{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C18: Keep incident notification decisions separate and current\nRisk addressed: Incomplete facts, mixed reporting routes or an assumed generic deadline delay a properly informed notification decision.",
    "operation": "In this example, the incident lead records known facts and awareness times, escalates to the appropriate decision-makers and maintains separate assessments of applicable notification duties as facts develop.\nSuggested operating trigger: incident detection or material new facts; urgent applicable duties are checked separately rather than deferred to a scheduled review.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The incident timeline, information sources and outstanding uncertainties.\n- Recorded impact assessments, organisational roles and decision authority.\n- Each notification decision, reasons, applicable deadline checks and subsequent updates.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Review a completed incident or clearly marked exercise; trace evolving facts to reassessed notification decisions and inspect whether different reporting routes and their timing were kept distinct.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: The log uses one unexplained deadline for every reporting route or new facts do not prompt a recorded reassessment.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}