metadata
evidence records the data sources that support this result
collected-at is the timestamp when the evidence was gathered
source identifies the artifact or system from which this evidence was collected
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
description explains what this evidence represents
target identifies the resource being evaluated
environment describes where the resource exists (e.g., production, staging, development, specific region)
owner is the contact information for the person or group responsible for managing or owning this resource
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
CapabilityCatalog describes a collection of system capabilities
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
capabilities is a list of capabilities defined by this catalog
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
Capability describes a system capability such as a feature, component or object.
description provides a detailed overview of this capability
Catalog describes a set of topically-associated entries
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
ControlCatalog describes a set of related controls and relevant metadata
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
controls is a list of unique controls defined by this catalog
assessment-requirements is a list of requirements that must be verified to confirm the control objective has been met
applicability is a list of strings describing the situations where this text functions as a requirement for its parent control
recommendation provides readers with non-binding suggestions to aid in evaluation or enforcement of the requirement
replaced-by references the assessment requirement that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
guidelines documents relationships between this control and Layer 1 guideline artifacts
reference-id identifies an element from a MappingReference in the artifact's metadata
threats documents relationships between this control and Layer 2 threat artifacts
reference-id identifies an element from a MappingReference in the artifact's metadata
replaced-by references the control that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
Control describes a safeguard or countermeasure with a clear objective and assessment requirements
assessment-requirements is a list of requirements that must be verified to confirm the control objective has been met
applicability is a list of strings describing the situations where this text functions as a requirement for its parent control
recommendation provides readers with non-binding suggestions to aid in evaluation or enforcement of the requirement
replaced-by references the assessment requirement that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
guidelines documents relationships between this control and Layer 1 guideline artifacts
reference-id identifies an element from a MappingReference in the artifact's metadata
threats documents relationships between this control and Layer 2 threat artifacts
reference-id identifies an element from a MappingReference in the artifact's metadata
replaced-by references the control that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
AssessmentRequirement describes a tightly scoped, verifiable condition that must be satisfied and confirmed by an evaluator
applicability is a list of strings describing the situations where this text functions as a requirement for its parent control
recommendation provides readers with non-binding suggestions to aid in evaluation or enforcement of the requirement
replaced-by references the assessment requirement that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
EnforcementLog records actions taken in response to noncompliance findings from Layer 5 evaluations.
metadata provides detailed data about this log
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
disposition is the aggregate enforcement disposition across all actions in this log
[#ActionResult, ...#ActionResult] & [...{
if disposition == "Clear" {
justification: assessments: [...{result: "Passed"}]
}
}]actions is the list of enforcement actions performed
Enforce that Clear dispositions only contain Passed assessment results
#ActionResult &
{
{
if disposition == "Clear" {
justification: assessments: [...{result: "Passed"}]
}
}}disposition is the enforcement action taken
method references the specific AcceptedMethod entry within the Policy being enforced
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
justification links the action to its assessment findings and any applicable exceptions
assessments links the action to one or more Assessment Findings
requirement maps to the Layer 2 assessment requirement that was evaluated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
plan maps to the Policy assessment plan that was executed
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
log maps to the EvaluationLog entry containing the finding
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
exceptions references approved Policy exceptions that authorize the action
reference-id identifies an element from a MappingReference in the artifact's metadata
target identifies the resource being evaluated
environment describes where the resource exists (e.g., production, staging, development, specific region)
owner is the contact information for the person or group responsible for managing or owning this resource
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
ActionResult captures a performed enforcement action.
disposition is the enforcement action taken
method references the specific AcceptedMethod entry within the Policy being enforced
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
justification links the action to its assessment findings and any applicable exceptions
assessments links the action to one or more Assessment Findings
requirement maps to the Layer 2 assessment requirement that was evaluated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
plan maps to the Policy assessment plan that was executed
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
log maps to the EvaluationLog entry containing the finding
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
exceptions references approved Policy exceptions that authorize the action
reference-id identifies an element from a MappingReference in the artifact's metadata
EnforcementStep is a reference to the code that performed an enforcement action
Entity represents a human or tool
description provides additional context about the entity
Actor represents an entity (human or tool) that performs actions in evaluations
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
EvaluationLog contains the results of evaluating a set of Layer 2 controls.
