<!-- تعليمات للنموذج الذكي: قم بتعبئة العناصر النائبة [ أضف التفاصيل... ] بناءً على سياق المشروع. -->

<h3 align="left">{{اسم_الشركة}}</h3>
<h2 align="left">{{اسم_المشروع}} - {{معرف_المشروع}}</h2>
<h1 align="center">خطة أمن المعلومات والامتثال التنظيمي</h1>

| **تاريخ الإعداد:** {{التاريخ_الحالي}} | **مدير المشروع:** {{اسم_مدير_المشروع}} | **تم الإعداد بواسطة:** {{تم_الإعداد_بواسطة}} |
| ---: | ---: | ---: |

---

## 1. حوكمة الامتثال وتصنيف البيانات

**الإطار التنظيمي والمعايير الإلزامية:**
[ أضف التفاصيل... ]

**تصنيف البيانات ومستويات الخصوصية:**
[ أضف التفاصيل... ]

---

## 2. الهندسة الأمنية وإدارة الحوادث

**الضوابط الأمنية الفنية والإدارية:**
[ أضف التفاصيل... ]

**تقييم الأمان وجدولة اختبارات الاختراق:**
[ أضف التفاصيل... ]

---

## 3. حوكمة التدقيق وأدوار الاعتماد

**بروتوكول الاستجابة للحوادث والإبلاغ عن الانتهاكات:**
[ أضف التفاصيل... ]

**بوابات تدقيق الامتثال ومعايير الاعتماد الرسمي:**
[ أضف التفاصيل... ]

---

### التحكم في الوثيقة والاعتمادات الرسمية

| الدور التنظيمي | الاسم | التوقيع | التاريخ |
| :--- | :--- | :---: | :---: |
| **مدير المشروع** | {{اسم_مدير_المشروع}} | _______________________ | [ .... - .... - .... ] |
| **المراجع الفني / مهندس الجودة** | {{اسم_المراجع_الفني}} | _______________________ | [ .... - .... - .... ] |
| **راعي المشروع / المعتمد** | {{اسم_راعي_المشروع}} | _______________________ | [ .... - .... - .... ] |

---

<div align="left" style="margin-top: 20px; font-size: 12px; color: #7f8c8d;">
  <span>سجل التدقيق الإلكتروني: Hash SHA256: {{رمز_تجزئة_التدقيق_SHA256}}</span> <br>
  <strong>النموذج:</strong> خطة أمن المعلومات والامتثال التنظيمي | <strong>المرجع:</strong> PMO-04.13.01 <br>
  <i>تم التوليد في: {{الوقت_الحالي}}، بواسطة <a href="https://github.com/fakhruldeen/Tasleemat/" style="color: #7f8c8d;">تسليمات</a></i>
</div>

