CyberRiskGuardian Ontology
Release: 2026-10-08
- Modified on: 2026-10-13
- This version:
- https://w3id.org/crgo/0.10.0/crgo
- Previous version:
- https://w3id.org/crgo/0.9.0/crgo
- Revision:
- 0.10.0
- Issued on:
- 2026-10-13
- Authors:
- Marc-André Léger
- Contributors:
- Claude (Anthropic), AI drafting assistant; every element approved by the creator
- Publisher:
- ITriskMgr
- Source:
- https://github.com/ITriskMgr/CyberRiskGuardian
- Download serialization:
- License:
- Visualization:
- Cite as:
- Léger, Marc-André (2026). CyberRiskGuardian Ontology (CRGO), version 0.10.0. https://github.com/ITriskMgr/cyberriskguardian-ontology
- Vocabulary maintained at:
- https://github.com/ITriskMgr/cyberriskguardian-ontology
released
Abstract
The CyberRiskGuardian Ontology (CRGO) gives a formal, reasoner-checked meaning to cybersecurity risk assessment data: assets, threat sources and events, vulnerabilities, risk scenarios, controls, frameworks and legal obligations, the CyberRiskGuardian quantitative model and the key risk indicators computed from it. It is published with SKOS vocabularies for NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27002:2022, COBIT 2019, MITRE ATT&CK, Québec Law 25 and the Québec health-information act, and with a library of about 1,900 generic risk scenarios linked to them.Introduction back to ToC
The CyberRiskGuardian Ontology (CRGO) is a formal vocabulary for cybersecurity risk assessment. It was built to give a precise, machine-checkable meaning to the data produced by CyberRiskGuardian, an AI-assisted risk assessment method and toolkit, and to support the identification of threats, vulnerabilities and risk scenarios for an organisation.
Design. CRGO is an OWL 2 DL ontology aligned with Basic Formal Ontology (BFO-2020, ISO/IEC 21838-2) and an extract of the Common Core Ontologies. It is split into seventeen modules: crgo-gov (governance annotations), crgo-core (assets, threats, weaknesses, scenarios, controls, frameworks, assessment and treatment), crgo-measure (method-independent estimates), crgo-crg (the CyberRiskGuardian quantitative model); crgo-evidence, crgo-org, crgo-vuln, crgo-grc and crgo-mapping (sources and observations, organisation profile, vulnerability observations, legal applicability and compliance, typed and qualified correspondences); crgo-governance, crgo-assurance, crgo-audit and crgo-incident (governance, assurance, the audit lifecycle, incidents); and, from 0.10.0, crgo-policy, crgo-compliance, crgo-siem and crgo-soar (policy and compliance management, security monitoring and detection, orchestration and response). Every term has English and French labels and definitions, and carries its source, confidence, governance status, approver and the release that introduced it. A risk scenario is a description of what might happen, not an event; its parts (threat source, threat event, weakness, consequence) are descriptions too, so that generic library scenarios can be recorded without inventing an organisation.
Around the ontology. SKOS vocabularies cover NIST CSF 2.0, NIST SP 800-53 Rev. 5, ISO/IEC 27002:2022 (identifiers and titles), COBIT 2019, MITRE ATT&CK Enterprise, Québec Law 25, the Québec Act respecting health and social services information and the domains of the CSA Cloud Controls Matrix, the EU GDPR, NIST SP 800-53A, audit and assurance standards (identifiers and paraphrases), ATT&CK detection strategies and analytics, and OCSF event classes. A library of about 1,900 generic risk scenarios is linked to them, with a confidence and an approval status on every link, and with calibration estimates from a 2023 scenario generator and from teaching cases. crgo-full imports everything.
Use. Load crgo to model assessments, or crgo-full for the library and vocabularies. CyberRiskGuardian uses CRGO through a local MCP server and a JSON export (see the repository's docs/crg-integration.md). Library and case values are calibration priors, never organisational evidence.
CyberRiskGuardian Ontology: Overview back to ToC
This ontology has the following classes and properties.Classes
- action execution record
- action risk class
- Agent
- alert disposition
- Algorithm
- amendment
- analytical hypothesis
- analytical result
- applicability assessment
- applicability condition
- applicability state
- approval decision
- approval gate
- approval status
- assessment method
- assessment scenario
- assessor line
- asset
- asset category
- asset tier
- asset valuation
- assumption
- assurance opinion
- assurance report exception
- assurance report type
- attestation
- audit charter
- audit committee
- audit conclusion
- audit criterion
- audit engagement
- audit finding
- audit function
- audit methodology
- audit objective
- audit observation
- audit plan
- audit plan entry
- audit procedure
- audit quality review
- audit report
- audit universe
- audit work programme
- audit workpaper
- auditable entity
- automation execution record
- behavioural baseline
- breach reportability assessment
- budget calibration
- business objective
- business process
- calculation activity
- calculation method
- case status
- chief audit executive role
- communication audience
- compensating control
- complementary user entity control
- compliance assessment campaign
- compliance attestation
- compliance deadline
- compliance determination
- compliance objective
- compliance officer role
- compliance programme
- compliance state
- computed risk quantity
- condition kind
- confidence level
- configuration baseline
- configuration evidence
- conflict-of-interest declaration
- connected device
- consequence description
- control
- control aspect
- control assessment
- control deficiency
- control effectiveness
- control function
- control gap finding
- control measure
- control owner role
- control status
- control test result
- corrective action
- corrective action status
- correlation rule
- cost allocation
- cost-effectiveness
- coverage status
- CRG parameter
- CVSS input
- deadline trigger kind
- decision outcome
- decision record
- deficiency severity
- delegation of authority
- Descriptive Information Content Entity
- detection coverage
- detection gap
- detection rule
- detection status
- detection strategy
- detection test
- directive lifecycle state
- directive review
- directive version
- disposition
- distribution family
- documentary evidence
- engagement rating
- engagement state
- engagement type
- entity
- Entity
- EPSS observation
- escalation flag
- estimate
- estimate distribution
- estimated risk Re
- evidence basis
- evidence quality
- evidence register entry
- evidence request
- evidence requirement
- evidence sufficiency assessment
- exception expiry review
- execution status
- expected damage δe
- external assurance report
- external assurance role
- Facility
- facility asset
- finding closure
- finding reopening
- finding significance
- first-line role
- follow-up verification
- forensic artefact
- framework
- framework adoption
- framework requirement
- governance committee
- governance evidence
- governance role
- governance status
- governing body
- governing body member role
- Group of Agents
- guideline
- hardware asset
- hunting hypothesis
- impact dimension
- impact estimate
- impact reduction
- incident
- incident category
- incident communication
- incident confirmation
- incident impact
- incident response phase
- incident severity
- incident timeline entry
- independence assessment
- independence conclusion
- information asset
- Information Content Entity
- information marking
- initiative priority
- instrument kind
- instrument version
- interview evidence
- jurisdiction
- key risk indicator
- knowledge status
- legacy computed risk quantity
- legal instrument
- legal obligation
- legal review state
- lesson learned
- library scenario
- likelihood
- management response
- management response stance
- mapping assertion
- mapping type
- Material Artifact
- maximum damage δm
- Measurement Information Content Entity
- measurement scale
- mitigated risk (risk removed)
- monitoring exception
- network asset
- nonconformity
- normalisation profile
- normative modality
- Objective
- obligated party role
- observation
- observational evidence
- operating effectiveness assessment
- operational evidence
- organisation type
- organisational resilience θ
- Organization
- oversight activity
- parser definition
- Person
- personal data category
- Plan
- plan entry state
- Planned Act
- playbook simulation
- playbook step
- playbook trigger
- playbook version
- policy
- policy acknowledgement
- policy clause
- policy exception
- policy family
- policy statement
- policy version
- population
- pre-treatment ratio
- predisposing condition
- Prescriptive Information Content Entity
- probability of exploitation Pb(ψ,A)
- probability reduction
- procedure
- process
- processing activity
- processing role
- Proper interval
- provision version
- quality review kind
- realizable entity
- reassessment trigger
- recommendation
- recovery verification
- regulatory authority
- regulatory change
- regulatory change type
- regulatory exemption
- regulatory submission
- reportability state
- requirement interpretation
- requirement level
- residual risk
- response action
- response effectiveness measurement
- response evidence
- response metric
- response playbook
- review state
- review trigger
- risk acceptance
- risk appetite statement
- risk assessment
- risk committee
- risk level
- risk management function role
- risk owner role
- risk scenario
- risk stage
- risk treatment decision
- risk-to-tolerance ratio
- role
- role assignment
- root-cause category
- sample item
- sample result
- sampling method
- sampling plan
- scenario criticality μ(E)
- scenario step
- screening criterion
- screening score
- second-line role
- security alert
- security event
- security event record
- security investigation
- selection disposition
- sensitivity case
- sensitivity case type
- service asset
- software asset
- source access status
- source record
- submission state
- sufficiency conclusion
- supplier role
- technical standard
- telemetry health observation
- telemetry health state
- telemetry source
- test evidence
- third-line role
- threat event description
- threat indicator
- threat intelligence source
- threat presence Pb(A)
- threat source description
- threat source role
- threat source type
- tolerance classification
- tolerated risk Rt
- training requirement
- transactional evidence
- treatment initiative
- treatment option
- trigger kind
- verification result
- vulnerability
- Vulnerability
- vulnerability description
Object Properties
- accountable for
- action target
- adapts reference strategy
- addressed by
- addresses
- addresses scenario
- adopts framework
- affects asset
- affects asset category
- affects process
- alert about
- allocated to
- allocation of
- amends instrument
- amends provision
- analytic uses data component
- answers deadline
- applicability of
- applies to scope
- approving authority
- arises from exception
- assessed by
- assessed in
- assessed under
- assesses aspect
- assesses organisation
- assigned to
- assignment of role
- attack pattern exploits weakness
- attack pattern related to technique
- attestation about
- attested by
- auditable entity for
- authorised by
- authorised by risk acceptance
- based on assessment
- based on control assessment
- baseline of
- broader than
- budget of
- carried out by
- case of
- change of
- charter of
- clause of
- closes finding
- closure based on
- collected by
- commits to action
- committee of
- communication about
- comparable obligation
- compensated by
- complementary user entity control of
- compliance with
- computed from input
- concerns organisation
- concluded incident
- conclusion of
- condition met
- condition not met
- condition of
- condition undetermined
- confirmation based on
- confirms incident
- conflict concerns
- control corresponds to control
- corrects
- correlated with
- corresponds to defensive technique
- coverage by
- covers asset
- covers scenario
- covers technique
- criterion refers to
- custodian
- data subjects in
- deadline for
- deadline triggered by
- decided by
- decision made by
- decision on
- declared by
- deficiency aspect
- deficiency of
- delegates authority to
- delegation from
- delegation to
- depends on assumption
- derived from requirement
- determination in
- emitted by
- enforced by
- engagement on
- entry for auditable entity
- entry for engagement
- entry in plan
- entry informed by
- established in
- estimate of
- evaluates control
- evaluates control measure
- evaluates provision version
- evidence for population
- evidence requirement for
- exception in report
- exception raised on
- exception scope
- exception to
- executes procedure
- execution for
- execution triggered by
- exemption from
- exploits
- finding about scenario
- finding on control
- follows methodology
- follows programme
- for criterion
- fulfilled by
- fulfils criterion
- gap for technique
- gap in telemetry
- gate authority
- gate for risk class
- generated by
- generated by rule
- granted by
- hadPrimarySource
- has access status
- has action risk class
- has action status
- has alert disposition
- has applicability state
- has approval status
- has asset tier
- has assurance opinion
- has assurance report type
- has audience
- has audit objective
- has availability requirement
- has case status
- has case type
- has change type
- has compliance state
- has condition kind
- has confidence
- has confidentiality requirement
- has consequence
- has control function
- has control gap
- has control status
- has coverage status
- has deadline trigger kind
- has decision outcome
- has deficiency severity
- has detection status
- has distribution
- has distribution family
- has engagement rating
- has engagement state
- has engagement type
- has escalation flag
- has evidence
- has evidence basis
- has evidence quality
- has execution status
- has external reference
- has finding significance
- has impact dimension
- has in-force period
- has incident category
- has incident severity
- has independence conclusion
- has information marking
- has instrument kind
- has integrity requirement
- has jurisdiction
- has knowledge status
- has legal review state
- has lifecycle state
- has mapping type
- has normative modality
- has observed impact
- has organisation type
- has owner
- has plan entry state
- has playbook trigger
- has priority
- has procedure
- has processing role
- has quality review kind
- has relevant requirement
- has reportability state
- has response stance
- has review state
- has review trigger
- has risk appetite
- has risk owner
- has risk stage
- has root-cause category
- has sample result
- has sampling method
- has scenario category
- has selection disposition
- has source record
- has stakeholder
- has step
- has submission state
- has sufficiency conclusion
- has telemetry health state
- has test result
- has threat event
- has threat source description
- has threat source type
- has tolerance classification
- has treatment decision
- has treatment option
- has trigger kind
- has verification result
- has vulnerability description
- housed in
- hypothesis about
- hypothesised cause
- identified by
- impact on dimension
- implemented by procedure
- implements control
- implements strategy
- in clause
- in instrument version
- in phase
- in policy family
- in sensitivity case
- incident informs scenario
- includes auditable entity
- includes control measure
- includes scenario
- includes step
- independence of
- independence with respect to
- indicator from source
- informed by
- initiated by
- intended to mitigate
- interpretation of
- investigates alert
- involves asset
- is about
- issued by assurer
- issued by authority
- justifies recommendation
- led to action
- lesson from
- mapped edition
- mapping source
- mapping target
- maps to event class
- maps to requirement
- matched indicator
- matches threat event
- measurement of
- measures metric
- missing control
- mitigated by
- monitors
- monitors behaviour of persons in
- narrower than
- next playbook step
- next step
- nonconformity with
- normalised under
- objective of programme
- obligated under
- obligation at stake in
- observation of
- offers goods or services to persons in
- on scale
- opened investigation
- operates control
- oversees
- oversight by
- oversight of
- parsed by
- part of execution
- part of framework
- partially overlaps
- performed in capacity
- performs action
- planned engagement
- potentially indicates
- pre-authorises action
- prepared by
- principle addressed by category
- processes data category
- produced evidence
- produces evidence for
- produces version
- profile for source
- programme covers
- protects asset
- provided by
- provides data component
- provision of
- provision version of
- quality review of
- raised from
- receipt evidence
- recommendation for
- recommends change to
- recorded as submission
- recovery after
- refines
- relies on asset
- reopens finding
- report of
- report on service of
- reportability of
- reports finding
- reports to
- requested from
- requests evidence
- requires approval
- requires independence from
- requires review of
- requires source
- requires training
- responded by
- response to
- result for
- review of
- review triggered by
- reviewed by
- role for
- role within
- rule for measure
- same obligation in another regime
- sample of
- serves objective
- simulated playbook
- source asset
- specified by standard
- statement implemented by
- statement in version
- statement of policy
- step performs action
- subcategory supported by control
- submission to
- submission under
- sufficiency for
- sufficiency of
- supersedes
- supplier to
- supported by test
- supports compliance with
- supports objective
- supports process
- targets technique
- technique countered by defensive technique
- technique mitigated by control
- tested population
- tested rule
- timeline of
- transfers personal information to
- triggered by
- triggers obligation
- under delegation
- used input
- uses analytic
- uses assessment method
- uses calculation method
- uses criterion
- uses method
- uses playbook version
- uses sampling plan
- validated as
- valuation of
- valued by
- verifies action
- verifies recovery of
- version of
- version of directive
- vulnerability associated with technique
- vulnerability is an instance of weakness
- wasDerivedFrom
- weakness of
- within engagement
- workpaper for
Data Properties
- accepting authority
- access restriction
- added to KEV on
- adoption scope
- allocated initial cost
- allocated recurring cost
- analytical model name
- analytical model version
- applicability note
- applicable sector
- applies from
- assessed on
- assessment factor
- assessment horizon
- assessment scope
- attempt identifier
- attestation scope
- attested on
- background
- case appetite
- closed on
- collected on
- computed at
- condition found
- condition test
- confidence method
- confirmed on
- consolidated to
- contract version
- critical threshold
- currency code
- CVSS severity
- CVSS vector
- CVSS version
- cybersecurity budget share
- data source
- deadline computation
- decided on
- decision rationale
- deferral reason
- delegation limit
- deviations found
- distribution parameters
- due offset (hours)
- due on
- effect
- effective on
- ended at
- entry description
- EPSS percentile
- estimated effort (hours)
- evidence gap
- evidence hash
- evidence limitation
- evidence locator
- exception justification
- exception logic
- expected deviation rate
- expected result
- expiry date
- fact relied on
- gate for critical assets
- identified on
- illustrative only
- impact description
- impact is estimated
- implied appetite
- indicator pattern
- initial cost
- input document hash
- is crown jewel
- issued on
- issuer
- IT budget
- items tested
- known ransomware campaign use
- last amended on
- legal basis
- legally privileged
- licence or terms
- local identifier
- lower bound
- mandatory engagement
- mapping confidence
- measurement method
- metric method
- missing fact
- model version
- narrative
- notification due by
- numeric value
- observation horizon
- observed cause
- observed on
- occurred at
- official citation
- official identifier
- opened at
- pattern language
- period end
- period start
- planned end
- planned sample size
- planned start
- population definition
- population size
- prepared on
- priority rationale
- procedure step
- profile complete for
- provision wording
- published on
- purpose
- qualitative reading
- raised on
- rationale
- receipt acknowledged on
- recorded at
- recurring cost
- redistribution in CRGO
- reference version
- reopened on
- reopening reason
- report audience
- report scope
- reporting frequency
- required evidence
- retired on
- retrieved on
- review due on
- review interval (months)
- reviewed on
- revoked on
- rule identifier
- rule language
- rule version
- sample size
- sampling rationale
- sampling seed
- sent at
- SHA-256 checksum
- significance method
- source system
- source version
- started at
- stated confidence
- statement
- statement text
- step order
- submitted on
- success indicator
- suggested mitigation
- system boundary
- target value
- test procedure
- threats considered
- tolerable deviation rate
- treatment horizon
- treatment summary
- upper bound
- valid from
- valid until
- value (hours)
- verification note
- version label
- warning threshold
Annotation Properties
- abstract
- alt Label
- approval date
- approved by
- bibliographic Citation
- change Note
- code Repository
- confidence rationale
- contributor
- corroborated by
- created
- creator
- definition
- derived from
- description
- evidence source
- has confidence (element)
- has governance status
- homepage
- introduced in
- issued
- license
- modified
- notation
- preferred Namespace Prefix
- preferred Namespace Uri
- proposed by
- publisher
- review note
- scope Note
- source
- status
- title
Named Individuals
- 2023 scenario-generator notebook v2-1b
- above tolerance
- accepts the risk
- accidental
- acknowledged by the authority
- action partly effective
- action risk class scheme
- action verified
- administrative action
- adversarial
- adverse
- advisory engagement
- affected persons
- agrees, will act
- AI estimate requiring validation
- alert disposition scheme
- alert trigger
- amended
- analyst inference
- analytical hypothesis (knowledge status)
- applicability state scheme
- applicable
- applications and software
- approval denied
- approval expired
- approval granted
- approval requested
- approval revoked
- approval status scheme
- approved
- approved (decision)
- approved (detection)
- approved (directive)
- approved (plan entry)
- approved (record)
- approximately at tolerance
- assessment method scheme
- assessor line scheme
- asset category scheme
- asset criticality
- asset tier scheme
- asset-category condition
- assurance engagement
- assurance opinion scheme
- assurance report type scheme
- audit conclusion (knowledge status)
- audit or assessment finding (trigger)
- availability
- awaiting approval
- backup or recovery destruction
- below tolerance
- benign true positive
- beta
- biometric data
- British Columbia or Alberta
- broader mapping
- business criticality
- calendar deadline
- Canada (federal legal order)
- Canadian province or territory without substantially similar privacy law
- cancelled
- cancelled (execution)
- cancelled (plan entry)
- case status scheme
- catastrophic data loss
- central case
- certification audit report
- Claude (Anthropic), drafting assistant
- closed (case)
- cloud and third-party services
- communication audience scheme
- compensated
- completed (plan entry)
- compliance audit
- compliance state scheme
- condition kind scheme
- confidence level scheme
- confidentiality
- conflicting mapping
- conforming
- consolidated
- contained
- containment
- containment action
- contract
- control aspect scheme
- control design (cause)
- control function scheme
- control status scheme
- control test result scheme
- control uncertainty
- controller
- corrective action status scheme
- coverage status scheme
- CRG Excel Guide v1.0c s.11
- CRG normalised cross-check
- CRG risk units
- critical severity
- critical significance
- customers and partners
- CVSS base score 0-10
- data about minors
- data category
- data exposure
- deadline trigger kind scheme
- decision outcome scheme
- decision usefulness
- deferred
- deferred (decision)
- deferred (plan entry)
- deficiency severity scheme
- degraded (telemetry)
- degraded coverage
- denial of service
- dependency / concentration
- deprecated
- design
- destructive action
- detection
- detection and analysis
- detection status scheme
- deviation
- directive (to be transposed)
- directive lifecycle state scheme
- disagrees
- disclaimer
- distribution family scheme
- documented evidence
- draft (detection)
- draft (directive)
- draft (record)
- dwell time
- effective
- empirical
- enabled (detection)
- endpoints
- engagement cancelled
- engagement closed
- engagement planning
- engagement rating scheme
- engagement reporting
- engagement state scheme
- engagement type scheme
- enterprise (private sector)
- environmental
- eradication
- escalated (decision)
- escalation flag scheme
- essential service
- European Union
- event trigger
- event-triggered deadline
- evidence basis scheme
- evidence quality scheme
- evidence strength
- exact mapping
- examine
- exception
- execution status scheme
- exercise or simulation evidence
- existential financial
- expert input
- exposure / vulnerability
- external assurer
- external evidence
- external quality assessment
- facilities
- failed
- false positive
- federal work, undertaking or business
- federally regulated financial institution
- fieldwork
- financial
- financial and payment data
- finding significance scheme
- five-point ordinal 1-5
- follow-up engagement
- full coverage
- governance
- governance (cause)
- governance status scheme
- governing body (audience)
- government identifiers
- guidance or interpretation
- haphazard selection
- health and social services body (Québec)
- health data
- healthy (telemetry)
- high confidence
- high requirement
- high severity
- high significance
- high-quality evidence
- higher case
- identity and access systems
- identity and contact data
- immediate
- impact dimension scheme
- impaired, disclosed
- implementation
- implemented and effective
- implemented, awaiting verification
- in place
- in progress
- incident (trigger)
- incident category scheme
- incident response phase scheme
- incident severity scheme
- independence conclusion scheme
- independent
- indeterminate (alert)
- ineffective
- information assets
- information marking scheme
- infrastructure
- inherent
- initiative priority scheme
- insider misuse
- instrument kind scheme
- insufficient
- integrity
- internal audit
- internal escalation
- internal quality assessment
- interview
- investigating
- judgemental selection
- jurisdiction scheme
- knowledge status scheme
- law enforcement
- legal and regulatory
- legal review in progress
- legal review state scheme
- legally reviewed
- licence restricted
- location data
- lognormal
- loss or theft
- low confidence
- low requirement
- low severity
- low significance
- low-quality evidence
- lower case
- major
- major regulatory
- malware incident
- management decision
- management response stance scheme
- management self-assessment
- manual trigger
- mapping type scheme
- Marc-André Léger
- may
- medium confidence
- medium severity
- medium significance
- minor
- misconfiguration exposure
- missing coverage
- moderate requirement
- moderate-quality evidence
- multi-unit or multi-jurisdiction
- must
- must not
- narrower mapping
- near-term
- needs improvement
- networks and communications
- new (case)
- new instrument or provision
- normal
- normative modality scheme
- not applicable
- not assessed
- not implemented or not effective
- not independent
- not legally reviewed
- not reportable
- not testable
- not tested
- online identifiers
- open
- operation
- operational
- operational resilience
- organisation type scheme
- organisation-type condition
- organisational change (trigger)
- organisational observation
- OT, IoT and connected devices
- other assurance report
- other country
- out of date
- out of scope
- partial coverage
- partially satisfied
- partly agrees
- partly effective
- pending (execution)
- pending access
- people (cause)
- people and key personnel
- personal data category scheme
- PERT (beta-PERT)
- plan entry state scheme
- planned
- post-incident review
- potential impact
- potentially applicable
- prevention
- primary asset
- privacy
- privileged infrastructure
- process (cause)
- processing
- processing role scheme
- processor or service provider
- proposed
- proposed (control)
- proposed (plan entry)
- public body (Québec)
- published (directive)
- qualified
- quality review kind scheme
- Québec
- random selection
- read-only action
- recovering
- recovery
- reference fact
- regulation
- regulator (audience)
- regulatory / legal
- regulatory change (trigger)
- regulatory change type scheme
- regulatory guideline
- rejected
- rejected (decision)
- rejected (record)
- rejected by the authority
- rejected source
- related mapping
- repealed
- reportability state scheme
- reportability undetermined
- reportable
- reputation
- requirement level scheme
- residual
- resilience
- resolved (case)
- resourcing (cause)
- response
- response metric scheme
- retired (detection)
- retired (directive)
- review state scheme
- review trigger scheme
- risk avoidance
- risk change (trigger)
- risk estimate
- risk modification
- risk retention
- risk sharing
- risk stage scheme
- risk velocity
- role condition
- root-cause category scheme
- running
- safety
- safety escalation
- sample result scheme
- sampling method scheme
- satisfactory
- satisfied
- scheduled later
- scheduled review
- scheduled trigger
- screening criterion scheme
- second line
- selected
- selection disposition scheme
- sensitivity case type scheme
- service recovery
- severe privacy
- should
- significant
- silent (telemetry)
- SOC 1 type 1
- SOC 1 type 2
- SOC 2 type 1
- SOC 2 type 2
- SOC 3
- social engineering
- source access status scheme
- statute
- strategic
- stratified selection
- structural
- submission in preparation
- submission state scheme
- submitted
- succeeded
- sufficiency conclusion scheme
- sufficient and appropriate
- sufficient with limitations
- superseded (directive)
- supervisory review
- supply-chain concentration
- supporting asset
- suppressed (detection)
- systematic selection
- systemic failure
- technology (cause)
- technology change (trigger)
- telemetry health state scheme
- territorial
- test
- testing (detection)
- third party (cause)
- threat relevance
- threat source type scheme
- time to acknowledge
- time to contain
- time to detect
- time to recover
- TLP:AMBER
- TLP:AMBER+STRICT
- TLP:CLEAR
- TLP:GREEN
- TLP:RED
- tolerance classification scheme
- treatment option scheme
- triaged (case)
- triangular
- trigger kind scheme
- true positive
- unauthorised access
- unavailable
- under consideration
- under review (directive)
- under review (record)
- undetermined
- uniform
- unit interval 0-1
- unknown
- unknown (telemetry)
- unmodified
- unreviewed
- unsatisfactory
- unsatisfied
- untested coverage
- validated coverage
- verification result scheme
- verified outcome
- verified source
- very high requirement
- very low-quality evidence
- withdrawn (record)
CyberRiskGuardian Ontology: Description back to ToC
Formal OWL 2 DL ontology for identifying, analysing and treating cybersecurity risk with risk scenarios, aligned to BFO-2020 (ISO/IEC 21838-2) and Common Core Ontologies, and to the CyberRiskGuardian method. Each element carries its own governance status; new elements stay proposed until the domain expert approves them.Cross-reference for CyberRiskGuardian Ontology classes, object properties and data properties back to ToC
This section provides details for each class and property defined by CyberRiskGuardian Ontology.Classes
- action execution record
- action risk class
- Agent
- alert disposition
- Algorithm
- amendment
- analytical hypothesis
- analytical result
- applicability assessment
- applicability condition
- applicability state
- approval decision
- approval gate
- approval status
- assessment method
- assessment scenario
- assessor line
- asset
- asset category
- asset tier
- asset valuation
- assumption
- assurance opinion
- assurance report exception
- assurance report type
- attestation
- audit charter
- audit committee
- audit conclusion
- audit criterion
- audit engagement
- audit finding
- audit function
- audit methodology
- audit objective
- audit observation
- audit plan
- audit plan entry
- audit procedure
- audit quality review
- audit report
- audit universe
- audit work programme
- audit workpaper
- auditable entity
- automation execution record
- behavioural baseline
- breach reportability assessment
- budget calibration
- business objective
- business process
- calculation activity
- calculation method
- case status
- chief audit executive role
- communication audience
- compensating control
- complementary user entity control
- compliance assessment campaign
- compliance attestation
- compliance deadline
- compliance determination
- compliance objective
- compliance officer role
- compliance programme
- compliance state
- computed risk quantity
- condition kind
- confidence level
- configuration baseline
- configuration evidence
- conflict-of-interest declaration
- connected device
- consequence description
- control
- control aspect
- control assessment
- control deficiency
- control effectiveness
- control function
- control gap finding
- control measure
- control owner role
- control status
- control test result
- corrective action
- corrective action status
- correlation rule
- cost allocation
- cost-effectiveness
- coverage status
- CRG parameter
- CVSS input
- deadline trigger kind
- decision outcome
- decision record
- deficiency severity
- delegation of authority
- Descriptive Information Content Entity
- detection coverage
- detection gap
- detection rule
- detection status
- detection strategy
- detection test
- directive lifecycle state
- directive review
- directive version
- disposition
- distribution family
- documentary evidence
- engagement rating
- engagement state
- engagement type
- entity
- Entity
- EPSS observation
- escalation flag
- estimate
- estimate distribution
- estimated risk Re
- evidence basis
- evidence quality
- evidence register entry
- evidence request
- evidence requirement
- evidence sufficiency assessment
- exception expiry review
- execution status
- expected damage δe
- external assurance report
- external assurance role
- Facility
- facility asset
- finding closure
- finding reopening
- finding significance
- first-line role
- follow-up verification
- forensic artefact
- framework
- framework adoption
- framework requirement
- governance committee
- governance evidence
- governance role
- governance status
- governing body
- governing body member role
- Group of Agents
- guideline
- hardware asset
- hunting hypothesis
- impact dimension
- impact estimate
- impact reduction
- incident
- incident category
- incident communication
- incident confirmation
- incident impact
- incident response phase
- incident severity
- incident timeline entry
- independence assessment
- independence conclusion
- information asset
- Information Content Entity
- information marking
- initiative priority
- instrument kind
- instrument version
- interview evidence
- jurisdiction
- key risk indicator
- knowledge status
- legacy computed risk quantity
- legal instrument
- legal obligation
- legal review state
- lesson learned
- library scenario
- likelihood
- management response
- management response stance
- mapping assertion
- mapping type
- Material Artifact
- maximum damage δm
- Measurement Information Content Entity
- measurement scale
- mitigated risk (risk removed)
- monitoring exception
- network asset
- nonconformity
- normalisation profile
- normative modality
- Objective
- obligated party role
- observation
- observational evidence
- operating effectiveness assessment
- operational evidence
- organisation type
- organisational resilience θ
- Organization
- oversight activity
- parser definition
- Person
- personal data category
- Plan
- plan entry state
- Planned Act
- playbook simulation
- playbook step
- playbook trigger
- playbook version
- policy
- policy acknowledgement
- policy clause
- policy exception
- policy family
- policy statement
- policy version
- population
- pre-treatment ratio
- predisposing condition
- Prescriptive Information Content Entity
- probability of exploitation Pb(ψ,A)
- probability reduction
- procedure
- process
- processing activity
- processing role
- Proper interval
- provision version
- quality review kind
- realizable entity
- reassessment trigger
- recommendation
- recovery verification
- regulatory authority
- regulatory change
- regulatory change type
- regulatory exemption
- regulatory submission
- reportability state
- requirement interpretation
- requirement level
- residual risk
- response action
- response effectiveness measurement
- response evidence
- response metric
- response playbook
- review state
- review trigger
- risk acceptance
- risk appetite statement
- risk assessment
- risk committee
- risk level
- risk management function role
- risk owner role
- risk scenario
- risk stage
- risk treatment decision
- risk-to-tolerance ratio
- role
- role assignment
- root-cause category
- sample item
- sample result
- sampling method
- sampling plan
- scenario criticality μ(E)
- scenario step
- screening criterion
- screening score
- second-line role
- security alert
- security event
- security event record
- security investigation
- selection disposition
- sensitivity case
- sensitivity case type
- service asset
- software asset
- source access status
- source record
- submission state
- sufficiency conclusion
- supplier role
- technical standard
- telemetry health observation
- telemetry health state
- telemetry source
- test evidence
- third-line role
- threat event description
- threat indicator
- threat intelligence source
- threat presence Pb(A)
- threat source description
- threat source role
- threat source type
- tolerance classification
- tolerated risk Rt
- training requirement
- transactional evidence
- treatment initiative
- treatment option
- trigger kind
- verification result
- vulnerability
- Vulnerability
- vulnerability description
action execution recordc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001121
A record of one attempt to carry out a response action on a target, with its time, status, the approval relied on and the evidence it produced.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- action target op, authorised by op, part of execution op, performs action op, produced evidence op
- is disjoint with
- automation execution record c
action risk classc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001188
How much harm a response action could do if wrong, which sets the approval it needs.
- has super-classes
- Concept c
- is in range of
- gate for risk class op, has action risk class op
- has members
- administrative action ni, containment action ni, destructive action ni, read-only action ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c
Agentc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00001017
A Material Entity that bears an Agent Capability.
- is in range of
- assessed by op, assigned to op, collected by op, custodian op, decided by op, declared by op, has owner op, has risk owner op, has stakeholder op, independence of op, issued by assurer op, requested from op, responded by op
alert dispositionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001137
The conclusion of an analyst's triage of a security alert.
- has super-classes
- Concept c
- is in range of
- has alert disposition op
- has members
- benign true positive ni, false positive ni, indeterminate (alert) ni, true positive ni, unreviewed ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, coverage status c, telemetry health state c, information marking c
Algorithmc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000653
A Prescriptive Information Content Entity that prescribes some Process and contains a finite sequence of unambiguous instructions in order to achieve some Objective.
- has sub-classes
- calculation method c
amendmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000508
A legal act or publication that changes the text of an instrument, producing a new version from a stated date.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- amends instrument op, produces version op
analytical hypothesisc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000475
A proposed explanation, such as a suspected cause of a control failure, recorded so that it can be tested against evidence. Until it is tested it is not a fact or a conclusion.
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- hunting hypothesis c
- is in domain of
- hypothesis about op
- is in range of
- hypothesised cause op
- is disjoint with
- assumption c
analytical resultc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000477
A record of a result computed outside CRGO by a named model and version, such as a CyberRiskGuardian risk calculation, with the inputs it used and when it was computed. CRGO stores it as a proposed risk estimate and never derives it by reasoning.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- analytical model name dp, analytical model version dp, computed at dp, computed from input op, input document hash dp, result for op
- is disjoint with
- observation c
applicability assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000345
A dated record (not the act of assessing) of whether a legal instrument, provision or policy statement applies to a given organisation or part of it, giving the state reached (applicable, not applicable, potentially applicable or unknown) and the conditions found met, not met or undetermined.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- applicability of op, condition met op, condition not met op, condition undetermined op, fact relied on dp, has applicability state op, missing fact dp
- is disjoint with
- compliance determination c
applicability conditionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000344
A description of a condition under which a legal instrument, one of its provisions or a policy statement applies to an organisation or part of it, such as its territory, organisation type, sector, role in processing personal information, a threshold or, for a policy statement, a role or asset category, written as a CRGO paraphrase or the organisation's own wording, with its citation and a machine-readable test.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- condition of op, condition test dp, has condition kind op
- is in range of
- condition met op, condition not met op, condition undetermined op
applicability statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000381
The result of evaluating whether an instrument or provision applies to an organisation.
- has super-classes
- Concept c
- is in range of
- has applicability state op
- has members
- applicable ni, not applicable ni, potentially applicable ni, unknown ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
approval decisionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001119
A decision record granting or denying the execution of a response action, or pre-authorising a stated class of actions for a stated scope and period, by an identified authority.
- has super-classes
- decision record c
- is in domain of
- has approval status op, pre-authorises action op, revoked on dp
- is in range of
- authorised by op
approval gatec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001118
A directive that an action, or a class of actions, may be executed only after a stated authority has approved it, or under a stated pre-authorisation, for example when it targets a critical asset.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- gate authority op, gate for critical assets dp, gate for risk class op
- is in range of
- requires approval op
approval statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001181
The state of an approval decision for a response action.
- has super-classes
- Concept c
- is in range of
- has approval status op
- has members
- approval denied ni, approval expired ni, approval granted ni, approval requested ni, approval revoked ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c
assessment methodc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000597
The method by which an assessor obtains evidence about a control or requirement.
- has super-classes
- Concept c
- is in range of
- uses assessment method op
- has members
- examine ni, interview ni, test ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
assessment scenarioc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000025
A risk scenario stated for a specific organisation within a risk assessment, whether as a screened candidate or as a selected scenario.
- has super-classes
- risk scenario c
- is in domain of
- has escalation flag op, has selection disposition op
- is disjoint with
- library scenario c
assessor linec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000602
The capacity in which a control assessment was performed, which bears on how much independent assurance it gives.
- has super-classes
- Concept c
- is in range of
- performed in capacity op
- has members
- external assurer ni, internal audit ni, management self-assessment ni, second line ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000001
An information, software, hardware, network, service or facility entity of a kind used to process, store, transmit or protect information or to deliver services; whether and how much a given organisation values it is recorded in an asset valuation.
- has super-classes
- entity c
- has sub-classes
- facility asset c, hardware asset c, information asset c, service asset c, software asset c
- is in domain of
- housed in op, provided by op, relies on asset op, supports process op
- is in range of
- affects asset op, covers asset op, involves asset op, protects asset op, relies on asset op, source asset op
asset categoryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000302
A kind of asset named in a scenario that belongs to no particular organisation.
- has super-classes
- Concept c
- is in range of
- affects asset category op
- has members
- OT, IoT and connected devices ni, applications and software ni, cloud and third-party services ni, endpoints ni, facilities ni, identity and access systems ni, information assets ni, infrastructure ni, networks and communications ni, people and key personnel ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset tier c, mapping type c, review state c
asset tierc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000314
Whether an asset is primary or supporting for a given process.
- has super-classes
- Concept c
- is in range of
- has asset tier op
- has members
- primary asset ni, supporting asset ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, mapping type c, review state c
asset valuationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000011
A description of how much an entity matters to a given organisation, recording its criticality, its confidentiality, integrity and availability requirements, its owner and whether it is a crown jewel.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has asset tier op, has availability requirement op, has confidentiality requirement op, has integrity requirement op, is crown jewel dp, purpose dp, valuation of op, valued by op
assumptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000339
A statement taken as true without verification for an estimate, an assessment or a decision, recorded so that the result can be reviewed when the statement turns out to be false or changes.
- has super-classes
- Descriptive Information Content Entity c
- is in range of
- depends on assumption op
- is disjoint with
- analytical hypothesis c
assurance opinionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000639
The opinion expressed in an external assurance report.
- has super-classes
- Concept c
- is in range of
- has assurance opinion op
- has members
- adverse ni, disclaimer ni, qualified ni, unmodified ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
assurance report exceptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000523
A deviation reported in an external assurance report, where a tested control did not operate as described during the period.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- exception in report op
assurance report typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000630
The kind of an external assurance report.
- has super-classes
- Concept c
- is in range of
- has assurance report type op
- has members
- SOC 1 type 1 ni, SOC 1 type 2 ni, SOC 2 type 1 ni, SOC 2 type 2 ni, SOC 3 ni, certification audit report ni, other assurance report ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
attestationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000891
A dated declaration by an identified agent about a stated subject and scope, such as having read a policy version or that a requirement is met. It records what the agent declares, not what was verified.
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- compliance attestation c, policy acknowledgement c
- is in domain of
- attestation about op, attestation scope dp, attested by op, attested on dp
- is disjoint with
- compliance determination c, audit conclusion c
audit charterc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000906
A directive approved by the governing body that sets the internal audit function's purpose, authority, responsibilities and reporting lines.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- charter of op
audit committeec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000480
A governance committee that oversees internal and external audit, financial reporting and the system of internal control.
- has super-classes
- governance committee c
audit conclusionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000542
A record of the overall result of an audit engagement against its objectives, based on its findings.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- conclusion of op, has engagement rating op
- is disjoint with
- attestation c
audit criterionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000538
A requirement used as the reference against which the condition found is compared, such as a provision, a control objective, a policy statement or an assessment objective.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- criterion refers to op
- is in range of
- uses criterion op
audit engagementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000536
A planned act of assurance or advice on an auditable entity, with stated objectives, scope, criteria and period, performed by an audit team.
- has super-classes
- Planned Act c
- is in domain of
- engagement on op, follows programme op, has engagement state op, has engagement type op
- is in range of
- conclusion of op, entry for engagement op, planned engagement op, report of op, within engagement op
audit findingc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000541
A record, made in an audit engagement, of the difference between a criterion and the condition found, with its observed or hypothesised cause, its effect, its significance and the evidence relied on.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- arises from exception op, condition found dp, effect dp, finding about scenario op, finding on control op, has finding significance op, hypothesised cause op, observed cause dp, significance method dp
- is in range of
- recommendation for op, reports finding op, validated as op
- is disjoint with
- compliance determination c, monitoring exception c, audit observation c
audit functionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000905
The group of agents in an organisation that performs internal audit under a charter, led by the chief audit executive.