metadata provides detailed data about this log
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
[#AssessmentLog, ...#AssessmentLog] & [...{requirement: "reference-id": control."reference-id"}] & [
#_AssessmentLogStrict,
...#_AssessmentLogStrict,
]Enforce that control reference and the assessments' references match This formulation uses the control's reference if the assessment doesn't include a reference
Require start timestamp on assessments that actually executed
Requirement should map to the assessment requirement for this assessment.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Plan maps to the policy assessment plan being executed.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Description provides a summary of the assessment procedure.
Result is the overall outcome of the assessment procedure, matching the result of the last step that was run.
Applicability is elevated from the Layer 2 Assessment Requirement to aid in execution and reporting.
Steps-executed is the number of steps that were executed as part of the assessment.
Recommendation provides guidance on how to address a failed assessment.
ConfidenceLevel indicates the evaluator's confidence level in this specific assessment result.
Evidence records the raw data cited to support this assessment's opinion.
collected-at is the timestamp when the evidence was gathered
description explains what this evidence represents
target identifies the resource being evaluated
environment describes where the resource exists (e.g., production, staging, development, specific region)
owner is the contact information for the person or group responsible for managing or owning this resource
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
ControlEvaluation contains the results of evaluating a single Layer 5 control.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
[#AssessmentLog, ...#AssessmentLog] & [...{requirement: "reference-id": control."reference-id"}] & [
#_AssessmentLogStrict,
...#_AssessmentLogStrict,
]Enforce that control reference and the assessments' references match This formulation uses the control's reference if the assessment doesn't include a reference
Require start timestamp on assessments that actually executed
Requirement should map to the assessment requirement for this assessment.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Plan maps to the policy assessment plan being executed.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Description provides a summary of the assessment procedure.
Result is the overall outcome of the assessment procedure, matching the result of the last step that was run.
Applicability is elevated from the Layer 2 Assessment Requirement to aid in execution and reporting.
Steps-executed is the number of steps that were executed as part of the assessment.
Recommendation provides guidance on how to address a failed assessment.
ConfidenceLevel indicates the evaluator's confidence level in this specific assessment result.
Evidence records the raw data cited to support this assessment's opinion.
collected-at is the timestamp when the evidence was gathered
source identifies the artifact or system from which this evidence was collected
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
description explains what this evidence represents
Group represents a classification or grouping that can be used in different contexts with semantic meaning derived from its usage
description explains the significance and traits of entries to this group
GuidanceCatalog represents a concerted documentation effort to help bring about an optimal future without foreknowledge of the implementation details
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
front-matter provides introductory text for the document to be used during rendering
guidelines is a list of unique guidelines defined by this catalog
recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the guideline
extends is an id for a guideline which this guideline adds to, in this document or elsewhere
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
applicability specifies the contexts in which this guideline applies
rationale provides the context for this guideline
importance is an explanation of why this guideline matters
statements is a list of structural sub-requirements within a guideline
recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the statement
principles documents the relationship between this guideline and one or more principles
reference-id identifies an element from a MappingReference in the artifact's metadata
vector-mappings documents the relationship between this guideline and one or more vectors
reference-id identifies an element from a MappingReference in the artifact's metadata
see-also lists related guideline IDs within the same GuidanceCatalog
replaced-by references the guideline that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
exemptions provides information about situations where this guidance is not applicable
description identifies who or what is exempt from the full guidance
redirect points to alternative guidelines or controls that should be followed instead
reference-id identifies an element from a MappingReference in the artifact's metadata
GuidanceType restricts the possible types that a catalog may be listed as
Exemption describes a single scenario where the catalog is not applicable
description identifies who or what is exempt from the full guidance
redirect points to alternative guidelines or controls that should be followed instead
reference-id identifies an element from a MappingReference in the artifact's metadata
Guideline provides explanatory context and recommendations for designing optimal outcomes
recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the guideline
extends is an id for a guideline which this guideline adds to, in this document or elsewhere
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
applicability specifies the contexts in which this guideline applies
rationale provides the context for this guideline
importance is an explanation of why this guideline matters
statements is a list of structural sub-requirements within a guideline
recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the statement
principles documents the relationship between this guideline and one or more principles
reference-id identifies an element from a MappingReference in the artifact's metadata
vector-mappings documents the relationship between this guideline and one or more vectors
reference-id identifies an element from a MappingReference in the artifact's metadata
see-also lists related guideline IDs within the same GuidanceCatalog
replaced-by references the guideline that supersedes this one when deprecated or retired
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Justification provides the assessment data and exception references that justify an enforcement action.