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://tasleemat.pmo/schemas/completed/PMO-04.13.01.schema.json",
  "title": "Completed INFORMATION SECURITY AND COMPLIANCE PLAN Data Contract",
  "description": "Additive structural schema validating completed INFORMATION SECURITY AND COMPLIANCE PLAN artifact data payloads (PMO-04.13.01).",
  "type": "object",
  "properties": {
    "artifact_id": {
      "type": "string",
      "const": "PMO-04.13.01"
    },
    "metadata": {
      "type": "object",
      "properties": {
        "project_name": {
          "type": "string",
          "minLength": 1
        },
        "project_code": {
          "type": "string"
        },
        "date_prepared": {
          "type": "string",
          "format": "date"
        },
        "project_manager": {
          "type": "string",
          "minLength": 1
        },
        "prepared_by": {
          "type": "string",
          "minLength": 1
        },
        "version": {
          "type": "string"
        },
        "status": {
          "type": "string",
          "enum": [
            "draft",
            "baselined",
            "in_review",
            "approved"
          ]
        }
      },
      "required": [
        "project_name",
        "date_prepared",
        "project_manager",
        "prepared_by"
      ]
    },
    "compliance_governance_data_classification": {
      "type": "object",
      "properties": {
        "regulatory_framework_and_applicable_standards": {
          "type": "string",
          "minLength": 1,
          "description": "Mandatory national regulations (NCA ECC, NDMO, GDPR, ISO 27001) governing project delivery."
        },
        "data_classification_and_privacy_tiering": {
          "type": "string",
          "minLength": 1,
          "description": "Information classification scheme (Public, Internal, Confidential, Highly Confidential) and PII protections."
        }
      },
      "required": [
        "regulatory_framework_and_applicable_standards",
        "data_classification_and_privacy_tiering"
      ]
    },
    "security_architecture_incident_management": {
      "type": "object",
      "properties": {
        "technical_and_administrative_security_controls": {
          "type": "string",
          "minLength": 1,
          "description": "Encryption at rest/in transit, identity and access management (IAM), multi-factor authentication, and audit trails."
        },
        "security_assessment_and_penetration_testing_cadence": {
          "type": "string",
          "minLength": 1,
          "description": "Vulnerability scanning, automated code analysis (SAST/DAST), and third-party penetration testing gateways."
        }
      },
      "required": [
        "technical_and_administrative_security_controls",
        "security_assessment_and_penetration_testing_cadence"
      ]
    },
    "audit_governance_sign_off_roles": {
      "type": "object",
      "properties": {
        "incident_response_protocol_and_breach_notification": {
          "type": "string",
          "minLength": 1,
          "description": "Escalation procedure, root cause containment, and mandatory regulatory reporting timeframes."
        },
        "compliance_audit_gateways_and_signoff_criteria": {
          "type": "string",
          "minLength": 1,
          "description": "Stage-gate evidence packages required by Chief Information Security Officer (CISO) and legal counsel."
        }
      },
      "required": [
        "incident_response_protocol_and_breach_notification",
        "compliance_audit_gateways_and_signoff_criteria"
      ]
    }
  },
  "required": [
    "artifact_id",
    "metadata",
    "compliance_governance_data_classification",
    "security_architecture_incident_management",
    "audit_governance_sign_off_roles"
  ]
}

{
  "form_name": "INFORMATION SECURITY AND COMPLIANCE PLAN",
  "document_reference": "PMO-04.13.01",
  "_llm_instructions": "Populate the fields of 'INFORMATION SECURITY AND COMPLIANCE PLAN' and write the value of each field under 'Generated Value', based on the project context. Context: the project carrying reference PMO-04.13.01.",
  "project_title": "",
  "date_prepared": "",
  "fields": {
    "f01_Regulatory_Framework_and_Applicable_Standards": {
      "section": "Compliance Governance & Data Classification",
      "label": "Regulatory Framework and Applicable Standards",
      "guidance": "Mandatory national regulations (NCA ECC, NDMO, GDPR, ISO 27001) governing project delivery.",
      "value": ""
    },
    "f02_Data_Classification_and_Privacy_Tiering": {
      "section": "Compliance Governance & Data Classification",
      "label": "Data Classification and Privacy Tiering",
      "guidance": "Information classification scheme (Public, Internal, Confidential, Highly Confidential) and PII protections.",
      "value": ""
    },
    "f03_Technical_and_Administrative_Security_Controls": {
      "section": "Security Architecture & Incident Management",
      "label": "Technical and Administrative Security Controls",
      "guidance": "Encryption at rest/in transit, identity and access management (IAM), multi-factor authentication, and audit trails.",
      "value": ""
    },
    "f04_Security_Assessment_and_Penetration_Testing_Cadence": {
      "section": "Security Architecture & Incident Management",
      "label": "Security Assessment and Penetration Testing Cadence",
      "guidance": "Vulnerability scanning, automated code analysis (SAST/DAST), and third-party penetration testing gateways.",
      "value": ""
    },
    "f05_Incident_Response_Protocol_and_Breach_Notification": {
      "section": "Audit Governance & Sign-off Roles",
      "label": "Incident Response Protocol and Breach Notification",
      "guidance": "Escalation procedure, root cause containment, and mandatory regulatory reporting timeframes.",
      "value": ""
    },
    "f06_Compliance_Audit_Gateways_and_Signoff_Criteria": {
      "section": "Audit Governance & Sign-off Roles",
      "label": "Compliance Audit Gateways and Signoff Criteria",
      "guidance": "Stage-gate evidence packages required by Chief Information Security Officer (CISO) and legal counsel.",
      "value": ""
    }
  }
}