- has super-classes
- Group of Agents c
- is in range of
- charter of op
audit methodologyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000907
A directive that sets how an audit function plans, performs and reports engagements, including its sampling and rating rules, identified by version.
- has super-classes
- Prescriptive Information Content Entity c
audit objectivec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000537
An objective stating what an audit engagement is to establish, such as whether access to a system is restricted to authorised users.
- has super-classes
- Objective c
- is in range of
- has audit objective op
audit observationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000910
A preliminary record of a condition noted during an engagement that has not yet been validated against criteria and evidence. It is not a finding and carries no audit conclusion.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- validated as op
- is disjoint with
- audit finding c
audit planc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000533
A plan, usually approved by the governing body, that sets out the audit engagements to be performed over a stated period and why.
- has super-classes
- Plan c
- is in domain of
- planned engagement op
- is in range of
- entry in plan op
audit plan entryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000908
An entry of an audit plan for one candidate or planned engagement, with its priority rationale, its state (proposed, approved, deferred, cancelled or completed) and, when deferred or cancelled, the reason and who authorised it.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- deferral reason dp, entry for auditable entity op, entry for engagement op, entry in plan op, entry informed by op, estimated effort (hours) dp, has plan entry state op, mandatory engagement dp, priority rationale dp
audit procedurec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000535
A plan for one audit step, stating the assessment method, the objectives it serves, the evidence to obtain, the expected result and when a deviation counts as an exception.
- has super-classes
- Plan c
- is in domain of
- exception logic dp, expected result dp, procedure step dp, serves objective op
- is in range of
- executes procedure op, has procedure op
audit quality reviewc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000911
A planned act in which the work of an engagement or of the audit function is evaluated against its methodology and the standards it follows, by a supervisor, an internal quality assessor or an external assessor.
- has super-classes
- Planned Act c
- is in domain of
- has quality review kind op, quality review of op
audit reportc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000543
A document that communicates an audit engagement's objectives, scope, findings, conclusions, recommendations and management responses.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- report audience dp, report of op, reports finding op
audit universec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000531
A description of all the auditable entities of an organisation from which the internal audit plan is drawn.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- includes auditable entity op
audit work programmec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000534
A reusable plan of audit procedures for a domain, giving objectives, criteria, control references, methods, expected evidence, population and sampling rationale.
- has super-classes
- Plan c
- is in domain of
- has procedure op
- is in range of
- follows programme op
audit workpaperc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000909
A record prepared by an auditor that documents work performed, evidence examined and conclusions reached in an engagement, with who prepared it and who reviewed it. CRGO holds its metadata, not its content.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- prepared on dp, workpaper for op
auditable entityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000532
A description of a unit, process, system, programme or third party that can be the subject of an audit engagement.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- auditable entity for op
- is in range of
- engagement on op, entry for auditable entity op, includes auditable entity op
automation execution recordc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001120
A record of one run of a playbook version: what triggered it, when it started and ended, its status and the investigation or incident it served. The full execution history stays in the operational store.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- execution for op, execution triggered by op, uses playbook version op
- is in range of
- part of execution op
- is disjoint with
- action execution record c
behavioural baselinec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001111
A description of the usual behaviour of a user, account, host or service over a stated period, against which deviations are measured. CRGO holds its metadata, not the profile data.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- baseline of op
breach reportability assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000553
A dated record of whether an incident must be reported to a regulator or to affected persons under a stated provision, such as a confidentiality incident presenting a risk of serious injury under Loi 25 or a personal data breach under the GDPR.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- assessed under op, has reportability state op, notification due by dp, reportability of op
budget calibrationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000035
A description that relates the organisation's cybersecurity budget, as a share of its total IT budget, to its risk appetite using the CRG 4 / 7.8 / 12 percent band.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- IT budget dp, budget of op, cybersecurity budget share dp, implied appetite dp
business objectivec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000010
An objective the organisation pursues that business processes support and that cybersecurity risk can threaten.
- has super-classes
- Objective c
- has sub-classes
- compliance objective c
- is in range of
- supports objective op
business processc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000009
A process, consisting of recurring organisational activities, that delivers part of the organisation's mission and depends on assets.
- has super-classes
- process c
- has sub-classes
- processing activity c
- is in domain of
- supports objective op
- is in range of
- affects process op, supports process op
calculation activityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000058
A process in which software computes risk quantities from estimates using a stated method, such as a run of crg_calc.py.
- has super-classes
- process c
- is in domain of
- uses method op
- is in range of
- generated by op
calculation methodc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000059
An algorithm, identified with its version, that specifies how risk quantities are computed from estimates.
- has super-classes
- Algorithm c
- is in range of
- uses calculation method op, uses method op
- has members
- 2023 scenario-generator notebook v2-1b ni, CRG Excel Guide v1.0c s.11 ni, CRG normalised cross-check ni
case statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001163
The recorded stage of a security investigation.
- has super-classes
- Concept c
- is in range of
- has case status op
- has members
- closed (case) ni, contained ni, investigating ni, new (case) ni, recovering ni, resolved (case) ni, triaged (case) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c
chief audit executive rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000488
The role of the person accountable for leading the internal audit function and reporting functionally to the governing body.
- has super-classes
- third-line role c
communication audiencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001216
Who an incident communication is addressed to.
- has super-classes
- Concept c
- is in range of
- has audience op
- has members
- affected persons ni, customers and partners ni, governing body (audience) ni, internal escalation ni, law enforcement ni, regulator (audience) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, response metric c
compensating controlc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000503
A control measure put in place because a required control is not, or not fully, implemented, intended to reduce the same risk to a comparable degree.
- has super-classes
- control measure c
complementary user entity controlc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000524
A control that an external assurance report assumes the user organisation operates, without which the service provider's controls may not achieve their objectives.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- addressed by op, complementary user entity control of op
compliance assessment campaignc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000899
A planned act in which an organisation assesses compliance with a stated set of obligations or requirements, for a stated scope, period and method, producing compliance determinations.
- has super-classes
- Planned Act c
- is in range of
- determination in op
compliance attestationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000904
An attestation by an identified signatory that an organisation meets stated obligations or requirements for a stated scope and period, citing what it is based on. It is a management declaration, not an audit conclusion.
- has super-classes
- attestation c
compliance deadlinec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000901
A record of when an obligation must be met, either on a calendar date or within a period counted from a triggering event, such as 72 hours after becoming aware of a breach, with how the date is computed.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- deadline computation dp, deadline for op, deadline triggered by op, due offset (hours) dp, has deadline trigger kind op
- is in range of
- answers deadline op
compliance determinationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000346
A dated record, made by an identified assessor, of the extent to which a given organisation satisfies a legal provision or obligation, a contractual obligation or a requirement of a framework it has adopted, with the evidence relied on or an explicit statement of the missing evidence. A mapped control or framework requirement is not by itself evidence of compliance.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- based on control assessment op, compliance with op, determination in op, evidence gap dp, has compliance state op
- is disjoint with
- applicability assessment c, decision record c, nonconformity c, audit finding c, attestation c, mapping assertion c
compliance objectivec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000895
A measurable objective that a compliance programme sets itself, such as reviewing every obligation of the register once a year.
- has super-classes
- business objective c
- is in domain of
- objective of programme op
compliance officer rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000489
The role of the person responsible for the compliance function: identifying compliance obligations, monitoring how they are met and reporting on them.
- has super-classes
- second-line role c
compliance programmec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000894
The plan by which an organisation operates its compliance management system: its scope, the obligations and commitments it covers, its objectives, the roles involved and its review cycle.
- has super-classes
- Plan c
- is in domain of
- programme covers op
- is in range of
- objective of programme op
compliance statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000387
The result of a compliance determination.
- has super-classes
- Concept c
- is in range of
- has compliance state op
- has members
- not assessed ni, partially satisfied ni, satisfied ni, undetermined ni, unsatisfied ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
computed risk quantityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000050
An estimate computed by the CRG formulas from a scenario's parameters, such as estimated, tolerated, mitigated or residual risk.
- has super-classes
- estimate c
- has sub-classes
- cost-effectiveness c, estimated risk Re c, legacy computed risk quantity c, mitigated risk (risk removed) c, pre-treatment ratio c, residual risk c, risk-to-tolerance ratio c, tolerated risk Rt c
- is in domain of
- generated by op, used input op
condition kindc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000394
The kind of fact an applicability condition tests.
- has super-classes
- Concept c
- is in range of
- has condition kind op
- has members
- asset-category condition ni, data category ni, exception ni, organisation-type condition ni, processing ni, role condition ni, territorial ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
confidence levelc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000061
A level of confidence in an estimate or in a proposed ontology element.
- has super-classes
- Concept c
- is in range of
- has confidence op
- has members
- high confidence ni, low confidence ni, medium confidence ni
- is disjoint with
- governance status c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
configuration baselinec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000501
An approved set of configuration settings that a kind of system must meet, against which deviations are detected.
- has super-classes
- Prescriptive Information Content Entity c
configuration evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000515
An evidence item describing system settings or configuration exports captured from a system at a stated time.
- has super-classes
- evidence register entry c
conflict-of-interest declarationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000506
A dated record in which an agent declares an interest that could impair, or appear to impair, its objectivity on a stated decision or assessment.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- conflict concerns op, declared by op
connected devicec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000005
A hardware asset with embedded computing and network connectivity whose malfunction can affect physical processes, such as an IoT, OT or medical device.
- has super-classes
- hardware asset c
consequence descriptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000027
A description of an outcome that a risk scenario could have for the organisation along one impact dimension.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has impact dimension op
- is in range of
- has consequence op
controlc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000019
A prescription of a measure that modifies risk, such as a policy, procedure, technical safeguard or practice, independent of whether any organisation has implemented it.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- implements control op, missing control op
control aspectc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000614
The aspect of a control measure that an assessment or deficiency concerns.
- has super-classes
- Concept c
- is in range of
- assesses aspect op, deficiency aspect op
- has members
- design ni, implementation ni, operation ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
control assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000347
A planned act in which an assessor tests or reviews a control measure of an organisation at a stated date, over a stated scope and by a stated procedure, and records its result and the evidence gathered.
- has super-classes
- Planned Act c
- has sub-classes
- detection test c, operating effectiveness assessment c, playbook simulation c
- is in domain of
- assesses aspect op, deviations found dp, evaluates control measure op, executes procedure op, has test result op, items tested dp, test procedure dp
- is in range of
- based on assessment op, based on control assessment op, identified by op
- is disjoint with
- risk assessment c
control deficiencyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000527
A record that the design, implementation or operation of an existing control measure does not allow it to meet its objective, identified by a control assessment, with its severity. Unlike a control gap, which describes an expected control that is absent or inadequate (often in a risk scenario), a deficiency is an assessed result about a measure in place.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- deficiency aspect op, deficiency of op, has deficiency severity op, identified by op
control effectivenessc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000300
An estimate of how well a control measure achieves its intended reduction of likelihood or impact, with the evidence for it.
- has super-classes
- estimate c
control functionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000133
The function a control or initiative serves in the treatment portfolio.
- has super-classes
- Concept c
- is in range of
- has control function op
- has members
- detection ni, governance ni, prevention ni, recovery ni, resilience ni, response ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, treatment option c, asset category c, asset tier c, mapping type c, review state c
control gap findingc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000018
A description stating that an expected control is absent or inadequate in an organisation, such as no penetration testing or no continuity plan.
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- detection gap c
- is in domain of
- missing control op
- is in range of
- has control gap op
control measurec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000020
A description of a control as it stands in a given organisation, with its status (in place, planned or proposed), scope, owner and the evidence of its effectiveness.
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- compensating control c
- is in domain of
- has control status op, implements control op, protects asset op
- is in range of
- addressed by op, compensated by op, deficiency of op, evaluates control measure op, finding on control op, includes control measure op, mitigated by op, operates control op, rule for measure op, statement implemented by op
control owner rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000491
The role of the person accountable for the design and operation of a control measure.
- has super-classes
- first-line role c
control statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000096
The implementation state of a control measure in an organisation.
- has super-classes
- Concept c
- is in range of
- has control status op
- has members
- in place ni, planned ni, proposed (control) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
control test resultc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000401
The result recorded by a control assessment.
- has super-classes
- Concept c
- is in range of
- has test result op
- has members
- effective ni, ineffective ni, not tested ni, partly effective ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
corrective actionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000546
A plan of action by an owner, with a due date, to eliminate the cause of a finding or nonconformity and prevent its recurrence.
- has super-classes
- Plan c
- is in domain of
- corrects op, has action status op
- is in range of
- commits to action op, led to action op, verifies action op
corrective action statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000674
The state of a corrective action, as last recorded.
- has super-classes
- Concept c
- is in range of
- has action status op
- has members
- action verified ni, cancelled ni, implemented, awaiting verification ni, in progress ni, open ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
correlation rulec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001103
A detection rule whose conditions combine several events or alerts, over a time window or by a shared attribute.
- has super-classes
- detection rule c
cost allocationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000033
A description of the share of a treatment initiative's initial and recurring cost charged to one risk scenario.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- allocated initial cost dp, allocated recurring cost dp, allocated to op, allocation of op
cost-effectivenessc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000056
A computed risk quantity equal to (estimated risk − residual risk) ÷ treatment cost × 1,000, the risk units removed per $1,000; the cost basis (first-year, annual or multi-year) is stated with the value.
- has super-classes
- computed risk quantity c
coverage statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001144
The state of a detection coverage statement.
- has super-classes
- Concept c
- is in range of
- has coverage status op
- has members
- degraded coverage ni, missing coverage ni, untested coverage ni, validated coverage ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, telemetry health state c, information marking c
CRG parameterc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000040
An estimate of one of the CyberRiskGuardian input parameters of a scenario, on the 0-1 scale, for the assessment horizon (12 months by default).
- has super-classes
- estimate c
- has sub-classes
- expected damage δe c, impact reduction c, maximum damage δm c, organisational resilience θ c, probability of exploitation Pb(ψ,A) c, probability reduction c, scenario criticality μ(E) c, threat presence Pb(A) c
CVSS inputc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000049
An estimate recording the CVSS version, vector, base score and severity of the representative weakness of a scenario, with a note when CVSS has limited applicability.
- has super-classes
- estimate c
- is in domain of
- CVSS severity dp, CVSS vector dp, CVSS version dp
deadline trigger kindc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000947
How a compliance deadline is set.
- has super-classes
- Concept c
- is in range of
- has deadline trigger kind op
- has members
- calendar deadline ni, event-triggered deadline ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, root-cause category c, mapping type c, review state c
decision outcomec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000586
The outcome recorded by a decision record.
- has super-classes
- Concept c
- is in range of
- has decision outcome op
- has members
- approved (decision) ni, deferred (decision) ni, escalated (decision) ni, rejected (decision) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c
decision recordc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000504
A dated record of a decision taken by an identified agent on a stated subject, such as approving a policy, an exception, a risk acceptance or the closure of a finding, with its outcome and rationale.
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- approval decision c, exception expiry review c, framework adoption c
- is in domain of
- decided on dp, decision made by op, decision on op, decision rationale dp, has decision outcome op, informed by op, under delegation op
- is disjoint with
- compliance determination c
deficiency severityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000619
How serious a control deficiency is, as judged by the assessor.
- has super-classes
- Concept c
- is in range of
- has deficiency severity op
- has members
- major ni, minor ni, significant ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
delegation of authorityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000494
A directive by which an agent grants another agent authority to decide or act within a stated scope, limit and period.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- delegation from op, delegation limit dp, delegation to op
- is in range of
- under delegation op
Descriptive Information Content Entityc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000853
An Information Content Entity that describes some Entity.
- has sub-classes
- action execution record c, analytical hypothesis c, analytical result c, applicability assessment c, applicability condition c, asset valuation c, assumption c, assurance report exception c, attestation c, audit conclusion c, audit finding c, audit observation c, audit plan entry c, audit report c, audit universe c, audit workpaper c, auditable entity c, automation execution record c, behavioural baseline c, breach reportability assessment c, budget calibration c, compliance deadline c, compliance determination c, conflict-of-interest declaration c, consequence description c, control deficiency c, control gap finding c, control measure c, cost allocation c, decision record c, detection coverage c, estimate distribution c, evidence register entry c, evidence sufficiency assessment c, finding closure c, finding reopening c, incident communication c, incident confirmation c, incident impact c, incident timeline entry c, independence assessment c, instrument version c, key risk indicator c, lesson learned c, management response c, mapping assertion c, measurement scale c, monitoring exception c, nonconformity c, playbook trigger c, policy family c, population c, provision version c, reassessment trigger c, recovery verification c, regulatory change c, regulatory submission c, requirement interpretation c, risk scenario c, role assignment c, sample item c, scenario step c, security alert c, sensitivity case c, source record c, telemetry source c, threat event description c, threat indicator c, threat source description c, vulnerability description c
detection coveragec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001106
A dated statement that a detection strategy or rule covers a technique, a risk scenario or an asset, with its coverage status (untested, validated, degraded or missing) and the tests that support it. Coverage is a claim to be tested, not a guarantee of detection.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- coverage by op, covers asset op, covers scenario op, covers technique op, has coverage status op, supported by test op
detection gapc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001107
A control gap finding that a technique, risk scenario or asset has no adequate detection, or that the telemetry a detection needs is missing or unhealthy.
- has super-classes
- control gap finding c
- is in domain of
- gap for technique op, gap in telemetry op
detection rulec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001102
A versioned, deployable specification of the conditions under which events should raise an alert, such as a Sigma rule or a rule in a product's native language, with its status and the telemetry it needs.
- has super-classes
- Prescriptive Information Content Entity c
- has sub-classes
- correlation rule c
- is in domain of
- has detection status op, implements strategy op, requires source op, rule for measure op, rule identifier dp, rule language dp
- is in range of
- generated by rule op
- is disjoint with
- detection strategy c
detection statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001129
The lifecycle state of a detection rule.
- has super-classes
- Concept c
- is in range of
- has detection status op
- has members
- approved (detection) ni, draft (detection) ni, enabled (detection) ni, retired (detection) ni, suppressed (detection) ni, testing (detection) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, alert disposition c, coverage status c, telemetry health state c, information marking c
detection strategyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001101
An organisation's documented approach to detecting a technique or behaviour, stating what to look for, in which data, and which analytics and rules carry it out; it may adapt a reference strategy such as an ATT&CK detection strategy.
- has super-classes
- Plan c
- is in domain of
- adapts reference strategy op
- is in range of
- implements strategy op
- is disjoint with
- detection rule c
detection testc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001108
A control assessment in which a detection rule or strategy is exercised under controlled conditions, such as by replaying or simulating the technique, to check that it raises the expected alert.
- has super-classes
- control assessment c
- is in domain of
- tested rule op
- is in range of
- supported by test op
directive lifecycle statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000919
The state of a directive version in the organisation's document lifecycle. Not the governance status of a CRGO term.
- has super-classes
- Concept c
- is in range of
- has lifecycle state op
- has members
- approved (directive) ni, draft (directive) ni, published (directive) ni, retired (directive) ni, superseded (directive) ni, under review (directive) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, review trigger c, mapping type c, review state c
directive reviewc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000890
A planned act in which a directive or some of its statements are reviewed, on schedule or after a trigger such as a regulatory change, an incident or an audit finding, ending in a decision to keep, revise or retire them.
- has super-classes
- Planned Act c
- is in domain of
- has review trigger op, review of op, review triggered by op
directive versionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000886
A fixed release of a policy, technical standard, procedure, guideline, audit charter or methodology, identified by a version label, with its approval, effective and retirement dates. Once effective its content does not change; a change makes a new version.
- has super-classes
- Prescriptive Information Content Entity c
- has sub-classes
- playbook version c, policy version c
- is in domain of
- has lifecycle state op, retired on dp, version of directive op
- is in range of
- clause of op, statement in version op
- is disjoint with
- instrument version c
dispositionc back to ToC or Class ToC
IRI: http://purl.obolibrary.org/obo/BFO_0000016
(Elucidation) A disposition b is a realizable entity such that if b ceases to exist then its bearer is physically changed & b's realization occurs when and because this bearer is in some special physical circumstances & this realization occurs in virtue of the bearer's physical make-up
- has sub-classes
- predisposing condition c
- is in range of
- exploits op
distribution familyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000577
The family of probability distribution used to express an estimate's uncertainty.
- has super-classes
- Concept c
- is in range of
- has distribution family op
- has members
- PERT (beta-PERT) ni, beta ni, empirical ni, lognormal ni, normal ni, triangular ni, uniform ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, reportability state c, incident response phase c
documentary evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000514
An evidence item describing documents, such as policies, contracts, plans or records prepared in the course of business.
- has super-classes
- evidence register entry c
engagement ratingc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000663
The overall rating given in an audit conclusion.
- has super-classes
- Concept c
- is in range of
- has engagement rating op
- has members
- needs improvement ni, satisfactory ni, unsatisfactory ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
engagement statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000966
The recorded stage of an audit engagement.
- has super-classes
- Concept c
- is in range of
- has engagement state op
- has members
- engagement cancelled ni, engagement closed ni, engagement planning ni, engagement reporting ni, fieldwork ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, plan entry state c, quality review kind c, mapping type c, review state c
engagement typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000960
The kind of an audit engagement: its nature (assurance or advisory) and, where relevant, its focus (compliance or follow-up). An engagement may have one nature and one focus.
- has super-classes
- Concept c
- is in range of
- has engagement type op
- has members
- advisory engagement ni, assurance engagement ni, compliance audit ni, follow-up engagement ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
entityc back to ToC or Class ToC
IRI: http://purl.obolibrary.org/obo/BFO_0000001
(Elucidation) An entity is anything that exists or has existed or will exist
- has sub-classes
- asset c
- is in range of
- estimate of op, initiated by op, valuation of op
Entityc back to ToC or Class ToC
IRI: http://www.w3.org/ns/prov#Entity
- has sub-classes
- observation c, source record c
EPSS observationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000340
An observation of the Exploit Prediction Scoring System score of a published vulnerability on a given day: FIRST's estimated probability that the vulnerability is exploited in the wild in the following 30 days, with its percentile among all scored vulnerabilities. It concerns the vulnerability in general, not its presence in any organisation, and it is not the likelihood of a risk scenario.
- has super-classes
- observation c
- is in domain of
- EPSS percentile dp
escalation flagc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000161
A CRG flag that keeps a candidate scenario in review regardless of low probability.
- has super-classes
- Concept c
- is in range of
- has escalation flag op
- has members
- backup or recovery destruction ni, catastrophic data loss ni, essential service ni, existential financial ni, major regulatory ni, multi-unit or multi-jurisdiction ni, privileged infrastructure ni, safety escalation ni, severe privacy ni, supply-chain concentration ni, systemic failure ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, asset category c, asset tier c
estimatec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000037
A measurement content entity giving a value for some aspect of a risk scenario or control, with its scale, qualitative reading, rationale, evidence and confidence.
- has super-classes
- Measurement Information Content Entity c
- has sub-classes
- CRG parameter c, CVSS input c, computed risk quantity c, control effectiveness c, impact estimate c, likelihood c, risk level c, screening score c
- is in domain of
- assessed in op, estimate of op, has confidence op, has distribution op, has risk stage op, in sensitivity case op, lower bound dp, on scale op, qualitative reading dp, sample size dp, upper bound dp
- is in range of
- used input op
- is disjoint with
- observation c
estimate distributionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000476
A description of the probability distribution that expresses the uncertainty of an estimate, giving its family (for example triangular or lognormal) and its parameters.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- distribution parameters dp, has distribution family op
- is in range of
- has distribution op
estimated risk Rec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000051
A computed risk quantity equal to Pb(A) × Pb(ψ,A) × CVSS × ((δe + δm)/2) × μ(E) ÷ θ × factor.
- has super-classes
- computed risk quantity c, risk level c
evidence basisc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000116
The kind of support behind an assertion, following the CRG evidence register.
- has super-classes
- Concept c
- is in range of
- has evidence basis op
- has members
- AI estimate requiring validation ni, analyst inference ni, documented evidence ni, exercise or simulation evidence ni, expert input ni, external evidence ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
evidence qualityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000571
How strongly the evidence behind an estimate or conclusion supports it.
- has super-classes
- Concept c
- is in range of
- has evidence quality op
- has members
- high-quality evidence ni, low-quality evidence ni, moderate-quality evidence ni, very low-quality evidence ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, distribution family c, reportability state c, incident response phase c
evidence register entryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000036
A description of a piece of evidence used in an assessment, with its locator and its basis (documented, external, expert input, inference or AI estimate).
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- configuration evidence c, documentary evidence c, external assurance report c, forensic artefact c, governance evidence c, interview evidence c, observational evidence c, operational evidence c, response evidence c, test evidence c, transactional evidence c
- is in domain of
- access restriction dp, collected by op, collected on dp, custodian op, evidence for population op, evidence hash dp, evidence limitation dp, evidence locator dp, has evidence basis op
- is in range of
- fulfilled by op, has evidence op, produced evidence op, receipt evidence op, sufficiency of op
- is disjoint with
- source record c
evidence requestc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000539
A request from an assessor to an identified agent for stated evidence by a stated date.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- fulfilled by op, requested from op
- is in range of
- requests evidence op
evidence requirementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000512
A directive stating what evidence must exist, and how it may be obtained, for a requirement or obligation to be shown as met.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- evidence requirement for op, required evidence dp
evidence sufficiency assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000525
A dated record of an assessor's judgement of whether the evidence gathered is sufficient, relevant, current and in scope for a stated objective or criterion.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has sufficiency conclusion op, sufficiency for op, sufficiency of op
exception expiry reviewc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000505
A decision record made when a policy exception reaches its expiry date, deciding whether it is renewed, changed or ended.
- has super-classes
- decision record c
execution statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001172
The state of an automation or action execution.
- has super-classes
- Concept c
- is in range of
- has execution status op
- has members
- awaiting approval ni, cancelled (execution) ni, compensated ni, failed ni, pending (execution) ni, running ni, succeeded ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c
expected damage δec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000043
A CRG parameter estimating, on 0-1, the damage expected if the scenario occurs.
- has super-classes
- CRG parameter c, impact estimate c
external assurance reportc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000522
An evidence item describing a report issued by an independent assurer on an organisation's or a service provider's controls, such as a SOC 1 or SOC 2 report or a certification audit report, with its type, period, scope, opinion, exceptions and the controls it expects users to operate.
- has super-classes
- evidence register entry c
- is in domain of
- has assurance opinion op, has assurance report type op, issued by assurer op, report on service of op, report scope dp
- is in range of
- complementary user entity control of op, exception in report op
external assurance rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000487
The role of an agent outside the organisation, such as an external auditor or service auditor, that gives assurance on its governance, risk management or control.
- has super-classes
- governance role c
- is disjoint with
- first-line role c, second-line role c, third-line role c
Facilityc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000192
A Material Artifact that is designed as a building or campus dedicated to some specific purpose.
- has sub-classes
- facility asset c
facility assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000008
An asset that is a building, room or site housing other assets or activities, such as a server room, data centre, archive or clinic.
finding closurec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000548
A dated record that a finding is closed, citing the follow-up verification or the risk acceptance it relies on.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- closed on dp, closes finding op, closure based on op
- is disjoint with
- finding reopening c
finding reopeningc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000549
A dated record that a closed finding is reopened, with the reason, such as the recurrence of the condition.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- reopened on dp, reopening reason dp, reopens finding op
- is disjoint with
- finding closure c
finding significancec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000657
The significance of an audit finding, as rated by the assessor under a stated method.
- has super-classes
- Concept c
- is in range of
- has finding significance op
- has members
- critical significance ni, high significance ni, low significance ni, medium significance ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
first-line rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000484
A management role that owns and manages risk in delivering products, services and operations, including designing and operating controls.
- has super-classes
- governance role c
- has sub-classes
- control owner role c, risk owner role c
- is disjoint with
- second-line role c, third-line role c, external assurance role c
follow-up verificationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000547
A planned act in which an assessor independent of the action owner checks whether a corrective action was implemented and is effective.
- has super-classes
- Planned Act c
- is in domain of
- has verification result op, verifies action op
forensic artefactc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001123
An evidence item collected for forensic analysis, such as a disk or memory image, kept under recorded custody with its integrity hash.
- has super-classes
- evidence register entry c
frameworkc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000296
A published standard, framework, law or catalogue whose requirements are held as a concept scheme, identified with its version, such as NIST CSF 2.0 or ISO/IEC 27002:2022.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- part of framework op
framework adoptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000898
A decision record by which an organisation has committed to meet a framework, or a stated part of it, for a stated scope, which makes its requirements commitments of that organisation. It records the commitment, not conformity.
- has super-classes
- decision record c
- is in domain of
- adoption scope dp, adopts framework op
framework requirementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000021
A requirement, control objective or outcome stated in a published framework or standard, identified by its official identifier.
- has super-classes
- Prescriptive Information Content Entity c
governance committeec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000479
A group of persons to which a governing body delegates the oversight of a defined area, such as audit, risk or compliance.
- has super-classes
- Group of Agents c
- has sub-classes
- audit committee c, risk committee c
- is in domain of
- committee of op
- is disjoint with
- governing body c
governance evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000521
An evidence item describing governance acts, such as minutes, approvals, charters or delegations.
- has super-classes
- evidence register entry c
governance rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000482
A role that an agent bears within an organisation's governance, risk management, control or assurance arrangements, and that can be assigned and withdrawn without the agent changing.
- has super-classes
- role c
- has sub-classes
- external assurance role c, first-line role c, governing body member role c, second-line role c, third-line role c
- is in domain of
- requires independence from op, role for op
- is in range of
- assignment of role op
governance statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000066
The approval state of an ontology element or data item.
- has super-classes
- Concept c
- has members
- approved ni, deprecated ni, proposed ni, rejected ni
- is disjoint with
- confidence level c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
governing bodyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000478
A group of persons with ultimate accountability for directing and overseeing an organisation, such as a board of directors or a board of trustees.
- has super-classes
- Group of Agents c
- is in range of
- committee of op
- is disjoint with
- governance committee c
governing body member rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000483
The role of a person who sits on a governing body or one of its committees.
- has super-classes
- governance role c
Group of Agentsc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000300
An Object Aggregate that has only Agents as member parts.
- has sub-classes
- audit function c, governance committee c, governing body c
- is in range of
- role within op
guidelinec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000889
A directive, issued as guidance separate from any policy, that recommends a practice without making it mandatory. Departing from a guideline needs no exception. A 'should' or 'may' statement written inside a policy is a policy statement, not a guideline.
- has super-classes
- Prescriptive Information Content Entity c
- is disjoint with
- policy statement c
hardware assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000004
An asset that is a material artifact used to process, store or transmit information, such as a server, workstation, network device or connected equipment.
- has super-classes
- Material Artifact c, asset c
- has sub-classes
- connected device c, network asset c
hunting hypothesisc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001110
An analytical hypothesis that a stated adversary behaviour may be present in the organisation's environment, put forward to direct a threat hunt.
- has super-classes
- analytical hypothesis c
impact dimensionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000072
A dimension along which a consequence affects the organisation.
- has super-classes
- Concept c
- is in range of
- has impact dimension op, impact on dimension op
- has members
- availability ni, confidentiality ni, financial ni, integrity ni, legal and regulatory ni, operational ni, privacy ni, reputation ni, safety ni, strategic ni
- is disjoint with
- confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
impact estimatec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000298
An estimate of the magnitude of a scenario's consequences, on any scale.
- has super-classes
- estimate c
- has sub-classes
- expected damage δe c, maximum damage δm c
impact reductionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000048
A CRG parameter estimating, on 0-1, how much the scenario's treatment package reduces its impact.
- has super-classes
- CRG parameter c
incidentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000015
An actual occurrence of an adverse event affecting the organisation's assets or information, including a confidentiality incident under Loi 25.
- has super-classes
- process c
- is in domain of
- incident informs scenario op, matches threat event op
- is in range of
- confirms incident op, reportability of op, timeline of op
- is disjoint with
- security investigation c
incident categoryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001194
A broad category of an incident. CRGO's own scale; NIST SP 800-61 Rev. 3 sets none.
- has super-classes
- Concept c
- is in range of
- has incident category op
- has members
- data exposure ni, denial of service ni, insider misuse ni, loss or theft ni, malware incident ni, misconfiguration exposure ni, social engineering ni, unauthorised access ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident severity c, trigger kind c, communication audience c, response metric c
incident communicationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001125
A record of a notification or escalation about an incident to a stated audience, such as management, affected persons, customers or a regulator, with when it was sent and what it covered.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- communication about op, has audience op, recorded as submission op, sent at dp
incident confirmationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000552
A dated record, made by an identified agent, that an incident has occurred, citing the alerts or events it is based on.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- confirmation based on op, confirmed on dp, confirms incident op
- is disjoint with
- threat indicator c
incident impactc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001124
A description of a consequence an incident had, or is estimated to have had, along one impact dimension, such as hours of service lost or the number of records exposed, with whether it is observed or estimated.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- impact description dp, impact is estimated dp, impact on dimension op
- is in range of
- has observed impact op
incident response phasec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000691
The phase of incident response an incident timeline entry belongs to.
- has super-classes
- Concept c
- is in range of
- in phase op
- has members
- containment ni, detection and analysis ni, eradication ni, post-incident review ni, service recovery ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c
incident severityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001204
The severity of an incident as rated by the responder. CRGO's own scale.
- has super-classes
- Concept c
- is in range of
- has incident severity op
- has members
- critical severity ni, high severity ni, low severity ni, medium severity ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, trigger kind c, communication audience c, response metric c
incident timeline entryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000554
A dated entry in the timeline of an incident, recording what happened or was done and in which response phase.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- entry description dp, in phase op, timeline of op
independence assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000496
A dated record of whether an assessor or assurance function is independent and objective with respect to the activity it assesses, with the threats to independence considered.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has independence conclusion op, independence of op, independence with respect to op, threats considered dp
independence conclusionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000592
The conclusion of an independence assessment.
- has super-classes
- Concept c
- is in range of
- has independence conclusion op
- has members
- impaired, disclosed ni, independent ni, not independent ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c
information assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000002
An asset that is information content, such as a data set, a record collection or a document, independent of the medium that carries it.
- has super-classes
- Information Content Entity c, asset c
Information Content Entityc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000958
A Generically Dependent Continuant that generically depends on some Information Bearing Entity and stands in relation of aboutness to some Entity.
- has sub-classes
- information asset c
information markingc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001156
The sharing restriction attached to information, following the FIRST Traffic Light Protocol 2.0.
- has super-classes
- Concept c
- is in range of
- has information marking op
- has members
- TLP:AMBER ni, TLP:AMBER+STRICT ni, TLP:CLEAR ni, TLP:GREEN ni, TLP:RED ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c
initiative priorityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000128
The urgency class of a treatment initiative in CRG.
- has super-classes
- Concept c
- is in range of
- has priority op
- has members
- immediate ni, near-term ni, scheduled later ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
instrument kindc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000376
The kind of a legal instrument.
- has super-classes
- Concept c
- is in range of
- has instrument kind op
- has members
- contract ni, directive (to be transposed) ni, regulation ni, regulatory guideline ni, statute ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
instrument versionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000507
A description of one version of a legal instrument or standard as in force or published over a stated period, such as a consolidation of a statute or an edition of a standard.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- version of op
- is in range of
- in instrument version op, produces version op
- is disjoint with
- directive version c
interview evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000518
An evidence item describing statements obtained by questioning knowledgeable persons, with who was interviewed and when.
- has super-classes
- evidence register entry c
jurisdictionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000348
A territory whose law or regulator CRGO's legal vocabularies come from, used to state where an organisation is established, offers services or has data subjects.
- has super-classes
- Concept c
- is in range of
- data subjects in op, established in op, has jurisdiction op, monitors behaviour of persons in op, offers goods or services to persons in op, transfers personal information to op
- has members
- British Columbia or Alberta ni, Canada (federal legal order) ni, Canadian province or territory without substantially similar privacy law ni, European Union ni, Québec ni, other country ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, organisation type c, processing role c, personal data category c
key risk indicatorc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000034
A description of a metric used to monitor one or more risk scenarios, with its measurement method, data source, owner, frequency, target and warning and critical thresholds.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- critical threshold dp, data source dp, measurement method dp, monitors op, reporting frequency dp, target value dp, warning threshold dp
knowledge statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000556
The epistemic category of a record or assertion, saying what kind of claim it is and so how far it can be relied on.
- has super-classes
- Concept c
- is in range of
- has knowledge status op
- has members
- analytical hypothesis (knowledge status) ni, audit conclusion (knowledge status) ni, management decision ni, organisational observation ni, reference fact ni, risk estimate ni, verified outcome ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c
legacy computed risk quantityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000057
A computed risk quantity produced by the 2023 scenario-generator notebook, kept for traceability but not comparable with CRG v1.0c results.
- has super-classes
- computed risk quantity c
legal instrumentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000343
A statute, regulation, regulatory guideline, directive to be transposed or binding contract taken as a whole, identified by its official citation or reference, with its jurisdiction and the dates of its publication, coming into force, application and consolidation. Its provisions are the concepts of the corresponding CRGO vocabulary or, for an organisation's contracts, its own clauses.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- consolidated to dp, has in-force period op, has instrument kind op, last amended on dp, official citation dp
- is in range of
- provision of op
legal obligationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000022
A prescription of a duty imposed by a statute or regulation, identified by its legal citation, such as keeping a register of confidentiality incidents under Loi 25.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- triggers obligation op
legal review statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000936
How far a requirement interpretation has been reviewed by legal counsel.
- has super-classes
- Concept c
- is in range of
- has legal review state op
- has members
- legal review in progress ni, legally reviewed ni, not legally reviewed ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c
lesson learnedc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000555
A record of what an incident or exercise showed should change, such as a control, procedure or scenario estimate.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- led to action op, lesson from op, recommends change to op
library scenarioc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000024
A risk scenario written for no particular organisation, or generalised from one, kept in a library to seed candidate scenarios.
- has super-classes
- risk scenario c
- is disjoint with
- assessment scenario c
likelihoodc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000297
An estimate of how likely a threat event or its success is over a stated period, on any scale.
- has super-classes
- estimate c
- has sub-classes
- probability of exploitation Pb(ψ,A) c, threat presence Pb(A) c
management responsec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000545
A dated record of management's position on a finding or recommendation, such as agreeing and committing to action, disagreeing, or accepting the risk.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- commits to action op, has response stance op, responded by op, response to op
management response stancec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000668
Management's position in a response to a finding or recommendation.
- has super-classes
- Concept c
- is in range of
- has response stance op
- has members
- accepts the risk ni, agrees, will act ni, disagrees ni, partly agrees ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
mapping assertionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000912
A directional statement, subject to review, that a source requirement corresponds to a target requirement in a stated way (exact, full or partial coverage, broader, narrower, related or conflicting), with the editions mapped, the rationale, the confidence, the reviewer and its review state. A mapping is not evidence of compliance.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has mapping type op, mapped edition op, mapping confidence dp, mapping source op, mapping target op
- is disjoint with
- compliance determination c
mapping typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000985
How the source of a mapping assertion corresponds to its target.
- has super-classes
- Concept c
- is in range of
- has mapping type op
- has members
- broader mapping ni, conflicting mapping ni, exact mapping ni, full coverage ni, narrower mapping ni, partial coverage ni, related mapping ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, review state c
Material Artifactc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000995
A Material Entity that was designed by some Agent to realize a certain Function.
- has sub-classes
- hardware asset c
maximum damage δmc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000044
A CRG parameter estimating, on 0-1, the damage in a plausible worst case if the scenario occurs.
- has super-classes
- CRG parameter c, impact estimate c
Measurement Information Content Entityc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00001163
A Descriptive Information Content Entity that describes the extent, dimensions, quantity, or quality of an Entity relative to some standard.
- has sub-classes
- estimate c, observation c, response effectiveness measurement c
measurement scalec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000038
A description of the range and meaning of the values an estimate may take, such as the unit interval 0-1, the CVSS 0-10 scale or a five-level ordinal scale.
- has super-classes
- Descriptive Information Content Entity c
- is in range of
- on scale op
- has members
- CRG risk units ni, CVSS base score 0-10 ni, five-point ordinal 1-5 ni, unit interval 0-1 ni
mitigated risk (risk removed)c back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000053
A computed risk quantity equal to estimated risk × probability reduction × impact reduction.
- has super-classes
- computed risk quantity c
monitoring exceptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000540
A record that continuous monitoring, such as a key risk indicator or automated control check, flagged a deviation. It is not an audit finding; it becomes the basis of one only if an audit engagement evaluates it against criteria.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- exception raised on op
- is in range of
- arises from exception op
- is disjoint with
- audit finding c
network assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000006
A hardware asset, or an interconnected set of them, that carries communications between other assets, such as a local network, a WiFi network or an inter-establishment link.
