# Data dictionary

All data is **synthetic and simulated** (fictional company Northstar Financial Technologies). Generated from `scripts/schema_defs.py` by `scripts/validate_data.py --write-schemas`; do not edit by hand.

Conventions: UTF-8 CSV, LF line endings, header row, empty string = null. Dates `YYYY-MM-DD`; timestamps ISO 8601 UTC (`...Z`). Business days are Monday to Friday; holidays are ignored. Population extract date: 2026-07-15. Audit period: 2026-01-01 to 2026-06-30.

## business_services

File: `business_services.csv` (generated). Fictional business services supported by the in-scope systems.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| service_id | string | yes | Unique service ID (BS-nn). | primary key |
| service_name | string | yes | Service name. |  |
| business_owner_role | string | yes | Accountable business owner (role, not a person). |  |
| criticality | enum | yes | Business criticality. | one of: Critical, High, Medium, Low |
| data_classification | enum | yes | Highest data classification handled. | one of: Restricted, Confidential, Internal, Public |
| dependencies | id_list | yes | System IDs the service depends on. | references assets_and_systems.asset_id |
| rto_hours | integer | yes | Recovery time objective in hours (simulated target). | range 0.. |
| rpo_hours | integer | yes | Recovery point objective in hours (simulated target). | range 0.. |
| pci_scope | enum | yes | Assumed payment-card scope position (assumption, not a compliance claim). | one of: In scope, Connected, Out of scope |
| assumptions | string | yes | Documented scenario assumptions. |  |

## assets_and_systems

File: `assets_and_systems.csv` (generated). Fictional systems inventory.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| asset_id | string | yes | Unique system ID (SYS-nn). | primary key |
| system | string | yes | System name. |  |
| environment | enum | yes | Hosting environment. | one of: Production, Corporate |
| owner_role | string | yes | System owner role. |  |
| data_classification | enum | yes | Highest data classification held. | one of: Restricted, Confidential, Internal, Public |
| criticality | enum | yes | System criticality. | one of: Critical, High, Medium, Low |
| identity_provider | string | yes | Authentication source. |  |
| logging_status | enum | yes | Logging status as documented by system owner. | one of: Enabled, Partial, Disabled |
| backup_status | enum | yes | Backup schedule as documented by system owner. | one of: Daily, Weekly, None |
| in_itgc_scope | enum | yes | In scope for the ITGC audit (Y/N). | one of: Y, N |
| pci_scope | enum | yes | Assumed payment-card scope position. | one of: In scope, Connected, Out of scope |

## employees

File: `employees.csv` (generated). Fictional HR roster (about 450 employees). All names are invented.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| employee_id | string | yes | Unique employee ID (Ennnn). | primary key |
| display_name | string | yes | Fictional display name. |  |
| department | string | yes | Current department. |  |
| job_title | string | yes | Job title. |  |
| manager_id | string | no | Manager's employee ID. | references employees.employee_id |
| hire_date | date | yes | Hire date. |  |
| termination_date | date | no | Last working day for leavers. |  |
| employment_status | enum | yes | Status at population extract date. | one of: Active, Leave of absence, Terminated |
| previous_department | string | no | Department before an internal transfer. |  |
| transfer_date | date | no | Date of internal transfer. |  |

## identity_access

File: `identity_access.csv` (generated). Account population for the five ITGC-scope systems as extracted on the population extract date.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| account_id | string | yes | Unique account ID (A-nnnn). | primary key |
| system_id | string | yes | System the account belongs to. | references assets_and_systems.asset_id |
| employee_id | string | no | Account holder (blank for service accounts). | references employees.employee_id |
| account_type | enum | yes | Human or service account. | one of: Human, Service |
| access_role | string | yes | Role or entitlement name. |  |
| privilege_level | enum | yes | Privilege tier. | one of: Standard, Elevated, Admin |
| granted_at | timestamp | yes | When access was provisioned (UTC). |  |
| approved_at | timestamp | no | When access was approved (UTC). |  |
| approved_by | string | no | Approver's employee ID. | references employees.employee_id |
| approval_ticket | string | no | Access request ticket reference. |  |
| owner_employee_id | string | no | Accountable owner (service accounts). | references employees.employee_id |
| account_status | enum | yes | Status at extract date. | one of: Active, Disabled |
| disabled_at | timestamp | no | When the account was disabled (UTC). |  |
| last_login_at | timestamp | no | Last recorded login (UTC). |  |
| mfa_enabled | enum | yes | Multi-factor authentication enforced (NA for service accounts). | one of: Y, N, NA |
| access_exception_ref | string | no | Documented exception reference, if any. |  |