assessments links the action to one or more Assessment Findings
requirement maps to the Layer 2 assessment requirement that was evaluated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
plan maps to the Policy assessment plan that was executed
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
log maps to the EvaluationLog entry containing the finding
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
exceptions references approved Policy exceptions that authorize the action
reference-id identifies an element from a MappingReference in the artifact's metadata
AssessmentFinding maps an enforcement action to its originating assessment data across Layer 2, Layer 3, and Layer 5.
requirement maps to the Layer 2 assessment requirement that was evaluated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
plan maps to the Policy assessment plan that was executed
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
log maps to the EvaluationLog entry containing the finding
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Disposition enumerates the possible enforcement outcomes.
Lexicon is a controlled vocabulary or glossary artifact referenced by Metadata.lexicon
metadata provides detailed data about this document
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
terms is one or more defined entries for linking and rendering
definition explains the meaning of the term
LexiconTerm is a single definition within a lexicon
definition explains the meaning of the term
Log describes a set of recorded entries from a measurement activity
metadata provides detailed data about this log
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
target identifies the resource being evaluated
environment describes where the resource exists (e.g., production, staging, development, specific region)
owner is the contact information for the person or group responsible for managing or owning this resource
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
Lifecycle represents the lifecycle state of a guideline, control, or assessment requirement
ConfidenceLevel indicates the evaluator's confidence level in an assessment result.
MappingDocument captures the user's intent for how entries in a source artifact relate to entries in a target artifact
metadata provides detailed data about this document
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
source-reference identifies the artifact being mapped from; must match a mapping-reference id
entry-type identifies the type of atomic unit entries in this direction
reference-id identifies an element from a MappingReference in the artifact's metadata
target-reference identifies the artifact being mapped to; must match a mapping-reference id
entry-type identifies the type of atomic unit entries in this direction
reference-id identifies an element from a MappingReference in the artifact's metadata
mappings is one or more atomic relationships between entries in the referenced artifacts
targets identifies the entries being mapped to; absent when relationship is no-match
entry-id identifies the specific entry in the target artifact
applicability constrains the contexts in which this target mapping holds
rationale explains why this relationship exists for this target
relationship describes the nature of the mapping between source and all targets
MappingReference represents a reference to an external document with full metadata.
description is prose regarding the artifact's purpose or content
ArtifactMapping represents a mapping to an external artifact or artifact entry
reference-id identifies an element from a MappingReference in the artifact's metadata
Metadata represents common metadata fields shared across all layers
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
"CapabilityCatalog" | "ControlCatalog" | "GuidanceCatalog" | "ThreatCatalog" | "RiskCatalog" | "Policy" | "MappingDocument" | "Lexicon" | "EvaluationLog" | "EnforcementLog" | "VectorCatalog" | "PrincipleCatalog" | "AuditLog"
ArtifactType identifies the kind of Gemara artifact for unambiguous parsing
MultiEntryMapping represents a mapping to an external reference with one or more entries.
reference-id identifies an element from a MappingReference in the artifact's metadata
EntryMapping represents how a specific entry maps to a MappingReference.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
EvidenceMapping identifies the source from which evidence was collected. reference-id names the MappingReference; coordinate or entry-id gives specificity within it; digest pins the observed content at collection time.
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
Policy represents a policy document with metadata, contacts, scope, imports, implementation plan, risks, and adherence requirements.