- has super-classes
- hardware asset c
nonconformityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000511
A dated record that a stated requirement, such as a provision, policy statement or management-system requirement, is not fulfilled by an organisation, raised by an audit, an assessment or self-reporting.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- nonconformity with op
- is disjoint with
- compliance determination c
normalisation profilec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001099
A versioned specification of how the fields of a telemetry source are mapped to a common event schema, such as an OCSF event class, so that events from different sources can be compared.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- normalised under op
normative modalityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000913
How binding a policy statement is.
- has super-classes
- Concept c
- is in range of
- has normative modality op
- has members
- may ni, must ni, must not ni, should ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, directive lifecycle state c, review trigger c, mapping type c, review state c
Objectivec back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000476
A Prescriptive Information Content Entity that prescribes some projected state that some Agent intends to achieve.
- has sub-classes
- audit objective c, business objective c
obligated party rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000513
The role of an organisation or person that a legal obligation or provision binds.
- has super-classes
- role c
- is in domain of
- obligated under op
observationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000338
A dated record that a stated source reported a value or category for an entity at a stated time, such as the EPSS score of a vulnerability on a given day. An observation reports what a source said; it is not an estimate made for an assessment.
- has super-classes
- Entity c, Measurement Information Content Entity c
- has sub-classes
- EPSS observation c, security event record c, telemetry health observation c
- is in domain of
- model version dp, observation horizon dp, observation of op, observed on dp
- is disjoint with
- estimate c, analytical result c
observational evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000519
An evidence item describing what an assessor saw while watching a process or control being performed.
- has super-classes
- evidence register entry c
operating effectiveness assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000526
A control assessment that tests whether a control measure operated as designed throughout a stated period, over a stated population or sample.
- has super-classes
- control assessment c
operational evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000517
An evidence item describing output of the routine operation or monitoring of a control, such as reports, dashboards or alerts.
- has super-classes
- evidence register entry c
organisation typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000355
The legal category of an organisation that decides which privacy and security regime binds it.
- has super-classes
- Concept c
- is in range of
- has organisation type op
- has members
- enterprise (private sector) ni, federal work, undertaking or business ni, federally regulated financial institution ni, health and social services body (Québec) ni, public body (Québec) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, processing role c, personal data category c
organisational resilience θc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000045
A CRG parameter estimating, on (0, 1], the organisation's ability to withstand and recover from the scenario; higher means stronger.
- has super-classes
- CRG parameter c
Organizationc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00001180
A Group of Agents which can be the bearer of roles, has members, and has a set of organization rules.
- has sub-classes
- regulatory authority c
- is in domain of
- established in op, has organisation type op, monitors behaviour of persons in op, offers goods or services to persons in op, profile complete for dp
- is in range of
- assesses organisation op, budget of op, carried out by op, concerns organisation op, provided by op, report on service of op, supplier to op, valued by op
oversight activityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000495
A planned act in which a governing body, committee or senior manager reviews and challenges a report, a risk, a decision or an assurance result.
- has super-classes
- Planned Act c
- is in domain of
- oversight by op, oversight of op
parser definitionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001100
A versioned specification of how raw records of a telemetry source are converted into structured events under a normalisation profile.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- parsed by op
Personc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00001262
An Animal that is a member of the species Homo sapiens.
- has members
- Marc-André Léger ni
personal data categoryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000366
A category of personal information that a processing activity handles, used for applicability conditions and sensitivity.
- has super-classes
- Concept c
- is in range of
- processes data category op
- has members
- biometric data ni, data about minors ni, financial and payment data ni, government identifiers ni, health data ni, identity and contact data ni, location data ni, online identifiers ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c
Planc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000974
A Prescriptive Information Content Entity that prescribes some set of intended Intentional Acts through which some Agent expects to achieve some Objective.
- has sub-classes
- audit plan c, audit procedure c, audit work programme c, compliance programme c, corrective action c, detection strategy c, procedure c, sampling plan c, treatment initiative c
plan entry statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000973
The state of an audit plan entry.
- has super-classes
- Concept c
- is in range of
- has plan entry state op
- has members
- approved (plan entry) ni, cancelled (plan entry) ni, completed (plan entry) ni, deferred (plan entry) ni, proposed (plan entry) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, quality review kind c, mapping type c, review state c
Planned Actc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000228
An Act in which at least one Agent plays a causative role and which is prescribed by some Directive Information Content Entity held by at least one of the Agents.
- has sub-classes
- audit engagement c, audit quality review c, compliance assessment campaign c, control assessment c, directive review c, follow-up verification c, oversight activity c, risk assessment c, security investigation c
playbook simulationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001128
A control assessment in which a playbook version is run in a test environment or exercise to check that it behaves as intended.
- has super-classes
- control assessment c
- is in domain of
- simulated playbook op
playbook stepc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001115
A directive that is one step of a playbook version, such as an action, a condition, a branch or a parallel block, with its order and what follows it.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- next playbook step op, step performs action op
- is in range of
- includes step op, next playbook step op
playbook triggerc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001116
A description of what starts a playbook: an alert or event matching stated conditions, a schedule, or a request by an analyst.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has trigger kind op
- is in range of
- has playbook trigger op
playbook versionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001114
A directive version of a response playbook. Executions cite the exact version they ran.
- has super-classes
- directive version c
- is in domain of
- includes step op
- is in range of
- simulated playbook op, uses playbook version op
policyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000497
A directive approved by an organisation's governing body or senior management that states its intentions and rules for a domain, such as information security or privacy.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- statement of policy op
policy acknowledgementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000892
An attestation by a person that they have received and read an exact policy version that applies to them. Acknowledging a policy is not understanding or complying with it.
- has super-classes
- attestation c
policy clausec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000888
A numbered or titled part of a directive version that contains one or more policy statements, used to cite where a statement appears.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- clause of op
- is in range of
- in clause op
policy exceptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000502
A directive that permits a stated deviation from a policy statement, technical standard or control for a stated scope (role, asset or process) and period, approved by an identified authority and usually with compensating controls. It does not waive a legal obligation.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- authorised by risk acceptance op, compensated by op, exception justification dp, exception scope op, exception to op
- is disjoint with
- risk treatment decision c, regulatory exemption c
policy familyc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000885
A named grouping of related directives, such as all the documents on access control, used to find the policies, standards and procedures that cover the same subject.
- has super-classes
- Descriptive Information Content Entity c
- is in range of
- in policy family op
policy statementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000498
A single rule within a policy, stated so that compliance with it can be assessed, such as 'privileged access is reviewed every quarter'.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- has normative modality op, in clause op, intended to mitigate op, requires training op, specified by standard op, statement implemented by op, statement in version op, statement of policy op, statement text dp
- is disjoint with
- guideline c
policy versionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000887
A directive version of a policy.
- has super-classes
- directive version c
populationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000528
A description of the complete set of items, such as transactions, accounts or events over a period, from which a sample is drawn or over which a control is tested.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- population definition dp, population size dp
- is in range of
- evidence for population op, tested population op
pre-treatment ratioc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000301
A computed risk quantity equal to estimated risk divided by tolerated risk, before any treatment.
- has super-classes
- computed risk quantity c
predisposing conditionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000017
A condition of the organisation, its environment or its systems that increases or decreases the likelihood that a threat event causes harm, without being a weakness of a specific control.
- has super-classes
- disposition c
Prescriptive Information Content Entityc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000965
An Information Content Entity that prescribes some Entity.
- has sub-classes
- amendment c, approval gate c, audit charter c, audit criterion c, audit methodology c, complementary user entity control c, configuration baseline c, control c, delegation of authority c, detection rule c, directive version c, evidence request c, evidence requirement c, framework c, framework requirement c, guideline c, legal instrument c, legal obligation c, normalisation profile c, parser definition c, playbook step c, policy c, policy clause c, policy exception c, policy statement c, recommendation c, regulatory exemption c, response action c, risk appetite statement c, risk treatment decision c, software asset c, technical standard c, training requirement c
probability of exploitation Pb(ψ,A)c back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000042
A CRG parameter estimating the probability that the threat exploits the scenario's vulnerability or condition, given the controls in place.
- has super-classes
- CRG parameter c, likelihood c
probability reductionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000047
A CRG parameter estimating, on 0-1, how much the scenario's treatment package reduces its probability.
- has super-classes
- CRG parameter c
procedurec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000500
A plan that sets out the steps by which a policy statement or technical standard is carried out, by whom and when.
- has super-classes
- Plan c
- has sub-classes
- response playbook c
- is in range of
- implemented by procedure op
processc back to ToC or Class ToC
IRI: http://purl.obolibrary.org/obo/BFO_0000015
(Elucidation) p is a process means p is an occurrent that has some temporal proper part and for some time t, p has some material entity as participant
- has sub-classes
- business process c, calculation activity c, incident c, security event c
processing activityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000341
A business process, or part of one, in which an organisation collects, uses, discloses, keeps or destroys personal information for stated purposes.
- has super-classes
- business process c
- is in domain of
- carried out by op, data subjects in op, has processing role op, processes data category op, transfers personal information to op
processing rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000362
The role an organisation plays in a processing activity.
- has super-classes
- Concept c
- is in range of
- has processing role op
- has members
- controller ni, processor or service provider ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, personal data category c
Proper intervalc back to ToC or Class ToC
IRI: http://www.w3.org/2006/time#ProperInterval
A temporal entity with non-zero extent or duration, i.e., for which the value of the beginning and end are different
- is in range of
- has in-force period op
provision versionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000900
A record of the wording of a provision as in force over a stated period, kept when an amendment changes that wording, so that earlier assessments can be reproduced against the text that applied then.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- in instrument version op, provision version of op, provision wording dp
- is in range of
- evaluates provision version op
quality review kindc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000980
The kind of an audit quality review.
- has super-classes
- Concept c
- is in range of
- has quality review kind op
- has members
- external quality assessment ni, internal quality assessment ni, supervisory review ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, mapping type c, review state c
realizable entityc back to ToC or Class ToC
IRI: http://purl.obolibrary.org/obo/BFO_0000017
(Elucidation) A realizable entity is a specifically dependent continuant that inheres in some independent continuant which is not a spatial region & which is of a type some instances of which are realized in processes of a correlated type
- has sub-classes
- service asset c
reassessment triggerc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000510
A record that an event, such as a regulatory change, an incident, an audit finding or the expiry of an exception, requires an existing assessment or determination to be reviewed.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- requires review of op, triggered by op
recommendationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000544
A directive proposed by an assessor to address the cause or effect of a finding.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- recommendation for op
- is in range of
- justifies recommendation op
recovery verificationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001126
A dated record that an asset or business process affected by an incident was checked to be restored to its expected operation, by whom and on what evidence.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- recovery after op, verifies recovery of op
regulatory authorityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000897
An organisation with legal power to issue, supervise or enforce legal instruments in a jurisdiction, such as a data protection authority.
- has super-classes
- Organization c
- is in range of
- enforced by op, granted by op, issued by authority op, submission to op
regulatory changec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000509
A record that a legal instrument, provision or regulatory guidance relevant to CRGO users is new, amended or repealed, with the dates it was identified and takes effect.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- change of op, has change type op
regulatory change typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000608
The kind of a regulatory change.
- has super-classes
- Concept c
- is in range of
- has change type op
- has members
- amended ni, guidance or interpretation ni, new instrument or provision ni, repealed ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c
regulatory exemptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000903
A directive issued by an authority that relieves an organisation, for a stated scope and period, from an obligation or part of it, on a stated legal basis. Only an authority with power over the obligation can grant it; an internal approval cannot.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- exemption from op, granted by op, legal basis dp
- is disjoint with
- policy exception c
regulatory submissionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000902
A record of a notice, filing or report sent to an authority under an obligation, with when it was submitted, its state and the receipt or acknowledgement obtained.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- answers deadline op, has submission state op, receipt acknowledged on dp, receipt evidence op, submission to op, submission under op, submitted on dp
- is in range of
- recorded as submission op
reportability statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000686
The result of a breach reportability assessment.
- has super-classes
- Concept c
- is in range of
- has reportability state op
- has members
- not reportable ni, reportability undetermined ni, reportable ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, incident response phase c
requirement interpretationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000896
A statement, subject to legal review, of how an organisation reads an obligation, provision or framework requirement for its own situation, with the assumptions made and its legal review state. It is the organisation's reading, not the text and not legal advice.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has legal review state op, interpretation of op
requirement levelc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000084
A level of confidentiality, integrity or availability requirement placed on an asset.
- has super-classes
- Concept c
- is in range of
- has availability requirement op, has confidentiality requirement op, has integrity requirement op
- has members
- high requirement ni, low requirement ni, moderate requirement ni, very high requirement ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
residual riskc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000054
A computed risk quantity equal to estimated risk minus mitigated risk.
- has super-classes
- computed risk quantity c, risk level c
response actionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001117
A directive that defines a kind of action a playbook may take, such as disabling an account, isolating a host or blocking a domain, with its risk class and the approval it needs. It is the definition, not an execution.
- has super-classes
- Prescriptive Information Content Entity c
- is in domain of
- corresponds to defensive technique op, has action risk class op
- is in range of
- performs action op, step performs action op
- is disjoint with
- response playbook c
response effectiveness measurementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001127
A measurement of how quickly or well an incident or a set of incidents was handled, such as time to contain, for a stated metric and under a stated method.
- has super-classes
- Measurement Information Content Entity c
- is in domain of
- measurement of op, measures metric op, metric method dp, value (hours) dp
response evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001122
An evidence item recording that a response action was carried out and with what result, such as a system log entry or a screenshot of the changed configuration.
- has super-classes
- evidence register entry c
response metricc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001224
What a response effectiveness measurement measures.
- has super-classes
- Concept c
- is in range of
- measures metric op
- has members
- dwell time ni, time to acknowledge ni, time to contain ni, time to detect ni, time to recover ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c
response playbookc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001113
A procedure that sets the steps, conditions, actions and approvals by which a kind of alert or incident is to be handled, manually or by automation, such as a CACAO playbook.
- has super-classes
- procedure c
- is in domain of
- addresses scenario op
- is disjoint with
- response action c
review statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000994
The review state of an organisation record such as a mapping assertion or a requirement interpretation. Not the governance status of a CRGO term.
- has super-classes
- Concept c
- is in range of
- has review state op
- has members
- approved (record) ni, draft (record) ni, rejected (record) ni, under review (record) ni, withdrawn (record) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c
review triggerc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000927
What caused a directive review.
- has super-classes
- Concept c
- is in range of
- has review trigger op
- has members
- audit or assessment finding (trigger) ni, incident (trigger) ni, organisational change (trigger) ni, regulatory change (trigger) ni, risk change (trigger) ni, scheduled review ni, technology change (trigger) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, mapping type c, review state c
risk acceptancec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000031
A risk treatment decision to retain a residual risk, recording the accepting authority and an expiry date.
- has super-classes
- risk treatment decision c
- is in domain of
- accepting authority dp, expiry date dp
- is in range of
- authorised by risk acceptance op
risk appetite statementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000029
A prescription, approved by management, of how much cybersecurity risk the organisation is willing to accept, expressed in CRG on a 0-1 scale.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- has risk appetite op
risk assessmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000028
A planned act in which an organisation identifies, analyses and evaluates its cybersecurity risk scenarios over a stated period, using a stated method and risk appetite.
- has super-classes
- Planned Act c
- is in domain of
- assesses organisation op, assessment factor dp, assessment horizon dp, case appetite dp, has risk appetite op, includes scenario op, uses calculation method op
- is in range of
- assessed in op
- is disjoint with
- control assessment c
risk committeec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000481
A governance committee that oversees risk appetite, risk exposure and the risk management framework.
- has super-classes
- governance committee c
risk levelc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000299
An estimate of the magnitude of a risk, combining likelihood and impact by a stated method.
- has super-classes
- estimate c
- has sub-classes
- estimated risk Re c, residual risk c
risk management function rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000490
The role of a person or unit that maintains the risk management framework, challenges risk assessments and reports aggregate risk.
- has super-classes
- second-line role c
risk owner rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000492
The role of the person with the accountability and authority to manage a risk, including proposing its treatment or acceptance.
- has super-classes
- first-line role c
risk scenarioc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000023
A description of a plausible causal chain in which a threat source initiates a threat event that exploits a vulnerability or condition, affects assets or processes and leads to consequences.
- has super-classes
- Descriptive Information Content Entity c
- has sub-classes
- assessment scenario c, library scenario c
- is in domain of
- affects asset op, affects asset category op, affects process op, applicable sector dp, background dp, exploits op, has consequence op, has control gap op, has relevant requirement op, has risk owner op, has scenario category op, has stakeholder op, has step op, has threat event op, has threat source description op, has treatment decision op, has vulnerability description op, initiated by op, mitigated by op, narrative dp, refines op, statement dp, suggested mitigation dp
- is in range of
- addresses op, addresses scenario op, allocated to op, case of op, covers scenario op, finding about scenario op, incident informs scenario op, includes scenario op, intended to mitigate op, obligation at stake in op, refines op
risk stagec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000101
Whether an estimate applies before or after treatment.
- has super-classes
- Concept c
- is in range of
- has risk stage op
- has members
- inherent ni, residual ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c
risk treatment decisionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000030
A decision prescribing how a risk scenario is treated (modify, retain, avoid or share), by whom and with what authority.
- has super-classes
- Prescriptive Information Content Entity c
- has sub-classes
- risk acceptance c
- is in domain of
- decided by op, has treatment option op, treatment horizon dp, treatment summary dp
- is in range of
- has treatment decision op
- is disjoint with
- policy exception c
risk-to-tolerance ratioc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000055
A computed risk quantity equal to residual risk divided by tolerated risk; below 0.90 is below tolerance and above 1.10 is above tolerance.
- has super-classes
- computed risk quantity c
- is in domain of
- has tolerance classification op
rolec back to ToC or Class ToC
IRI: http://purl.obolibrary.org/obo/BFO_0000023
(Elucidation) A role b is a realizable entity such that b exists because there is some single bearer that is in some special physical, social, or institutional set of circumstances in which this bearer does not have to be & b is not such that, if it ceases to exist, then the physical make-up of the bearer is thereby changed
- has sub-classes
- governance role c, obligated party role c, supplier role c, threat source role c
role assignmentc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000493
A record that an agent bears a governance role over a stated period, so that who held the role on a given date can be answered.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- assigned to op, assignment of role op
root-cause categoryc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000951
A broad category of the cause of a finding or nonconformity, used to group recurring causes. CRGO's own scale.
- has super-classes
- Concept c
- is in range of
- has root-cause category op
- has members
- control design (cause) ni, governance (cause) ni, people (cause) ni, process (cause) ni, resourcing (cause) ni, technology (cause) ni, third party (cause) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, mapping type c, review state c
sample itemc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000530
A description of one item selected under a sampling plan and the result of testing it.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- has sample result op, sample of op
sample resultc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000652
The result of testing one sample item.
- has super-classes
- Concept c
- is in range of
- has sample result op
- has members
- conforming ni, deviation ni, not testable ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
sampling methodc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000645
How the items of a sample are selected.
- has super-classes
- Concept c
- is in range of
- has sampling method op
- has members
- haphazard selection ni, judgemental selection ni, random selection ni, stratified selection ni, systematic selection ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
sampling planc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000529
A plan that states how items are selected from a population, how many, and the tolerable and expected deviation on which the sample size is based.
- has super-classes
- Plan c
- is in domain of
- expected deviation rate dp, has sampling method op, planned sample size dp, sampling seed dp, tolerable deviation rate dp
- is in range of
- sample of op, uses sampling plan op
scenario criticality μ(E)c back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000046
A CRG parameter estimating, on 0-1, the strategic importance to the organisation of the assets and processes at risk in the scenario.
- has super-classes
- CRG parameter c
scenario stepc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000026
A description of one stage in the event sequence of a risk scenario, with its order and evidence basis.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- next step op, step order dp
- is in range of
- has step op, next step op
screening criterionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000147
One of the 12 CRG criteria used to score candidate scenarios.
- has super-classes
- Concept c
- is in range of
- for criterion op
- has members
- asset criticality ni, business criticality ni, control uncertainty ni, decision usefulness ni, dependency / concentration ni, evidence strength ni, exposure / vulnerability ni, operational resilience ni, potential impact ni, regulatory / legal ni, risk velocity ni, threat relevance ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, escalation flag c, asset category c, asset tier c
screening scorec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000039
An estimate scoring a candidate scenario from 1 to 5 on one screening criterion.
- has super-classes
- estimate c
- is in domain of
- for criterion op
second-line rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000485
A management role that gives expertise, support, monitoring and challenge on risk-related matters, such as risk management or compliance functions.
- has super-classes
- governance role c
- has sub-classes
- compliance officer role c, risk management function role c
- is disjoint with
- first-line role c, third-line role c, external assurance role c
security alertc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000551
A notification, generated by a monitoring tool or a person, that one or more security events may indicate an incident and need triage.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- alert about op, correlated with op, generated by rule op, has alert disposition op, opened investigation op
- is in range of
- correlated with op, investigates alert op
security eventc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000550
An observable occurrence in an information system or network that may be relevant to security, such as a failed login or a malware detection. An event can be part of an incident; most events are not.
- has super-classes
- process c
- is in range of
- alert about op
security event recordc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001098
An observation that points to one security event held in an operational store, with the source that emitted it, when it occurred and was recorded, and the profile it was normalised under. It does not carry the event payload.
- has super-classes
- observation c
- is in domain of
- emitted by op, normalised under op, parsed by op
- is disjoint with
- telemetry health observation c
security investigationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001112
A planned act in which analysts examine one or more alerts, events or reports to establish what happened, whether it is an incident and what its scope is, with its case status as last recorded.
- has super-classes
- Planned Act c
- is in domain of
- concluded incident op, has case status op, investigates alert op, opened at dp
- is disjoint with
- incident c
selection dispositionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000110
The outcome of screening a candidate scenario.
- has super-classes
- Concept c
- is in range of
- has selection disposition op
- has members
- consolidated ni, deferred ni, selected ni, under consideration ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c
sensitivity casec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000060
A description of a variant of a scenario's estimates (lower, central or higher) used to test whether its tolerance classification changes.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- case of op, has case type op
- is in range of
- in sensitivity case op
sensitivity case typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000123
The direction of a CRG sensitivity shift.
- has super-classes
- Concept c
- is in range of
- has case type op
- has members
- central case ni, higher case ni, lower case ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c
service assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000007
An asset that is a provider's capability to deliver a service to the organisation, internally or as a third party, such as a cloud application, hosting, telecommunications or a managed security service; the capability inheres in the provider's systems or organisation.
- has super-classes
- asset c, realizable entity c
software assetc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000003
An asset that is a computer program or application, including its configuration, considered independently of the hardware that runs it.
- has super-classes
- Prescriptive Information Content Entity c, asset c
source access statusc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000565
Whether CRGO holds and may use a source, and so what it can import from it.
- has super-classes
- Concept c
- is in range of
- has access status op
- has members
- licence restricted ni, pending access ni, rejected source ni, verified source ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, evidence quality c, distribution family c, reportability state c, incident response phase c
source recordc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000337
A description of a dataset, publication or legal text from which CRGO content was imported or derived, recording its issuer, official identifier, version, retrieval date, licence, what CRGO redistributes and the checksum of the file used.
- has super-classes
- Descriptive Information Content Entity c, Entity c
- has sub-classes
- threat intelligence source c
- is in domain of
- SHA-256 checksum dp, has access status op, issuer dp, licence or terms dp, official identifier dp, redistribution in CRGO dp, retrieved on dp, source version dp, verification note dp
- is in range of
- has source record op
- is disjoint with
- evidence register entry c
submission statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000941
The state of a regulatory submission.
- has super-classes
- Concept c
- is in range of
- has submission state op
- has members
- acknowledged by the authority ni, rejected by the authority ni, submission in preparation ni, submitted ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, deadline trigger kind c, root-cause category c, mapping type c, review state c
sufficiency conclusionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000624
The conclusion of an evidence sufficiency assessment.
- has super-classes
- Concept c
- is in range of
- has sufficiency conclusion op
- has members
- insufficient ni, out of date ni, out of scope ni, sufficient and appropriate ni, sufficient with limitations ni, unavailable ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
supplier rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000342
A role of an organisation that supplies goods, services or the operation of assets to another organisation, which comes to depend on it.
- has super-classes
- role c
- is in domain of
- supplier to op
technical standardc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000499
An internal directive that specifies mandatory technical requirements implementing one or more policy statements, such as a password or encryption standard.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- specified by standard op
telemetry health observationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001109
An observation of whether a telemetry source was delivering the expected data at a stated time, such as healthy, degraded or silent.
- has super-classes
- observation c
- is in domain of
- has telemetry health state op
- is disjoint with
- security event record c
telemetry health statec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001150
The state reported by a telemetry health observation.
- has super-classes
- Concept c
- is in range of
- has telemetry health state op
- has members
- degraded (telemetry) ni, healthy (telemetry) ni, silent (telemetry) ni, unknown (telemetry) ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, information marking c
telemetry sourcec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001097
A description of a product, service or device configured to send security logs or events to an organisation's monitoring, with the asset it runs on, the kinds of data it sends and how they are collected.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- provides data component op, source asset op
- is in range of
- emitted by op, profile for source op
test evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000520
An evidence item describing the result of an assessor exercising or re-performing a control under stated conditions and comparing actual with expected behaviour.
- has super-classes
- evidence register entry c
third-line rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000486
The role of internal audit: independent and objective assurance and advice to the governing body and management on governance, risk management and control.
- has super-classes
- governance role c
- has sub-classes
- chief audit executive role c
- is disjoint with
- first-line role c, second-line role c, external assurance role c
threat event descriptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000014
A description of a kind of event that, if it occurred, could adversely affect assets, such as credential phishing, ransomware encryption or a server-room fire.
- has super-classes
- Descriptive Information Content Entity c
- is in range of
- has threat event op, matches threat event op, potentially indicates op
threat indicatorc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001104
A description of a pattern, such as a file hash, address, domain or behaviour, that a source states may indicate malicious activity, with its validity period, its confidence as given by the source and how that confidence is defined. A match with an indicator is not by itself an incident or an attribution.
- has super-classes
- Descriptive Information Content Entity c
- is in domain of
- indicator from source op, indicator pattern dp, pattern language dp
- is in range of
- matched indicator op
- is disjoint with
- incident confirmation c
threat intelligence sourcec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001105
A source record for a provider or feed of threat intelligence, with its licence, its sharing marking and the reliability the organisation gives it.
- has super-classes
- source record c
- is in range of
- indicator from source op
threat presence Pb(A)c back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000041
A CRG parameter estimating the probability that the scenario's threat event is attempted or occurs during the horizon.
- has super-classes
- CRG parameter c, likelihood c
threat source descriptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000294
A description of a kind of threat source, such as a financially motivated cybercriminal, a negligent employee or a flood, with its type, used when the source is not an identified agent or process.
- has super-classes
- Descriptive Information Content Entity c
- is in range of
- has threat source description op
threat source rolec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000012
A role borne by an agent or artifact in virtue of which it may initiate a threat event, intentionally or not.
- has super-classes
- role c
threat source typec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000090
A category of threat source following NIST SP 800-30.
- has super-classes
- Concept c
- is in range of
- has threat source type op
- has members
- accidental ni, adversarial ni, environmental ni, structural ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, control status c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, mapping type c, review state c
tolerance classificationc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000105
The CRG reading of a risk-to-tolerance ratio.
- has super-classes
- Concept c
- is in range of
- has tolerance classification op
- has members
- above tolerance ni, approximately at tolerance ni, below tolerance ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, treatment option c, screening criterion c, escalation flag c, asset category c, asset tier c
tolerated risk Rtc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000052
A computed risk quantity equal to Pb(A) × Pb(ψ,A) × CVSS × appetite × μ(E) ÷ θ × factor.
- has super-classes
- computed risk quantity c
training requirementc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000893
A directive that persons in a stated role or scope complete stated training, usually because a policy statement applies to them. Completing training is not the same as acknowledging or complying.
- has super-classes
- Prescriptive Information Content Entity c
- is in range of
- requires training op
transactional evidencec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000516
An evidence item describing records of individual transactions or events, such as access requests, change tickets or log entries, from which samples can be drawn.
- has super-classes
- evidence register entry c
treatment initiativec back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000032
A plan to implement one or more control measures that addresses one or more risk scenarios, with owner, priority, costs and schedule.
- has super-classes
- Plan c
- is in domain of
- addresses op, has priority op, includes control measure op, initial cost dp, planned end dp, planned start dp, recurring cost dp, success indicator dp
- is in range of
- allocation of op
treatment optionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000141
One of the generic ways to treat a risk.
- has super-classes
- Concept c
- is in range of
- has treatment option op
- has members
- risk avoidance ni, risk modification ni, risk retention ni, risk sharing ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, tolerance classification c, selection disposition c, evidence basis c, sensitivity case type c, initiative priority c, control function c, screening criterion c, escalation flag c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, normative modality c, directive lifecycle state c, review trigger c, mapping type c, review state c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, assessment method c, assessor line c, regulatory change type c, reportability state c, incident response phase c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, knowledge status c, source access status c, evidence quality c, distribution family c, reportability state c, incident response phase c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, evidence basis c, initiative priority c, control function c, asset category c, asset tier c, mapping type c, review state c
trigger kindc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0001210
What kind of thing starts a playbook.
- has super-classes
- Concept c
- is in range of
- has trigger kind op
- has members
- alert trigger ni, event trigger ni, manual trigger ni, scheduled trigger ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, verification result c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, communication audience c, response metric c
verification resultc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000681
The result of a follow-up verification.
- has super-classes
- Concept c
- is in range of
- has verification result op
- has members
- action partly effective ni, implemented and effective ni, not implemented or not effective ni
- is disjoint with
- confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, reportability state c, incident response phase c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c, detection status c, alert disposition c, coverage status c, telemetry health state c, information marking c, case status c, execution status c, approval status c, action risk class c, incident category c, incident severity c, trigger kind c, communication audience c, response metric c, confidence level c, governance status c, impact dimension c, requirement level c, threat source type c, control status c, risk stage c, evidence basis c, initiative priority c, control function c, treatment option c, asset category c, asset tier c, jurisdiction c, organisation type c, processing role c, personal data category c, instrument kind c, applicability state c, compliance state c, condition kind c, control test result c, knowledge status c, source access status c, evidence quality c, distribution family c, decision outcome c, independence conclusion c, assessment method c, assessor line c, regulatory change type c, control aspect c, deficiency severity c, sufficiency conclusion c, assurance report type c, assurance opinion c, sampling method c, sample result c, finding significance c, engagement rating c, management response stance c, corrective action status c, normative modality c, directive lifecycle state c, review trigger c, legal review state c, submission state c, deadline trigger kind c, root-cause category c, engagement type c, engagement state c, plan entry state c, quality review kind c, mapping type c, review state c
vulnerabilityc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000016
A disposition of a material asset, such as a device, storage medium or network equipment, or of an organisation, that a threat source can exploit to cause harm. Weaknesses of software, information or controls are recorded as vulnerability descriptions.
- has super-classes
- Vulnerability c
Vulnerabilityc back to ToC or Class ToC
IRI: https://www.commoncoreontologies.org/ont00000548
A Disrupting Disposition the realization of which would disrupt a process that the bearer of the Disrupting Disposition has an interest in.
- has sub-classes
- vulnerability c
vulnerability descriptionc back to ToC or Class ToC
IRI: https://w3id.org/crgo/CRGO_0000295
A description of a kind of weakness or predisposing condition, including weaknesses of software, information and controls, that a threat event can exploit.
- has super-classes
- Descriptive Information Content Entity c
- is in range of
- has vulnerability description op
Object Properties
- accountable for
- action target
- adapts reference strategy
- addressed by
- addresses
- addresses scenario
- adopts framework
- affects asset
- affects asset category
- affects process
- alert about
- allocated to
- allocation of
- amends instrument
- amends provision
- analytic uses data component
- answers deadline
- applicability of
- applies to scope
- approving authority
- arises from exception
- assessed by
- assessed in
- assessed under
- assesses aspect
- assesses organisation
- assigned to
- assignment of role
- attack pattern exploits weakness
- attack pattern related to technique
- attestation about
- attested by
- auditable entity for
- authorised by
- authorised by risk acceptance
- based on assessment
- based on control assessment
- baseline of
- broader than
- budget of
- carried out by
- case of
- change of
- charter of
- clause of
- closes finding
- closure based on
- collected by
- commits to action
- committee of
- communication about
- comparable obligation
- compensated by
- complementary user entity control of
- compliance with
- computed from input
- concerns organisation
- concluded incident
- conclusion of
- condition met
- condition not met
- condition of
- condition undetermined
- confirmation based on
- confirms incident
- conflict concerns
- control corresponds to control
- corrects
- correlated with
- corresponds to defensive technique
- coverage by
- covers asset
- covers scenario
- covers technique
- criterion refers to
- custodian
- data subjects in
- deadline for
- deadline triggered by
- decided by
- decision made by
- decision on
- declared by
- deficiency aspect
- deficiency of
- delegates authority to
- delegation from
- delegation to
- depends on assumption
- derived from requirement
- determination in
- emitted by
- enforced by
- engagement on
- entry for auditable entity
- entry for engagement
- entry in plan
- entry informed by
- established in
- estimate of
- evaluates control
- evaluates control measure
- evaluates provision version
- evidence for population
- evidence requirement for
- exception in report
- exception raised on
- exception scope
- exception to
- executes procedure
- execution for
- execution triggered by
- exemption from
- exploits
- finding about scenario
- finding on control
- follows methodology
- follows programme
- for criterion
- fulfilled by
- fulfils criterion
- gap for technique
- gap in telemetry
- gate authority
- gate for risk class
- generated by
- generated by rule
- granted by
- hadPrimarySource
- has access status
- has action risk class
- has action status
- has alert disposition
- has applicability state
- has approval status
- has asset tier
- has assurance opinion
- has assurance report type
- has audience
- has audit objective
- has availability requirement
- has case status
- has case type
- has change type
- has compliance state
- has condition kind
- has confidence
- has confidentiality requirement
- has consequence
- has control function
- has control gap
- has control status
- has coverage status
- has deadline trigger kind
- has decision outcome
- has deficiency severity
- has detection status
- has distribution
- has distribution family
- has engagement rating
- has engagement state
- has engagement type
- has escalation flag
- has evidence
- has evidence basis
- has evidence quality
- has execution status
- has external reference
- has finding significance
- has impact dimension
- has in-force period
- has incident category
- has incident severity
- has independence conclusion
- has information marking
- has instrument kind
- has integrity requirement
- has jurisdiction
- has knowledge status
- has legal review state
- has lifecycle state
- has mapping type
- has normative modality
- has observed impact
- has organisation type
- has owner
- has plan entry state
- has playbook trigger
- has priority
- has procedure
- has processing role
- has quality review kind
- has relevant requirement
- has reportability state
- has response stance
- has review state
- has review trigger
- has risk appetite
- has risk owner
- has risk stage
- has root-cause category
- has sample result
- has sampling method
- has scenario category
- has selection disposition
- has source record
- has stakeholder
- has step
- has submission state
- has sufficiency conclusion
- has telemetry health state
- has test result
- has threat event
- has threat source description
- has threat source type
- has tolerance classification
- has treatment decision
- has treatment option
- has trigger kind
- has verification result
- has vulnerability description
- housed in
- hypothesis about
- hypothesised cause
- identified by
- impact on dimension
- implemented by procedure
- implements control
- implements strategy
- in clause
- in instrument version
- in phase
- in policy family
- in sensitivity case
- incident informs scenario
- includes auditable entity
- includes control measure
- includes scenario
- includes step
- independence of
- independence with respect to
- indicator from source
- informed by
- initiated by
- intended to mitigate
- interpretation of
- investigates alert
- involves asset
- is about
- issued by assurer
- issued by authority
- justifies recommendation
- led to action
- lesson from
- mapped edition
- mapping source
- mapping target
- maps to event class
- maps to requirement
- matched indicator
- matches threat event
- measurement of
- measures metric
- missing control
- mitigated by
- monitors
- monitors behaviour of persons in
- narrower than
- next playbook step
- next step
- nonconformity with
- normalised under
- objective of programme
- obligated under
- obligation at stake in
- observation of
- offers goods or services to persons in
- on scale
- opened investigation
- operates control
- oversees
- oversight by
- oversight of
- parsed by
- part of execution
- part of framework
- partially overlaps
- performed in capacity
- performs action
- planned engagement
- potentially indicates
- pre-authorises action
- prepared by
- principle addressed by category
- processes data category
- produced evidence
- produces evidence for
- produces version
- profile for source
- programme covers
- protects asset
- provided by
- provides data component
- provision of
- provision version of
- quality review of
- raised from
- receipt evidence
- recommendation for
- recommends change to
- recorded as submission
- recovery after
- refines
- relies on asset
- reopens finding
- report of
- report on service of
- reportability of
- reports finding
- reports to
- requested from
- requests evidence
- requires approval
- requires independence from
- requires review of
- requires source
- requires training
- responded by
- response to
- result for
- review of
- review triggered by
- reviewed by
- role for
- role within
- rule for measure
- same obligation in another regime
- sample of
- serves objective
- simulated playbook
- source asset
- specified by standard
- statement implemented by
- statement in version
- statement of policy
- step performs action
- subcategory supported by control
- submission to
- submission under
- sufficiency for
- sufficiency of
- supersedes
- supplier to
- supported by test
- supports compliance with
- supports objective
- supports process
- targets technique
- technique countered by defensive technique
- technique mitigated by control
- tested population
- tested rule
- timeline of
- transfers personal information to
- triggered by
- triggers obligation
- under delegation
- used input
- uses analytic
- uses assessment method
- uses calculation method
- uses criterion
- uses method
- uses playbook version
- uses sampling plan
- validated as
- valuation of
- valued by
- verifies action
- verifies recovery of
- version of
- version of directive
- vulnerability associated with technique
- vulnerability is an instance of weakness
- wasDerivedFrom
- weakness of
- within engagement
- workpaper for
accountable forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000706
Relates an agent, or a group of agents such as a committee, to something it answers for, such as a risk, a control measure, a policy or a corrective action.
action targetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001290
Relates an action execution record to the asset, account or other entity it acted on.
- has domain
- action execution record c
adapts reference strategyop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001239
Relates an organisation's detection strategy to a reference strategy it adapts, such as an ATT&CK detection strategy.
- has domain
- detection strategy c
addressed byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000773
Relates a complementary user entity control to a control measure of the user organisation that carries it out.
- has domain
- complementary user entity control c
- has range
- control measure c
addressesop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000222
Relates a treatment initiative to a risk scenario it is meant to reduce.
- has domain
- treatment initiative c
- has range
- risk scenario c
addresses scenarioop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001276
Relates a response playbook to a risk scenario whose occurrence it is meant to handle. States intent; it does not reduce the scenario's risk by itself.
- has domain
- response playbook c
- has range
- risk scenario c
adopts frameworkop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001029
Relates a framework adoption to the framework, or the part of a framework, adopted.
- has domain
- framework adoption c
affects assetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000198
Relates a risk scenario to an asset that would be harmed.
- has domain
- risk scenario c
- has range
- asset c
affects asset categoryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000322
Relates a risk scenario, typically a library scenario, to a category of asset it would harm.
- has domain
- risk scenario c
- has range
- asset category c
affects processop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000199
Relates a risk scenario to a business process that would be disrupted.
- has domain
- risk scenario c
- has range
- business process c
alert aboutop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000814
Relates a security alert to a security event it reports.
- has domain
- security alert c
- has range
- security event c
allocated toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000226
Relates a cost allocation to the risk scenario it charges.
- has domain
- cost allocation c
- has range
- risk scenario c
allocation ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000225
Relates a cost allocation to the initiative whose cost it shares out.
- has domain
- cost allocation c
- has range
- treatment initiative c
amends instrumentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000740
Relates an amendment to the instrument whose text it changes.
- has domain
- amendment c
amends provisionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000741
Relates an amendment or regulatory change to a provision whose text or reading it changes.
analytic uses data componentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001243
Relates an analytic to a kind of data it reads, such as an ATT&CK data component.
answers deadlineop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001095
Relates a regulatory submission to the compliance deadline it answers. Whether it was on time is computed from the dates, not stated.
- has domain
- regulatory submission c
- has range
- compliance deadline c
applicability ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000426
Relates an applicability assessment to the instrument, provision or policy statement assessed.
- has domain
- applicability assessment c
applies to scopeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001015
Relates a policy statement, guideline or directive to an asset, process, role, organisational unit or jurisdiction it explicitly applies to.
approving authorityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000728
Relates a policy exception, policy or risk acceptance record to the agent with authority to approve it.
arises from exceptionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000791
Relates an audit finding to a monitoring exception that the engagement evaluated against criteria.
- has domain
- audit finding c
- has range
- monitoring exception c
assessed byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000435
Relates an applicability assessment, compliance determination or control assessment to the agent responsible for it.
- has range
- Agent c
assessed inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000232
Relates an estimate to the risk assessment in which it was made.
- has domain
- estimate c
- has range
- risk assessment c
assessed underop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000818
Relates a breach reportability assessment to the provision whose reporting conditions it assesses.
- has domain
- breach reportability assessment c
assesses aspectop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000754
Relates a control assessment to the aspect of the control measure it tests: design, implementation or operation.