## access_reviews

File: `access_reviews.csv` (generated). Quarterly user access review records per in-scope system.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| review_id | string | yes | Unique review ID. | primary key |
| system_id | string | yes | System reviewed. | references assets_and_systems.asset_id |
| review_period | enum | yes | Quarter reviewed. | one of: 2026-Q1, 2026-Q2 |
| reviewer_id | string | yes | Reviewer's employee ID. | references employees.employee_id |
| due_date | date | yes | Policy due date. |  |
| completed_date | date | no | Completion date. |  |
| accounts_in_scope | integer | yes | Accounts the review claims to cover. | range 0.. |
| accounts_revoked | integer | no | Accounts revoked as a result. | range 0.. |
| attestation_status | enum | yes | Review status. | one of: Attested, In progress, Not performed |
| evidence_id | string | no | Evidence register item. | references evidence_register.evidence_id |

## change_records

File: `change_records.csv` (generated). Production change records for the five ITGC-scope systems during the audit period.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| change_id | string | yes | Unique change ID (CHG-nnnn). | primary key |
| system_id | string | yes | System changed. | references assets_and_systems.asset_id |
| change_type | enum | yes | Change category. | one of: Standard, Normal, Emergency |
| title | string | yes | Short description. |  |
| requested_by | string | yes | Requester. | references employees.employee_id |
| developer_id | string | yes | Developer. | references employees.employee_id |
| deployer_id | string | yes | Person who deployed to production. | references employees.employee_id |
| approved_by | string | no | Approver. | references employees.employee_id |
| approved_at | timestamp | no | Approval time (UTC). For emergency changes, the initial verbal/chat approval. |  |
| implemented_at | timestamp | yes | Production implementation time (UTC). |  |
| test_result | enum | yes | Recorded test outcome. | one of: Pass, Fail, Not recorded |
| test_evidence_ref | string | no | Reference to test evidence. |  |
| retro_approved_at | timestamp | no | Retrospective formal approval (emergency changes). |  |
| status | enum | yes | Final status. | one of: Closed, Rolled back |

## backup_jobs

File: `backup_jobs.csv` (generated). Backup job log for critical backed-up systems (one scheduled run per day plus retries).

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| job_id | string | yes | Unique job ID. | primary key |
| system_id | string | yes | System backed up. | references assets_and_systems.asset_id |
| run_date | date | yes | Run date. |  |
| status | enum | yes | Job outcome. | one of: Success, Failed, Warning |
| retry_of | string | no | Job ID this run retried. | references backup_jobs.job_id |
| size_gb | number | no | Backup size in GB (blank when failed). | range 0.. |

## restore_tests

File: `restore_tests.csv` (generated). Recorded restoration tests.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| restore_test_id | string | yes | Unique ID. | primary key |
| system_id | string | yes | System tested. | references assets_and_systems.asset_id |
| test_date | date | yes | Test date. |  |
| scope | string | yes | What was restored. |  |
| result | enum | yes | Outcome. | one of: Pass, Partial, Fail |
| performed_by | string | yes | Tester. | references employees.employee_id |
| evidence_id | string | no | Evidence register item. | references evidence_register.evidence_id |

## log_reviews

File: `log_reviews.csv` (generated). Weekly security-alert review records from the monitoring system.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| review_id | string | yes | Unique ID. | primary key |
| system_id | string | yes | Monitoring system. | references assets_and_systems.asset_id |
| week_start | date | yes | Monday of the week reviewed. |  |
| reviewer_id | string | yes | Reviewer. | references employees.employee_id |
| alerts_total | integer | yes | Alerts triaged. | range 0.. |
| alerts_high | integer | yes | High-severity alerts. | range 0.. |
| alerts_escalated | integer | yes | Alerts escalated to incident process. | range 0.. |
| completed_at | timestamp | yes | Review completion (UTC). |  |
| evidence_id | string | no | Evidence register item. | references evidence_register.evidence_id |

## control_library

File: `control_library.csv` (generated). Northstar control library (as documented by management, before assessment).

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| control_id | string | yes | Unique control ID (NS-DDD-nn). | primary key |
| objective | string | yes | Control objective. |  |
| risk_id | string | yes | Primary risk addressed. | references risks.risk_id |
| domain | enum | yes | Control domain. | one of: Identity and access, Privileged access, Change management, IT operations, Logging and monitoring, Vulnerability management, Incident response, Supplier risk, Privacy, Secure development, AI governance |
| control_description | string | yes | Control as documented (may contain design weaknesses, see ground truth). |  |
| type | enum | yes | Control type. | one of: Preventive, Detective, Corrective |
| nature | enum | yes | Manual, automated or IT-dependent manual. | one of: Manual, Automated, IT-dependent manual |
| frequency | enum | yes | Operating frequency. | one of: Continuous, Per event, Daily, Weekly, Monthly, Quarterly, Annual |
| owner_role | string | yes | Control owner role. |  |
| evidence_expected | string | yes | Evidence that should exist if the control operates. |  |
| design_status | enum | yes | Assessment status (assessed in later milestones). | one of: Not yet assessed |
| mappings | id_list | no | Framework requirement IDs (populated in M3 after source verification). |  |

## risks

File: `risks.csv` (generated). Baseline risk register (management view before assessment).