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
responsible identifies the entities responsible for executing work to manage or mitigate the artifact
accountable identifies the entity ultimately accountable for the outcome
consulted identifies entities whose input is required when assessing or responding to the artifact
informed identifies entities that should be notified about changes to the artifact status
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
The updated applicability of the assessment requirement
The updated recommendation for the assessment requirement
Constraints allow policy authors to define ad hoc minimum requirements (e.g., "review at least annually").
Mitigated risks only need reference-id and risk-id (no justification required)
risk references the risk being mitigated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Accepted risks require rationale (justification) and may include scope. Controls addressing these risks are implicitly identified through threat mappings.
target-id optionally links this acceptance to a mitigated risk entry
risk references the risk being accepted
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
scope defines where the risk acceptance applies
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
justification explains why the risk is accepted
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
description provides additional context about the entity
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
PrincipleCatalog describes a set of related principles and relevant metadata
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
principles is a list of unique principles defined by this catalog
description explains the principle and its expected outcomes
rationale provides the context for this principle
Principle represents a foundational value or tenet that guides governance, design, and operational decisions
description explains the principle and its expected outcomes
rationale provides the context for this principle
Resource represents an entity that exists in the system and can be evaluated
environment describes where the resource exists (e.g., production, staging, development, specific region)
owner is the contact information for the person or group responsible for managing or owning this resource
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
EntityType specifies what entity is interacting in the workflow
Contact is the contact information for a person or group
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
RACI defines the roles responsible for managing an artifact
responsible identifies the entities responsible for executing work to manage or mitigate the artifact
accountable identifies the entity ultimately accountable for the outcome
consulted identifies entities whose input is required when assessing or responding to the artifact
informed identifies entities that should be notified about changes to the artifact status
ResultType classifies the nature of an audit result
AuditResult records a single result with supporting evidence and recommendations.
description explains the result in detail
criteria-reference maps this result to specific criteria entries
reference-id identifies an element from a MappingReference in the artifact's metadata
evidence records the data sources that support this result
collected-at is the timestamp when the evidence was gathered
source identifies the artifact or system from which this evidence was collected
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
description explains what this evidence represents
Evidence records what was cited to support an opinion for a specific activity: raw data for the evaluation layer, evaluation and enforcement artifacts for the audit layer. At least one of payload or source MUST be present; an entry with neither is semantically incomplete.
collected-at is the timestamp when the evidence was gathered
source identifies the artifact or system from which this evidence was collected
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
description explains what this evidence represents
EvidenceType categorizes the kind of evidence. It remains an open enum: recommended values include artifact types already known to Gemara (e.g. EvaluationLog, EnforcementLog) plus categories for common evidence forms.
A RiskCatalog is a structured collection of documented risks that may affect an organization, system, or service. It provides a centralized reference for risks that can be mapped to threats and referenced by policies when documenting how those risks are mitigated or accepted.
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
groups narrows the base groups to risk categories with appetite and severity boundaries
groups contains a list of groups that can be referenced by entries in this catalog
description explains the significance and traits of entries to this group
max-severity defines the risk tolerance boundary: the highest severity the organization will accept within this category
reference-id identifies an element from a MappingReference in the artifact's metadata
risks is a list of risks defined by this catalog
description explains the risk scenario
owner defines the RACI roles responsible for managing this risk
responsible identifies the entities responsible for executing work to manage or mitigate the artifact
accountable identifies the entity ultimately accountable for the outcome
consulted identifies entities whose input is required when assessing or responding to the artifact
informed identifies entities that should be notified about changes to the artifact status
threats link this risk to Layer 2 threats
reference-id identifies an element from a MappingReference in the artifact's metadata
RiskCategory describes a grouping of risks and defines appetite boundaries
max-severity defines the risk tolerance boundary: the highest severity the organization will accept within this category
description explains the significance and traits of entries to this group
Scope defines what is included and excluded from policy applicability.
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
Dimensions specify the applicability criteria for a policy
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
Imports defines external policies, controls, and guidelines required by this policy.
The updated applicability of the assessment requirement
The updated recommendation for the assessment requirement
Constraints allow policy authors to define ad hoc minimum requirements (e.g., "review at least annually").