- has domain
- control assessment c
- has range
- control aspect c
assesses organisationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000216
Relates a risk assessment to the organisation whose risk it assesses.
- has domain
- risk assessment c
- has range
- Organization c
assigned toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000715
Relates a role assignment to the agent that bears the role.
- has domain
- role assignment c
- has range
- Agent c
assignment of roleop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000714
Relates a role assignment to the governance role assigned.
- has domain
- role assignment c
- has range
- governance role c
attack pattern exploits weaknessop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000440
Relates a CAPEC attack pattern to a CWE weakness it exploits, as referenced by CAPEC.
- has super-properties
- related Match op
attack pattern related to techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000441
Relates a CAPEC attack pattern to an ATT&CK technique it references.
- has super-properties
- related Match op
attestation aboutop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001022
Relates an attestation to what it declares about, such as an exact policy version or a set of obligations.
- has domain
- attestation c
attested byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001021
Relates an attestation to the agent who made it.
- has domain
- attestation c
auditable entity forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000775
Relates an auditable entity to the process, asset, organisation or third party it stands for.
- has super-properties
- is about op
- has domain
- auditable entity c
authorised byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001291
Relates an action execution record to the approval decision it relied on.
- has domain
- action execution record c
- has range
- approval decision c
authorised by risk acceptanceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001017
Relates a policy exception to the risk acceptance decision that accepts the risk it leaves. A policy exception does not imply a risk acceptance; the link is stated when one was made.
- has domain
- policy exception c
- has range
- risk acceptance c
based on assessmentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000796
Relates an audit finding or conclusion to a control assessment it relies on.
- has range
- control assessment c
based on control assessmentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000434
Relates a compliance determination to a control assessment it relies on.
- has domain
- compliance determination c
- has range
- control assessment c
baseline ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001264
Relates a behavioural baseline to the user, account, host or service it describes.
- has domain
- behavioural baseline c
broader thanop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000826
Relates a concept of one vocabulary to a concept of another whose meaning it includes.
- has super-properties
- narrow Match op
budget ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000230
Relates a budget calibration to the organisation whose budget it calibrates.
- has domain
- budget calibration c
- has range
- Organization c
carried out byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000414
Relates a processing activity to the organisation that carries it out.
- has domain
- processing activity c
- has range
- Organization c
case ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000243
Relates a sensitivity case to the scenario it varies.
- has domain
- sensitivity case c
- has range
- risk scenario c
change ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000743
Relates a regulatory change to the instrument or provision that changed.
- has domain
- regulatory change c
charter ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001046
Relates an audit charter to the audit function it governs.
- has domain
- audit charter c
- has range
- audit function c
clause ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001008
Relates a policy clause to the directive version it is part of.
- has domain
- policy clause c
- has range
- directive version c
closes findingop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000811
Relates a finding closure to the audit finding or nonconformity it closes.
- has domain
- finding closure c
closure based onop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000812
Relates a finding closure to the follow-up verification or risk acceptance it relies on.
- has domain
- finding closure c
collected byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000751
Relates an evidence item to the agent that collected it.
- has domain
- evidence register entry c
- has range
- Agent c
commits to actionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000806
Relates a management response to a corrective action it commits to.
- has domain
- management response c
- has range
- corrective action c
committee ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000884
Relates a governance committee to the governing body that set it up and to which it reports.
- has domain
- governance committee c
- has range
- governing body c
communication aboutop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001295
Relates an incident communication to the incident it concerns.
- has domain
- incident communication c
comparable obligationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000447
Relates an obligation in one legal regime to a comparable obligation in another regime; comparable is not equivalent, and the annotation states the differences.
- has super-properties
- related Match op
compensated byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000729
Relates a policy exception to a compensating control that reduces the risk it leaves.
- has domain
- policy exception c
- has range
- control measure c
complementary user entity control ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000772
Relates a complementary user entity control to the external assurance report that states it.
- has domain
- complementary user entity control c
- has range
- external assurance report c
compliance withop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000432
Relates a compliance determination to the provision or obligation determined.
- has domain
- compliance determination c
computed from inputop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000705
Relates an analytical result to an estimate or record it used as input.
- has domain
- analytical result c
concerns organisationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000427
Relates an applicability assessment, compliance determination or control assessment to the organisation it is about.
- has range
- Organization c
concluded incidentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001268
Relates a security investigation to the incident it concluded had occurred. The incident is confirmed by an incident confirmation, not by this link alone.
- has domain
- security investigation c
conclusion ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000797
Relates an audit conclusion to its engagement.
- has domain
- audit conclusion c
- has range
- audit engagement c
condition metop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000429
Relates an applicability assessment to a condition found met.
- has domain
- applicability assessment c
- has range
- applicability condition c
condition not metop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000430
Relates an applicability assessment to a condition found not met.
- has domain
- applicability assessment c
- has range
- applicability condition c
condition ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000424
Relates an applicability condition to the instrument, provision or policy statement whose application it governs.
- has domain
- applicability condition c
condition undeterminedop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000431
Relates an applicability assessment to a condition that could not be evaluated because a needed fact is missing.
- has domain
- applicability assessment c
- has range
- applicability condition c
confirmation based onop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000816
Relates an incident confirmation to an alert or event it is based on.
- has domain
- incident confirmation c
confirms incidentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000815
Relates an incident confirmation to the incident confirmed.
- has domain
- incident confirmation c
- has range
- incident c
conflict concernsop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000735
Relates a conflict-of-interest declaration to the decision or assessment it concerns.
- has domain
- conflict-of-interest declaration c
control corresponds to controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000445
Relates an SP 800-53 control to an ISO/IEC 27002 control that NIST OLIR relates to it.
- has super-properties
- related Match op
correctsop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000807
Relates a corrective action to the finding or nonconformity whose cause it is to remove.
- has domain
- corrective action c
correlated withop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001248
Relates a security alert to another alert judged to concern the same activity.
- has domain
- security alert c
- has range
- security alert c
corresponds to defensive techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001278
Relates a response action to a defensive technique it carries out, such as a D3FEND technique.
- has domain
- response action c
coverage byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001254
Relates a detection coverage statement to the detection strategy or rule that provides it.
- has domain
- detection coverage c
covers assetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001257
Relates a detection coverage statement to an asset it covers.
- has domain
- detection coverage c
- has range
- asset c
covers scenarioop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001255
Relates a detection coverage statement to a risk scenario it covers.
- has domain
- detection coverage c
- has range
- risk scenario c
covers techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001256
Relates a detection coverage statement to an adversary technique it covers.
- has domain
- detection coverage c
criterion refers toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000780
Relates an audit criterion to the requirement it takes as reference, such as a provision, a control, a policy statement or an SP 800-53A assessment objective.
- has domain
- audit criterion c
custodianop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000752
Relates an evidence item to the agent responsible for keeping it intact and controlling access to it.
- has domain
- evidence register entry c
- has range
- Agent c
data subjects inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000417
Relates a processing activity to a jurisdiction where persons whose information it handles are located.
- has domain
- processing activity c
- has range
- jurisdiction c
deadline forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001034
Relates a compliance deadline to the obligation or provision that sets it.
- has domain
- compliance deadline c
deadline triggered byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001036
Relates an event-triggered compliance deadline to the record of the triggering event, such as an incident confirmation.
- has domain
- compliance deadline c
decided byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000221
Relates a treatment decision to the agent who made it.
- has domain
- risk treatment decision c
- has range
- Agent c
decision made byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000731
Relates a decision record to the agent or body that made the decision.
- has domain
- decision record c
decision onop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000730
Relates a decision record to what was decided, such as a policy, an exception, a risk acceptance or a finding closure.
- has super-properties
- is about op
- has domain
- decision record c
declared byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000734
Relates a conflict-of-interest declaration to the agent who declares it.
- has domain
- conflict-of-interest declaration c
- has range
- Agent c
deficiency aspectop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000762
Gives whether a control deficiency lies in design, implementation or operation.
- has domain
- control deficiency c
- has range
- control aspect c
deficiency ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000760
Relates a control deficiency to the control measure concerned.
- has domain
- control deficiency c
- has range
- control measure c
delegates authority toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000709
Relates an agent or governing body to another agent to which it delegates authority; the scope and limits are given by a delegation of authority.
delegation fromop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000710
Relates a delegation of authority to the agent that grants it.
- has domain
- delegation of authority c
delegation toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000711
Relates a delegation of authority to the agent that receives it.
- has domain
- delegation of authority c
depends on assumptionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000409
Relates an estimate, assessment, determination or decision to an assumption it takes as true.
- has range
- assumption c
derived from requirementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000723
Relates a policy statement or technical standard to an obligation, control or framework requirement it is written to meet.
determination inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001030
Relates a compliance determination to the compliance assessment campaign that produced it.
- has domain
- compliance determination c
- has range
- compliance assessment campaign c
emitted byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001233
Relates a security event record to the telemetry source that emitted it.
- has domain
- security event record c
- has range
- telemetry source c
enforced byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001028
Relates a legal instrument or provision to a regulatory authority that supervises or enforces it.
- has range
- regulatory authority c
engagement onop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000777
Relates an audit engagement to the auditable entity it covers.
- has domain
- audit engagement c
- has range
- auditable entity c
entry for auditable entityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001049
Relates an audit plan entry to an auditable entity it covers.
- has domain
- audit plan entry c
- has range
- auditable entity c
entry for engagementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001048
Relates an audit plan entry to the engagement it plans.
- has domain
- audit plan entry c
- has range
- audit engagement c
entry in planop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001047
Relates an audit plan entry to the audit plan it belongs to.
- has domain
- audit plan entry c
- has range
- audit plan c
entry informed byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001051
Relates an audit plan entry to a risk assessment or risk scenario that informed its priority.
- has domain
- audit plan entry c
established inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000411
Relates an organisation to a jurisdiction where it has an establishment.
- has domain
- Organization c
- has range
- jurisdiction c
estimate ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000231
Relates an estimate to the scenario, control measure or other entity it gives a value for.
evaluates controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000830
Relates an assessment objective, such as an SP 800-53A objective, to the control or control enhancement whose implementation it assesses.
- has super-properties
- related Match op
evaluates control measureop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000436
Relates a control assessment to the control measure it tests.
- has domain
- control assessment c
- has range
- control measure c
evaluates provision versionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001033
Relates a compliance or applicability determination to the exact provision version it evaluated, when the wording has changed over time.
- has range
- provision version c
evidence for populationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000753
Relates an evidence item to the population it covers.
- has domain
- evidence register entry c
- has range
- population c
evidence requirement forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000749
Relates an evidence requirement to the requirement or obligation whose fulfilment it serves to show.
- has domain
- evidence requirement c
exception in reportop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000771
Relates an assurance report exception to the report that states it.
- has domain
- assurance report exception c
- has range
- external assurance report c
exception raised onop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000790
Relates a monitoring exception to the indicator, control measure or asset that raised it.
- has domain
- monitoring exception c
exception scopeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000727
Relates a policy exception to an asset, process, role or organisational unit it covers.
- has domain
- policy exception c
exception toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000726
Relates a policy exception to the policy statement, technical standard, baseline or control it permits a deviation from.
- has domain
- policy exception c
executes procedureop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000789
Relates a control assessment to the audit procedure it carries out.
- has domain
- control assessment c
- has range
- audit procedure c
execution forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001286
Relates an automation execution record to the investigation or incident it served.
- has domain
- automation execution record c
execution triggered byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001285
Relates an automation execution record to the trigger, alert or request that started it.
- has domain
- automation execution record c
exemption fromop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001042
Relates a regulatory exemption to the obligation or provision it relieves the organisation from.
- has domain
- regulatory exemption c
exploitsop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000197
Relates a risk scenario to an identified vulnerability or predisposing condition, borne by a material asset or an organisation, that its threat event takes advantage of. Described weaknesses use hasVulnerabilityDescription.
- has domain
- risk scenario c
- has range
- disposition c
finding about scenarioop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000794
Relates an audit finding to a risk scenario whose likelihood or impact the condition found bears on.
- has domain
- audit finding c
- has range
- risk scenario c
finding on controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000795
Relates an audit finding to a control measure whose design or operation it concerns.
- has domain
- audit finding c
- has range
- control measure c
follows methodologyop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001054
Relates an audit engagement or plan to the audit methodology version it follows.
follows programmeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000781
Relates an audit engagement to the work programme it follows.
- has domain
- audit engagement c
- has range
- audit work programme c
for criterionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000236
Gives the screening criterion a screening score rates.
- has domain
- screening score c
- has range
- screening criterion c
fulfilled byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000787
Relates an evidence request to an evidence item provided in response.
- has domain
- evidence request c
- has range
- evidence register entry c
fulfils criterionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000829
Relates a control to an assurance criterion, such as a Trust Services criterion, that it is designed to meet.
- has super-properties
- related Match op
gap for techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001262
Relates a detection gap to an adversary technique left undetected.
- has domain
- detection gap c
gap in telemetryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001261
Relates a detection gap to a telemetry source or data component that is missing or unhealthy.
- has domain
- detection gap c
gate authorityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001281
Relates an approval gate to the role or agent whose approval it requires.
- has domain
- approval gate c
gate for risk classop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001280
Relates an approval gate to an action risk class it applies to.
- has domain
- approval gate c
- has range
- action risk class c
generated byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000238
Relates a computed risk quantity to the calculation activity that produced it.
- has domain
- computed risk quantity c
- has range
- calculation activity c
generated by ruleop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001246
Relates a security alert to the detection rule version that raised it.
- has domain
- security alert c
- has range
- detection rule c
granted byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001043
Relates a regulatory exemption to the authority that granted it.
- has super-properties
- issued by authority op
- has domain
- regulatory exemption c
- has range
- regulatory authority c
hadPrimarySourceop back to ToC or Object Property ToC
IRI: http://www.w3.org/ns/prov#hadPrimarySource
- has sub-properties
- has source record op
has access statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000699
Gives whether CRGO holds and may use the source a source record describes.
- has domain
- source record c
- has range
- source access status c
has action risk classop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001277
Gives the risk class of a response action.
- has domain
- response action c
- has range
- action risk class c
has action statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000808
Gives the recorded state of a corrective action.
- has domain
- corrective action c
- has range
- corrective action status c
has alert dispositionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001247
Gives the conclusion of an analyst's triage of a security alert, as last recorded.
- has domain
- security alert c
- has range
- alert disposition c
has applicability stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000428
Gives the state reached by an applicability assessment.
- has domain
- applicability assessment c
- has range
- applicability state c
has approval statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001282
Gives the state of an approval decision, as last recorded.
- has domain
- approval decision c
- has range
- approval status c
has asset tierop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000323
States, in an asset valuation, whether the asset is primary or supporting.
- has domain
- asset valuation c
- has range
- asset tier c
has assurance opinionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000768
Gives the opinion expressed in an external assurance report.
- has domain
- external assurance report c
- has range
- assurance opinion c
has assurance report typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000767
Gives the kind of an external assurance report.
- has domain
- external assurance report c
- has range
- assurance report type c
has audienceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001296
Gives who an incident communication is addressed to.
- has domain
- incident communication c
- has range
- communication audience c
has audit objectiveop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000778
Relates an audit engagement or work programme to an objective it is to establish.
- has range
- audit objective c
has availability requirementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000188
Gives the availability requirement level recorded in an asset valuation.
- has domain
- asset valuation c
- has range
- requirement level c
has case statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001267
Gives the recorded stage of a security investigation, as last recorded.
- has domain
- security investigation c
- has range
- case status c
has case typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000242
Gives the direction of a sensitivity case.
- has domain
- sensitivity case c
- has range
- sensitivity case type c
has change typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000744
Gives the kind of a regulatory change.
- has domain
- regulatory change c
- has range
- regulatory change type c
has compliance stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000433
Gives the state recorded by a compliance determination.
- has domain
- compliance determination c
- has range
- compliance state c
has condition kindop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000425
Gives the kind of fact an applicability condition tests.
- has domain
- applicability condition c
- has range
- condition kind c
has confidenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000234
Gives the analyst's confidence in an estimate.
- has domain
- estimate c
- has range
- confidence level c
has confidentiality requirementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000186
Gives the confidentiality requirement level recorded in an asset valuation.
- has domain
- asset valuation c
- has range
- requirement level c
has consequenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000200
Relates a risk scenario to one of its consequences.
- has domain
- risk scenario c
- has range
- consequence description c
has control functionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000211
Gives the function a control, control measure or initiative serves.
- has range
- control function c
has control gapop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000320
Relates a risk scenario to a control gap finding it is anchored on.
- has domain
- risk scenario c
- has range
- control gap finding c
has control statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000210
Gives the implementation status of a control measure.
- has domain
- control measure c
- has range
- control status c
has coverage statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001258
Gives the state of a detection coverage statement.
- has domain
- detection coverage c
- has range
- coverage status c
has deadline trigger kindop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001035
Gives whether a compliance deadline is a calendar date or counted from an event.
- has domain
- compliance deadline c
- has range
- deadline trigger kind c
has decision outcomeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000732
Gives the outcome recorded by a decision record.
- has domain
- decision record c
- has range
- decision outcome c
has deficiency severityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000763
Gives the severity of a control deficiency.
- has domain
- control deficiency c
- has range
- deficiency severity c
has detection statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001245
Gives the lifecycle state of a detection rule, as last recorded.
- has domain
- detection rule c
- has range
- detection status c
has distributionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000701
Relates an estimate to the distribution that expresses its uncertainty.
- has domain
- estimate c
- has range
- estimate distribution c
has distribution familyop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000702
Gives the family of an estimate distribution.
- has domain
- estimate distribution c
- has range
- distribution family c
has engagement ratingop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000798
Gives the overall rating of an audit conclusion.
- has domain
- audit conclusion c
- has range
- engagement rating c
has engagement stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001053
Gives the recorded stage of an audit engagement.
- has domain
- audit engagement c
- has range
- engagement state c
has engagement typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001052
Gives the nature, and where relevant the focus, of an audit engagement.
- has domain
- audit engagement c
- has range
- engagement type c
has escalation flagop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000245
Relates an assessment scenario to an escalation flag that applies to it.
- has domain
- assessment scenario c
- has range
- escalation flag c
has evidenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000213
Relates an estimate, control measure or other statement to an evidence item that supports it.
- has range
- evidence register entry c
has evidence basisop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000214
Gives the kind of support behind an evidence item.
- has domain
- evidence register entry c
- has range
- evidence basis c
has evidence qualityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000700
Gives how strongly the evidence behind an estimate or conclusion supports it.
- has range
- evidence quality c
has execution statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001287
Gives the state of an automation or action execution, as last recorded.
- has range
- execution status c
has external referenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000325
Relates a description or control to a concept in an external catalogue, such as an ATT&CK technique, a CWE weakness, a CAPEC pattern or a CVE record.
- has range
- Concept c
has finding significanceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000793
Gives the significance of an audit finding.
- has domain
- audit finding c
- has range
- finding significance c
has impact dimensionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000201
Gives the impact dimension of a consequence.
- has domain
- consequence description c
- has range
- impact dimension c
has in-force periodop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000423
Relates a legal instrument to the OWL-Time interval during which it is in force; the interval has no end while the instrument is not repealed.
- has domain
- legal instrument c
- has range
- Proper interval c
has incident categoryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001269
Gives a broad category of an incident.
- has range
- incident category c
has incident severityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001270
Gives the severity of an incident as last rated.
- has range
- incident severity c
has independence conclusionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000721
Gives the conclusion of an independence assessment.
- has domain
- independence assessment c
- has range
- independence conclusion c
has information markingop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001253
Gives the sharing restriction attached to an indicator, source, record or communication.
- has range
- information marking c
has instrument kindop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000421
Gives the kind of a legal instrument.
- has domain
- legal instrument c
- has range
- instrument kind c
has integrity requirementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000187
Gives the integrity requirement level recorded in an asset valuation.
- has domain
- asset valuation c
- has range
- requirement level c
has jurisdictionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000420
Relates a legal instrument, applicability assessment or compliance determination to its jurisdiction.
- has range
- jurisdiction c
has knowledge statusop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000698
Gives the epistemic category of a record or assertion, such as risk estimate or audit conclusion.
- has range
- knowledge status c
has legal review stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001026
Gives how far a requirement interpretation has been reviewed by counsel.
- has domain
- requirement interpretation c
- has range
- legal review state c
has lifecycle stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001012
Gives the lifecycle state of a directive version, as last recorded.
- has domain
- directive version c
- has range
- directive lifecycle state c
has mapping typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001062
Gives how the source of a mapping assertion corresponds to its target.
- has domain
- mapping assertion c
- has range
- mapping type c
has normative modalityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001011
Gives how binding a policy statement is.
- has domain
- policy statement c
- has range
- normative modality c
has observed impactop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001293
Relates an incident to an impact it had or is estimated to have had.
- has range
- incident impact c
has organisation typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000410
Gives the legal category of an organisation.
- has domain
- Organization c
- has range
- organisation type c
has ownerop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000185
Relates an asset valuation, control measure, initiative or indicator to the agent accountable for it.
- has range
- Agent c
has plan entry stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001050
Gives the state of an audit plan entry.
- has domain
- audit plan entry c
- has range
- plan entry state c
has playbook triggerop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001274
Relates a response playbook or version to a trigger that starts it.
- has range
- playbook trigger c
has priorityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000224
Gives the priority of a treatment initiative.
- has domain
- treatment initiative c
- has range
- initiative priority c
has procedureop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000782
Relates a work programme to a procedure in it.
- has domain
- audit work programme c
- has range
- audit procedure c
has processing roleop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000416
Gives the role the organisation carrying out a processing activity plays in it.
- has domain
- processing activity c
- has range
- processing role c
has quality review kindop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001059
Gives the kind of an audit quality review.
- has domain
- audit quality review c
- has range
- quality review kind c
has relevant requirementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000335
Relates a risk scenario to a requirement of a control framework, such as a NIST CSF 2.0 subcategory, a NIST SP 800-53 control or an ISO/IEC 27002 control, whose implementation would prevent, detect or limit the scenario.
- has domain
- risk scenario c
- has range
- Concept c
has reportability stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000819
Gives the result of a breach reportability assessment.
- has domain
- breach reportability assessment c
- has range
- reportability state c
has response stanceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000804
Gives management's position in a management response.
- has domain
- management response c
- has range
- management response stance c
has review stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001064
Gives the review state of an organisation record such as a mapping assertion. A requirement interpretation also has a legal review state, which says whether counsel has reviewed it.
- has range
- review state c
has review triggerop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001019
Gives what caused a directive review.
- has domain
- directive review c
- has range
- review trigger c
has risk appetiteop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000217
Relates a risk assessment to the risk appetite statement it applies.
- has domain
- risk assessment c
- has range
- risk appetite statement c
has risk ownerop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000206
Relates a risk scenario to the agent accountable for managing it.
- has domain
- risk scenario c
- has range
- Agent c
has risk stageop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000235
States whether an estimate applies before or after treatment.
- has domain
- estimate c
- has range
- risk stage c
has root-cause categoryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001045
Gives a broad category of the cause of a finding or nonconformity.
- has range
- root-cause category c
has sample resultop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000759
Gives the result of testing a sample item.
- has domain
- sample item c
- has range
- sample result c
has sampling methodop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000757
Gives how a sampling plan selects items.
- has domain
- sampling plan c
- has range
- sampling method c
has scenario categoryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000246
Relates a risk scenario to a category of the controlled scenario category list.
- has domain
- risk scenario c
- has range
- Concept c
has selection dispositionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000244
Gives the screening outcome of an assessment scenario.
- has domain
- assessment scenario c
- has range
- selection disposition c
has source recordop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000407
Relates a vocabulary, dataset, observation or other record to the source record of the content it was imported or derived from.
- has super-properties
- hadPrimarySource op
- has range
- source record c
has stakeholderop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000205
Relates a risk scenario to an agent with an interest in it.
- has domain
- risk scenario c
- has range
- Agent c
has stepop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000202
Relates a risk scenario to a step of its event sequence.
- has domain
- risk scenario c
- has range
- scenario step c
has submission stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001040
Gives the state of a regulatory submission, as last recorded.
- has domain
- regulatory submission c
- has range
- submission state c
has sufficiency conclusionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000766
Gives the conclusion of an evidence sufficiency assessment.
- has domain
- evidence sufficiency assessment c
- has range
- sufficiency conclusion c
has telemetry health stateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001263
Gives the state reported by a telemetry health observation.
- has domain
- telemetry health observation c
- has range
- telemetry health state c
has test resultop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000437
Gives the result recorded by a control assessment.
- has domain
- control assessment c
- has range
- control test result c
has threat eventop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000196
Relates a risk scenario to the threat event it describes.
- has domain
- risk scenario c
- has range
- threat event description c
has threat source descriptionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000318
Relates a risk scenario to a description of the kind of threat source that would initiate it.
- has domain
- risk scenario c
- has range
- threat source description c
has threat source typeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000194
Classifies a threat source role or a threat source description by NIST SP 800-30 category.
- has range
- threat source type c
has tolerance classificationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000240
Gives the tolerance classification of a risk-to-tolerance ratio.
- has domain
- risk-to-tolerance ratio c
- has range
- tolerance classification c
has treatment decisionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000219
Relates a risk scenario to a decision on how it is treated.
- has domain
- risk scenario c
- has range
- risk treatment decision c
has treatment optionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000220
Gives the treatment option a decision chooses.
- has domain
- risk treatment decision c
- has range
- treatment option c
has trigger kindop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001275
Gives what kind of thing a playbook trigger is.
- has domain
- playbook trigger c
- has range
- trigger kind c
has verification resultop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000810
Gives the result of a follow-up verification.
- has domain
- follow-up verification c
- has range
- verification result c
has vulnerability descriptionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000319
Relates a risk scenario to a description of a weakness or predisposing condition it relies on.
- has domain
- risk scenario c
- has range
- vulnerability description c
housed inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000193
Relates an asset to the facility that houses it.
- has domain
- asset c
- has range
- facility asset c
hypothesis aboutop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000703
Relates an analytical hypothesis to what it seeks to explain, such as a finding or an incident.
- has super-properties
- is about op
- has domain
- analytical hypothesis c
hypothesised causeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000792
Relates an audit finding to an analytical hypothesis about its cause that has not been confirmed.
- has domain
- audit finding c
- has range
- analytical hypothesis c
identified byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000761
Relates a control deficiency to the control assessment that identified it.
- has domain
- control deficiency c
- has range
- control assessment c
impact on dimensionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001294
Gives the impact dimension of an incident impact.
- has domain
- incident impact c
- has range
- impact dimension c
implemented by procedureop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000725
Relates a policy statement, technical standard or baseline to a procedure that carries it out.
- has range
- procedure c
implements controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000208
Relates a control measure to the control it applies.
- has domain
- control measure c
- has range
- control c
implements strategyop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001238
Relates a detection rule to the detection strategy it carries out.
- has domain
- detection rule c
- has range
- detection strategy c
in clauseop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001009
Relates a policy statement to the clause where it appears.
- has domain
- policy statement c
- has range
- policy clause c
in instrument versionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001032
Relates a provision version to the instrument version that carries that wording.
- has domain
- provision version c
- has range
- instrument version c
in phaseop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000821
Gives the response phase of an incident timeline entry.
- has domain
- incident timeline entry c
- has range
- incident response phase c
in policy familyop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001010
Relates a directive to a policy family it belongs to.
- has range
- policy family c
in sensitivity caseop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000241
Relates an estimate to the sensitivity case it belongs to; estimates used as given may link to a central case or to none.
- has domain
- estimate c
- has range
- sensitivity case c
incident informs scenarioop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000824
Relates an incident to a risk scenario it is evidence about. An incident supports a scenario's likelihood estimate; it does not prove it, and its absence does not disprove it.
- has domain
- incident c
- has range
- risk scenario c
includes auditable entityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000774
Relates an audit universe to an auditable entity in it.
- has domain
- audit universe c
- has range
- auditable entity c
includes control measureop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000223
Relates a treatment initiative to a control measure it will put in place.
- has domain
- treatment initiative c
- has range
- control measure c
includes scenarioop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000215
Relates a risk assessment to a scenario screened or analysed in it.
- has domain
- risk assessment c
- has range
- risk scenario c
includes stepop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001271
Relates a playbook version to a step it contains.
- has domain
- playbook version c
- has range
- playbook step c
independence ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000719
Relates an independence assessment to the agent whose independence is assessed.
- has domain
- independence assessment c
- has range
- Agent c
independence with respect toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000720
Relates an independence assessment to the activity, control or unit with respect to which independence is assessed.
- has domain
- independence assessment c
indicator from sourceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001252
Relates a threat indicator to the threat intelligence source that provided it.
- has domain
- threat indicator c
- has range
- threat intelligence source c
informed byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000883
Relates a decision record to an analytical result, assessment, finding or evidence item the decision took into account.
- has domain
- decision record c
initiated byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000195
Relates a risk scenario to the entity that would initiate it: the bearer of a threat source role, such as a person, organisation, artifact or natural feature. Use hasThreatSourceDescription when only the kind of source is known.
- has domain
- risk scenario c
- has range
- entity c
intended to mitigateop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001014
Relates a policy statement to a risk scenario it is meant to reduce. States intent only; it does not say that the risk is reduced.
- has domain
- policy statement c
- has range
- risk scenario c
interpretation ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001025
Relates a requirement interpretation to the obligation, provision or requirement it interprets.
- has domain
- requirement interpretation c
investigates alertop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001266
Relates a security investigation to an alert it examines.
- has domain
- security investigation c
- has range
- security alert c
involves assetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001249
Relates a security alert, investigation or action execution to an asset it concerns.
- has range
- asset c
is aboutop back to ToC or Object Property ToC
IRI: https://www.commoncoreontologies.org/ont00001808
x is_about y is a primitive relationship between an instance of Information Content Entity x and an instance of Entity y.
- has sub-properties
- auditable entity for op, decision on op, estimate of op, hypothesis about op, observation of op, result for op
issued by assurerop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000770
Relates an external assurance report to the assurer that issued it.
- has domain
- external assurance report c
- has range
- Agent c
issued by authorityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001027
Relates a legal instrument, guidance or exemption to the regulatory authority that issued it.
- has sub-properties
- granted by op
- has range
- regulatory authority c
justifies recommendationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000802
Relates a finding, risk scenario or evidence item to a recommendation it gives grounds for.
- has range
- recommendation c
led to actionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001298
Relates a lesson learned to a corrective action it led to.
- has domain
- lesson learned c
- has range
- corrective action c
lesson fromop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000822
Relates a lesson learned to the incident or exercise it comes from.
- has domain
- lesson learned c
mapped editionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001063
Relates a mapping assertion to the source record or version of each side that was mapped, so that a later edition does not silently change it.
- has domain
- mapping assertion c
mapping sourceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001060
Relates a mapping assertion to its source requirement, such as a policy statement or a control.
- has domain
- mapping assertion c
mapping targetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001061
Relates a mapping assertion to its target requirement, such as an obligation or a framework requirement.
- has domain
- mapping assertion c
maps to event classop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001237
Relates a normalisation profile or detection rule to a common event class it uses, such as an OCSF event class. A correspondence, not an equivalence of taxonomies.
maps to requirementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000212
Relates a control, framework requirement or legal obligation to a framework requirement or obligation it satisfies, contributes to or corresponds with.
matched indicatorop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001251
Relates a security alert or event record to a threat indicator it matched.
- has range
- threat indicator c
matches threat eventop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000229
Relates an incident to the threat event description it is an occurrence of.
- has domain
- incident c
- has range
- threat event description c
measurement ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001302
Relates a response effectiveness measurement to the incident or set of incidents measured.
- has domain
- response effectiveness measurement c
measures metricop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001301
Gives the metric of a response effectiveness measurement.
- has domain
- response effectiveness measurement c
- has range
- response metric c
missing controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000321
Relates a control gap finding to the control found absent or inadequate.
- has domain
- control gap finding c
- has range
- control c
mitigated byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000207
Relates a risk scenario to a control measure that reduces its likelihood or consequences.
- has domain
- risk scenario c
- has range
- control measure c
monitorsop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000227
Relates a key risk indicator to a risk scenario, control measure or asset it monitors.
- has domain
- key risk indicator c
monitors behaviour of persons inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000413
Relates an organisation to a jurisdiction in which it monitors the behaviour of persons, such as by online tracking or profiling.
- has domain
- Organization c
- has range
- jurisdiction c
narrower thanop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000825
Relates a concept of one vocabulary to a concept of another whose meaning includes it; every case of the subject is a case of the object.
- has super-properties
- broad Match op
next playbook stepop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001272
Relates a playbook step to a step that follows it.
- has domain
- playbook step c
- has range
- playbook step c
next stepop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000203
Relates a scenario step to the step that immediately follows it.
- has domain
- scenario step c
- has range
- scenario step c
nonconformity withop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000747
Relates a nonconformity to the requirement not fulfilled.
- has domain
- nonconformity c
normalised underop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001234
Relates a security event record to the normalisation profile it was normalised under.
- has domain
- security event record c
- has range
- normalisation profile c
objective of programmeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001024
Relates a compliance objective to the compliance programme that sets it.
- has domain
- compliance objective c
- has range
- compliance programme c
obligated underop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000750
Relates an obligated party role to the instrument or provision that creates the obligation.
- has domain
- obligated party role c
obligation at stake inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001044
Relates an obligation or provision to a risk scenario in which failing to meet it is part of the consequence.
- has range
- risk scenario c
observation ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000408
Relates an observation to the entity it reports on, such as a published vulnerability.
- has super-properties
- is about op
- has domain
- observation c
offers goods or services to persons inop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000412
Relates an organisation to a jurisdiction whose residents it targets with goods or services, paid or not.
- has domain
- Organization c
- has range
- jurisdiction c
on scaleop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000233
Gives the measurement scale of an estimate.
- has domain
- estimate c
- has range
- measurement scale c
opened investigationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001265
Relates a security alert to a security investigation opened because of it.
- has domain
- security alert c
operates controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000712
Relates an agent to a control measure it performs or runs.
- has range
- control measure c
overseesop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000707
Relates a governing body, committee or agent to an activity, function or risk it oversees.
oversight byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000717
Relates an oversight activity to the body or agent that performs it.
- has domain
- oversight activity c
oversight ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000718
Relates an oversight activity to what it reviews, such as an audit report or a risk.
- has domain
- oversight activity c
parsed byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001235
Relates a security event record to the parser definition version that produced it.
- has domain
- security event record c
- has range
- parser definition c
part of executionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001288
Relates an action execution record to the automation execution it was part of.
- has domain
- action execution record c
- has range
- automation execution record c
part of frameworkop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000324
Relates a framework requirement or legal obligation to the framework, standard or law that states it.
- has range
- framework c
partially overlapsop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000827
Relates two concepts of different vocabularies that share part of their meaning, neither including the other; the annotation states what is shared.
- has super-properties
- related Match op
performed in capacityop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000737
Gives the capacity in which a control assessment or follow-up verification was performed: management self-assessment, second line, internal audit or external assurer.
- has range
- assessor line c
performs actionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001289
Relates an action execution record to the response action attempted.
- has domain
- action execution record c
- has range
- response action c
planned engagementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000776
Relates an audit plan to an engagement it includes.
- has domain
- audit plan c
- has range
- audit engagement c
potentially indicatesop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001250
Relates a security alert or indicator to a threat event description it may indicate. States a possibility to be investigated, never a confirmed event or attribution.
- has range
- threat event description c
pre-authorises actionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001283
Relates an approval decision to a response action or risk class it pre-authorises for its scope and period.
- has domain
- approval decision c
prepared byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001056
Relates an audit workpaper or report to an agent who prepared it.
principle addressed by categoryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000446
Relates an OSFI B-13 principle to a NIST CSF 2.0 category that addresses it.
- has super-properties
- related Match op
processes data categoryop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000415
Relates a processing activity to a category of personal information it handles.
- has domain
- processing activity c
- has range
- personal data category c
produced evidenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001292
Relates an action execution record to an evidence item it produced.
- has domain
- action execution record c
- has range
- evidence register entry c
produces evidence forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000784
Relates an audit procedure, control assessment or evidence request to the control, requirement or criterion it produces evidence for.
produces versionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000742
Relates an amendment to the instrument version it produces.
- has domain
- amendment c
- has range
- instrument version c
profile for sourceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001236
Relates a normalisation profile or parser definition to the telemetry source it applies to.
- has range
- telemetry source c
programme coversop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001023
Relates a compliance programme to an obligation, legal instrument, framework adoption or commitment within its scope.
- has domain
- compliance programme c
protects assetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000209
Relates a control measure to an asset it protects.
- has domain
- control measure c
- has range
- asset c
provided byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000192
Relates an asset to the third-party organisation that supplies or operates it.
- has domain
- asset c
- has range
- Organization c
provides data componentop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001232
Relates a telemetry source to a kind of data it sends, such as an ATT&CK data component.
- has domain
- telemetry source c
provision ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000422
Relates a provision, such as a concept of a CRGO legal vocabulary, to the legal instrument it belongs to.
- has range
- legal instrument c
provision version ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001031
Relates a provision version to the provision whose wording it records.
- has domain
- provision version c
quality review ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001058
Relates an audit quality review to the engagement, workpaper or audit function reviewed.
- has domain
- audit quality review c
raised fromop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000748
Relates a nonconformity or deficiency to the audit finding, assessment or report it was raised from.
receipt evidenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001041
Relates a regulatory submission to the evidence item recording its submission or the authority's acknowledgement.
- has domain
- regulatory submission c
- has range
- evidence register entry c
recommendation forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000801
Relates a recommendation to the finding it addresses.
- has domain
- recommendation c
- has range
- audit finding c
recommends change toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000823
Relates a lesson learned to a control, procedure, scenario or estimate it says should change.
- has domain
- lesson learned c
recorded as submissionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001297
Relates an incident communication to a regulator to the regulatory submission that records it.
- has domain
- incident communication c
- has range
- regulatory submission c
recovery afterop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001300
Relates a recovery verification to the incident it follows.
- has domain
- recovery verification c
refinesop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000204
Relates a risk scenario to a more generic scenario it was derived from, such as a selected scenario to its candidate or a candidate to a library scenario.
- has domain
- risk scenario c
- has range
- risk scenario c
relies on assetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000191
Relates an asset to another asset it needs in order to function, such as an application and its hosting service.
reopens findingop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000813
Relates a finding reopening to the audit finding or nonconformity it reopens.
- has domain
- finding reopening c
report ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000799
Relates an audit report to the engagement it reports on.
- has domain
- audit report c
- has range
- audit engagement c
report on service ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000769
Relates an external assurance report to the organisation whose service or controls it covers.
- has domain
- external assurance report c
- has range
- Organization c
reportability ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000817
Relates a breach reportability assessment to the incident assessed.
- has domain
- breach reportability assessment c
- has range
- incident c
reports findingop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000800
Relates an audit report to a finding it communicates.
- has domain
- audit report c
- has range
- audit finding c
reports toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000708
Relates an agent or body to the agent or body it reports to.
requested fromop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000786
Relates an evidence request to the agent asked to provide the evidence.
- has domain
- evidence request c
- has range
- Agent c
requests evidenceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000785
Relates an audit procedure or engagement to an evidence request it issues.
- has range
- evidence request c
requires approvalop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001279
Relates a response action or playbook step to an approval gate it must pass.
- has range
- approval gate c
requires independence fromop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000713
Relates a governance role to another role, function or activity from which its bearer must be independent.
- has domain
- governance role c
requires review ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000746
Relates a reassessment trigger to an assessment, determination or estimate that must be reviewed.
- has domain
- reassessment trigger c
requires sourceop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001242
Relates a detection rule to a telemetry source, or a data component, it needs in order to work.
- has domain
- detection rule c
requires trainingop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001016
Relates a policy statement to a training requirement for those it applies to.
- has domain
- policy statement c
- has range
- training requirement c
responded byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000805
Relates a management response to the manager who gave it.
- has domain
- management response c
- has range
- Agent c
response toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000803
Relates a management response to the finding or recommendation it answers.
- has domain
- management response c
result forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000704
Relates an analytical result to what it is computed for, such as a risk scenario or an assessment.
- has super-properties
- is about op
- has domain
- analytical result c
review ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001018
Relates a directive review to the directive, directive version or policy statement reviewed.
- has domain
- directive review c
review triggered byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001020
Relates a directive review to the regulatory change, incident, finding or other record that caused it.
- has domain
- directive review c
reviewed byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001065
Relates a record, such as a mapping assertion, a requirement interpretation, an audit workpaper or a report, to an agent who reviewed it.
role forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000882
Relates a governance role to the control measure, risk scenario, process or function it concerns, such as the backup control for a control owner role.
- has domain
- governance role c
role withinop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000716
Relates a governance role or role assignment to the organisation or body in which it is held.
- has range
- Group of Agents c
rule for measureop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001244
Relates a detection rule to the detective control measure it carries out in the organisation.
- has domain
- detection rule c
- has range
- control measure c
same obligation in another regimeop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000448
Relates an obligation of the Québec private-sector Act to the obligation worded the same way for public bodies.
- has super-properties
- close Match op
sample ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000758
Relates a sample item to the sampling plan under which it was selected.
- has domain
- sample item c
- has range
- sampling plan c
serves objectiveop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000783
Relates an audit procedure to an objective it obtains evidence for, such as an SP 800-53A assessment objective or an audit objective.
