Record Template Library

These record templates make the compliance work repeatable. They are deliberately small so they can become GitHub issue templates, change records, ConMon checklist items, or OSCAL-backed evidence records later.

Monthly ConMon Record

Field	Value
Reporting month	`[FILL IN]`
System and environment	`[FILL IN]`
Inventory version	`[FILL IN]`
Vulnerability scans attached	`[FILL IN]`
POA&M status	`[FILL IN: open, new, closed, overdue]`
Significant changes	`[FILL IN]`
Access review status	`[FILL IN]`
Backup and restore status	`[FILL IN]`
Incidents or alerts	`[FILL IN]`
Security sign-off	`[FILL IN]`
Platform sign-off	`[FILL IN]`

Access Review Record

Field	Value
Review scope	`[FILL IN: GitHub, IdP, Kubernetes, database, secret manager]`
Review period	`[FILL IN]`
Export location	`[FILL IN]`
Reviewer	`[FILL IN]`
Removed access	`[FILL IN]`
Exceptions	`[FILL IN]`
Break-glass use reviewed	`[FILL IN]`
Approval	`[FILL IN]`

POA&M Item Record

Field	Value
POA&M ID	`[FILL IN]`
Source	`[FILL IN]`
Control	`[FILL IN]`
Weakness	`[FILL IN]`
Severity	`[FILL IN]`
Owner	`[FILL IN]`
Milestones	`[FILL IN]`
Due date	`[FILL IN]`
Status	`[FILL IN]`
Closure evidence	`[FILL IN]`

Significant Change Record

Field	Value
Change ID	`[FILL IN]`
Change summary	`[FILL IN]`
Reason	`[FILL IN]`
Affected services	`[FILL IN]`
Affected controls	`[FILL IN]`
Customer impact	`[FILL IN]`
Security impact analysis	`[FILL IN]`
Privacy impact analysis	`[FILL IN]`
Validation plan	`[FILL IN]`
Rollback plan	`[FILL IN]`
AO notification decision	`[FILL IN]`
Approver	`[FILL IN]`

Incident Record

Field	Value
Incident ID	`[FILL IN]`
Severity	`[FILL IN]`
Detection source	`[FILL IN]`
Start time	`[FILL IN]`
Incident commander	`[FILL IN]`
Affected systems	`[FILL IN]`
Data impact	`[FILL IN]`
Containment actions	`[FILL IN]`
Notifications	`[FILL IN]`
Recovery time	`[FILL IN]`
Evidence location	`[FILL IN]`
POA&M follow-ups	`[FILL IN]`

Backup Restore Test Record

Field	Value
Test ID	`[FILL IN]`
System	`[FILL IN]`
Backup source	`[FILL IN]`
Restore target	`[FILL IN]`
RTO target	`[FILL IN]`
RTO actual	`[FILL IN]`
RPO target	`[FILL IN]`
RPO actual	`[FILL IN]`
Validation performed	`[FILL IN]`
Issues found	`[FILL IN]`
Evidence location	`[FILL IN]`

Supplier Review Record

Field	Value
Supplier	`[FILL IN]`
Service	`[FILL IN]`
Boundary relationship	`[FILL IN: inherited, shared, external, subprocessor]`
Data handled	`[FILL IN]`
Authorization evidence	`[FILL IN]`
Security documentation	`[FILL IN]`
Privacy documentation	`[FILL IN]`
Exit plan	`[FILL IN]`
Renewal date	`[FILL IN]`
Risk decision	`[FILL IN]`

Risk Acceptance Record

Field	Value
Risk ID	`[FILL IN]`
Related POA&M ID	`[FILL IN]`
Control	`[FILL IN]`
Risk owner	`[FILL IN]`
Compensating controls	`[FILL IN]`
Acceptance period	`[FILL IN]`
Expiration date	`[FILL IN]`
AO decision	`[FILL IN]`
Review trigger	`[FILL IN]`