Risks defines mitigated and accepted risks addressed by this policy.
Mitigated risks only need reference-id and risk-id (no justification required)
risk references the risk being mitigated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Accepted risks require rationale (justification) and may include scope. Controls addressing these risks are implicitly identified through threat mappings.
target-id optionally links this acceptance to a mitigated risk entry
risk references the risk being accepted
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
scope defines where the risk acceptance applies
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
justification explains why the risk is accepted
MitigatedRisk represents a risk addressed by the policy
risk references the risk being mitigated
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
AcceptedRisk documents a risk the organization has chosen to accept, optionally linking it to a mitigated risk when the acceptance covers residual risk after partial mitigation.
target-id optionally links this acceptance to a mitigated risk entry
risk references the risk being accepted
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
scope defines where the risk acceptance applies
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
technologies is an optional list of technology categories or services
geopolitical is an optional list of geopolitical regions
sensitivity is an optional list of data classification levels
justification explains why the risk is accepted
Adherence defines evaluation methods, assessment plans, enforcement methods, and non-compliance notifications.
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
AssessmentPlan defines how a specific assessment requirement is evaluated.
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
AcceptedMethod defines a method for evaluation or enforcement.
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
Parameter defines a configurable parameter for assessment or enforcement activities.
GuidanceImport defines how to import guidance documents with optional exclusions and constraints.
Constraints allow policy authors to define ad hoc minimum requirements (e.g., "review at least annually").
CatalogImport defines how to import control catalogs with optional exclusions, constraints, and assessment requirement modifications.
The updated applicability of the assessment requirement
The updated recommendation for the assessment requirement
Constraint defines a prescriptive requirement that applies to a specific guidance or control.
Links to the specific Guidance or Control being constrained
AssessmentRequirementModifier allows organizations to customize assessment requirements based on how an organization wants to gather evidence for the objective.
The updated applicability of the assessment requirement
The updated recommendation for the assessment requirement
RiskAppetite defines the acceptable level of exposure for a risk category
A Risk represents the potential for negative impact resulting from one or more threats.
description explains the risk scenario
owner defines the RACI roles responsible for managing this risk
responsible identifies the entities responsible for executing work to manage or mitigate the artifact
accountable identifies the entity ultimately accountable for the outcome
consulted identifies entities whose input is required when assessing or responding to the artifact
informed identifies entities that should be notified about changes to the artifact status
threats link this risk to Layer 2 threats
reference-id identifies an element from a MappingReference in the artifact's metadata
Statement represents a structural sub-requirement within a guideline; They do not increase strictness and all statements within a guideline apply together
recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the statement
Rationale provides a structured way to communicate a guideline author's intent
importance is an explanation of why this guideline matters
ThreatCatalog describes a set of topically-associated threats
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
threats is a list of threats defined by this catalog
description provides a detailed explanation of an opportunity for negative impact
capabilities documents the relationship between this threat and a system capability
reference-id identifies an element from a MappingReference in the artifact's metadata
vectors documents the relationship between this threat and one or more vectors
reference-id identifies an element from a MappingReference in the artifact's metadata
actors describes the relevant internal or external threat actors
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
Threat describes a specifically-scoped opportunity for a negative impact to the organization
description provides a detailed explanation of an opportunity for negative impact
capabilities documents the relationship between this threat and a system capability
reference-id identifies an element from a MappingReference in the artifact's metadata
vectors documents the relationship between this threat and one or more vectors
reference-id identifies an element from a MappingReference in the artifact's metadata
actors describes the relevant internal or external threat actors
contact is contact information for the actor
affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
description provides additional context about the entity
TypedMapping extends ArtifactMapping with a required entry-type for all entries in this direction
entry-type identifies the type of atomic unit entries in this direction
reference-id identifies an element from a MappingReference in the artifact's metadata
metadata provides detailed data about this catalog
gemara-version declares which version of the Gemara specification this artifact conforms to
description provides a high-level summary of the artifact's purpose and scope
mapping-references is a list of external documents referenced within this artifact
description is prose regarding the artifact's purpose or content
applicability-groups is a list of groups used to classify within this artifact to specify scope
lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
reference-id identifies an element from a MappingReference in the artifact's metadata
groups contains a list of groups that can be referenced by entries in this catalog
reference-id identifies an element from a MappingReference in the artifact's metadata
vectors is a list of attack vectors documented in this catalog
description explains how the attack vector works
applicability specifies the contexts in which this vector can manifest
A Vector represents a method, pathway, or technique through which a threat may be realized or an attack may be carried out.