- has domain
- audit procedure c
simulated playbookop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001303
Relates a playbook simulation to the playbook version it ran.
- has domain
- playbook simulation c
- has range
- playbook version c
source assetop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001231
Relates a telemetry source to the asset it runs on or reports from.
- has domain
- telemetry source c
- has range
- asset c
specified by standardop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000724
Relates a policy statement to a technical standard that specifies how it is met.
- has domain
- policy statement c
- has range
- technical standard c
statement implemented byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001013
Relates a policy statement to a control measure the organisation relies on to meet it. Implementation is not evidence that the measure is effective.
- has domain
- policy statement c
- has range
- control measure c
statement in versionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001007
Relates a policy statement to the directive version it is part of.
- has domain
- policy statement c
- has range
- directive version c
statement of policyop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000722
Relates a policy statement to the policy it belongs to.
- has domain
- policy statement c
- has range
- policy c
step performs actionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001273
Relates a playbook step to the response action it carries out.
- has domain
- playbook step c
- has range
- response action c
subcategory supported by controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000444
Relates a NIST CSF 2.0 element to an SP 800-53 control that supports it.
- has super-properties
- related Match op
submission toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001037
Relates a regulatory submission to the authority it was sent to.
- has domain
- regulatory submission c
- has range
- regulatory authority c
submission underop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001038
Relates a regulatory submission to the obligation or provision it is made under.
- has domain
- regulatory submission c
sufficiency forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000765
Relates an evidence sufficiency assessment to the objective, criterion or control assessment for which sufficiency is judged.
- has domain
- evidence sufficiency assessment c
sufficiency ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000764
Relates an evidence sufficiency assessment to an evidence item it judges.
- has domain
- evidence sufficiency assessment c
- has range
- evidence register entry c
supersedesop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000739
Relates an instrument version, policy or other directive to the earlier one it replaces.
- has super-properties
- wasDerivedFrom op
supplier toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000419
Relates a supplier role to the organisation that depends on what its bearer supplies.
- has domain
- supplier role c
- has range
- Organization c
supported by testop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001259
Relates a detection coverage statement to a detection test that supports it.
- has domain
- detection coverage c
- has range
- detection test c
supports compliance withop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000828
Relates a control or framework requirement to a provision or obligation that implementing it can help meet. It never proves compliance: that needs a compliance determination with evidence.
- has super-properties
- related Match op
supports objectiveop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000190
Relates a business process to a business objective it contributes to.
- has domain
- business process c
- has range
- business objective c
supports processop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000189
Relates an asset to a business process that depends on it.
- has domain
- asset c
- has range
- business process c
targets techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001241
Relates a detection strategy or rule to an adversary technique it is meant to detect, such as an ATT&CK technique.
technique countered by defensive techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000439
Relates an ATT&CK technique to a D3FEND defensive technique that can counter it.
- has super-properties
- related Match op
technique mitigated by controlop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000438
Relates an ATT&CK technique to an SP 800-53 control that can mitigate it, as mapped by MITRE CTID.
- has super-properties
- related Match op
tested populationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000755
Relates an operating effectiveness assessment or sampling plan to the population tested.
- has range
- population c
tested ruleop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001260
Relates a detection test to the detection rule or strategy it exercised.
- has domain
- detection test c
timeline ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000820
Relates an incident timeline entry to its incident.
- has domain
- incident timeline entry c
- has range
- incident c
transfers personal information toop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000418
Relates a processing activity to a jurisdiction where personal information is disclosed to, or stored by, a recipient.
- has domain
- processing activity c
- has range
- jurisdiction c
triggered byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000745
Relates a reassessment trigger to the event or record that gives rise to it, such as a regulatory change or an incident.
- has domain
- reassessment trigger c
triggers obligationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000228
Relates a risk scenario or incident to a legal obligation its realisation would trigger, such as notice to the CAI.
- has range
- legal obligation c
under delegationop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000733
Relates a decision record to the delegation of authority under which it was made.
- has domain
- decision record c
- has range
- delegation of authority c
used inputop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000237
Relates a computed risk quantity to an estimate used to compute it.
- has domain
- computed risk quantity c
- has range
- estimate c
uses analyticop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001240
Relates a detection strategy to an analytic it uses, such as an ATT&CK analytic.
uses assessment methodop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000736
Relates a control assessment, audit procedure or evidence item to the assessment method used.
- has range
- assessment method c
uses calculation methodop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000218
Relates a risk assessment to the calculation method it applies to all its scenarios.
- has domain
- risk assessment c
- has range
- calculation method c
uses criterionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000779
Relates an audit engagement, procedure or finding to an audit criterion it uses.
- has range
- audit criterion c
uses methodop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000239
Relates a calculation activity to the method it executes.
- has domain
- calculation activity c
- has range
- calculation method c
uses playbook versionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001284
Relates an automation execution record to the playbook version that ran.
- has domain
- automation execution record c
- has range
- playbook version c
uses sampling planop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000756
Relates a control assessment or audit procedure to the sampling plan it follows.
- has range
- sampling plan c
validated asop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001057
Relates an audit observation to the audit finding it became after validation.
- has domain
- audit observation c
- has range
- audit finding c
valuation ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000183
Relates an asset valuation to the entity it values.
- has domain
- asset valuation c
- has range
- entity c
valued byop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000184
Relates an asset valuation to the organisation for which the value holds.
- has domain
- asset valuation c
- has range
- Organization c
verifies actionop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000809
Relates a follow-up verification to the corrective action it checks.
- has domain
- follow-up verification c
- has range
- corrective action c
verifies recovery ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001299
Relates a recovery verification to the asset or business process checked.
- has domain
- recovery verification c
version ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000738
Relates an instrument version to the legal instrument or standard it is a version of.
- has domain
- instrument version c
version of directiveop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001006
Relates a directive version to the policy, technical standard, procedure, guideline, charter or methodology it is a version of.
- has domain
- directive version c
vulnerability associated with techniqueop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000443
Relates a CVE in the KEV catalogue to an ATT&CK technique used to exploit it or describing its impact, as mapped by MITRE CTID; the mapping type is in the annotation.
- has super-properties
- related Match op
vulnerability is an instance of weaknessop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000442
Relates a CVE in the KEV catalogue to a CWE weakness it is an instance of, as given by CISA.
- has super-properties
- related Match op
wasDerivedFromop back to ToC or Object Property ToC
IRI: http://www.w3.org/ns/prov#wasDerivedFrom
- has sub-properties
- supersedes op
weakness ofop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000293
Relates a vulnerability, vulnerability description or predisposing condition to the asset, organisation or process it is a weakness of. Shortcut for BFO 'inheres in', which cannot be used when the asset is software or information: in BFO-2020 a disposition can inhere only in a material bearer, so the weakness of a software asset strictly inheres in the copies or devices that carry it.
within engagementop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0000788
Relates a control assessment, finding, evidence request or sufficiency assessment to the audit engagement it belongs to.
- has range
- audit engagement c
workpaper forop back to ToC or Object Property ToC
IRI: https://w3id.org/crgo/CRGO_0001055
Relates an audit workpaper to the engagement, procedure or control assessment it documents.
- has domain
- audit workpaper c
Data Properties
- accepting authority
- access restriction
- added to KEV on
- adoption scope
- allocated initial cost
- allocated recurring cost
- analytical model name
- analytical model version
- applicability note
- applicable sector
- applies from
- assessed on
- assessment factor
- assessment horizon
- assessment scope
- attempt identifier
- attestation scope
- attested on
- background
- case appetite
- closed on
- collected on
- computed at
- condition found
- condition test
- confidence method
- confirmed on
- consolidated to
- contract version
- critical threshold
- currency code
- CVSS severity
- CVSS vector
- CVSS version
- cybersecurity budget share
- data source
- deadline computation
- decided on
- decision rationale
- deferral reason
- delegation limit
- deviations found
- distribution parameters
- due offset (hours)
- due on
- effect
- effective on
- ended at
- entry description
- EPSS percentile
- estimated effort (hours)
- evidence gap
- evidence hash
- evidence limitation
- evidence locator
- exception justification
- exception logic
- expected deviation rate
- expected result
- expiry date
- fact relied on
- gate for critical assets
- identified on
- illustrative only
- impact description
- impact is estimated
- implied appetite
- indicator pattern
- initial cost
- input document hash
- is crown jewel
- issued on
- issuer
- IT budget
- items tested
- known ransomware campaign use
- last amended on
- legal basis
- legally privileged
- licence or terms
- local identifier
- lower bound
- mandatory engagement
- mapping confidence
- measurement method
- metric method
- missing fact
- model version
- narrative
- notification due by
- numeric value
- observation horizon
- observed cause
- observed on
- occurred at
- official citation
- official identifier
- opened at
- pattern language
- period end
- period start
- planned end
- planned sample size
- planned start
- population definition
- population size
- prepared on
- priority rationale
- procedure step
- profile complete for
- provision wording
- published on
- purpose
- qualitative reading
- raised on
- rationale
- receipt acknowledged on
- recorded at
- recurring cost
- redistribution in CRGO
- reference version
- reopened on
- reopening reason
- report audience
- report scope
- reporting frequency
- required evidence
- retired on
- retrieved on
- review due on
- review interval (months)
- reviewed on
- revoked on
- rule identifier
- rule language
- rule version
- sample size
- sampling rationale
- sampling seed
- sent at
- SHA-256 checksum
- significance method
- source system
- source version
- started at
- stated confidence
- statement
- statement text
- step order
- submitted on
- success indicator
- suggested mitigation
- system boundary
- target value
- test procedure
- threats considered
- tolerable deviation rate
- treatment horizon
- treatment summary
- upper bound
- valid from
- valid until
- value (hours)
- verification note
- version label
- warning threshold
accepting authoritydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000272
Names the authority, such as the board or a named executive, that accepted a residual risk.
- has domain
- risk acceptance c
access restrictiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000853
States who may see an evidence item, such as 'audit team and CISO only'.
- has domain
- evidence register entry c
added to KEV ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000462
Gives the date CISA added a vulnerability to its Known Exploited Vulnerabilities catalogue.
has characteristics: functional
- has range
- date Time
adoption scopedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001075
States which parts of a framework are adopted and for which entities, systems or services.
- has domain
- framework adoption c
allocated initial costdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000266
Gives the share of an initiative's initial cost charged to one scenario.
has characteristics: functional
- has domain
- cost allocation c
- has range
- decimal
allocated recurring costdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000267
Gives the share of an initiative's recurring cost charged to one scenario.
has characteristics: functional
- has domain
- cost allocation c
- has range
- decimal
analytical model namedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000832
Gives the name of the model or tool that computed an analytical result, such as 'CyberRiskGuardian'.
has characteristics: functional
- has domain
- analytical result c
- has range
- string
analytical model versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000833
Gives the version of the model that computed an analytical result.
has characteristics: functional
- has domain
- analytical result c
- has range
- string
applicability notedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000260
Explains how well an estimate's method fits the scenario, for example CVSS with limited applicability.
applicable sectordp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000329
Gives the economic sector a library scenario was written for, such as healthcare, without naming an organisation.
- has domain
- risk scenario c
- has range
- string
applies fromdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000466
Gives the date from which an instrument or provision applies, when it differs from its coming into force.
- has range
- date Time
assessed ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000464
Gives when an applicability assessment, compliance determination or control assessment was made.
has characteristics: functional
- has range
- date Time
assessment factordp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000261
Gives the constant multiplication factor applied to every scenario of a CRG assessment.
has characteristics: functional
- has domain
- risk assessment c
- has range
- decimal
assessment horizondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000262
Gives the period the estimates of an assessment refer to, such as 'next 12 months'.
has characteristics: functional
- has domain
- risk assessment c
- has range
- string
assessment scopedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000472
States what a control assessment or compliance determination covered.
- has range
- string
attempt identifierdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001316
Gives the operational identifier of an execution attempt, so that it can be traced in the store.
has characteristics: functional
- has range
- string
attestation scopedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001071
States the scope and period an attestation covers and what it is based on.
- has domain
- attestation c
attested ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001070
Gives when an attestation was made.
has characteristics: functional
- has domain
- attestation c
- has range
- date Time
backgrounddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000326
Gives the business background of a risk scenario.
- has domain
- risk scenario c
case appetitedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000328
Gives the risk appetite stated by the case or client documents, when it differs from the appetite applied in the assessment.
has characteristics: functional
- has domain
- risk assessment c
- has range
- decimal
closed ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000875
Gives when a finding was closed.
has characteristics: functional
- has domain
- finding closure c
- has range
- date Time
collected ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000848
Gives when an evidence item was collected.
has characteristics: functional
- has domain
- evidence register entry c
- has range
- date Time
computed atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000834
Gives when an analytical result was computed.
has characteristics: functional
- has domain
- analytical result c
- has range
- date Time
condition founddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000870
States the condition an assessor found, as opposed to the criterion.
- has domain
- audit finding c
condition testdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000469
Gives the machine-readable test of an applicability condition, evaluated over an organisation profile by pipeline/grc/applicability.py.
has characteristics: functional
- has domain
- applicability condition c
- has range
- string
confidence methoddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001311
States how a stated confidence is defined and on which scale, such as 'STIX 2.1 confidence, 0-100'.
confirmed ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000879
Gives when an incident was confirmed.
has characteristics: functional
- has domain
- incident confirmation c
- has range
- date Time
consolidated todp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000468
Gives the date to which the consolidated text used by CRGO is up to date.
- has domain
- legal instrument c
- has range
- date Time
contract versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000835
Gives the version of the CRGO data contract a document conformed to, such as 'dss/v1'.
has characteristics: functional
- has range
- string
critical thresholddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000279
Gives the critical threshold of a key risk indicator, as stated.
- has domain
- key risk indicator c
currency codedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000263
Gives the ISO 4217 currency code in which costs are expressed, such as CAD.
- has range
- string
CVSS severitydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000259
Gives the severity rating that corresponds to a CVSS base score.
has characteristics: functional
- has domain
- CVSS input c
- has range
- string
CVSS vectordp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000257
Gives the CVSS vector string of a CVSS input.
has characteristics: functional
- has domain
- CVSS input c
- has range
- string
CVSS versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000258
Gives the CVSS version of a CVSS input, such as 4.0 or 3.1.
has characteristics: functional
- has domain
- CVSS input c
- has range
- string
cybersecurity budget sharedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000281
Gives a cybersecurity budget as a fraction of the total IT budget (for example 0.078).
- has domain
- budget calibration c
- has range
- decimal
data sourcedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000275
Gives where the data of a key risk indicator comes from.
- has domain
- key risk indicator c
deadline computationdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001078
States how a compliance deadline is computed, such as calendar or business days, time zone and the provision cited.
- has domain
- compliance deadline c
decided ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000840
Gives when the decision of a decision record was taken.
has characteristics: functional
- has domain
- decision record c
- has range
- date Time
decision rationaledp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000841
States the reasons for a decision.
- has domain
- decision record c
deferral reasondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001085
States why an audit plan entry was deferred or cancelled.
- has domain
- audit plan entry c
delegation limitdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000839
States the scope and limits of a delegation of authority, such as a monetary threshold or a class of decision.
- has domain
- delegation of authority c
deviations founddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000862
Gives the number of tested items that did not meet the criterion.
has characteristics: functional
- has domain
- control assessment c
- has range
- non Negative Integer
distribution parametersdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000831
Gives the parameters of an estimate distribution as name=value pairs separated by semicolons, such as 'min=0.1;mode=0.3;max=0.6'.
has characteristics: functional
- has domain
- estimate distribution c
- has range
- string
due offset (hours)dp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001077
Gives the number of hours, counted from the triggering event, within which an event-triggered deadline falls.
has characteristics: functional
- has domain
- compliance deadline c
- has range
- non Negative Integer
due ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000868
Gives the date by which an evidence request or corrective action is due.
has characteristics: functional
- has range
- date Time
effectdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000872
States the actual or potential consequence of the condition found.
- has domain
- audit finding c
effective ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000845
Gives the date from which an amendment, regulatory change or version takes effect.
has characteristics: functional
- has range
- date Time
ended atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001315
Gives when an automation or action execution ended.
has characteristics: functional
- has range
- date Time
entry descriptiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000881
Describes what happened or was done in an incident timeline entry.
- has domain
- incident timeline entry c
EPSS percentiledp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000461
Gives the share of scored vulnerabilities whose EPSS score is at or below that of the observed vulnerability on that day, from 0 to 1.
has characteristics: functional
- has domain
- EPSS observation c
- has range
- decimal
estimated effort (hours)dp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001086
Gives the estimated effort of a planned engagement, in hours.
has characteristics: functional
- has domain
- audit plan entry c
- has range
- non Negative Integer
evidence gapdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000470
States what evidence a compliance determination lacks; required when no evidence is linked.
- has domain
- compliance determination c
- has range
- string
evidence hashdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000852
Gives the SHA-256 checksum of an evidence file, so that later changes can be detected.
has characteristics: functional
- has domain
- evidence register entry c
- has range
- string
evidence limitationdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000854
States a limitation of an evidence item, such as a partial population or a self-reported source.
- has domain
- evidence register entry c
evidence locatordp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000251
Gives where an evidence item can be found, such as a document, section, page or file identifier.
- has domain
- evidence register entry c
- has range
- string
exception justificationdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000842
States why a policy exception is needed and what risk it leaves.
- has domain
- policy exception c
exception logicdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000867
States when a deviation found by an audit procedure counts as an exception.
- has domain
- audit procedure c
expected deviation ratedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000859
Gives the rate of deviation, from 0 to 1, the assessor expects in the population.
has characteristics: functional
- has domain
- sampling plan c
- has range
- decimal
expected resultdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000866
States the result an audit procedure expects when the control operates as designed.
- has domain
- audit procedure c
expiry datedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000273
Gives when a risk acceptance lapses and must be reviewed.
has characteristics: functional
- has domain
- risk acceptance c
- has range
- date Time
fact relied ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001082
States a fact about the organisation that an applicability assessment relied on.
- has domain
- applicability assessment c
gate for critical assetsdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001317
States that an approval gate applies whenever the action targets an asset the organisation values as a crown jewel.
has characteristics: functional
- has domain
- approval gate c
- has range
- boolean
identified ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000846
Gives when a regulatory change, nonconformity, trigger or deficiency was identified.
has characteristics: functional
- has range
- date Time
illustrative onlydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000864
States that a work programme or procedure is an illustration of structure, not a validated audit methodology.
has characteristics: functional
- has range
- boolean
impact descriptiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001319
Describes an incident impact, such as hours of service lost or records exposed.
- has domain
- incident impact c
impact is estimateddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001318
States that an incident impact is an estimate rather than an observed value.
has characteristics: functional
- has domain
- incident impact c
- has range
- boolean
implied appetitedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000282
Gives the risk appetite implied by a proposed cybersecurity budget under the CRG band.
- has domain
- budget calibration c
- has range
- decimal
indicator patterndp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001308
Gives the pattern of a threat indicator, in the pattern language stated.
- has domain
- threat indicator c
initial costdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000264
Gives the one-time cost of a treatment initiative.
has characteristics: functional
- has domain
- treatment initiative c
- has range
- decimal
input document hashdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000836
Gives the SHA-256 checksum of the input document an analytical result was computed from, so that the inputs can be identified exactly.
has characteristics: functional
- has domain
- analytical result c
- has range
- string
is crown jeweldp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000255
States whether an asset valuation designates the entity as one of the organisation's crown jewels.
has characteristics: functional
- has domain
- asset valuation c
- has range
- boolean
issued ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000874
Gives when an audit or assurance report was issued.
has characteristics: functional
- has range
- date Time
issuerdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000452
Gives the organisation that issues or publishes a source.
- has domain
- source record c
- has range
- string
IT budgetdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000280
Gives the organisation's total IT budget, salaries included, used in a budget calibration.
has characteristics: functional
- has domain
- budget calibration c
- has range
- decimal
items testeddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000861
Gives the number of items tested by a control assessment.
has characteristics: functional
- has domain
- control assessment c
- has range
- non Negative Integer
known ransomware campaign usedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000463
Gives whether CISA knows of a ransomware campaign using the vulnerability ('Known' or 'Unknown').
has characteristics: functional
- has range
- string
last amended ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000467
Gives the date of the latest amendment of a legal instrument known to the consolidation used.
- has domain
- legal instrument c
- has range
- date Time
legal basisdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001074
States the legal basis on which a regulatory exemption is granted.
- has domain
- regulatory exemption c
legally privilegeddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001073
States that a record contains or summarises legally privileged advice and must not be passed to general reasoning, reporting or AI services.
has characteristics: functional
- has range
- boolean
licence or termsdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000453
Gives the licence or terms of use of a source.
- has domain
- source record c
- has range
- string
local identifierdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000250
Gives the identifier a record has in its source, such as S1, C01, I01, KRI-01 or E1 in a CRG file.
- has range
- string
lower bounddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000331
Gives the smallest value observed or allowed for an estimate, such as the minimum across merged source records.
mandatory engagementdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001087
States that an audit plan entry is required by law, regulation or the governing body, whatever its risk ranking.
has characteristics: functional
- has domain
- audit plan entry c
- has range
- boolean
mapping confidencedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001091
Gives the reviewer's confidence in a mapping assertion, from 0 to 1.
has characteristics: functional
- has domain
- mapping assertion c
- has range
- decimal
measurement methoddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000274
Gives how a key risk indicator is computed.
- has domain
- key risk indicator c
metric methoddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001323
States how a response effectiveness measurement was computed, such as the start and end events used and the incidents included.
- has domain
- response effectiveness measurement c
missing factdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001083
States a fact that an applicability assessment needed but did not have.
- has domain
- applicability assessment c
model versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000460
Gives the version of the model that produced an observed score.
has characteristics: functional
- has domain
- observation c
- has range
- string
narrativedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000253
Gives the narrative of how a risk scenario unfolds.
- has domain
- risk scenario c
notification due bydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000880
Gives the latest date by which a reportable incident must be notified under the provision assessed, as computed by the assessor.
has characteristics: functional
- has domain
- breach reportability assessment c
- has range
- date Time
numeric valuedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000247
Gives the numeric value of an estimate, a risk appetite statement or another quantitative statement.
has characteristics: functional
- has range
- decimal
observation horizondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000459
Gives the period a reported probability or frequency refers to, such as 'next 30 days'.
has characteristics: functional
- has domain
- observation c
- has range
- string
observed causedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000871
States a cause of a finding that the evidence establishes.
- has domain
- audit finding c
observed ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000458
Gives the date and time an observation refers to, such as the date of an EPSS score.
has characteristics: functional
- has domain
- observation c
- has range
- date Time
occurred atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000878
Gives when a security event, timeline entry or alert occurred.
has characteristics: functional
- has range
- date Time
official citationdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000465
Gives the official citation of a legal instrument, such as CQLR c. P-39.1.
has characteristics: functional
- has domain
- legal instrument c
- has range
- string
official identifierdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000451
Gives the official citation, identifier or web address of a source.
- has domain
- source record c
- has range
- string
opened atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001313
Gives when a security investigation was opened.
has characteristics: functional
- has domain
- security investigation c
- has range
- date Time
pattern languagedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001309
Names the language of a threat indicator's pattern, such as STIX patterning or a Sigma rule.
has characteristics: functional
- has domain
- threat indicator c
- has range
- string
period enddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000850
Gives the end of the period an evidence item, assurance report, assessment or engagement covers.
has characteristics: functional
- has range
- date Time
period startdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000849
Gives the start of the period an evidence item, assurance report, assessment or engagement covers.
has characteristics: functional
- has range
- date Time
planned enddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000269
Gives when a treatment initiative is planned to finish, as stated in the source.
has characteristics: functional
- has domain
- treatment initiative c
- has range
- string
planned sample sizedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000857
Gives the number of items a sampling plan selects.
has characteristics: functional
- has domain
- sampling plan c
- has range
- non Negative Integer
planned startdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000268
Gives when a treatment initiative is planned to start, as stated in the source (for example 'Month 0').
has characteristics: functional
- has domain
- treatment initiative c
- has range
- string
population definitiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000856
States what items a population includes and from which source and period.
- has domain
- population c
population sizedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000855
Gives the number of items in a population.
has characteristics: functional
- has domain
- population c
- has range
- non Negative Integer
prepared ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001090
Gives when an audit workpaper was completed by its preparer.
has characteristics: functional
- has domain
- audit workpaper c
- has range
- date Time
priority rationaledp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001084
States why an audit plan entry has its priority, such as the risks and mandatory requirements it addresses.
- has domain
- audit plan entry c
procedure stepdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000865
Describes what the assessor does in an audit procedure.
- has domain
- audit procedure c
profile complete fordp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000474
Names a property (by its CRGO key, such as offersServicesIn or transfersDataTo) for which the organisation profile lists every value, so that a value it does not list can be taken as absent. Without it, an unlisted value is unknown.
- has domain
- Organization c
- has range
- string
provision wordingdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001076
Gives the wording of a provision version, only for texts CRGO may reproduce, such as legislation; otherwise only its citation.
- has domain
- provision version c
published ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000457
Gives the publication date of a source or legal instrument.
- has range
- date Time
purposedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000256
Gives what an entity is used for, as recorded in an asset valuation.
- has domain
- asset valuation c
qualitative readingdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000248
Gives the words that interpret a numeric estimate, such as 'very likely'.
- has domain
- estimate c
raised ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000869
Gives when a monitoring exception, finding or nonconformity was raised.
has characteristics: functional
- has range
- date Time
rationaledp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000249
Gives the reasoning behind an estimate, selection or decision.
receipt acknowledged ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001096
Gives when the authority acknowledged a regulatory submission.
has characteristics: functional
- has domain
- regulatory submission c
- has range
- date Time
recorded atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001305
Gives when a record was stored by the operational system, as distinct from when the event occurred or was observed.
has characteristics: functional
- has range
- date Time
recurring costdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000265
Gives the annual recurring cost of a treatment initiative.
has characteristics: functional
- has domain
- treatment initiative c
- has range
- decimal
redistribution in CRGOdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000454
States what CRGO reproduces or derives from a source, such as identifiers and titles only, or counts only.
- has domain
- source record c
- has range
- string
reference versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001324
Gives the version of the reference vocabulary, such as ATT&CK, that a detection strategy or rule was mapped against, so that historical alerts can be read against it.
has characteristics: functional
- has range
- string
reopened ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000876
Gives when a finding was reopened.
has characteristics: functional
- has domain
- finding reopening c
- has range
- date Time
reopening reasondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000877
States why a finding was reopened.
- has domain
- finding reopening c
report audiencedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001089
States who an audit report is addressed to.
- has domain
- audit report c
report scopedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000863
States the services, systems and criteria an external assurance report covers.
- has domain
- external assurance report c
reporting frequencydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000276
Gives how often a key risk indicator is reported.
- has domain
- key risk indicator c
required evidencedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000847
Describes the evidence an evidence requirement asks for.
- has domain
- evidence requirement c
retired ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001067
Gives when a directive version ceased to be in effect.
has characteristics: functional
- has domain
- directive version c
- has range
- date Time
retrieved ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000449
Gives when the file a source record describes was obtained.
has characteristics: functional
- has domain
- source record c
- has range
- date Time
review due ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001068
Gives the date by which a directive or directive version must next be reviewed, as last recorded.
- has range
- date Time
review interval (months)dp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001069
Gives the number of months between scheduled reviews of a directive.
has characteristics: functional
- has range
- non Negative Integer
reviewed ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001092
Gives when a record was reviewed.
- has range
- date Time
revoked ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001325
Gives when an approval decision was revoked.
has characteristics: functional
- has domain
- approval decision c
- has range
- date Time
rule identifierdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001307
Gives the identifier of a detection rule in its source, such as a Sigma rule identifier.
- has domain
- detection rule c
- has range
- string
rule languagedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001306
Names the language a detection rule is written in, such as Sigma or a product's query language.
has characteristics: functional
- has domain
- detection rule c
- has range
- string
rule versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001081
Gives the version of the applicability rules used by an applicability assessment, so that it can be reproduced.
has characteristics: functional
- has range
- string
sample sizedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000333
Gives how many source values an aggregated estimate was computed from.
has characteristics: functional
- has domain
- estimate c
- has range
- non Negative Integer
sampling rationaledp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000860
States why a sampling plan's method and size are adequate.
sampling seeddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001088
Gives the seed or starting point used to select a random or systematic sample, so that the selection can be reproduced.
has characteristics: functional
- has domain
- sampling plan c
- has range
- string
sent atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001320
Gives when an incident communication was sent.
has characteristics: functional
- has domain
- incident communication c
- has range
- date Time
SHA-256 checksumdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000455
Gives the SHA-256 checksum of a file a source record describes, so that a rebuild can verify it used the same file.
- has domain
- source record c
- has range
- string
significance methoddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000873
Names the method used to rate the significance of a finding.
has characteristics: functional
- has domain
- audit finding c
- has range
- string
source systemdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001304
Names the operational system a record was taken from, such as a SIEM or case management product.
source versiondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000450
Gives the version, release or consolidation date of a source as its issuer states it.
has characteristics: functional
- has domain
- source record c
- has range
- string
started atdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001314
Gives when an automation or action execution started.
has characteristics: functional
- has range
- date Time
stated confidencedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001310
Gives the confidence a source states for an indicator or assertion, on the scale named by the confidence method. Not a calibrated probability unless validated.
has characteristics: functional
- has range
- decimal
statementdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000252
Gives the one-sentence causal statement of a risk scenario.
- has domain
- risk scenario c
statement textdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001066
Gives the wording of an organisation's own policy statement. Never used for the text of a licensed standard.
- has domain
- policy statement c
step orderdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000254
Gives the position of a step in its scenario's event sequence, starting at 1.
has characteristics: functional
- has domain
- scenario step c
- has range
- integer
submitted ondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001079
Gives when a regulatory submission was sent.
has characteristics: functional
- has domain
- regulatory submission c
- has range
- date Time
success indicatordp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000270
Gives the measurable result that shows a treatment initiative succeeded.
- has domain
- treatment initiative c
suggested mitigationdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000330
Gives, as text, a mitigation measure proposed for a risk scenario by its source, before any treatment decision.
- has domain
- risk scenario c
system boundarydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000851
States which systems, locations or entities an evidence item or assurance report covers.
target valuedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000277
Gives the target of a key risk indicator, as stated (for example '100%').
- has domain
- key risk indicator c
test proceduredp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000471
Describes how a control assessment tested the control measure, such as inspection, sampling or a restore test.
- has domain
- control assessment c
- has range
- string
threats considereddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000843
States the threats to independence or objectivity an independence assessment considered.
- has domain
- independence assessment c
tolerable deviation ratedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000858
Gives the highest rate of deviation, from 0 to 1, at which the assessor would still rely on the control.
has characteristics: functional
- has domain
- sampling plan c
- has range
- decimal
treatment horizondp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000271
Gives the time frame in which a treatment decision is to be carried out, such as '0-6 months'.
- has domain
- risk treatment decision c
- has range
- string
treatment summarydp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000327
Summarises the treatment chosen for a risk scenario, as stated in the source.
- has domain
- risk treatment decision c
upper bounddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000332
Gives the largest value observed or allowed for an estimate, such as the maximum across merged source records.
valid fromdp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000837
Gives the start of the period over which a role assignment, delegation, exception, evidence item or version is valid.
has characteristics: functional
- has range
- date Time
valid untildp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000838
Gives the end of the period over which a role assignment, delegation, exception, evidence item or version is valid; absent while open-ended.
has characteristics: functional
- has range
- date Time
value (hours)dp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0001322
Gives the value of a response effectiveness measurement, in hours.
has characteristics: functional
- has domain
- response effectiveness measurement c
- has range
- decimal
verification notedp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000456
States how and against what a source's content was verified.
- has domain
- source record c
- has range
- string
version labeldp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000844
Gives the version label of an instrument version, directive version or report as its issuer states it, such as a consolidation date, an edition or a revision number.
has characteristics: functional
- has range
- string
warning thresholddp back to ToC or Data Property ToC
IRI: https://w3id.org/crgo/CRGO_0000278
Gives the warning threshold of a key risk indicator, as stated (for example '< 95%').
- has domain
- key risk indicator c
Annotation Properties
- abstract
- alt Label
- approval date
- approved by
- bibliographic Citation
- change Note
- code Repository
- confidence rationale
- contributor
- corroborated by
- created
- creator
- definition
- derived from
- description
- evidence source
- has confidence (element)
- has governance status
- homepage
- introduced in
- issued
- license
- modified
- notation
- preferred Namespace Prefix
- preferred Namespace Uri
- proposed by
- publisher
- review note
- scope Note
- source
- status
- title
abstractap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/abstract
alt Labelap back to ToC or Annotation Property ToC
IRI: http://www.w3.org/2004/02/skos/core#altLabel
approval dateap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000290
Date of approval.
approved byap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000289
Agent who approved the element.
bibliographic Citationap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/bibliographicCitation
change Noteap back to ToC or Annotation Property ToC
IRI: http://www.w3.org/2004/02/skos/core#changeNote
code Repositoryap back to ToC or Annotation Property ToC
IRI: https://schema.org/codeRepository
confidence rationaleap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000285
Why the element received its confidence level.
contributorap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/contributor
corroborated byap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000336
Independent published source that supports the element, for example an expert mapping made by a third party; the value names the source and what it supports.
createdap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/created
creatorap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/creator
definitionap back to ToC or Annotation Property ToC
IRI: http://www.w3.org/2004/02/skos/core#definition
derived fromap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000287
IRI of an element in another ontology (for example retired MOACCO) this element was derived from. Annotation stand-in for prov:wasDerivedFrom, which PROV-O declares as an object property.
- has super-properties
- source ap
descriptionap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/description
evidence sourceap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000286
Document, scenario or framework passage that supports the element.
- has super-properties
- source ap
has confidence (element)ap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000284
Confidence in an element as proposed; value is a ConfidenceLevel individual.
has governance statusap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000283
Approval state of an element; value is a GovernanceStatus individual.
homepageap back to ToC or Annotation Property ToC
IRI: http://xmlns.com/foaf/0.1/homepage
introduced inap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000291
Ontology version in which the element first appeared.
issuedap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/issued
licenseap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/license
modifiedap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/modified
notationap back to ToC or Annotation Property ToC
IRI: http://www.w3.org/2004/02/skos/core#notation
preferred Namespace Prefixap back to ToC or Annotation Property ToC
IRI: http://purl.org/vocab/vann/preferredNamespacePrefix
preferred Namespace Uriap back to ToC or Annotation Property ToC
IRI: http://purl.org/vocab/vann/preferredNamespaceUri
proposed byap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000288
Agent who drafted the element.
publisherap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/publisher
review noteap back to ToC or Annotation Property ToC
IRI: https://w3id.org/crgo/CRGO_0000292
Open question or comment for the reviewer.
scope Noteap back to ToC or Annotation Property ToC
IRI: http://www.w3.org/2004/02/skos/core#scopeNote
sourceap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/source
- has sub-properties
- derived from ap, evidence source ap
statusap back to ToC or Annotation Property ToC
IRI: http://purl.org/ontology/bibo/status
titleap back to ToC or Annotation Property ToC
IRI: http://purl.org/dc/terms/title
Named Individuals
- 2023 scenario-generator notebook v2-1b
- above tolerance
- accepts the risk
- accidental
- acknowledged by the authority
- action partly effective
- action risk class scheme
- action verified
- administrative action
- adversarial
- adverse
- advisory engagement
- affected persons
- agrees, will act
- AI estimate requiring validation
- alert disposition scheme
- alert trigger
- amended
- analyst inference
- analytical hypothesis (knowledge status)
- applicability state scheme
- applicable
- applications and software
- approval denied
- approval expired
- approval granted
- approval requested
- approval revoked
- approval status scheme
- approved
- approved (decision)
- approved (detection)
- approved (directive)
- approved (plan entry)
- approved (record)
- approximately at tolerance
- assessment method scheme
- assessor line scheme
- asset category scheme
- asset criticality
- asset tier scheme
- asset-category condition
- assurance engagement
- assurance opinion scheme
- assurance report type scheme
- audit conclusion (knowledge status)
- audit or assessment finding (trigger)
- availability
- awaiting approval
- backup or recovery destruction
- below tolerance
- benign true positive
- beta
- biometric data
- British Columbia or Alberta
- broader mapping
- business criticality
- calendar deadline
- Canada (federal legal order)
- Canadian province or territory without substantially similar privacy law
- cancelled
- cancelled (execution)
- cancelled (plan entry)
- case status scheme
- catastrophic data loss
- central case
- certification audit report
- Claude (Anthropic), drafting assistant
- closed (case)
- cloud and third-party services
- communication audience scheme
- compensated
- completed (plan entry)
- compliance audit
- compliance state scheme
- condition kind scheme
- confidence level scheme
- confidentiality
- conflicting mapping
- conforming
- consolidated
- contained
- containment
- containment action
- contract
- control aspect scheme
- control design (cause)
- control function scheme
- control status scheme
- control test result scheme
- control uncertainty
- controller
- corrective action status scheme
- coverage status scheme
- CRG Excel Guide v1.0c s.11
- CRG normalised cross-check
- CRG risk units
- critical severity
- critical significance
- customers and partners
- CVSS base score 0-10
- data about minors
- data category
- data exposure
- deadline trigger kind scheme
- decision outcome scheme
- decision usefulness
- deferred
- deferred (decision)
- deferred (plan entry)
- deficiency severity scheme
- degraded (telemetry)
- degraded coverage
- denial of service
- dependency / concentration
- deprecated
- design
- destructive action
- detection
- detection and analysis
- detection status scheme
- deviation
- directive (to be transposed)
- directive lifecycle state scheme
- disagrees
- disclaimer
- distribution family scheme
- documented evidence
- draft (detection)
- draft (directive)
- draft (record)
- dwell time
- effective
- empirical
- enabled (detection)
- endpoints
- engagement cancelled
- engagement closed
- engagement planning
- engagement rating scheme
- engagement reporting
- engagement state scheme
- engagement type scheme
- enterprise (private sector)
- environmental
- eradication
- escalated (decision)
- escalation flag scheme
- essential service
- European Union
- event trigger
- event-triggered deadline
- evidence basis scheme
- evidence quality scheme
- evidence strength
- exact mapping
- examine
- exception
- execution status scheme
- exercise or simulation evidence
- existential financial
- expert input
- exposure / vulnerability
- external assurer
- external evidence
- external quality assessment
- facilities
- failed
- false positive
- federal work, undertaking or business
- federally regulated financial institution
- fieldwork
- financial
- financial and payment data
- finding significance scheme
- five-point ordinal 1-5
- follow-up engagement
- full coverage
- governance
- governance (cause)
- governance status scheme
- governing body (audience)
- government identifiers
- guidance or interpretation
- haphazard selection
- health and social services body (Québec)
- health data
- healthy (telemetry)
- high confidence
- high requirement
- high severity
- high significance
- high-quality evidence
- higher case
- identity and access systems
- identity and contact data
- immediate
- impact dimension scheme
- impaired, disclosed
- implementation
- implemented and effective
- implemented, awaiting verification
- in place
- in progress
- incident (trigger)
- incident category scheme
- incident response phase scheme
- incident severity scheme
- independence conclusion scheme
- independent
- indeterminate (alert)
- ineffective
- information assets
- information marking scheme
- infrastructure
- inherent
- initiative priority scheme
- insider misuse
- instrument kind scheme
- insufficient
- integrity
- internal audit
- internal escalation
- internal quality assessment
- interview
- investigating
- judgemental selection
- jurisdiction scheme
- knowledge status scheme
- law enforcement
- legal and regulatory
- legal review in progress
- legal review state scheme
- legally reviewed
- licence restricted
- location data
- lognormal
- loss or theft
- low confidence
- low requirement
- low severity
- low significance
- low-quality evidence
- lower case
- major
- major regulatory
- malware incident
- management decision
- management response stance scheme
- management self-assessment
- manual trigger
- mapping type scheme
- Marc-André Léger
- may
- medium confidence
- medium severity
- medium significance
- minor
- misconfiguration exposure
- missing coverage
- moderate requirement
- moderate-quality evidence
- multi-unit or multi-jurisdiction
- must
- must not
- narrower mapping
- near-term
- needs improvement
- networks and communications
- new (case)
- new instrument or provision
- normal
- normative modality scheme
- not applicable
- not assessed
- not implemented or not effective
- not independent
- not legally reviewed
- not reportable
- not testable
- not tested
- online identifiers
- open
- operation
- operational
- operational resilience
- organisation type scheme
- organisation-type condition
- organisational change (trigger)
- organisational observation
- OT, IoT and connected devices
- other assurance report
- other country
- out of date
- out of scope
- partial coverage
- partially satisfied
- partly agrees
- partly effective
- pending (execution)
- pending access
- people (cause)
- people and key personnel
- personal data category scheme
- PERT (beta-PERT)
- plan entry state scheme
- planned
- post-incident review
- potential impact
- potentially applicable
- prevention
- primary asset
- privacy
- privileged infrastructure
- process (cause)
- processing
- processing role scheme
- processor or service provider
- proposed
- proposed (control)
- proposed (plan entry)
- public body (Québec)
- published (directive)
- qualified
- quality review kind scheme
- Québec
- random selection
- read-only action
- recovering
- recovery
- reference fact
- regulation
- regulator (audience)
- regulatory / legal
- regulatory change (trigger)
- regulatory change type scheme
- regulatory guideline
- rejected
- rejected (decision)
- rejected (record)
- rejected by the authority
- rejected source
- related mapping
- repealed
- reportability state scheme
- reportability undetermined
- reportable
- reputation
- requirement level scheme
- residual
- resilience
- resolved (case)
- resourcing (cause)
- response
- response metric scheme
- retired (detection)
- retired (directive)
- review state scheme
- review trigger scheme
- risk avoidance
- risk change (trigger)
- risk estimate
- risk modification
- risk retention
- risk sharing
- risk stage scheme
- risk velocity
- role condition
- root-cause category scheme
- running
- safety
- safety escalation
- sample result scheme
- sampling method scheme
- satisfactory
- satisfied
- scheduled later
- scheduled review
- scheduled trigger
- screening criterion scheme
- second line
- selected
- selection disposition scheme
- sensitivity case type scheme
- service recovery
- severe privacy
- should
- significant
- silent (telemetry)
- SOC 1 type 1
- SOC 1 type 2
- SOC 2 type 1
- SOC 2 type 2
- SOC 3
- social engineering
- source access status scheme
- statute
- strategic
- stratified selection
- structural
- submission in preparation
- submission state scheme
- submitted
- succeeded
- sufficiency conclusion scheme
- sufficient and appropriate
- sufficient with limitations
- superseded (directive)
- supervisory review
- supply-chain concentration
- supporting asset
- suppressed (detection)
- systematic selection
- systemic failure
- technology (cause)
- technology change (trigger)
- telemetry health state scheme
- territorial
- test
- testing (detection)
- third party (cause)
- threat relevance
- threat source type scheme
- time to acknowledge
- time to contain
- time to detect
- time to recover
- TLP:AMBER
- TLP:AMBER+STRICT
- TLP:CLEAR
- TLP:GREEN
- TLP:RED
- tolerance classification scheme
- treatment option scheme
- triaged (case)
- triangular
- trigger kind scheme
- true positive
- unauthorised access
- unavailable
- under consideration
- under review (directive)
- under review (record)
- undetermined
- uniform
- unit interval 0-1
- unknown
- unknown (telemetry)
- unmodified
- unreviewed
- unsatisfactory
- unsatisfied
- untested coverage
- validated coverage
- verification result scheme
- verified outcome
- verified source
- very high requirement
- very low-quality evidence
- withdrawn (record)
2023 scenario-generator notebook v2-1bni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000180
Legacy calculation method of the 2023 scenario generator, used to produce the original values of the scenario library.
- belongs to
- calculation method c
- has facts
- definition ap "Legacy calculation method of the 2023 scenario generator, used to produce the original values of the scenario library."@en
- definition ap "Méthode de calcul héritée du générateur de scénarios de 2023, utilisée pour produire les valeurs d'origine de la bibliothèque de scénarios."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-10"^^date
- introduced in ap "0.1.0"
- review note ap "Known defects of the 2023 notebook: its Monte Carlo step centres noise on the column mean rather than on each scenario's value, and its CVSS extraction is defective. Library values are therefore re-read from the generator's answers (decisions §6.1)."@en
above toleranceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000109
Ratio above 1.10.
- belongs to
- tolerance classification c
- has facts
- in Scheme op tolerance classification scheme ni
- definition ap "Ratio above 1.10."@en
- definition ap "Ratio supérieur à 1,10."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
accepts the riskni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000673
Management accepts the risk instead of acting; GIAS Standard 11.5 applies to how this is communicated.
- belongs to
- management response stance c
- has facts
- in Scheme op management response stance scheme ni
- definition ap "La direction accepte le risque au lieu d'agir; la norme 11.5 des GIAS s'applique à la façon de le communiquer."@fr
- definition ap "Management accepts the risk instead of acting; GIAS Standard 11.5 applies to how this is communicated."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
accidentalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000093
Errors and omissions by people acting without malicious intent.
- belongs to
- threat source type c
- has facts
- in Scheme op threat source type scheme ni
- definition ap "Erreurs et omissions de personnes qui agissent sans intention malveillante."@fr
- definition ap "Errors and omissions by people acting without malicious intent."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "NIST SP 800-30 Rev. 1 (2012), Appendices D-I (threat sources, events, vulnerabilities and predisposing conditions, likelihood, impact, risk)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
acknowledged by the authorityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000945
The authority has acknowledged receipt.
- belongs to
- submission state c
- has facts
- in Scheme op submission state scheme ni
- definition ap "L'autorité en a accusé réception."@fr
- definition ap "The authority has acknowledged receipt."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
action partly effectiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000684
The action is in place but the condition still occurs in part.
- belongs to
- verification result c
- has facts
- in Scheme op verification result scheme ni
- definition ap "L'action est en place mais la situation se produit encore en partie."@fr
- definition ap "The action is in place but the condition still occurs in part."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
action risk class schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001189
Concept scheme of the action risk class value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the action risk class value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « classe de risque de l'action »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
action verifiedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000679
Independently verified as implemented and effective.
- belongs to
- corrective action status c
- has facts
- in Scheme op corrective action status scheme ni
- definition ap "Independently verified as implemented and effective."@en
- definition ap "Vérifiée de façon indépendante comme réalisée et efficace."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
administrative actionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001191
Changes records or tickets, not systems.
- belongs to
- action risk class c
- has facts
- in Scheme op action risk class scheme ni
- definition ap "Changes records or tickets, not systems."@en
- definition ap "Modifie des dossiers ou des billets, et non des systèmes."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
adversarialni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000092
Individuals, groups or organisations acting with intent.
- belongs to
- threat source type c
- has facts
- in Scheme op threat source type scheme ni
- definition ap "Individuals, groups or organisations acting with intent."@en
- definition ap "Personnes, groupes ou organisations qui agissent intentionnellement."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "NIST SP 800-30 Rev. 1 (2012), Appendices D-I (threat sources, events, vulnerabilities and predisposing conditions, likelihood, impact, risk)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
adverseni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000643
The assurer concludes that the subject matter is materially misstated or the controls are not effective.
- belongs to
- assurance opinion c
- has facts
- in Scheme op assurance opinion scheme ni
- definition ap "L'assureur conclut que l'objet est entaché d'anomalies significatives ou que les mesures ne sont pas efficaces."@fr
- definition ap "The assurer concludes that the subject matter is materially misstated or the controls are not effective."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
advisory engagementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000963
Gives advice at management's request; gives no assurance.
- belongs to
- engagement type c
- has facts
- in Scheme op engagement type scheme ni
- definition ap "Donne des conseils à la demande de la direction; ne donne aucune assurance."@fr
- definition ap "Gives advice at management's request; gives no assurance."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
affected personsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001220
Persons whose information or services were affected.
- belongs to
- communication audience c
- has facts
- in Scheme op communication audience scheme ni
- definition ap "Personnes dont les informations ou les services ont été touchés."@fr
- definition ap "Persons whose information or services were affected."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
agrees, will actni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000670
Management agrees and commits to a corrective action.
- belongs to
- management response stance c
- has facts
- in Scheme op management response stance scheme ni
- definition ap "La direction est d'accord et s'engage à une action corrective."@fr
- definition ap "Management agrees and commits to a corrective action."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
AI estimate requiring validationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000122
Produced by an AI system; must be validated.
- belongs to
- evidence basis c
- has facts
- in Scheme op evidence basis scheme ni
- definition ap "Produced by an AI system; must be validated."@en
- definition ap "Produite par un système d'IA; doit être validée."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
alert disposition schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001138
Concept scheme of the alert disposition value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the alert disposition value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « décision sur l'alerte »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
alert triggerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001212
An alert matching stated conditions.
- belongs to
- trigger kind c
- has facts
- in Scheme op trigger kind scheme ni
- definition ap "An alert matching stated conditions."@en
- definition ap "Une alerte répondant à des conditions données."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
amendedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000611
The text of an instrument or provision changes.
- belongs to
- regulatory change type c
- has facts
- in Scheme op regulatory change type scheme ni
- definition ap "Le texte d'un instrument ou d'une disposition change."@fr
- definition ap "The text of an instrument or provision changes."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
analyst inferenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000121
Reasoned inference by the analyst.
- belongs to
- evidence basis c
- has facts
- in Scheme op evidence basis scheme ni
- definition ap "Inférence raisonnée de l'analyste."@fr
- definition ap "Reasoned inference by the analyst."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
analytical hypothesis (knowledge status)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000560
A proposed explanation not yet tested against evidence.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "A proposed explanation not yet tested against evidence."@en
- definition ap "Explication proposée qui n'a pas encore été vérifiée au regard des preuves."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
applicability state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000382
Concept scheme of the applicability state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the applicability state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état d'applicabilité »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
applicableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000383
Every required condition is met and no exception applies.
- belongs to
- applicability state c
- has facts
- in Scheme op applicability state scheme ni
- definition ap "Every required condition is met and no exception applies."@en
- definition ap "Toutes les conditions requises sont remplies et aucune exception ne s'applique."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
applications and softwareni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000306
Business applications, web applications, APIs.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Applications d'affaires, applications Web, API."@fr
- definition ap "Business applications, web applications, APIs."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
approval deniedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001185
Refused; the decision outcome is 'rejected'.
- belongs to
- approval status c
- has facts
- in Scheme op approval status scheme ni
- definition ap "Refused; the decision outcome is 'rejected'."@en
- definition ap "Refusée; le résultat de la décision est « rejetée »."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
approval expiredni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001186
Its validity period ended.
- belongs to
- approval status c
- has facts
- in Scheme op approval status scheme ni
- definition ap "Its validity period ended."@en
- definition ap "Sa période de validité a pris fin."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
approval grantedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001184
Granted for the stated scope and period; the decision outcome is 'approved'.
- belongs to
- approval status c
- has facts
- in Scheme op approval status scheme ni
- definition ap "Accordée pour le périmètre et la période précisés; le résultat de la décision est « approuvée »."@fr
- definition ap "Granted for the stated scope and period; the decision outcome is 'approved'."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
approval requestedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001183
Requested; no decision yet.
- belongs to
- approval status c
- has facts
- in Scheme op approval status scheme ni
- definition ap "Demandée; aucune décision encore."@fr
- definition ap "Requested; no decision yet."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
approval revokedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001187
Withdrawn before it expired, on the date recorded as 'revoked on'.
- belongs to
- approval status c
- has facts
- in Scheme op approval status scheme ni
- definition ap "Retirée avant son expiration, à la date consignée comme « révoquée le »."@fr
- definition ap "Withdrawn before it expired, on the date recorded as 'revoked on'."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
approval status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001182
Concept scheme of the approval status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the approval status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de l'approbation »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
approvedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000069
Explicitly approved by the domain expert.
- belongs to
- governance status c
- has facts
- in Scheme op governance status scheme ni
- definition ap "Approuvé explicitement par l'expert du domaine."@fr
- definition ap "Explicitly approved by the domain expert."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
approved (decision)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000588
The subject is approved as submitted or with stated conditions.
- belongs to
- decision outcome c
- has facts
- in Scheme op decision outcome scheme ni
- definition ap "L'objet est approuvé tel que soumis ou sous conditions précisées."@fr
- definition ap "The subject is approved as submitted or with stated conditions."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
approved (detection)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001133
Approved for production; not yet enabled.
- belongs to
- detection status c
- has facts
- in Scheme op detection status scheme ni
- definition ap "Approuvée pour la production; pas encore activée."@fr
- definition ap "Approved for production; not yet enabled."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
approved (directive)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000923
Approved by the competent authority; not yet in effect.
- belongs to
- directive lifecycle state c
- has facts
- in Scheme op directive lifecycle state scheme ni
- definition ap "Approuvée par l'autorité compétente; pas encore en vigueur."@fr
- definition ap "Approved by the competent authority; not yet in effect."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
approved (plan entry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000976
Approved as part of the plan.
- belongs to
- plan entry state c
- has facts
- in Scheme op plan entry state scheme ni
- definition ap "Approuvée dans le cadre du plan."@fr
- definition ap "Approved as part of the plan."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
approved (record)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000998
Approved by the reviewer.
- belongs to
- review state c
- has facts
- in Scheme op review state scheme ni
- definition ap "Approuvé par le réviseur."@fr
- definition ap "Approved by the reviewer."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
approximately at toleranceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000108
Ratio from 0.90 to 1.10.
- belongs to
- tolerance classification c
- has facts
- in Scheme op tolerance classification scheme ni
- definition ap "Ratio de 0,90 à 1,10."@fr
- definition ap "Ratio from 0.90 to 1.10."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
assessment method schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000598
Concept scheme of the assessment method value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the assessment method value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « méthode d'évaluation »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- evidence source ap "NIST SP 800-53A Rev. 5 assessment objectives and methods (examine, interview, test), as carried in the SP 800-53 Rev. 5.2.0 OSCAL catalogue (2026-05-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
assessor line schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000603
Concept scheme of the assessor line value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the assessor line value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « ligne de l'évaluateur »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
asset category schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000303
Concept scheme of the asset category value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the asset category value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « catégorie d'actif »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
asset criticalityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000150
Importance of the assets involved.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Importance des actifs touchés."@fr
- definition ap "Importance of the assets involved."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
asset tier schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000315
Concept scheme of the asset tier value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the asset tier value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « rang d'actif »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
asset-category conditionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001094
Whether an asset belongs to a stated category or tier, for a policy statement that applies to it.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "Si un actif appartient à une catégorie ou à un niveau donné, pour un énoncé de politique qui s'y applique."@fr
- definition ap "Whether an asset belongs to a stated category or tier, for a policy statement that applies to it."@en
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 5 (values added to instrument kind and condition kind)"@en
assurance engagementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000962
Gives an opinion or conclusion on governance, risk management or control.
- belongs to
- engagement type c
- has facts
- in Scheme op engagement type scheme ni
- definition ap "Donne une opinion ou une conclusion sur la gouvernance, la gestion des risques ou le contrôle."@fr
- definition ap "Gives an opinion or conclusion on governance, risk management or control."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
assurance opinion schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000640
Concept scheme of the assurance opinion value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the assurance opinion value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « opinion d'assurance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
assurance report type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000631
Concept scheme of the assurance report type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the assurance report type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de rapport d'assurance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
audit conclusion (knowledge status)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000562
A conclusion reached by an assessor against criteria on the basis of evidence.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "A conclusion reached by an assessor against criteria on the basis of evidence."@en
- definition ap "Conclusion à laquelle arrive un évaluateur au regard de critères sur la base de preuves."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
audit or assessment finding (trigger)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000932
A finding or nonconformity concerns the directive.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "A finding or nonconformity concerns the directive."@en
- definition ap "Une constatation ou une non-conformité porte sur la directive."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
availabilityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000076
Information, systems or services not available when needed.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Information, systems or services not available when needed."@en
- definition ap "Information, systèmes ou services indisponibles au moment voulu."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
awaiting approvalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001176
Stopped at an approval gate.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Arrêtée à un point d'approbation."@fr
- definition ap "Stopped at an approval gate."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
backup or recovery destructionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000171
Could destroy backups or recovery capacity.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could destroy backups or recovery capacity."@en
- definition ap "Pourrait détruire les sauvegardes ou la capacité de relève."@fr
- notation ap "9"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
below toleranceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000107
Ratio below 0.90.
- belongs to
- tolerance classification c
- has facts
- in Scheme op tolerance classification scheme ni
- definition ap "Ratio below 0.90."@en
- definition ap "Ratio inférieur à 0,90."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
benign true positiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001142
The activity occurred as detected but is authorised or harmless.
- belongs to
- alert disposition c
- has facts
- in Scheme op alert disposition scheme ni
- definition ap "L'activité a eu lieu comme détectée mais est autorisée ou inoffensive."@fr
- definition ap "The activity occurred as detected but is authorised or harmless."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
betani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000584
A distribution on the interval from 0 to 1, often used for probabilities.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "A distribution on the interval from 0 to 1, often used for probabilities."@en
- definition ap "Loi définie sur l'intervalle de 0 à 1, souvent utilisée pour des probabilités."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
biometric datani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000371
Characteristics used to identify a person, such as fingerprints or facial geometry.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Caractéristiques servant à identifier une personne, comme les empreintes digitales ou la géométrie faciale."@fr
- definition ap "Characteristics used to identify a person, such as fingerprints or facial geometry."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
British Columbia or Albertani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000473
British Columbia or Alberta, whose private-sector privacy Acts are declared substantially similar to PIPEDA.
- belongs to
- jurisdiction c
- has facts
- in Scheme op jurisdiction scheme ni
- definition ap "British Columbia or Alberta, whose private-sector privacy Acts are declared substantially similar to PIPEDA."@en
- definition ap "La Colombie-Britannique ou l'Alberta, dont les lois sur la protection des renseignements personnels dans le secteur privé sont déclarées essentiellement similaires à la LPRPDE."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
broader mappingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000990
The source is broader than the target.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "La source est plus large que la cible."@fr
- definition ap "The source is broader than the target."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
business criticalityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000149
Importance of the processes involved.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Importance des processus touchés."@fr
- definition ap "Importance of the processes involved."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
calendar deadlineni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000949
A fixed date or a recurring date, such as an annual filing.
- belongs to
- deadline trigger kind c
- has facts
- in Scheme op deadline trigger kind scheme ni
- definition ap "A fixed date or a recurring date, such as an annual filing."@en
- definition ap "Une date fixe ou récurrente, comme un dépôt annuel."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
Canada (federal legal order)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000351
Canada as the legal order of federal statutes and regulators. It is the jurisdiction of an instrument, not a place: an organisation's establishment, markets and data subjects are given by a province or territory.
- belongs to
- jurisdiction c
- has facts
- in Scheme op jurisdiction scheme ni
- definition ap "Canada as the legal order of federal statutes and regulators. It is the jurisdiction of an instrument, not a place: an organisation's establishment, markets and data subjects are given by a province or territory."@en
- definition ap "Le Canada en tant qu'ordre juridique des lois et autorités fédérales. C'est la juridiction d'un instrument, non un lieu : l'établissement, les marchés et les personnes concernées d'une organisation sont indiqués par une province ou un territoire."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
Canadian province or territory without substantially similar privacy lawni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000352
A Canadian province or territory other than Québec, British Columbia and Alberta, whose private sector is not covered by a provincial law declared substantially similar to PIPEDA.
- belongs to
- jurisdiction c
- has facts
- in Scheme op jurisdiction scheme ni
- definition ap "A Canadian province or territory other than Québec, British Columbia and Alberta, whose private sector is not covered by a provincial law declared substantially similar to PIPEDA."@en
- definition ap "Province ou territoire canadien autre que le Québec, la Colombie-Britannique et l'Alberta, dont le secteur privé n'est pas régi par une loi provinciale déclarée essentiellement similaire à la LPRPDE."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
cancelledni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000680
Withdrawn, for example because the risk was accepted.
- belongs to
- corrective action status c
- has facts
- in Scheme op corrective action status scheme ni
- definition ap "Retirée, par exemple parce que le risque a été accepté."@fr
- definition ap "Withdrawn, for example because the risk was accepted."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
cancelled (execution)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001179
Stopped before completion.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Arrêtée avant d'être menée à terme."@fr
- definition ap "Stopped before completion."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
cancelled (plan entry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000978
Removed from the plan, with a recorded reason and authoriser.
- belongs to
- plan entry state c
- has facts
- in Scheme op plan entry state scheme ni
- definition ap "Removed from the plan, with a recorded reason and authoriser."@en
- definition ap "Retirée du plan, avec un motif et un auteur consignés."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
case status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001164
Concept scheme of the case status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the case status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état du dossier »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
catastrophic data lossni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000165
Could destroy critical data.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could destroy critical data."@en
- definition ap "Pourrait détruire des données critiques."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
central caseni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000126
Estimates as given.
- belongs to
- sensitivity case type c
- has facts
- in Scheme op sensitivity case type scheme ni
- definition ap "Estimates as given."@en
- definition ap "Estimations telles quelles."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
certification audit reportni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000637
A report of a certification body on conformity with a management-system standard, such as ISO/IEC 27001.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "A report of a certification body on conformity with a management-system standard, such as ISO/IEC 27001."@en
- definition ap "Rapport d'un organisme de certification sur la conformité à une norme de système de management, comme l'ISO/IEC 27001."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
Claude (Anthropic), drafting assistantni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000181
AI system that drafted proposed elements of this ontology.
closed (case)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001171
Follow-up done and the case closed.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Follow-up done and the case closed."@en
- definition ap "Suivi effectué et dossier clos."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
cloud and third-party servicesni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000310
SaaS, IaaS, hosting, managed services.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "SaaS, IaaS, hosting, managed services."@en
- definition ap "SaaS, IaaS, hébergement, services gérés."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
communication audience schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001217
Concept scheme of the communication audience value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the communication audience value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « destinataires de la communication »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
compensatedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001180
Its effects were reversed by a compensating action.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Its effects were reversed by a compensating action."@en
- definition ap "Ses effets ont été annulés par une action compensatoire."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
completed (plan entry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000979
The engagement was carried out.
- belongs to
- plan entry state c
- has facts
- in Scheme op plan entry state scheme ni
- definition ap "La mission a été réalisée."@fr
- definition ap "The engagement was carried out."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
compliance auditni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000964
Checks conformity with stated obligations or requirements.
- belongs to
- engagement type c
- has facts
- in Scheme op engagement type scheme ni
- definition ap "Checks conformity with stated obligations or requirements."@en
- definition ap "Vérifie la conformité à des obligations ou exigences précisées."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
compliance state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000388
Concept scheme of the compliance state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the compliance state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de conformité »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
condition kind schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000395
Concept scheme of the condition kind value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the condition kind value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de condition »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
confidence level schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000062
Concept scheme of the confidence level value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the confidence level value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « niveau de confiance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
confidentialityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000074
Information disclosed to unauthorised parties.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Information disclosed to unauthorised parties."@en
- definition ap "Information divulguée à des personnes non autorisées."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
conflicting mappingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000993
Meeting the source makes the target harder or impossible to meet.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "Meeting the source makes the target harder or impossible to meet."@en
- definition ap "Respecter la source rend la cible plus difficile ou impossible à respecter."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
conformingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000654
The item meets the criterion.
- belongs to
- sample result c
- has facts
- in Scheme op sample result scheme ni
- definition ap "L'élément satisfait au critère."@fr
- definition ap "The item meets the criterion."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
consolidatedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000114
Merged into another scenario of the same exposure.
- belongs to
- selection disposition c
- has facts
- in Scheme op selection disposition scheme ni
- definition ap "Fusionné avec un autre scénario de la même exposition."@fr
- definition ap "Merged into another scenario of the same exposure."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
containedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001168
Spread or effect stopped.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Propagation ou effet arrêtés."@fr
- definition ap "Spread or effect stopped."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
containmentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000694
The spread or effect of the incident is limited.
- belongs to
- incident response phase c
- has facts
- in Scheme op incident response phase scheme ni
- definition ap "La propagation ou l'effet de l'incident est limité."@fr
- definition ap "The spread or effect of the incident is limited."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
containment actionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001192
Restricts a user, host or service, reversibly.
- belongs to
- action risk class c
- has facts
- in Scheme op action risk class scheme ni
- definition ap "Restreint un utilisateur, un hôte ou un service, de façon réversible."@fr
- definition ap "Restricts a user, host or service, reversibly."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
contractni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001001
An agreement that binds the organisation to obligations towards another party, such as a customer or a supplier.
- belongs to
- instrument kind c
- has facts
- in Scheme op instrument kind scheme ni
- definition ap "An agreement that binds the organisation to obligations towards another party, such as a customer or a supplier."@en
- definition ap "Entente qui lie l'organisation à des obligations envers une autre partie, comme un client ou un fournisseur."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 5 (values added to instrument kind and condition kind)"@en
control aspect schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000615
Concept scheme of the control aspect value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the control aspect value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « aspect de la mesure »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
control design (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000958
The control would not meet its objective even if operated as designed.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "La mesure n'atteindrait pas son objectif même si elle fonctionnait comme prévu."@fr
- definition ap "The control would not meet its objective even if operated as designed."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
control function schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000134
Concept scheme of the control function value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the control function value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « fonction de contrôle »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
control status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000097
Concept scheme of the control status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the control status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « statut de contrôle »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
control test result schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000402
Concept scheme of the control test result value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the control test result value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « résultat d'évaluation d'une mesure »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
control uncertaintyni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000159
How uncertain the effectiveness of controls is.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "How uncertain the effectiveness of controls is."@en
- definition ap "Incertitude quant à l'efficacité des contrôles."@fr
- notation ap "11"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
controllerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000364
Decides the purposes and means of the processing; under Loi 25, the person carrying on an enterprise who holds the information.
- belongs to
- processing role c
- has facts
- in Scheme op processing role scheme ni
- definition ap "Decides the purposes and means of the processing; under Loi 25, the person carrying on an enterprise who holds the information."@en
- definition ap "Détermine les finalités et les moyens du traitement; sous la Loi 25, la personne qui exploite une entreprise et détient les renseignements."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
corrective action status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000675
Concept scheme of the corrective action status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the corrective action status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de l'action corrective »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
coverage status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001145
Concept scheme of the coverage status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the coverage status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de couverture »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
CRG Excel Guide v1.0c s.11ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000178
The authoritative CyberRiskGuardian KRI formulas, implemented in crg_calc.py.
- belongs to
- calculation method c
- has facts
- definition ap "Formules ICR de référence de CyberRiskGuardian, mises en œuvre dans crg_calc.py."@fr
- definition ap "The authoritative CyberRiskGuardian KRI formulas, implemented in crg_calc.py."@en
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
CRG normalised cross-checkni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000179
Secondary score T × E × I × (1 − C), with C proxied by resilience; post-treatment × (1 − P × Q).
- belongs to
- calculation method c
- has facts
- definition ap "Score secondaire T × E × I × (1 − C), où C est approché par la résilience; après traitement × (1 − P × Q)."@fr
- definition ap "Secondary score T × E × I × (1 − C), with C proxied by resilience; post-treatment × (1 − P × Q)."@en
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
CRG risk unitsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000177
Unbounded non-negative scale of CRG computed risk quantities, which depends on the factor of the assessment.
- belongs to
- measurement scale c
- has facts
- definition ap "Unbounded non-negative scale of CRG computed risk quantities, which depends on the factor of the assessment."@en
- definition ap "Échelle non négative et non bornée des quantités de risque CRG, qui dépend du facteur de l'appréciation."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
critical severityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001209
Threatens the organisation's operations or obligations; crisis procedures apply.
- belongs to
- incident severity c
- has facts
- in Scheme op incident severity scheme ni
- definition ap "Menace les activités ou les obligations de l'organisation; les procédures de crise s'appliquent."@fr
- definition ap "Threatens the organisation's operations or obligations; crisis procedures apply."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
critical significanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000662
The objective is not met and harm is likely; the governing body should be informed.
- belongs to
- finding significance c
- has facts
- in Scheme op finding significance scheme ni
- definition ap "L'objectif n'est pas atteint et un préjudice est probable; l'organe de gouvernance devrait être informé."@fr
- definition ap "The objective is not met and harm is likely; the governing body should be informed."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
customers and partnersni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001221
Customers, suppliers or partners.
- belongs to
- communication audience c
- has facts
- in Scheme op communication audience scheme ni
- definition ap "Clients, fournisseurs ou partenaires."@fr
- definition ap "Customers, suppliers or partners."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
CVSS base score 0-10ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000175
CVSS base score scale from 0.0 to 10.0.
- belongs to
- measurement scale c
- has facts
- definition ap "CVSS base score scale from 0.0 to 10.0."@en
- definition ap "Échelle du score de base CVSS de 0,0 à 10,0."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
data about minorsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000373
Personal information about persons under 14 (Loi 25) or under 16 (GDPR information society services).
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Personal information about persons under 14 (Loi 25) or under 16 (GDPR information society services)."@en
- definition ap "Renseignements personnels sur des personnes de moins de 14 ans (Loi 25) ou de moins de 16 ans (services de la société de l'information, RGPD)."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
data categoryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000399
Which categories of personal information are processed.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "Catégories de renseignements personnels traitées."@fr
- definition ap "Which categories of personal information are processed."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
data exposureni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001198
Information was disclosed, exfiltrated or made accessible to unauthorised parties.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "Des informations ont été divulguées, exfiltrées ou rendues accessibles à des tiers non autorisés."@fr
- definition ap "Information was disclosed, exfiltrated or made accessible to unauthorised parties."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
deadline trigger kind schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000948
Concept scheme of the deadline trigger kind value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the deadline trigger kind value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de déclenchement d'échéance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
decision outcome schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000587
Concept scheme of the decision outcome value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the decision outcome value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « résultat de la décision »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
decision usefulnessni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000160
Whether analysing it could change a decision.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Possibilité que son analyse change une décision."@fr
- definition ap "Whether analysing it could change a decision."@en
- notation ap "12"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
deferredni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000115
Not selected now; kept on a watch list.
- belongs to
- selection disposition c
- has facts
- in Scheme op selection disposition scheme ni
- definition ap "Non retenu pour l'instant; placé en veille."@fr
- definition ap "Not selected now; kept on a watch list."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
deferred (decision)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000590
The decision is postponed, for example pending information.
- belongs to
- decision outcome c
- has facts
- in Scheme op decision outcome scheme ni
- definition ap "La décision est reportée, par exemple dans l'attente d'informations."@fr
- definition ap "The decision is postponed, for example pending information."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
deferred (plan entry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000977
Moved to a later period, with a recorded reason and authoriser.
- belongs to
- plan entry state c
- has facts
- in Scheme op plan entry state scheme ni
- definition ap "Moved to a later period, with a recorded reason and authoriser."@en
- definition ap "Reportée à une période ultérieure, avec un motif et un auteur consignés."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
deficiency severity schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000620
Concept scheme of the deficiency severity value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the deficiency severity value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « gravité de la déficience »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
degraded (telemetry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001153
Data arrives late, incomplete or partly unparsed.
- belongs to
- telemetry health state c
- has facts
- in Scheme op telemetry health state scheme ni
- definition ap "Data arrives late, incomplete or partly unparsed."@en
- definition ap "Les données arrivent en retard, incomplètes ou partiellement analysées."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
degraded coverageni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001148
Partly working, for example because a needed source is unhealthy.
- belongs to
- coverage status c
- has facts
- in Scheme op coverage status scheme ni
- definition ap "Fonctionne en partie, par exemple parce qu'une source nécessaire est défaillante."@fr
- definition ap "Partly working, for example because a needed source is unhealthy."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
denial of serviceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001199
A service was made unavailable or degraded on purpose.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "A service was made unavailable or degraded on purpose."@en
- definition ap "Un service a été rendu indisponible ou dégradé délibérément."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
dependency / concentrationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000156
Reliance on single points of failure or suppliers.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Dépendance envers des points de défaillance uniques ou des fournisseurs."@fr
- definition ap "Reliance on single points of failure or suppliers."@en
- notation ap "8"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
deprecatedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000071
Previously approved and now retired.
- belongs to
- governance status c
- has facts
- in Scheme op governance status scheme ni
- definition ap "Approuvé auparavant et maintenant retiré."@fr
- definition ap "Previously approved and now retired."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
designni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000616
Whether the control, as designed, would meet its objective if it operated as intended.
- belongs to
- control aspect c
- has facts
- in Scheme op control aspect scheme ni
- definition ap "Si la mesure, telle que conçue, atteindrait son objectif si elle fonctionnait comme prévu."@fr
- definition ap "Whether the control, as designed, would meet its objective if it operated as intended."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
destructive actionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001193
Deletes, wipes or otherwise changes something irreversibly.
- belongs to
- action risk class c
- has facts
- in Scheme op action risk class scheme ni
- definition ap "Deletes, wipes or otherwise changes something irreversibly."@en
- definition ap "Supprime, efface ou modifie autrement quelque chose de façon irréversible."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
detectionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000137
Identifies the event when it happens.
- belongs to
- control function c
- has facts
- in Scheme op control function scheme ni
- definition ap "Identifies the event when it happens."@en
- definition ap "Repère l'événement lorsqu'il se produit."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
detection and analysisni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000693
Events are detected, triaged and analysed.
- belongs to
- incident response phase c
- has facts
- in Scheme op incident response phase scheme ni
- definition ap "Events are detected, triaged and analysed."@en
- definition ap "Les événements sont détectés, triés et analysés."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
detection status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001130
Concept scheme of the detection status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the detection status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de la détection »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
deviationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000655
The item does not meet the criterion.
- belongs to
- sample result c
- has facts
- in Scheme op sample result scheme ni
- definition ap "L'élément ne satisfait pas au critère."@fr
- definition ap "The item does not meet the criterion."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
directive (to be transposed)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001002
An instrument that binds states to a result and is given effect through national law, such as a European Union directive.
- belongs to
- instrument kind c
- has facts
- in Scheme op instrument kind scheme ni
- definition ap "An instrument that binds states to a result and is given effect through national law, such as a European Union directive."@en
- definition ap "Instrument qui oblige des États quant au résultat et qui produit ses effets par le droit national, comme une directive de l'Union européenne."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 5 (values added to instrument kind and condition kind)"@en
directive lifecycle state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000920
Concept scheme of the directive lifecycle state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the directive lifecycle state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état du cycle de vie d'une directive »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
disagreesni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000672
Management disagrees, giving its reasons.
- belongs to
- management response stance c
- has facts
- in Scheme op management response stance scheme ni
- definition ap "La direction est en désaccord et donne ses motifs."@fr
- definition ap "Management disagrees, giving its reasons."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
disclaimerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000644
The assurer cannot express an opinion.
- belongs to
- assurance opinion c
- has facts
- in Scheme op assurance opinion scheme ni
- definition ap "L'assureur ne peut pas exprimer d'opinion."@fr
- definition ap "The assurer cannot express an opinion."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
distribution family schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000578
Concept scheme of the distribution family value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the distribution family value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « famille de lois »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
documented evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000118
Organisational documents or records.
- belongs to
- evidence basis c
- has facts
- in Scheme op evidence basis scheme ni
- definition ap "Documents ou registres de l'organisation."@fr
- definition ap "Organisational documents or records."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
draft (detection)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001131
Being written; not deployed.
- belongs to
- detection status c
- has facts
- in Scheme op detection status scheme ni
- definition ap "Being written; not deployed."@en
- definition ap "En cours de rédaction; non déployée."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
draft (directive)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000921
Being written; not binding.
- belongs to
- directive lifecycle state c
- has facts
- in Scheme op directive lifecycle state scheme ni
- definition ap "Being written; not binding."@en
- definition ap "En cours de rédaction; non contraignante."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
draft (record)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000996
Written; not yet submitted for review.
- belongs to
- review state c
- has facts
- in Scheme op review state scheme ni
- definition ap "Rédigé; pas encore soumis à la revue."@fr
- definition ap "Written; not yet submitted for review."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
dwell timeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001230
From the start of malicious activity to its containment.
- belongs to
- response metric c
- has facts
- in Scheme op response metric scheme ni
- definition ap "Du début de l'activité malveillante à son confinement."@fr
- definition ap "From the start of malicious activity to its containment."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
effectiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000403
Operates as designed over the scope tested.
- belongs to
- control test result c
- has facts
- in Scheme op control test result scheme ni
- definition ap "Fonctionne comme prévu sur le périmètre testé."@fr
- definition ap "Operates as designed over the scope tested."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
empiricalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000585
Given by observed data rather than a parametric family.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "Donnée par des observations plutôt que par une famille paramétrique."@fr
- definition ap "Given by observed data rather than a parametric family."@en
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
enabled (detection)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001134
Running in production and raising alerts.
- belongs to
- detection status c
- has facts
- in Scheme op detection status scheme ni
- definition ap "En production et générant des alertes."@fr
- definition ap "Running in production and raising alerts."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
endpointsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000307
Workstations, laptops, mobile devices, removable media.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Postes de travail, portables, appareils mobiles, supports amovibles."@fr
- definition ap "Workstations, laptops, mobile devices, removable media."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
engagement cancelledni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000972
Stopped before completion.
- belongs to
- engagement state c
- has facts
- in Scheme op engagement state scheme ni
- definition ap "Arrêtée avant d'être menée à terme."@fr
- definition ap "Stopped before completion."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
engagement closedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000971
The report is issued and the file is closed.
- belongs to
- engagement state c
- has facts
- in Scheme op engagement state scheme ni
- definition ap "Le rapport est émis et le dossier est clos."@fr
- definition ap "The report is issued and the file is closed."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
engagement planningni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000968
Scope, objectives and programme are being set.
- belongs to
- engagement state c
- has facts
- in Scheme op engagement state scheme ni
- definition ap "Le périmètre, les objectifs et le programme sont en cours d'établissement."@fr
- definition ap "Scope, objectives and programme are being set."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
engagement rating schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000664
Concept scheme of the engagement rating value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the engagement rating value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « cote de la mission »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
engagement reportingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000970
Findings and conclusions are being communicated.
- belongs to
- engagement state c
- has facts
- in Scheme op engagement state scheme ni
- definition ap "Findings and conclusions are being communicated."@en
- definition ap "Les constatations et conclusions sont en cours de communication."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
engagement state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000967
Concept scheme of the engagement state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the engagement state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de la mission »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
engagement type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000961
Concept scheme of the engagement type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the engagement type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de mission »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
enterprise (private sector)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000357
A person or organisation carrying on an enterprise within the meaning of the Civil Code of Québec, or a private-sector organisation in commercial activity.
- belongs to
- organisation type c
- has facts
- in Scheme op organisation type scheme ni
- definition ap "A person or organisation carrying on an enterprise within the meaning of the Civil Code of Québec, or a private-sector organisation in commercial activity."@en
- definition ap "Personne ou organisation qui exploite une entreprise au sens du Code civil du Québec, ou organisation du secteur privé exerçant une activité commerciale."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "OSFI Guideline B-13, scope (federally regulated financial institutions), 2022-07-31"@en
- evidence source ap "PIPEDA ss. 4, 26(2)(b), Sch. 1 (S.C. 2000, c. 5, current to 2026-09-21)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
environmentalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000095
Natural or infrastructure events outside the organisation's control.
- belongs to
- threat source type c
- has facts
- in Scheme op threat source type scheme ni
- definition ap "Natural or infrastructure events outside the organisation's control."@en
- definition ap "Événements naturels ou d'infrastructure hors du contrôle de l'organisation."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "NIST SP 800-30 Rev. 1 (2012), Appendices D-I (threat sources, events, vulnerabilities and predisposing conditions, likelihood, impact, risk)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
eradicationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000695
The cause is removed.
- belongs to
- incident response phase c
- has facts
- in Scheme op incident response phase scheme ni
- definition ap "La cause est éliminée."@fr
- definition ap "The cause is removed."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
escalated (decision)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000591
The subject is referred to a higher authority.
- belongs to
- decision outcome c
- has facts
- in Scheme op decision outcome scheme ni
- definition ap "L'objet est renvoyé à une autorité supérieure."@fr
- definition ap "The subject is referred to a higher authority."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
escalation flag schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000162
Concept scheme of the escalation flag value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the escalation flag value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « signal d'escalade »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
essential serviceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000164
Could stop an essential service.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could stop an essential service."@en
- definition ap "Pourrait interrompre un service essentiel."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
European Unionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000353
The European Union and its Member States.
- belongs to
- jurisdiction c
- has facts
- in Scheme op jurisdiction scheme ni
- definition ap "L'Union européenne et ses États membres."@fr
- definition ap "The European Union and its Member States."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
event triggerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001213
An event matching stated conditions.
- belongs to
- trigger kind c
- has facts
- in Scheme op trigger kind scheme ni
- definition ap "An event matching stated conditions."@en
- definition ap "Un événement répondant à des conditions données."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
event-triggered deadlineni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000950
A period counted from an event, such as becoming aware of a breach.
- belongs to
- deadline trigger kind c
- has facts
- in Scheme op deadline trigger kind scheme ni
- definition ap "A period counted from an event, such as becoming aware of a breach."@en
- definition ap "Un délai compté à partir d'un événement, comme la prise de connaissance d'une atteinte."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
evidence basis schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000117
Concept scheme of the evidence basis value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the evidence basis value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « fondement de la preuve »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
evidence quality schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000572
Concept scheme of the evidence quality value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the evidence quality value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « qualité des preuves »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
evidence strengthni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000157
Quality of the supporting evidence.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Quality of the supporting evidence."@en
- definition ap "Qualité des preuves à l'appui."@fr
- notation ap "9"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
exact mappingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000987
Source and target say the same thing.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "La source et la cible disent la même chose."@fr
- definition ap "Source and target say the same thing."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
examineni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000599
Review, inspect, observe or analyse documents, records, configurations or activities.
- belongs to
- assessment method c
- has facts
- in Scheme op assessment method scheme ni
- definition ap "Passer en revue, inspecter, observer ou analyser des documents, des registres, des configurations ou des activités."@fr
- definition ap "Review, inspect, observe or analyse documents, records, configurations or activities."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- evidence source ap "NIST SP 800-53A Rev. 5 assessment objectives and methods (examine, interview, test), as carried in the SP 800-53 Rev. 5.2.0 OSCAL catalogue (2026-05-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
exceptionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000400
A condition that, when met, excludes application.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "A condition that, when met, excludes application."@en
- definition ap "Condition qui, lorsqu'elle est remplie, exclut l'application."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
execution status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001173
Concept scheme of the execution status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the execution status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de l'exécution »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
exercise or simulation evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000334
Comes from a tabletop exercise, simulation or sample data; indicative only and to be validated, never a confirmed incident.