description explains how the attack vector works
applicability specifies the contexts in which this vector can manifest
#AssessmentLog &
{
@go(-)
{
result: #Result
if result != "Not Run" && result != "Unknown" && result != "Not Applicable" {
start: #Datetime
}
}
}_AssessmentLogStrict layers the "start required unless unexecuted" rule on top of #AssessmentLog
Requirement should map to the assessment requirement for this assessment.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Plan maps to the policy assessment plan being executed.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Description provides a summary of the assessment procedure.
Result is the overall outcome of the assessment procedure, matching the result of the last step that was run.
Applicability is elevated from the Layer 2 Assessment Requirement to aid in execution and reporting.
Steps-executed is the number of steps that were executed as part of the assessment.
Recommendation provides guidance on how to address a failed assessment.
ConfidenceLevel indicates the evaluator's confidence level in this specific assessment result.
Evidence records the raw data cited to support this assessment's opinion.
collected-at is the timestamp when the evidence was gathered
source identifies the artifact or system from which this evidence was collected
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
description explains what this evidence represents
AssessmentLog contains the results of executing a single assessment procedure for a control requirement.
Requirement should map to the assessment requirement for this assessment.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Plan maps to the policy assessment plan being executed.
reference-id is the id for a MappingReference entry in the artifact's metadata
entry-id is the identifier being mapped to in the referenced artifact
Description provides a summary of the assessment procedure.
Applicability is elevated from the Layer 2 Assessment Requirement to aid in execution and reporting.
Steps-executed is the number of steps that were executed as part of the assessment.
Recommendation provides guidance on how to address a failed assessment.
ConfidenceLevel indicates the evaluator's confidence level in this specific assessment result.
Evidence records the raw data cited to support this assessment's opinion.
collected-at is the timestamp when the evidence was gathered
source identifies the artifact or system from which this evidence was collected
reference-id ties this evidence to a mapping-reference in the artifact's metadata
coordinate is the precise location within the stream identified by reference-id (e.g. an API path, file path, or JSON path expression). Do not set if entry-id is set.
entry-id identifies a specific entry within a referenced Gemara artifact. Do not set if coordinate is set.
description explains what this evidence represents
#Mapping &
{
@go(-)
{
relationship: #RelationshipType
if relationship != "no-match" {
targets: [#MappingTarget, ...#MappingTarget]
}
}
}_MappingStrict layers the "targets required when not no-match" rule on top of #Mapping
targets identifies the entries being mapped to; absent when relationship is no-match
entry-id identifies the specific entry in the target artifact
applicability constrains the contexts in which this target mapping holds
rationale explains why this relationship exists for this target
relationship describes the nature of the mapping between source and all targets
MappingTarget identifies a target entry with optional per-target metadata
entry-id identifies the specific entry in the target artifact
applicability constrains the contexts in which this target mapping holds
rationale explains why this relationship exists for this target
Mapping represents a relationship between a source entry and one or more target entries
targets identifies the entries being mapped to; absent when relationship is no-match
entry-id identifies the specific entry in the target artifact
applicability constrains the contexts in which this target mapping holds
rationale explains why this relationship exists for this target
relationship describes the nature of the mapping between source and all targets
RelationshipType enumerates the nature of the mapping between entries.
"Guideline" | "Statement" | "Control" | "AssessmentRequirement" | "Capability" | "Threat" | "Risk" | "Vector" | "Principle"
EntryType enumerates the atomic units within Gemara artifacts that can participate in mappings
AuditLog records results from an audit performed against a target resource