- belongs to
- evidence basis c
- has facts
- in Scheme op evidence basis scheme ni
- definition ap "Comes from a tabletop exercise, simulation or sample data; indicative only and to be validated, never a confirmed incident."@en
- definition ap "Provient d'un exercice sur table, d'une simulation ou de données d'exemple; indicative seulement et à valider, jamais un incident confirmé."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-10"^^date
- introduced in ap "0.2.0"
existential financialni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000169
Could threaten the organisation's survival.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could threaten the organisation's survival."@en
- definition ap "Pourrait menacer la survie de l'organisation."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
expert inputni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000120
Judgement of a subject-matter expert.
- belongs to
- evidence basis c
- has facts
- in Scheme op evidence basis scheme ni
- definition ap "Judgement of a subject-matter expert."@en
- definition ap "Jugement d'un expert du domaine."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
exposure / vulnerabilityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000152
How exposed the assets are.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Degré d'exposition des actifs."@fr
- definition ap "How exposed the assets are."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
external assurerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000607
Performed by an independent party outside the organisation.
- belongs to
- assessor line c
- has facts
- in Scheme op assessor line scheme ni
- definition ap "Performed by an independent party outside the organisation."@en
- definition ap "Réalisée par une partie indépendante extérieure à l'organisation."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
external evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000119
Sector, threat-intelligence or published sources.
- belongs to
- evidence basis c
- has facts
- in Scheme op evidence basis scheme ni
- definition ap "Sector, threat-intelligence or published sources."@en
- definition ap "Sources sectorielles, de renseignement sur les menaces ou publiées."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
external quality assessmentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000984
Assessment of the audit function by a qualified independent assessor.
- belongs to
- quality review kind c
- has facts
- in Scheme op quality review kind scheme ni
- definition ap "Assessment of the audit function by a qualified independent assessor."@en
- definition ap "Évaluation de la fonction d'audit par un évaluateur indépendant qualifié."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
facilitiesni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000312
Server rooms, data centres, sites, archives.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Salles des serveurs, centres de données, sites, archives."@fr
- definition ap "Server rooms, data centres, sites, archives."@en
- notation ap "9"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
failedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001178
Finished without the expected result.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Finished without the expected result."@en
- definition ap "Terminée sans le résultat attendu."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
false positiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001141
The rule fired, but the activity did not match what it is meant to detect.
- belongs to
- alert disposition c
- has facts
- in Scheme op alert disposition scheme ni
- definition ap "La règle s'est déclenchée, mais l'activité ne correspondait pas à ce qu'elle doit détecter."@fr
- definition ap "The rule fired, but the activity did not match what it is meant to detect."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
federal work, undertaking or businessni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000361
An organisation that operates a federal work, undertaking or business, such as a bank, airline or telecommunications carrier.
- belongs to
- organisation type c
- has facts
- in Scheme op organisation type scheme ni
- definition ap "An organisation that operates a federal work, undertaking or business, such as a bank, airline or telecommunications carrier."@en
- definition ap "Organisation qui exploite une entreprise fédérale, comme une banque, un transporteur aérien ou une entreprise de télécommunications."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "OSFI Guideline B-13, scope (federally regulated financial institutions), 2022-07-31"@en
- evidence source ap "PIPEDA ss. 4, 26(2)(b), Sch. 1 (S.C. 2000, c. 5, current to 2026-09-21)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
federally regulated financial institutionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000360
A bank, insurer or trust and loan company regulated by OSFI.
- belongs to
- organisation type c
- has facts
- in Scheme op organisation type scheme ni
- definition ap "A bank, insurer or trust and loan company regulated by OSFI."@en
- definition ap "Banque, société d'assurance ou société de fiducie et de prêt réglementée par le BSIF."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "OSFI Guideline B-13, scope (federally regulated financial institutions), 2022-07-31"@en
- evidence source ap "PIPEDA ss. 4, 26(2)(b), Sch. 1 (S.C. 2000, c. 5, current to 2026-09-21)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
fieldworkni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000969
Procedures are being performed.
- belongs to
- engagement state c
- has facts
- in Scheme op engagement state scheme ni
- definition ap "Les procédures sont en cours d'exécution."@fr
- definition ap "Procedures are being performed."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
financialni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000079
Direct or indirect monetary loss.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Direct or indirect monetary loss."@en
- definition ap "Perte monétaire directe ou indirecte."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
financial and payment datani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000369
Payment card, bank account or transaction data.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Données de carte de paiement, de compte bancaire ou de transaction."@fr
- definition ap "Payment card, bank account or transaction data."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
finding significance schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000658
Concept scheme of the finding significance value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the finding significance value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « importance de la constatation »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
five-point ordinal 1-5ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000176
Integer scale from 1 to 5 used for screening scores.
- belongs to
- measurement scale c
- has facts
- definition ap "Integer scale from 1 to 5 used for screening scores."@en
- definition ap "Échelle entière de 1 à 5 utilisée pour les scores de présélection."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
follow-up engagementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000965
Checks the status and effectiveness of earlier corrective actions.
- belongs to
- engagement type c
- has facts
- in Scheme op engagement type scheme ni
- definition ap "Checks the status and effectiveness of earlier corrective actions."@en
- definition ap "Vérifie l'état et l'efficacité d'actions correctives antérieures."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
full coverageni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000988
Meeting the source meets all of the target.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "Meeting the source meets all of the target."@en
- definition ap "Respecter la source permet de respecter toute la cible."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
governanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000135
Direction, accountability and oversight.
- belongs to
- control function c
- has facts
- in Scheme op control function scheme ni
- definition ap "Direction, accountability and oversight."@en
- definition ap "Orientation, responsabilité et surveillance."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
governance (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000956
Unclear accountability, oversight or direction.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "Responsabilité, surveillance ou orientation imprécises."@fr
- definition ap "Unclear accountability, oversight or direction."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
governance status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000067
Concept scheme of the governance status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the governance status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « statut de gouvernance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
governing body (audience)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001219
The board or one of its committees.
- belongs to
- communication audience c
- has facts
- in Scheme op communication audience scheme ni
- definition ap "Le conseil ou l'un de ses comités."@fr
- definition ap "The board or one of its committees."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
government identifiersni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000374
Social insurance, health insurance, passport or driver's licence numbers.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Numéros d'assurance sociale, d'assurance maladie, de passeport ou de permis de conduire."@fr
- definition ap "Social insurance, health insurance, passport or driver's licence numbers."@en
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
guidance or interpretationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000613
A regulator or court publishes guidance or a decision that changes how a provision is read.
- belongs to
- regulatory change type c
- has facts
- in Scheme op regulatory change type scheme ni
- definition ap "A regulator or court publishes guidance or a decision that changes how a provision is read."@en
- definition ap "Une autorité ou un tribunal publie une orientation ou une décision qui change la lecture d'une disposition."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
haphazard selectionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000650
Items are chosen without a conscious bias, but not by a random process.
- belongs to
- sampling method c
- has facts
- in Scheme op sampling method scheme ni
- definition ap "Items are chosen without a conscious bias, but not by a random process."@en
- definition ap "Les éléments sont choisis sans biais conscient, mais pas par un processus aléatoire."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISACA IT Audit Framework (ITAF), 5th edition (copyright 2026 ISACA); identifiers and titles cited, text not reproduced"@en
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
health and social services body (Québec)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000359
A body listed in s. 4 or the Schedules of CQLR c. R-22.1.
- belongs to
- organisation type c
- has facts
- in Scheme op organisation type scheme ni
- definition ap "A body listed in s. 4 or the Schedules of CQLR c. R-22.1."@en
- definition ap "Organisme visé à l'article 4 ou aux annexes de la loi c. R-22.1."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "OSFI Guideline B-13, scope (federally regulated financial institutions), 2022-07-31"@en
- evidence source ap "PIPEDA ss. 4, 26(2)(b), Sch. 1 (S.C. 2000, c. 5, current to 2026-09-21)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
health datani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000370
Information about a person's physical or mental health or health services.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Information about a person's physical or mental health or health services."@en
- definition ap "Renseignements sur la santé physique ou mentale d'une personne ou sur les services de santé reçus."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
healthy (telemetry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001152
Expected data arrives on time and parses.
- belongs to
- telemetry health state c
- has facts
- in Scheme op telemetry health state scheme ni
- definition ap "Expected data arrives on time and parses."@en
- definition ap "Les données attendues arrivent à temps et sont analysées."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
high confidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000063
Supported by direct evidence or an authoritative source.
- belongs to
- confidence level c
- has facts
- in Scheme op confidence level scheme ni
- definition ap "Appuyé par une preuve directe ou une source qui fait autorité."@fr
- definition ap "Supported by direct evidence or an authoritative source."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
high requirementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000088
Serious harm if the property is lost.
- belongs to
- requirement level c
- has facts
- in Scheme op requirement level scheme ni
- definition ap "Préjudice grave si la propriété est perdue."@fr
- definition ap "Serious harm if the property is lost."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, examples/medibec/source/data30.json and budget.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
high severityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001208
Serious effect on critical services or sensitive data; management is informed.
- belongs to
- incident severity c
- has facts
- in Scheme op incident severity scheme ni
- definition ap "Effet grave sur des services critiques ou des données sensibles; la direction est informée."@fr
- definition ap "Serious effect on critical services or sensitive data; management is informed."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
high significanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000661
A serious effect on the objective; needs prompt action and senior attention.
- belongs to
- finding significance c
- has facts
- in Scheme op finding significance scheme ni
- definition ap "A serious effect on the objective; needs prompt action and senior attention."@en
- definition ap "Effet grave sur l'objectif; exige une action rapide et l'attention de la haute direction."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
high-quality evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000573
Direct, recent and relevant evidence from the organisation or an authoritative source.
- belongs to
- evidence quality c
- has facts
- in Scheme op evidence quality scheme ni
- definition ap "Direct, recent and relevant evidence from the organisation or an authoritative source."@en
- definition ap "Preuves directes, récentes et pertinentes provenant de l'organisation ou d'une source faisant autorité."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
higher caseni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000127
Threat, exploitation and damage +0.10; resilience and reductions −0.10.
- belongs to
- sensitivity case type c
- has facts
- in Scheme op sensitivity case type scheme ni
- definition ap "Menace, exploitation et dommages +0,10; résilience et réductions −0,10."@fr
- definition ap "Threat, exploitation and damage +0.10; resilience and reductions −0.10."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
identity and access systemsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000305
Directories, identity providers, privileged access.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Annuaires, fournisseurs d'identité, accès privilégiés."@fr
- definition ap "Directories, identity providers, privileged access."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
identity and contact datani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000368
Names, addresses, e-mail addresses, telephone numbers.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Names, addresses, e-mail addresses, telephone numbers."@en
- definition ap "Noms, adresses, courriels, numéros de téléphone."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
immediateni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000130
Start now.
- belongs to
- initiative priority c
- has facts
- in Scheme op initiative priority scheme ni
- definition ap "Start now."@en
- definition ap "À commencer maintenant."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
impact dimension schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000073
Concept scheme of the impact dimension value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the impact dimension value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « dimension d'impact »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
impaired, disclosedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000595
Independence or objectivity is impaired and the impairment is disclosed with the result.
- belongs to
- independence conclusion c
- has facts
- in Scheme op independence conclusion scheme ni
- definition ap "Independence or objectivity is impaired and the impairment is disclosed with the result."@en
- definition ap "L'indépendance ou l'objectivité est compromise et l'atteinte est déclarée avec le résultat."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
implementationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000617
Whether the control is in place on the assets and processes in scope at a point in time.
- belongs to
- control aspect c
- has facts
- in Scheme op control aspect scheme ni
- definition ap "Si la mesure est en place sur les actifs et processus visés à un moment donné."@fr
- definition ap "Whether the control is in place on the assets and processes in scope at a point in time."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
implemented and effectiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000683
The action is in place and the condition no longer occurs.
- belongs to
- verification result c
- has facts
- in Scheme op verification result scheme ni
- definition ap "L'action est en place et la situation ne se produit plus."@fr
- definition ap "The action is in place and the condition no longer occurs."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
implemented, awaiting verificationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000678
The owner reports it implemented; not yet independently verified.
- belongs to
- corrective action status c
- has facts
- in Scheme op corrective action status scheme ni
- definition ap "Le responsable la déclare réalisée; elle n'a pas encore été vérifiée de façon indépendante."@fr
- definition ap "The owner reports it implemented; not yet independently verified."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
in placeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000098
Implemented and operating; claims require evidence.
- belongs to
- control status c
- has facts
- in Scheme op control status scheme ni
- definition ap "Implemented and operating; claims require evidence."@en
- definition ap "Mise en œuvre et en fonctionnement; toute affirmation exige une preuve."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
in progressni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000677
Being carried out.
- belongs to
- corrective action status c
- has facts
- in Scheme op corrective action status scheme ni
- definition ap "Being carried out."@en
- definition ap "En cours d'exécution."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
incident (trigger)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000931
An incident revealed that the directive is inadequate.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "An incident revealed that the directive is inadequate."@en
- definition ap "Un incident a révélé que la directive est inadéquate."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
incident category schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001195
Concept scheme of the incident category value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the incident category value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « catégorie d'incident »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
incident response phase schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000692
Concept scheme of the incident response phase value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the incident response phase value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « phase de réponse à l'incident »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
incident severity schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001205
Concept scheme of the incident severity value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the incident severity value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « gravité de l'incident »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
independence conclusion schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000593
Concept scheme of the independence conclusion value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the independence conclusion value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « conclusion sur l'indépendance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
independentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000594
No threat to independence or objectivity was found, or threats are reduced to an acceptable level.
- belongs to
- independence conclusion c
- has facts
- in Scheme op independence conclusion scheme ni
- definition ap "Aucune menace à l'indépendance ou à l'objectivité n'a été relevée, ou les menaces sont ramenées à un niveau acceptable."@fr
- definition ap "No threat to independence or objectivity was found, or threats are reduced to an acceptable level."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
indeterminate (alert)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001143
The evidence does not allow a conclusion.
- belongs to
- alert disposition c
- has facts
- in Scheme op alert disposition scheme ni
- definition ap "Les preuves ne permettent pas de conclure."@fr
- definition ap "The evidence does not allow a conclusion."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
ineffectiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000405
Does not operate as designed.
- belongs to
- control test result c
- has facts
- in Scheme op control test result scheme ni
- definition ap "Does not operate as designed."@en
- definition ap "Ne fonctionne pas comme prévu."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
information assetsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000304
Data sets, records and documents.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Data sets, records and documents."@en
- definition ap "Jeux de données, dossiers et documents."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
information marking schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001157
Concept scheme of the information marking value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the information marking value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « marquage de l'information »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "FIRST Traffic Light Protocol (TLP) 2.0 (authoritative from August 2022)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
infrastructureni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000308
Servers, storage, virtualisation, backups.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Servers, storage, virtualisation, backups."@en
- definition ap "Serveurs, stockage, virtualisation, sauvegardes."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
inherentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000103
With existing controls only, before proposed treatment.
- belongs to
- risk stage c
- has facts
- in Scheme op risk stage scheme ni
- definition ap "Avec les seuls contrôles existants, avant le traitement proposé."@fr
- definition ap "With existing controls only, before proposed treatment."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
initiative priority schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000129
Concept scheme of the initiative priority value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the initiative priority value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « priorité d'initiative »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
insider misuseni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001201
An authorised user misused their access.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "An authorised user misused their access."@en
- definition ap "Un utilisateur autorisé a abusé de son accès."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
instrument kind schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000377
Concept scheme of the instrument kind value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the instrument kind value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type d'instrument »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
insufficientni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000627
More or better evidence is needed.
- belongs to
- sufficiency conclusion c
- has facts
- in Scheme op sufficiency conclusion scheme ni
- definition ap "Des preuves supplémentaires ou meilleures sont nécessaires."@fr
- definition ap "More or better evidence is needed."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
integrityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000075
Information or systems altered in an unauthorised or incorrect way.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Information or systems altered in an unauthorised or incorrect way."@en
- definition ap "Information ou systèmes modifiés de manière non autorisée ou erronée."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
internal auditni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000606
Performed by the internal audit function.
- belongs to
- assessor line c
- has facts
- in Scheme op assessor line scheme ni
- definition ap "Performed by the internal audit function."@en
- definition ap "Réalisée par la fonction d'audit interne."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
internal escalationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001218
Responders, owners or management within the organisation.
- belongs to
- communication audience c
- has facts
- in Scheme op communication audience scheme ni
- definition ap "Intervenants, responsables ou direction au sein de l'organisation."@fr
- definition ap "Responders, owners or management within the organisation."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
internal quality assessmentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000983
Periodic self-assessment of the audit function.
- belongs to
- quality review kind c
- has facts
- in Scheme op quality review kind scheme ni
- definition ap "Autoévaluation périodique de la fonction d'audit."@fr
- definition ap "Periodic self-assessment of the audit function."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
interviewni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000600
Hold discussions with persons to obtain or confirm information.
- belongs to
- assessment method c
- has facts
- in Scheme op assessment method scheme ni
- definition ap "Hold discussions with persons to obtain or confirm information."@en
- definition ap "S'entretenir avec des personnes pour obtenir ou confirmer des informations."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- evidence source ap "NIST SP 800-53A Rev. 5 assessment objectives and methods (examine, interview, test), as carried in the SP 800-53 Rev. 5.2.0 OSCAL catalogue (2026-05-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
investigatingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001167
Scope and cause being established.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Scope and cause being established."@en
- definition ap "Étendue et cause en cours d'établissement."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
judgemental selectionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000651
Items are chosen by the assessor for a stated reason, such as high value or risk.
- belongs to
- sampling method c
- has facts
- in Scheme op sampling method scheme ni
- definition ap "Items are chosen by the assessor for a stated reason, such as high value or risk."@en
- definition ap "Les éléments sont choisis par l'évaluateur pour un motif indiqué, comme une valeur ou un risque élevés."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISACA IT Audit Framework (ITAF), 5th edition (copyright 2026 ISACA); identifiers and titles cited, text not reproduced"@en
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
jurisdiction schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000349
Concept scheme of the jurisdiction value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the jurisdiction value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « juridiction »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
knowledge status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000557
Concept scheme of the knowledge status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the knowledge status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « statut épistémique »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
law enforcementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001223
Police or other law enforcement bodies.
- belongs to
- communication audience c
- has facts
- in Scheme op communication audience scheme ni
- definition ap "La police ou d'autres organismes chargés de l'application de la loi."@fr
- definition ap "Police or other law enforcement bodies."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
legal and regulatoryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000080
Breach of legal, regulatory or contractual obligations and its sanctions.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Breach of legal, regulatory or contractual obligations and its sanctions."@en
- definition ap "Manquement à des obligations légales, réglementaires ou contractuelles et ses sanctions."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
legal review in progressni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000939
Submitted to counsel.
- belongs to
- legal review state c
- has facts
- in Scheme op legal review state scheme ni
- definition ap "Soumise au conseiller juridique."@fr
- definition ap "Submitted to counsel."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
legal review state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000937
Concept scheme of the legal review state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the legal review state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de la revue juridique »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
legally reviewedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000940
Reviewed and accepted by counsel for the stated situation.
- belongs to
- legal review state c
- has facts
- in Scheme op legal review state scheme ni
- definition ap "Reviewed and accepted by counsel for the stated situation."@en
- definition ap "Revue et acceptée par le conseiller juridique pour la situation précisée."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
licence restrictedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000569
The file is held under terms that do not allow its text to be republished; CRGO publishes only identifiers, titles and its own paraphrases.
- belongs to
- source access status c
- has facts
- in Scheme op source access status scheme ni
- definition ap "Le fichier est détenu selon des conditions qui n'en permettent pas la republication du texte; CRGO publie seulement des identifiants, des titres et ses propres paraphrases."@fr
- definition ap "The file is held under terms that do not allow its text to be republished; CRGO publishes only identifiers, titles and its own paraphrases."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
location datani back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000372
Information revealing where a person is or has been.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Information revealing where a person is or has been."@en
- definition ap "Renseignements révélant où une personne se trouve ou s'est trouvée."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
lognormalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000583
A distribution whose logarithm is normal, often used for losses.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "A distribution whose logarithm is normal, often used for losses."@en
- definition ap "Loi dont le logarithme suit une loi normale, souvent utilisée pour les pertes."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
loss or theftni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001202
A device or medium holding information was lost or stolen.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "A device or medium holding information was lost or stolen."@en
- definition ap "Un appareil ou un support contenant de l'information a été perdu ou volé."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
low confidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000065
Weakly supported; needs validation before use in decisions.
- belongs to
- confidence level c
- has facts
- in Scheme op confidence level scheme ni
- definition ap "Faiblement appuyé; doit être validé avant d'éclairer une décision."@fr
- definition ap "Weakly supported; needs validation before use in decisions."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
low requirementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000086
Limited harm if the property is lost.
- belongs to
- requirement level c
- has facts
- in Scheme op requirement level scheme ni
- definition ap "Limited harm if the property is lost."@en
- definition ap "Préjudice limité si la propriété est perdue."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, examples/medibec/source/data30.json and budget.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
low severityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001206
Little effect; handled in normal operations.
- belongs to
- incident severity c
- has facts
- in Scheme op incident severity scheme ni
- definition ap "Little effect; handled in normal operations."@en
- definition ap "Peu d'effet; traité dans le cadre des activités normales."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
low significanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000659
Little effect on the objective; addressed in the normal course of business.
- belongs to
- finding significance c
- has facts
- in Scheme op finding significance scheme ni
- definition ap "Little effect on the objective; addressed in the normal course of business."@en
- definition ap "Peu d'effet sur l'objectif; traité dans le cours normal des activités."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
low-quality evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000575
Indirect or dated evidence, such as industry data for a different sector.
- belongs to
- evidence quality c
- has facts
- in Scheme op evidence quality scheme ni
- definition ap "Indirect or dated evidence, such as industry data for a different sector."@en
- definition ap "Preuves indirectes ou datées, comme des données sectorielles d'un autre secteur."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
lower caseni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000125
Threat, exploitation and damage −0.10; resilience and reductions +0.10.
- belongs to
- sensitivity case type c
- has facts
- in Scheme op sensitivity case type scheme ni
- definition ap "Menace, exploitation et dommages −0,10; résilience et réductions +0,10."@fr
- definition ap "Threat, exploitation and damage −0.10; resilience and reductions +0.10."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
majorni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000623
The control objective is not met; the governing body should be informed.
- belongs to
- deficiency severity c
- has facts
- in Scheme op deficiency severity scheme ni
- definition ap "L'objectif de la mesure n'est pas atteint; l'organe de gouvernance devrait être informé."@fr
- definition ap "The control objective is not met; the governing body should be informed."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
major regulatoryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000168
Could trigger major regulatory action.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could trigger major regulatory action."@en
- definition ap "Pourrait entraîner une intervention réglementaire majeure."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
malware incidentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001196
Malicious code ran or was installed, including ransomware.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "Malicious code ran or was installed, including ransomware."@en
- definition ap "Un code malveillant s'est exécuté ou a été installé, y compris un rançongiciel."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
management decisionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000563
A decision taken by an authorised person or body.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "A decision taken by an authorised person or body."@en
- definition ap "Décision prise par une personne ou un organe autorisé."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
management response stance schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000669
Concept scheme of the management response stance value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the management response stance value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « position de la direction »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
management self-assessmentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000604
Performed by the first line that operates the control, such as a control self-assessment (RCSA).
- belongs to
- assessor line c
- has facts
- in Scheme op assessor line scheme ni
- definition ap "Performed by the first line that operates the control, such as a control self-assessment (RCSA)."@en
- definition ap "Réalisée par la première ligne qui exploite la mesure, comme une autoévaluation des risques et des contrôles (ARC)."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
manual triggerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001215
A request by an analyst.
- belongs to
- trigger kind c
- has facts
- in Scheme op trigger kind scheme ni
- definition ap "A request by an analyst."@en
- definition ap "Une demande d'un analyste."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
mapping type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000986
Concept scheme of the mapping type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the mapping type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de correspondance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
Marc-André Légerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000182
Domain expert and approver of the ontology.
- belongs to
- Person c
- has facts
- definition ap "Domain expert and approver of the ontology."@en
- definition ap "Expert du domaine et approbateur de l'ontologie."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
mayni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000918
The statement permits something without requiring it.
- belongs to
- normative modality c
- has facts
- in Scheme op normative modality scheme ni
- definition ap "L'énoncé permet quelque chose sans l'exiger."@fr
- definition ap "The statement permits something without requiring it."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
medium confidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000064
Supported by partial evidence or a defensible judgement.
- belongs to
- confidence level c
- has facts
- in Scheme op confidence level scheme ni
- definition ap "Appuyé par une preuve partielle ou un jugement défendable."@fr
- definition ap "Supported by partial evidence or a defensible judgement."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, plugins/cyberriskguardian/skills/cyber-risk-assessment/assets/scenario-template.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
medium severityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001207
Noticeable effect on a service or data; needs a coordinated response.
- belongs to
- incident severity c
- has facts
- in Scheme op incident severity scheme ni
- definition ap "Effet notable sur un service ou des données; exige une réponse coordonnée."@fr
- definition ap "Noticeable effect on a service or data; needs a coordinated response."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
medium significanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000660
A noticeable effect on the objective; needs a planned action.
- belongs to
- finding significance c
- has facts
- in Scheme op finding significance scheme ni
- definition ap "A noticeable effect on the objective; needs a planned action."@en
- definition ap "Effet notable sur l'objectif; exige une action planifiée."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
minorni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000621
The control objective is still largely met.
- belongs to
- deficiency severity c
- has facts
- in Scheme op deficiency severity scheme ni
- definition ap "L'objectif de la mesure est encore largement atteint."@fr
- definition ap "The control objective is still largely met."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
misconfiguration exposureni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001203
A configuration error exposed a system or data.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "A configuration error exposed a system or data."@en
- definition ap "Une erreur de configuration a exposé un système ou des données."@fr
- notation ap "8"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
missing coverageni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001149
No working detection.
- belongs to
- coverage status c
- has facts
- in Scheme op coverage status scheme ni
- definition ap "Aucune détection fonctionnelle."@fr
- definition ap "No working detection."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
moderate requirementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000087
Noticeable harm if the property is lost.
- belongs to
- requirement level c
- has facts
- in Scheme op requirement level scheme ni
- definition ap "Noticeable harm if the property is lost."@en
- definition ap "Préjudice notable si la propriété est perdue."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, examples/medibec/source/data30.json and budget.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
moderate-quality evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000574
Relevant evidence with some indirectness, age or gaps.
- belongs to
- evidence quality c
- has facts
- in Scheme op evidence quality scheme ni
- definition ap "Preuves pertinentes, mais en partie indirectes, anciennes ou lacunaires."@fr
- definition ap "Relevant evidence with some indirectness, age or gaps."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
multi-unit or multi-jurisdictionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000173
Spreads across units or jurisdictions.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "S'étend à plusieurs unités ou juridictions."@fr
- definition ap "Spreads across units or jurisdictions."@en
- notation ap "11"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
mustni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000915
The statement is mandatory (must, shall).
- belongs to
- normative modality c
- has facts
- in Scheme op normative modality scheme ni
- definition ap "L'énoncé est obligatoire (doit)."@fr
- definition ap "The statement is mandatory (must, shall)."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
must notni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000916
The statement prohibits something.
- belongs to
- normative modality c
- has facts
- in Scheme op normative modality scheme ni
- definition ap "L'énoncé interdit quelque chose."@fr
- definition ap "The statement prohibits something."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
narrower mappingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000991
The source is narrower than the target.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "La source est plus étroite que la cible."@fr
- definition ap "The source is narrower than the target."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
near-termni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000131
Start within the next planning cycle.
- belongs to
- initiative priority c
- has facts
- in Scheme op initiative priority scheme ni
- definition ap "Start within the next planning cycle."@en
- definition ap "À commencer au prochain cycle de planification."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
needs improvementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000666
The objectives are partly met.
- belongs to
- engagement rating c
- has facts
- in Scheme op engagement rating scheme ni
- definition ap "Les objectifs sont partiellement atteints."@fr
- definition ap "The objectives are partly met."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
networks and communicationsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000309
LAN, WiFi, WAN links, telecommunications.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "LAN, WiFi, WAN links, telecommunications."@en
- definition ap "Réseaux locaux, sans fil, liens étendus, télécommunications."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
new (case)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001165
Opened; not yet triaged.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Opened; not yet triaged."@en
- definition ap "Ouvert; pas encore trié."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
new instrument or provisionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000610
A new instrument or provision is adopted.
- belongs to
- regulatory change type c
- has facts
- in Scheme op regulatory change type scheme ni
- definition ap "A new instrument or provision is adopted."@en
- definition ap "Un nouvel instrument ou une nouvelle disposition est adopté."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
normalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000582
Defined by a mean and a standard deviation.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "Defined by a mean and a standard deviation."@en
- definition ap "Définie par une moyenne et un écart type."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
normative modality schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000914
Concept scheme of the normative modality value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the normative modality value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « modalité normative »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
not applicableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000384
A required condition is not met.
- belongs to
- applicability state c
- has facts
- in Scheme op applicability state scheme ni
- definition ap "A required condition is not met."@en
- definition ap "Une condition requise n'est pas remplie."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
not assessedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000392
No assessment has been made.
- belongs to
- compliance state c
- has facts
- in Scheme op compliance state scheme ni
- definition ap "Aucune évaluation n'a été faite."@fr
- definition ap "No assessment has been made."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
not implemented or not effectiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000685
The action is not in place, or the condition persists.
- belongs to
- verification result c
- has facts
- in Scheme op verification result scheme ni
- definition ap "L'action n'est pas en place, ou la situation persiste."@fr
- definition ap "The action is not in place, or the condition persists."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
not independentni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000596
The assessor cannot give independent assurance on the activity.
- belongs to
- independence conclusion c
- has facts
- in Scheme op independence conclusion scheme ni
- definition ap "L'évaluateur ne peut donner d'assurance indépendante sur l'activité."@fr
- definition ap "The assessor cannot give independent assurance on the activity."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
not legally reviewedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000938
No legal review yet; the interpretation is provisional.
- belongs to
- legal review state c
- has facts
- in Scheme op legal review state scheme ni
- definition ap "Aucune revue juridique; l'interprétation est provisoire."@fr
- definition ap "No legal review yet; the interpretation is provisional."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
not reportableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000689
The provision's reporting conditions are not met; the reasons are recorded.
- belongs to
- reportability state c
- has facts
- in Scheme op reportability state scheme ni
- definition ap "Les conditions de déclaration de la disposition ne sont pas remplies; les motifs sont consignés."@fr
- definition ap "The provision's reporting conditions are not met; the reasons are recorded."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
not testableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000656
The item could not be tested, for example because evidence was missing.
- belongs to
- sample result c
- has facts
- in Scheme op sample result scheme ni
- definition ap "L'élément n'a pas pu être vérifié, par exemple faute de preuves."@fr
- definition ap "The item could not be tested, for example because evidence was missing."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
not testedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000406
In scope but not yet tested.
- belongs to
- control test result c
- has facts
- in Scheme op control test result scheme ni
- definition ap "Dans le périmètre mais pas encore testée."@fr
- definition ap "In scope but not yet tested."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
online identifiersni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000375
Account names, device identifiers, IP addresses, cookies.
- belongs to
- personal data category c
- has facts
- in Scheme op personal data category scheme ni
- definition ap "Account names, device identifiers, IP addresses, cookies."@en
- definition ap "Noms de compte, identifiants d'appareil, adresses IP, témoins."@fr
- notation ap "8"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
openni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000676
Agreed but not started.
- belongs to
- corrective action status c
- has facts
- in Scheme op corrective action status scheme ni
- definition ap "Agreed but not started."@en
- definition ap "Convenue mais non commencée."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
operationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000618
Whether the control operated as designed throughout a period.
- belongs to
- control aspect c
- has facts
- in Scheme op control aspect scheme ni
- definition ap "Si la mesure a fonctionné comme prévu pendant toute une période."@fr
- definition ap "Whether the control operated as designed throughout a period."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
operationalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000082
Disruption of business processes or service delivery.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Disruption of business processes or service delivery."@en
- definition ap "Perturbation des processus d'affaires ou de la prestation de services."@fr
- notation ap "9"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
operational resilienceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000155
Effect on the ability to keep operating.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Effect on the ability to keep operating."@en
- definition ap "Effet sur la capacité à poursuivre les activités."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
organisation type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000356
Concept scheme of the organisation type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the organisation type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type d'organisation »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "OSFI Guideline B-13, scope (federally regulated financial institutions), 2022-07-31"@en
- evidence source ap "PIPEDA ss. 4, 26(2)(b), Sch. 1 (S.C. 2000, c. 5, current to 2026-09-21)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
organisation-type conditionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000397
The legal category of the organisation.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "Catégorie juridique de l'organisation."@fr
- definition ap "The legal category of the organisation."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
organisational change (trigger)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000934
A change in structure, mandate, activities or roles.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "A change in structure, mandate, activities or roles."@en
- definition ap "Un changement de structure, de mandat, d'activités ou de rôles."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
organisational observationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000559
A fact recorded about a given organisation, such as a configuration or a test result.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "A fact recorded about a given organisation, such as a configuration or a test result."@en
- definition ap "Fait consigné au sujet d'une organisation donnée, comme une configuration ou un résultat d'essai."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
OT, IoT and connected devicesni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000311
Industrial, building, medical and IoT devices.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Appareils industriels, de bâtiment, médicaux et objets connectés."@fr
- definition ap "Industrial, building, medical and IoT devices."@en
- notation ap "8"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
other assurance reportni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000638
Another kind of independent assurance report.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "Another kind of independent assurance report."@en
- definition ap "Autre type de rapport d'assurance indépendant."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
other countryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000354
A country outside Canada and the European Union.
- belongs to
- jurisdiction c
- has facts
- in Scheme op jurisdiction scheme ni
- definition ap "A country outside Canada and the European Union."@en
- definition ap "Pays situé hors du Canada et de l'Union européenne."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
out of dateni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000628
The evidence predates the period assessed or has expired.
- belongs to
- sufficiency conclusion c
- has facts
- in Scheme op sufficiency conclusion scheme ni
- definition ap "Les preuves sont antérieures à la période évaluée ou ont expiré."@fr
- definition ap "The evidence predates the period assessed or has expired."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
out of scopeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000629
The evidence covers other systems, entities or populations than those assessed.
- belongs to
- sufficiency conclusion c
- has facts
- in Scheme op sufficiency conclusion scheme ni
- definition ap "Les preuves portent sur d'autres systèmes, entités ou populations que ceux évalués."@fr
- definition ap "The evidence covers other systems, entities or populations than those assessed."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
partial coverageni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000989
Meeting the source meets only part of the target.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "Meeting the source meets only part of the target."@en
- definition ap "Respecter la source ne permet de respecter qu'une partie de la cible."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
partially satisfiedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000390
The evidence shows the provision is met in part.
- belongs to
- compliance state c
- has facts
- in Scheme op compliance state scheme ni
- definition ap "Les preuves montrent que la disposition est respectée en partie."@fr
- definition ap "The evidence shows the provision is met in part."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
partly agreesni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000671
Management agrees with part of the finding or recommendation.
- belongs to
- management response stance c
- has facts
- in Scheme op management response stance scheme ni
- definition ap "La direction est d'accord avec une partie de la constatation ou de la recommandation."@fr
- definition ap "Management agrees with part of the finding or recommendation."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
partly effectiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000404
Operates as designed for part of the scope or with exceptions.
- belongs to
- control test result c
- has facts
- in Scheme op control test result scheme ni
- definition ap "Fonctionne comme prévu pour une partie du périmètre ou avec des exceptions."@fr
- definition ap "Operates as designed for part of the scope or with exceptions."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
pending (execution)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001174
Scheduled but not started.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Prévue mais non commencée."@fr
- definition ap "Scheduled but not started."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
pending accessni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000568
The source is identified but not yet obtained; nothing is imported from it.
- belongs to
- source access status c
- has facts
- in Scheme op source access status scheme ni
- definition ap "La source est repérée mais pas encore obtenue; rien n'en est importé."@fr
- definition ap "The source is identified but not yet obtained; nothing is imported from it."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
people (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000953
Awareness, skills, workload or behaviour.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "Awareness, skills, workload or behaviour."@en
- definition ap "Sensibilisation, compétences, charge de travail ou comportement."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
people and key personnelni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000313
Staff whose absence or error matters.
- belongs to
- asset category c
- has facts
- in Scheme op asset category scheme ni
- definition ap "Personnel dont l'absence ou l'erreur a des conséquences."@fr
- definition ap "Staff whose absence or error matters."@en
- notation ap "10"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
personal data category schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000367
Concept scheme of the personal data category value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the personal data category value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « catégorie de renseignements personnels »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
PERT (beta-PERT)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000581
Defined by a minimum, a most likely value and a maximum, with less weight in the tails than a triangular distribution.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "Defined by a minimum, a most likely value and a maximum, with less weight in the tails than a triangular distribution."@en
- definition ap "Définie par un minimum, une valeur la plus probable et un maximum, avec moins de poids aux extrémités qu'une loi triangulaire."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
plan entry state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000974
Concept scheme of the plan entry state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the plan entry state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de l'entrée du plan »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
plannedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000099
Approved and scheduled but not yet operating.
- belongs to
- control status c
- has facts
- in Scheme op control status scheme ni
- definition ap "Approuvée et planifiée, mais pas encore en fonctionnement."@fr
- definition ap "Approved and scheduled but not yet operating."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
post-incident reviewni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000697
Lessons are drawn and follow-up actions are set.
- belongs to
- incident response phase c
- has facts
- in Scheme op incident response phase scheme ni
- definition ap "Les leçons sont tirées et les actions de suivi sont fixées."@fr
- definition ap "Lessons are drawn and follow-up actions are set."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
potential impactni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000153
Severity of the plausible consequences.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Gravité des conséquences plausibles."@fr
- definition ap "Severity of the plausible consequences."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
potentially applicableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000385
The conditions met point to application, but the result depends on an interpretation or a fact that needs review by a qualified person.
- belongs to
- applicability state c
- has facts
- in Scheme op applicability state scheme ni
- definition ap "Les conditions remplies indiquent l'application, mais le résultat dépend d'une interprétation ou d'un fait qui doit être examiné par une personne qualifiée."@fr
- definition ap "The conditions met point to application, but the result depends on an interpretation or a fact that needs review by a qualified person."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
preventionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000136
Stops the event or the exploitation.
- belongs to
- control function c
- has facts
- in Scheme op control function scheme ni
- definition ap "Empêche l'événement ou l'exploitation."@fr
- definition ap "Stops the event or the exploitation."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
primary assetni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000316
Information or process valued for itself.
- belongs to
- asset tier c
- has facts
- in Scheme op asset tier scheme ni
- definition ap "Information or process valued for itself."@en
- definition ap "Information ou processus qui a de la valeur en soi."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
privacyni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000077
Harm to individuals through misuse of their personal information.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Harm to individuals through misuse of their personal information."@en
- definition ap "Préjudice causé à des personnes par un mauvais usage de leurs renseignements personnels."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
privileged infrastructureni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000170
Involves identity or administrative infrastructure.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Involves identity or administrative infrastructure."@en
- definition ap "Touche l'infrastructure d'identité ou d'administration."@fr
- notation ap "8"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
process (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000954
A missing, unclear or unfollowed process.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "A missing, unclear or unfollowed process."@en
- definition ap "Un processus absent, imprécis ou non suivi."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
processingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000398
Whether and how the organisation processes personal information.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "Si et comment l'organisation traite des renseignements personnels."@fr
- definition ap "Whether and how the organisation processes personal information."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
processing role schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000363
Concept scheme of the processing role value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the processing role value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « rôle dans le traitement »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
processor or service providerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000365
Processes personal information on behalf of a controller under a mandate or contract.
- belongs to
- processing role c
- has facts
- in Scheme op processing role scheme ni
- definition ap "Processes personal information on behalf of a controller under a mandate or contract."@en
- definition ap "Traite des renseignements personnels pour le compte d'un responsable en vertu d'un mandat ou d'un contrat."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "Regulation (EU) 2016/679, Arts. 3, 4, 24, 28, 30 (OJ L 119, 4.5.2016)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
proposedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000068
Drafted and awaiting review by the domain expert.
- belongs to
- governance status c
- has facts
- in Scheme op governance status scheme ni
- definition ap "Drafted and awaiting review by the domain expert."@en
- definition ap "Rédigé et en attente d'examen par l'expert du domaine."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
proposed (control)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000100
Recommended but not yet approved.
- belongs to
- control status c
- has facts
- in Scheme op control status scheme ni
- definition ap "Recommandée, mais pas encore approuvée."@fr
- definition ap "Recommended but not yet approved."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
proposed (plan entry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000975
Candidate engagement, not yet approved.
- belongs to
- plan entry state c
- has facts
- in Scheme op plan entry state scheme ni
- definition ap "Candidate engagement, not yet approved."@en
- definition ap "Mission envisagée, pas encore approuvée."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
public body (Québec)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000358
A body subject to CQLR c. A-2.1, such as a ministry, municipality or school service centre.
- belongs to
- organisation type c
- has facts
- in Scheme op organisation type scheme ni
- definition ap "A body subject to CQLR c. A-2.1, such as a ministry, municipality or school service centre."@en
- definition ap "Organisme assujetti à la Loi sur l'accès (c. A-2.1), comme un ministère, une municipalité ou un centre de services scolaire."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CQLR c. P-39.1 ss. 1, 3.1-3.8, 17, 18.3; CQLR c. A-2.1 s. 3; CQLR c. R-22.1 s. 4 (LégisQuébec, updated to 2026-08-12)"@en
- evidence source ap "OSFI Guideline B-13, scope (federally regulated financial institutions), 2022-07-31"@en
- evidence source ap "PIPEDA ss. 4, 26(2)(b), Sch. 1 (S.C. 2000, c. 5, current to 2026-09-21)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
published (directive)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000924
Communicated and in effect.
- belongs to
- directive lifecycle state c
- has facts
- in Scheme op directive lifecycle state scheme ni
- definition ap "Communicated and in effect."@en
- definition ap "Communiquée et en vigueur."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
qualifiedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000642
The assurer concludes except for stated matters.
- belongs to
- assurance opinion c
- has facts
- in Scheme op assurance opinion scheme ni
- definition ap "L'assureur conclut, sauf pour des points précisés."@fr
- definition ap "The assurer concludes except for stated matters."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
quality review kind schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000981
Concept scheme of the quality review kind value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the quality review kind value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de revue de qualité »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
Québecni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000350
The province of Québec.
- belongs to
- jurisdiction c
- has facts
- in Scheme op jurisdiction scheme ni
- definition ap "La province de Québec."@fr
- definition ap "The province of Québec."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
random selectionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000647
Every item has an equal, known chance of selection.
- belongs to
- sampling method c
- has facts
- in Scheme op sampling method scheme ni
- definition ap "Chaque élément a une probabilité de sélection égale et connue."@fr
- definition ap "Every item has an equal, known chance of selection."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISACA IT Audit Framework (ITAF), 5th edition (copyright 2026 ISACA); identifiers and titles cited, text not reproduced"@en
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
read-only actionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001190
Gathers information; changes nothing.
- belongs to
- action risk class c
- has facts
- in Scheme op action risk class scheme ni
- definition ap "Gathers information; changes nothing."@en
- definition ap "Recueille de l'information; ne change rien."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
recoveringni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001169
Affected services and data being restored.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Affected services and data being restored."@en
- definition ap "Services et données touchés en cours de rétablissement."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
recoveryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000139
Restores operations after the event.
- belongs to
- control function c
- has facts
- in Scheme op control function scheme ni
- definition ap "Restores operations after the event."@en
- definition ap "Rétablit les activités après l'événement."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
reference factni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000558
Content taken from an authoritative published source, such as a control catalogue or a statute.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "Content taken from an authoritative published source, such as a control catalogue or a statute."@en
- definition ap "Contenu tiré d'une source publiée faisant autorité, comme un catalogue de mesures ou une loi."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
regulationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000379
Delegated legislation made under a statute.
- belongs to
- instrument kind c
- has facts
- in Scheme op instrument kind scheme ni
- definition ap "Delegated legislation made under a statute."@en
- definition ap "Texte réglementaire pris en vertu d'une loi."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
regulator (audience)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001222
A regulatory or supervisory authority.
- belongs to
- communication audience c
- has facts
- in Scheme op communication audience scheme ni
- definition ap "A regulatory or supervisory authority."@en
- definition ap "Une autorité de réglementation ou de surveillance."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
regulatory / legalni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000154
Legal and regulatory significance.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Legal and regulatory significance."@en
- definition ap "Portée juridique et réglementaire."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
regulatory change (trigger)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000930
A legal or regulatory change affects the directive.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "A legal or regulatory change affects the directive."@en
- definition ap "Un changement juridique ou réglementaire touche la directive."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
regulatory change type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000609
Concept scheme of the regulatory change type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the regulatory change type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de changement réglementaire »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
regulatory guidelineni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000380
A regulator's guideline setting expectations for regulated organisations.
- belongs to
- instrument kind c
- has facts
- in Scheme op instrument kind scheme ni
- definition ap "A regulator's guideline setting expectations for regulated organisations."@en
- definition ap "Ligne directrice d'une autorité de réglementation énonçant ses attentes envers les organisations réglementées."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
rejectedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000070
Reviewed and not accepted.
- belongs to
- governance status c
- has facts
- in Scheme op governance status scheme ni
- definition ap "Examiné et non retenu."@fr
- definition ap "Reviewed and not accepted."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Phase 1 report (8 Oct 2026), section 5 and recorded decisions"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
rejected (decision)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000589
The subject is not approved.
- belongs to
- decision outcome c
- has facts
- in Scheme op decision outcome scheme ni
- definition ap "L'objet n'est pas approuvé."@fr
- definition ap "The subject is not approved."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 1"@en
rejected (record)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000999
Rejected by the reviewer.
- belongs to
- review state c
- has facts
- in Scheme op review state scheme ni
- definition ap "Rejected by the reviewer."@en
- definition ap "Rejeté par le réviseur."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
rejected by the authorityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000946
The authority has refused or returned it.
- belongs to
- submission state c
- has facts
- in Scheme op submission state scheme ni
- definition ap "L'autorité l'a refusée ou renvoyée."@fr
- definition ap "The authority has refused or returned it."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
rejected sourceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000570
The source was considered and not used, for a stated reason.
- belongs to
- source access status c
- has facts
- in Scheme op source access status scheme ni
- definition ap "La source a été examinée et n'a pas été utilisée, pour un motif indiqué."@fr
- definition ap "The source was considered and not used, for a stated reason."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
related mappingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000992
Source and target concern the same subject without coverage.
- belongs to
- mapping type c
- has facts
- in Scheme op mapping type scheme ni
- definition ap "La source et la cible portent sur le même sujet sans couverture."@fr
- definition ap "Source and target concern the same subject without coverage."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
repealedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000612
An instrument or provision ceases to have effect.
- belongs to
- regulatory change type c
- has facts
- in Scheme op regulatory change type scheme ni
- definition ap "An instrument or provision ceases to have effect."@en
- definition ap "Un instrument ou une disposition cesse d'avoir effet."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
reportability state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000687
Concept scheme of the reportability state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the reportability state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de déclaration »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
reportability undeterminedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000690
Facts needed to decide are still missing.
- belongs to
- reportability state c
- has facts
- in Scheme op reportability state scheme ni
- definition ap "Des faits nécessaires à la décision manquent encore."@fr
- definition ap "Facts needed to decide are still missing."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
reportableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000688
The incident must be reported under the provision assessed.
- belongs to
- reportability state c
- has facts
- in Scheme op reportability state scheme ni
- definition ap "L'incident doit être déclaré en vertu de la disposition évaluée."@fr
- definition ap "The incident must be reported under the provision assessed."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
reputationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000081
Loss of trust of clients, partners or the public.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Loss of trust of clients, partners or the public."@en
- definition ap "Perte de confiance des clients, des partenaires ou du public."@fr
- notation ap "8"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
requirement level schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000085
Concept scheme of the requirement level value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the requirement level value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « niveau d'exigence »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, examples/medibec/source/data30.json and budget.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
residualni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000104
After the proposed treatment package.
- belongs to
- risk stage c
- has facts
- in Scheme op risk stage scheme ni
- definition ap "After the proposed treatment package."@en
- definition ap "Après l'ensemble des traitements proposés."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
resilienceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000140
Lets the organisation keep operating under stress.
- belongs to
- control function c
- has facts
- in Scheme op control function scheme ni
- definition ap "Lets the organisation keep operating under stress."@en
- definition ap "Permet à l'organisation de poursuivre ses activités sous contrainte."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
resolved (case)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001170
Response complete; follow-up pending.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Response complete; follow-up pending."@en
- definition ap "Réponse terminée; suivi en attente."@fr
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
resourcing (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000959
Insufficient budget, staff or time.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "Budget, personnel ou temps insuffisants."@fr
- definition ap "Insufficient budget, staff or time."@en
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
responseni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000138
Contains and handles the event.
- belongs to
- control function c
- has facts
- in Scheme op control function scheme ni
- definition ap "Contains and handles the event."@en
- definition ap "Contient et traite l'événement."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
response metric schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001225
Concept scheme of the response metric value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the response metric value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « indicateur de réponse »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
retired (detection)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001136
No longer used.
- belongs to
- detection status c
- has facts
- in Scheme op detection status scheme ni
- definition ap "N'est plus utilisée."@fr
- definition ap "No longer used."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
retired (directive)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000925
No longer in effect and not replaced.
- belongs to
- directive lifecycle state c
- has facts
- in Scheme op directive lifecycle state scheme ni
- definition ap "N'est plus en vigueur et n'est pas remplacée."@fr
- definition ap "No longer in effect and not replaced."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
review state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000995
Concept scheme of the review state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the review state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de la revue »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
review trigger schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000928
Concept scheme of the review trigger value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the review trigger value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « déclencheur de revue »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
risk avoidanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000145
Stop the activity that gives rise to the risk.
- belongs to
- treatment option c
- has facts
- in Scheme op treatment option scheme ni
- definition ap "Cesser l'activité à l'origine du risque."@fr
- definition ap "Stop the activity that gives rise to the risk."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO 31000:2018 (risk treatment options; paraphrased)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
risk change (trigger)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000933
A change in assessed risk or risk appetite.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "A change in assessed risk or risk appetite."@en
- definition ap "Un changement du risque évalué ou de l'appétence au risque."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
risk estimateni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000561
A model or expert estimate of likelihood, impact or risk.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "A model or expert estimate of likelihood, impact or risk."@en
- definition ap "Estimation, par un modèle ou un expert, d'une vraisemblance, d'un impact ou d'un risque."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
risk modificationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000143
Change likelihood or consequence with controls.
- belongs to
- treatment option c
- has facts
- in Scheme op treatment option scheme ni
- definition ap "Change likelihood or consequence with controls."@en
- definition ap "Modifier la probabilité ou la conséquence par des contrôles."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO 31000:2018 (risk treatment options; paraphrased)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
risk retentionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000144
Accept the risk with formal authority.
- belongs to
- treatment option c
- has facts
- in Scheme op treatment option scheme ni
- definition ap "Accept the risk with formal authority."@en
- definition ap "Accepter le risque avec une autorisation formelle."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO 31000:2018 (risk treatment options; paraphrased)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
risk sharingni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000146
Transfer part of the risk, for example through insurance or contracts.
- belongs to
- treatment option c
- has facts
- in Scheme op treatment option scheme ni
- definition ap "Transfer part of the risk, for example through insurance or contracts."@en
- definition ap "Transférer une partie du risque, par exemple par l'assurance ou des contrats."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO 31000:2018 (risk treatment options; paraphrased)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
risk stage schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000102
Concept scheme of the risk stage value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the risk stage value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « stade du risque »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
risk velocityni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000158
How fast harm would materialise.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "How fast harm would materialise."@en
- definition ap "Rapidité avec laquelle le préjudice se matérialiserait."@fr
- notation ap "10"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
role conditionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001093
Whether a person or unit holds a stated role, for a policy statement that applies to that role.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "Si une personne ou une unité exerce un rôle donné, pour un énoncé de politique qui s'applique à ce rôle."@fr
- definition ap "Whether a person or unit holds a stated role, for a policy statement that applies to that role."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 5 (values added to instrument kind and condition kind)"@en
root-cause category schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000952
Concept scheme of the root-cause category value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the root-cause category value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « catégorie de cause fondamentale »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
runningni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001175
Started and not finished.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Commencée et non terminée."@fr
- definition ap "Started and not finished."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
safetyni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000078
Physical harm to people.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Physical harm to people."@en
- definition ap "Préjudice physique à des personnes."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
safety escalationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000163
Could harm people.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could harm people."@en
- definition ap "Pourrait blesser des personnes."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
sample result schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000653
Concept scheme of the sample result value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the sample result value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « résultat d'élément d'échantillon »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
sampling method schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000646
Concept scheme of the sampling method value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the sampling method value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « méthode d'échantillonnage »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISACA IT Audit Framework (ITAF), 5th edition (copyright 2026 ISACA); identifiers and titles cited, text not reproduced"@en
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
satisfactoryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000665
The objectives are met; findings, if any, are minor.
- belongs to
- engagement rating c
- has facts
- in Scheme op engagement rating scheme ni
- definition ap "Les objectifs sont atteints; les constatations éventuelles sont mineures."@fr
- definition ap "The objectives are met; findings, if any, are minor."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
satisfiedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000389
The evidence shows the provision is met.
- belongs to
- compliance state c
- has facts
- in Scheme op compliance state scheme ni
- definition ap "Les preuves montrent que la disposition est respectée."@fr
- definition ap "The evidence shows the provision is met."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
scheduled laterni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000132
Scheduled later in the roadmap.
- belongs to
- initiative priority c
- has facts
- in Scheme op initiative priority scheme ni
- definition ap "Prévue plus tard dans la feuille de route."@fr
- definition ap "Scheduled later in the roadmap."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
scheduled reviewni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000929
The review interval has elapsed.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "L'intervalle de revue est écoulé."@fr
- definition ap "The review interval has elapsed."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
scheduled triggerni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001214
A schedule.
- belongs to
- trigger kind c
- has facts
- in Scheme op trigger kind scheme ni
- definition ap "A schedule."@en
- definition ap "Un calendrier."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
screening criterion schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000148
Concept scheme of the screening criterion value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the screening criterion value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « critère de présélection »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
second lineni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000605
Performed by a risk management, compliance or security oversight function.
- belongs to
- assessor line c
- has facts
- in Scheme op assessor line scheme ni
- definition ap "Performed by a risk management, compliance or security oversight function."@en
- definition ap "Réalisée par une fonction de gestion des risques, de conformité ou de surveillance de la sécurité."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
selectedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000112
Selected for detailed quantification.
- belongs to
- selection disposition c
- has facts
- in Scheme op selection disposition scheme ni
- definition ap "Retenu pour une quantification détaillée."@fr
- definition ap "Selected for detailed quantification."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
selection disposition schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000111
Concept scheme of the selection disposition value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the selection disposition value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « décision de présélection »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
sensitivity case type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000124
Concept scheme of the sensitivity case type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the sensitivity case type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de cas de sensibilité »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
service recoveryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000696
Affected services and data are restored.
- belongs to
- incident response phase c
- has facts
- in Scheme op incident response phase scheme ni
- definition ap "Affected services and data are restored."@en
- definition ap "Les services et données touchés sont rétablis."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 4 (module kept)"@en
severe privacyni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000167
Could seriously harm individuals' privacy.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could seriously harm individuals' privacy."@en
- definition ap "Pourrait porter gravement atteinte à la vie privée."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
shouldni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000917
The statement is recommended; departing from it needs a recorded reason.
- belongs to
- normative modality c
- has facts
- in Scheme op normative modality scheme ni
- definition ap "L'énoncé est recommandé; s'en écarter exige un motif consigné."@fr
- definition ap "The statement is recommended; departing from it needs a recorded reason."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
significantni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000622
The control objective is not reliably met; management attention is needed.
- belongs to
- deficiency severity c
- has facts
- in Scheme op deficiency severity scheme ni
- definition ap "L'objectif de la mesure n'est pas atteint de façon fiable; l'attention de la direction est nécessaire."@fr
- definition ap "The control objective is not reliably met; management attention is needed."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
silent (telemetry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001154
No data received in the expected interval.
- belongs to
- telemetry health state c
- has facts
- in Scheme op telemetry health state scheme ni
- definition ap "Aucune donnée reçue dans l'intervalle attendu."@fr
- definition ap "No data received in the expected interval."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
SOC 1 type 1ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000632
Controls relevant to user entities' financial reporting, design at a point in time.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "Controls relevant to user entities' financial reporting, design at a point in time."@en
- definition ap "Mesures pertinentes pour l'information financière des entités utilisatrices, conception à une date donnée."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
SOC 1 type 2ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000633
Controls relevant to user entities' financial reporting, design and operating effectiveness over a period.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "Controls relevant to user entities' financial reporting, design and operating effectiveness over a period."@en
- definition ap "Mesures pertinentes pour l'information financière des entités utilisatrices, conception et efficacité opérationnelle sur une période."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
SOC 2 type 1ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000634
Controls relevant to the Trust Services Criteria, design at a point in time.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "Controls relevant to the Trust Services Criteria, design at a point in time."@en
- definition ap "Mesures pertinentes au regard des critères des services de confiance, conception à une date donnée."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
SOC 2 type 2ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000635
Controls relevant to the Trust Services Criteria, design and operating effectiveness over a period.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "Controls relevant to the Trust Services Criteria, design and operating effectiveness over a period."@en
- definition ap "Mesures pertinentes au regard des critères des services de confiance, conception et efficacité opérationnelle sur une période."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
SOC 3ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000636
A general-use summary report on the Trust Services Criteria.
- belongs to
- assurance report type c
- has facts
- in Scheme op assurance report type scheme ni
- definition ap "A general-use summary report on the Trust Services Criteria."@en
- definition ap "Rapport sommaire d'usage général portant sur les critères des services de confiance."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); identifiers cited"@en
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
social engineeringni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001200
People were deceived, such as by phishing or payment fraud.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "Des personnes ont été trompées, par exemple par hameçonnage ou fraude au paiement."@fr
- definition ap "People were deceived, such as by phishing or payment fraud."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
source access status schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000566
Concept scheme of the source access status value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the source access status value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « statut d'accès à la source »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
statuteni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000378
An act adopted by a legislature, or an EU regulation.
- belongs to
- instrument kind c
- has facts
- in Scheme op instrument kind scheme ni
- definition ap "An act adopted by a legislature, or an EU regulation."@en
- definition ap "Loi adoptée par un parlement, ou règlement de l'Union européenne."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
strategicni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000083
Harm to the organisation's objectives or competitive position.
- belongs to
- impact dimension c
- has facts
- in Scheme op impact dimension scheme ni
- definition ap "Atteinte aux objectifs ou à la position concurrentielle de l'organisation."@fr
- definition ap "Harm to the organisation's objectives or competitive position."@en
- notation ap "10"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, cyber-risk-assessment SKILL.md, workflow steps 1-19 (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
stratified selectionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000649
The population is divided into strata, each sampled separately.
- belongs to
- sampling method c
- has facts
- in Scheme op sampling method scheme ni
- definition ap "La population est divisée en strates, échantillonnées séparément."@fr
- definition ap "The population is divided into strata, each sampled separately."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISACA IT Audit Framework (ITAF), 5th edition (copyright 2026 ISACA); identifiers and titles cited, text not reproduced"@en
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
structuralni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000094
Failures of equipment, software or environmental controls.
- belongs to
- threat source type c
- has facts
- in Scheme op threat source type scheme ni
- definition ap "Défaillances d'équipements, de logiciels ou de systèmes de contrôle environnemental."@fr
- definition ap "Failures of equipment, software or environmental controls."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "NIST SP 800-30 Rev. 1 (2012), Appendices D-I (threat sources, events, vulnerabilities and predisposing conditions, likelihood, impact, risk)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
submission in preparationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000943
Being prepared; not sent.
- belongs to
- submission state c
- has facts
- in Scheme op submission state scheme ni
- definition ap "Being prepared; not sent."@en
- definition ap "En préparation; non transmise."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
submission state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000942
Concept scheme of the submission state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the submission state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de la transmission »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
submittedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000944
Sent to the authority; no acknowledgement yet.
- belongs to
- submission state c
- has facts
- in Scheme op submission state scheme ni
- definition ap "Sent to the authority; no acknowledgement yet."@en
- definition ap "Transmise à l'autorité; pas encore d'accusé de réception."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
succeededni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001177
Finished with the expected result.
- belongs to
- execution status c
- has facts
- in Scheme op execution status scheme ni
- definition ap "Finished with the expected result."@en
- definition ap "Terminée avec le résultat attendu."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "OASIS CACAO Security Playbooks Version 2.0, Committee Specification 01 (2023-11-27)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
sufficiency conclusion schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000625
Concept scheme of the sufficiency conclusion value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the sufficiency conclusion value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « conclusion sur le caractère suffisant »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
sufficient and appropriateni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000626
The evidence supports a conclusion on the objective.
- belongs to
- sufficiency conclusion c
- has facts
- in Scheme op sufficiency conclusion scheme ni
- definition ap "Les preuves permettent de conclure sur l'objectif."@fr
- definition ap "The evidence supports a conclusion on the objective."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
sufficient with limitationsni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001003
The evidence supports a conclusion only with stated limitations.
- belongs to
- sufficiency conclusion c
- has facts
- in Scheme op sufficiency conclusion scheme ni
- definition ap "Les preuves permettent de conclure seulement sous réserve de limites précisées."@fr
- definition ap "The evidence supports a conclusion only with stated limitations."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 5 (values added to sufficiency conclusion)"@en
superseded (directive)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000926
No longer in effect; replaced by a later version.
- belongs to
- directive lifecycle state c
- has facts
- in Scheme op directive lifecycle state scheme ni
- definition ap "N'est plus en vigueur; remplacée par une version ultérieure."@fr
- definition ap "No longer in effect; replaced by a later version."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
supervisory reviewni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000982
Review of engagement work by its supervisor.
- belongs to
- quality review kind c
- has facts
- in Scheme op quality review kind scheme ni
- definition ap "Review of engagement work by its supervisor."@en
- definition ap "Revue des travaux d'une mission par son superviseur."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 3 (0.10.0 additions)"@en
supply-chain concentrationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000172
Depends on a concentrated supplier.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Depends on a concentrated supplier."@en
- definition ap "Dépend d'un fournisseur concentré."@fr
- notation ap "10"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
supporting assetni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000317
Asset on which primary assets rely.
- belongs to
- asset tier c
- has facts
- in Scheme op asset tier scheme ni
- definition ap "Actif sur lequel reposent les actifs principaux."@fr
- definition ap "Asset on which primary assets rely."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
suppressed (detection)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001135
Temporarily not raising alerts, for a recorded reason.
- belongs to
- detection status c
- has facts
- in Scheme op detection status scheme ni
- definition ap "Ne génère temporairement plus d'alertes, pour un motif consigné."@fr
- definition ap "Temporarily not raising alerts, for a recorded reason."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
systematic selectionni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000648
Every n-th item is selected from a random start.
- belongs to
- sampling method c
- has facts
- in Scheme op sampling method scheme ni
- definition ap "Every n-th item is selected from a random start."@en
- definition ap "Un élément sur n est choisi à partir d'un point de départ aléatoire."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISACA IT Audit Framework (ITAF), 5th edition (copyright 2026 ISACA); identifiers and titles cited, text not reproduced"@en
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
systemic failureni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000166
Could cascade across systems or units.
- belongs to
- escalation flag c
- has facts
- in Scheme op escalation flag scheme ni
- definition ap "Could cascade across systems or units."@en
- definition ap "Pourrait se propager entre systèmes ou unités."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
technology (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000955
A tool, system or configuration that does not support the control.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "A tool, system or configuration that does not support the control."@en
- definition ap "Un outil, un système ou une configuration qui ne soutient pas la mesure."@fr
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
technology change (trigger)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000935
A change in systems, services or technology.
- belongs to
- review trigger c
- has facts
- in Scheme op review trigger scheme ni
- definition ap "A change in systems, services or technology."@en
- definition ap "Un changement de systèmes, de services ou de technologie."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST CSF 2.0 (CSWP 29), category GV.PO (Policy), subcategories GV.PO-01 and GV.PO-02"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
telemetry health state schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001151
Concept scheme of the telemetry health state value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the telemetry health state value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « état de la télémétrie »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
territorialni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000396
Where the organisation is established, offers services or monitors behaviour.
- belongs to
- condition kind c
- has facts
- in Scheme op condition kind scheme ni
- definition ap "Lieu d'établissement de l'organisation, ou lieu où elle offre des services ou suit des comportements."@fr
- definition ap "Where the organisation is established, offers services or monitors behaviour."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
testni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000601
Exercise a control or system under stated conditions and compare actual with expected behaviour.
- belongs to
- assessment method c
- has facts
- in Scheme op assessment method scheme ni
- definition ap "Actionner une mesure ou un système dans des conditions données et comparer le comportement réel au comportement attendu."@fr
- definition ap "Exercise a control or system under stated conditions and compare actual with expected behaviour."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO/IEC TS 27008:2019, Guidelines for the assessment of information security controls (1st edition, 2019-01); clause identifiers cited"@en
- evidence source ap "NIST SP 800-53A Rev. 5 assessment objectives and methods (examine, interview, test), as carried in the SP 800-53 Rev. 5.2.0 OSCAL catalogue (2026-05-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
testing (detection)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001132
Deployed for testing; alerts are not acted on.
- belongs to
- detection status c
- has facts
- in Scheme op detection status scheme ni
- definition ap "Deployed for testing; alerts are not acted on."@en
- definition ap "Déployée à l'essai; les alertes ne donnent pas lieu à une intervention."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "Sigma rules specification v2.1.0 (SigmaHQ, 2025-09-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
third party (cause)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000957
A supplier or other external party did not perform as required.
- belongs to
- root-cause category c
- has facts
- in Scheme op root-cause category scheme ni
- definition ap "A supplier or other external party did not perform as required."@en
- definition ap "Un fournisseur ou une autre partie externe n'a pas agi comme exigé."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Audit management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 2"@en
threat relevanceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000151
How active the threat is for this organisation.
- belongs to
- screening criterion c
- has facts
- in Scheme op screening criterion scheme ni
- definition ap "Activité de la menace pour cette organisation."@fr
- definition ap "How active the threat is for this organisation."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
threat source type schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000091
Concept scheme of the threat source type value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the threat source type value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de source de menace »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "NIST SP 800-30 Rev. 1 (2012), Appendices D-I (threat sources, events, vulnerabilities and predisposing conditions, likelihood, impact, risk)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
time to acknowledgeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001227
From an alert to an analyst taking it up.
- belongs to
- response metric c
- has facts
- in Scheme op response metric scheme ni
- definition ap "D'une alerte à sa prise en charge par un analyste."@fr
- definition ap "From an alert to an analyst taking it up."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
time to containni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001228
From detection to containment.
- belongs to
- response metric c
- has facts
- in Scheme op response metric scheme ni
- definition ap "De la détection au confinement."@fr
- definition ap "From detection to containment."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
time to detectni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001226
From the start of malicious activity to its detection.
- belongs to
- response metric c
- has facts
- in Scheme op response metric scheme ni
- definition ap "Du début de l'activité malveillante à sa détection."@fr
- definition ap "From the start of malicious activity to its detection."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
time to recoverni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001229
From detection to verified recovery.
- belongs to
- response metric c
- has facts
- in Scheme op response metric scheme ni
- definition ap "De la détection au rétablissement vérifié."@fr
- definition ap "From detection to verified recovery."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
TLP:AMBERni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001160
Limited disclosure, to the recipient's organisation and its clients on a need-to-know basis.
- belongs to
- information marking c
- has facts
- in Scheme op information marking scheme ni
- definition ap "Diffusion limitée à l'organisation du destinataire et à ses clients selon le besoin d'en connaître."@fr
- definition ap "Limited disclosure, to the recipient's organisation and its clients on a need-to-know basis."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "FIRST Traffic Light Protocol (TLP) 2.0 (authoritative from August 2022)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
TLP:AMBER+STRICTni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001159
Limited disclosure, restricted to the recipient's organisation only.
- belongs to
- information marking c
- has facts
- in Scheme op information marking scheme ni
- definition ap "Diffusion limitée à l'organisation du destinataire seulement."@fr
- definition ap "Limited disclosure, restricted to the recipient's organisation only."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "FIRST Traffic Light Protocol (TLP) 2.0 (authoritative from August 2022)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
TLP:CLEARni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001162
Disclosure is not limited.
- belongs to
- information marking c
- has facts
- in Scheme op information marking scheme ni
- definition ap "Disclosure is not limited."@en
- definition ap "La diffusion n'est pas limitée."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "FIRST Traffic Light Protocol (TLP) 2.0 (authoritative from August 2022)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
TLP:GREENni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001161
Limited disclosure, within the recipient's community.
- belongs to
- information marking c
- has facts
- in Scheme op information marking scheme ni
- definition ap "Diffusion limitée à la communauté du destinataire."@fr
- definition ap "Limited disclosure, within the recipient's community."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "FIRST Traffic Light Protocol (TLP) 2.0 (authoritative from August 2022)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
TLP:REDni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001158
Only the named recipients may see it; it is not passed on to anyone else.
- belongs to
- information marking c
- has facts
- in Scheme op information marking scheme ni
- definition ap "Only the named recipients may see it; it is not passed on to anyone else."@en
- definition ap "Seuls les destinataires nommés peuvent en prendre connaissance; elle n'est transmise à personne d'autre."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "FIRST Traffic Light Protocol (TLP) 2.0 (authoritative from August 2022)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
tolerance classification schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000106
Concept scheme of the tolerance classification value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the tolerance classification value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « classification par rapport à la tolérance »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
treatment option schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000142
Concept scheme of the treatment option value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the treatment option value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « option de traitement »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "ISO 31000:2018 (risk treatment options; paraphrased)"@en
- evidence source ap "ISO/IEC 27005:2022, risk concepts (paraphrased; clause numbers to verify against the licensed text)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
triaged (case)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001166
Priority and owner assigned.
- belongs to
- case status c
- has facts
- in Scheme op case status scheme ni
- definition ap "Priority and owner assigned."@en
- definition ap "Priorité et responsable attribués."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- evidence source ap "NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), doi:10.6028/NIST.SP.800-61r3"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
triangularni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000580
Defined by a minimum, a most likely value and a maximum.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "Defined by a minimum, a most likely value and a maximum."@en
- definition ap "Définie par un minimum, une valeur la plus probable et un maximum."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
trigger kind schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001211
Concept scheme of the trigger kind value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the trigger kind value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « type de déclencheur »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
true positiveni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001140
The alerted activity occurred and is malicious or unauthorised.
- belongs to
- alert disposition c
- has facts
- in Scheme op alert disposition scheme ni
- definition ap "L'activité signalée a eu lieu et est malveillante ou non autorisée."@fr
- definition ap "The alerted activity occurred and is malicious or unauthorised."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
unauthorised accessni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001197
An account, system or data was accessed without authorisation.
- belongs to
- incident category c
- has facts
- in Scheme op incident category scheme ni
- definition ap "An account, system or data was accessed without authorisation."@en
- definition ap "Un compte, un système ou des données ont été consultés sans autorisation."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 SIEM and SOAR Phase 0 analysis and decisions S1-S12 (docs/baseline/siem_soar_phase0.md, 2026-10-12)"@en
- evidence source ap "CRGO SOAR Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 2"@en
unavailableni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001004
The evidence needed could not be obtained.
- belongs to
- sufficiency conclusion c
- has facts
- in Scheme op sufficiency conclusion scheme ni
- definition ap "Les preuves nécessaires n'ont pu être obtenues."@fr
- definition ap "The evidence needed could not be obtained."@en
- notation ap "6"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 5 (values added to sufficiency conclusion)"@en
under considerationni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000113
Kept under consideration.
- belongs to
- selection disposition c
- has facts
- in Scheme op selection disposition scheme ni
- definition ap "Gardé à l'étude."@fr
- definition ap "Kept under consideration."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, scenario-selection-instructions.md, steps 9-12 and required output A-E (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
under review (directive)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000922
Submitted for review or approval; not binding.
- belongs to
- directive lifecycle state c
- has facts
- in Scheme op directive lifecycle state scheme ni
- definition ap "Soumise à la revue ou à l'approbation; non contraignante."@fr
- definition ap "Submitted for review or approval; not binding."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO 0.10.0 Phase 0 analysis and decisions D1-D14 (docs/baseline/policy_compliance_audit_phase0.md, approved 2026-10-12)"@en
- evidence source ap "Information Security Policy Governance, Compliance Traceability and Assurance, specification O-ISPMS-001 v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 1 ("I'll follow your recommendations for all the decisions", 19:26)"@en
under review (record)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000997
Submitted for review.
- belongs to
- review state c
- has facts
- in Scheme op review state scheme ni
- definition ap "Soumis à la revue."@fr
- definition ap "Submitted for review."@en
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
undeterminedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000393
An assessment was attempted but the evidence does not allow a conclusion.
- belongs to
- compliance state c
- has facts
- in Scheme op compliance state scheme ni
- definition ap "An assessment was attempted but the evidence does not allow a conclusion."@en
- definition ap "Une évaluation a été tentée mais les preuves ne permettent pas de conclure."@fr
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
uniformni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000579
Every value between a minimum and a maximum is equally likely.
- belongs to
- distribution family c
- has facts
- in Scheme op distribution family scheme ni
- definition ap "Every value between a minimum and a maximum is equally likely."@en
- definition ap "Toutes les valeurs entre un minimum et un maximum sont également probables."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
unit interval 0-1ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000174
Continuous scale from 0 to 1 used by the CRG parameters and reductions.
- belongs to
- measurement scale c
- has facts
- definition ap "Continuous scale from 0 to 1 used by the CRG parameters and reductions."@en
- definition ap "Échelle continue de 0 à 1 utilisée par les paramètres et réductions CRG."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, crg-formulas-and-workbook.md (Excel Guide v1.0c s.11) and scripts/crg_calc.py (commit f0cd36e)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
unknownni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000386
A fact needed to evaluate a condition is missing; nothing is concluded.
- belongs to
- applicability state c
- has facts
- in Scheme op applicability state scheme ni
- definition ap "A fact needed to evaluate a condition is missing; nothing is concluded."@en
- definition ap "Un fait nécessaire à l'évaluation d'une condition est absent; rien n'est conclu."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
unknown (telemetry)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001155
Health is not monitored or could not be determined.
- belongs to
- telemetry health state c
- has facts
- in Scheme op telemetry health state scheme ni
- definition ap "Health is not monitored or could not be determined."@en
- definition ap "L'état n'est pas surveillé ou n'a pu être déterminé."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
unmodifiedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000641
The assurer concludes without reservation.
- belongs to
- assurance opinion c
- has facts
- in Scheme op assurance opinion scheme ni
- definition ap "L'assureur conclut sans réserve."@fr
- definition ap "The assurer concludes without reservation."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 2"@en
unreviewedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001139
Not yet triaged.
- belongs to
- alert disposition c
- has facts
- in Scheme op alert disposition scheme ni
- definition ap "Not yet triaged."@en
- definition ap "Pas encore triée."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
unsatisfactoryni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000667
The objectives are not met.
- belongs to
- engagement rating c
- has facts
- in Scheme op engagement rating scheme ni
- definition ap "Les objectifs ne sont pas atteints."@fr
- definition ap "The objectives are not met."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- evidence source ap "IIA Global Internal Audit Standards (published 2024-01-09); identifiers and titles cited, text not reproduced"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
unsatisfiedni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000391
The evidence shows the provision is not met.
- belongs to
- compliance state c
- has facts
- in Scheme op compliance state scheme ni
- definition ap "Les preuves montrent que la disposition n'est pas respectée."@fr
- definition ap "The evidence shows the provision is not met."@en
- notation ap "3"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO v0.8 to v1.0 Claude Implementation Specification (project owner, 2026-10-11), sections 3-13"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
untested coverageni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001146
Claimed but not yet tested.
- belongs to
- coverage status c
- has facts
- in Scheme op coverage status scheme ni
- definition ap "Claimed but not yet tested."@en
- definition ap "Revendiquée mais pas encore testée."@fr
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
validated coverageni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001147
Supported by a passed detection test within the review period.
- belongs to
- coverage status c
- has facts
- in Scheme op coverage status scheme ni
- definition ap "Supported by a passed detection test within the review period."@en
- definition ap "Étayée par un essai de détection réussi pendant la période de revue."@fr
- notation ap "2"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO SIEM Ontology Extension Specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-13"^^date
- introduced in ap "0.10.0"
- review note ap "0.10.0 final review group 1 ("go ahead", 02:42)"@en
verification result schemeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000682
Concept scheme of the verification result value set.
- belongs to
- Concept Scheme c
- has facts
- definition ap "Concept scheme of the verification result value set."@en
- definition ap "Schéma de concepts de l'ensemble de valeurs « résultat de la vérification »."@fr
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 3"@en
verified outcomeni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000564
An outcome confirmed by independent verification, such as a corrective action verified as effective.
- belongs to
- knowledge status c
- has facts
- in Scheme op knowledge status scheme ni
- definition ap "An outcome confirmed by independent verification, such as a corrective action verified as effective."@en
- definition ap "Résultat confirmé par une vérification indépendante, comme une action corrective vérifiée comme efficace."@fr
- notation ap "7"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
verified sourceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000567
The file is held, its version and terms are checked, and CRGO may reuse its content within those terms.
- belongs to
- source access status c
- has facts
- in Scheme op source access status scheme ni
- definition ap "Le fichier est détenu, sa version et ses conditions sont vérifiées, et CRGO peut en réutiliser le contenu dans ces limites."@fr
- definition ap "The file is held, its version and terms are checked, and CRGO may reuse its content within those terms."@en
- notation ap "1"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Governance, Risk, Compliance and Assurance (GRCA) Audit: Claude Implementation Specification (project owner, v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
very high requirementni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000089
Severe or irreversible harm if the property is lost.
- belongs to
- requirement level c
- has facts
- in Scheme op requirement level scheme ni
- definition ap "Préjudice sévère ou irréversible si la propriété est perdue."@fr
- definition ap "Severe or irreversible harm if the property is lost."@en
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CyberRiskGuardian, examples/medibec/source/data30.json and budget.json (commit f0cd36e)"@en
- evidence source ap "Phase 1 scenario extraction (Drive folder 'scenarios'): corpora A-D, F"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-08"^^date
- introduced in ap "0.1.0"
very low-quality evidenceni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0000576
Little or no evidence beyond judgement.
- belongs to
- evidence quality c
- has facts
- in Scheme op evidence quality scheme ni
- definition ap "Little or no evidence beyond judgement."@en
- definition ap "Peu ou pas de preuves au-delà du jugement."@fr
- notation ap "4"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "CRGO Knowledge Expansion: Remaining GRC, Cybersecurity and Operational Knowledge Domains (project owner, draft v1.0, 2026-10-11)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-11"^^date
- introduced in ap "0.9.0"
- review note ap "GRCA review item 5 (all terms, including the GRCA additions)"@en
withdrawn (record)ni back to ToC or Named Individual ToC
IRI: https://w3id.org/crgo/CRGO_0001000
Withdrawn by its author or no longer valid.
- belongs to
- review state c
- has facts
- in Scheme op review state scheme ni
- definition ap "Retiré par son auteur ou n'étant plus valide."@fr
- definition ap "Withdrawn by its author or no longer valid."@en
- notation ap "5"
- has governance status ap approved ni
- has confidence (element) ap high confidence ni
- evidence source ap "Compliance management ontology extension: implementation specification v1.0 (project owner, 2026-10-12)"@en
- proposed by ap Claude (Anthropic), drafting assistant ni
- approved by ap Marc-André Léger ni
- approval date ap "2026-10-12"^^date
- introduced in ap "0.10.0"
- review note ap "P1 review group 4 (0.10.0 additions)"@en
Legend back to ToC
c: Classes
op: Object Properties
dp: Data Properties
ni: Named Individuals
op: Object Properties
dp: Data Properties
ni: Named Individuals
References back to ToC
- ISO/IEC 21838-2:2021. Information technology — Top-level ontologies (TLO) — Part 2: Basic Formal Ontology (BFO). BFO-2020.
- Common Core Ontologies, version 2.2. github.com/CommonCoreOntology.
- W3C (2012). OWL 2 Web Ontology Language Document Overview (Second Edition). w3.org/TR/owl2-overview.
- W3C (2009). SKOS Simple Knowledge Organization System Reference. w3.org/TR/skos-reference.
- W3C (2017). Shapes Constraint Language (SHACL). w3.org/TR/shacl.
- ISO/IEC 27005:2022. Guidance on managing information security risks. ISO 31000:2018. Risk management — Guidelines.
- NIST SP 800-30 Rev. 1 (2012). Guide for Conducting Risk Assessments.
- NIST CSWP 29 (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST SP 800-53 Rev. 5, release 5.2.0. OSCAL catalogues: github.com/usnistgov/oscal-content.
- ISO/IEC 27002:2022. Information security controls. ISACA (2018). COBIT 2019 Framework: Introduction and Methodology.
- The MITRE Corporation. ATT&CK Enterprise, version 19.2. attack.mitre.org.
- Québec. Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by S.Q. 2021, c. 25 (Law 25). Act respecting health and social services information (CQLR c. R-22.1). LégisQuébec.
- Léger, Marc-André (2026). CyberRiskGuardian. github.com/ITriskMgr/CyberRiskGuardian.
Acknowledgments back to ToC
The authors would like to thank Silvio Peroni for developing LODE, a Live OWL Documentation Environment, which is used for representing the Cross Referencing Section of this document and Daniel Garijo for developing Widoco, the program used to create the template used in this documentation.