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| risk_id | string | yes | Unique risk ID (R-nn). | primary key |
| title | string | yes | Risk title. |  |
| cause | string | yes | Cause. |  |
| event | string | yes | Risk event. |  |
| impact | string | yes | Impact description. |  |
| likelihood | integer | yes | Inherent likelihood 1-5. | range 1..5 |
| impact_rating | integer | yes | Inherent impact 1-5. | range 1..5 |
| inherent_score | integer | yes | likelihood x impact_rating. | range 1..25 |
| existing_controls | id_list | yes | Controls management says mitigate the risk. | references control_library.control_id |
| residual_likelihood | integer | yes | Management's own residual likelihood estimate. | range 1..5 |
| residual_impact | integer | yes | Management's own residual impact estimate. | range 1..5 |
| residual_score | integer | yes | Management residual score. | range 1..25 |
| owner_role | string | yes | Risk owner role. |  |
| treatment | enum | yes | Treatment decision. | one of: Mitigate, Accept, Transfer, Avoid |
| due_date | date | yes | Treatment due date. |  |
| status | enum | yes | Risk status. | one of: Open, Monitoring, Accepted |

## evidence_register

File: `evidence_register.csv` (generated). Evidence collected for the simulated ITGC audit.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| evidence_id | string | yes | Unique ID (EV-nnn). | primary key |
| control_id | string | yes | Control the evidence supports. | references control_library.control_id |
| source_system | string | yes | Source system or document origin. |  |
| file_or_record_name | string | yes | File or record name as received. |  |
| period_start | date | yes | Period covered (start). |  |
| period_end | date | yes | Period covered (end). |  |
| collected_at | timestamp | yes | Collection time (UTC). |  |
| owner_role | string | yes | Role that provided the evidence. |  |
| integrity_status | enum | yes | Result of hash verification at collection. | one of: Hash recorded, Not hashed |
| completeness | enum | yes | Provider's statement of completeness. | one of: Complete, Partial, Unknown |
| reliability_notes | string | yes | Notes on provenance and reliability. |  |
| synthetic_source_reference | string | yes | Dataset (and filter) the synthetic evidence was derived from. |  |
| content_sha256 | string | no | SHA-256 recorded at collection (blank when not hashed). |  |

## vendors

File: `vendors.csv` (generated). Fictional vendor inventory with tiering inputs. Scores are computed in a later milestone.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| vendor_id | string | yes | Unique ID (V-nn). | primary key |
| vendor_name | string | yes | Fictional vendor name. |  |
| service_description | string | yes | Service provided. |  |
| service_category | string | yes | Category. |  |
| service_criticality | enum | yes | Business criticality of the service. | one of: Critical, High, Medium, Low |
| data_access | enum | yes | Highest data classification the vendor can access. | one of: Restricted, Confidential, Internal, Public, None |
| privileged_connectivity | enum | yes | Privileged or network connectivity (Y/N). | one of: Y, N |
| concentration_dependency | enum | yes | Concentration / dependency. | one of: Low, Medium, High |
| regulatory_relevance | enum | yes | Regulatory relevance. | one of: Low, Medium, High |
| substitutability | enum | yes | How easily the service can be replaced. | one of: Easy, Moderate, Difficult |
| geography | string | yes | Primary service/data location (fictional). |  |
| contract_start | date | yes | Contract start. |  |
| contract_end | date | yes | Contract end. |  |
| owner_role | string | yes | Internal relationship owner role. |  |
| assessment_status | enum | yes | Whether this vendor is one of the three assessed cases. | one of: Assessment case, Not assessed |

## ai_use_cases

File: `ai_use_cases.csv` (generated). The two fictional AI use cases proposed by Northstar.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| use_case_id | string | yes | Unique ID (AI-nn). | primary key |
| name | string | yes | Use case name. |  |
| purpose | string | yes | Intended purpose. |  |
| business_owner_role | string | yes | Business owner role. |  |
| users | string | yes | Intended users. |  |
| data_categories | string | yes | Data the system would process. |  |
| data_classification | enum | yes | Highest classification of data processed. | one of: Restricted, Confidential, Internal, Public |
| affected_parties | string | yes | People affected by outputs. |  |
| model_provider_type | string | yes | Model/provider arrangement. |  |
| vendor_id | string | yes | Provider in the vendor inventory. | references vendors.vendor_id |
| human_oversight_proposed | string | yes | Oversight as proposed by the sponsor. |  |
| intake_date | date | yes | Intake date. |  |
| status | enum | yes | Lifecycle status. | one of: Proposed |

## framework_requirements

File: `framework_requirements.csv` (planned, M3). Paraphrased requirements/outcomes with verified source references.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| requirement_id | string | yes | Unique requirement ID. | primary key |
| framework | string | yes | Framework. |  |
| version | string | yes | Framework version. |  |
| section | string | yes | Section/identifier. |  |
| paraphrased_intent | string | yes | Original paraphrase. |  |
| applicability | string | yes | Applicability to the fictional scope. |  |
| source_id | string | yes | Source register ID. |  |

## control_tests

File: `control_tests.csv` (planned, M3). Test results computed by the ITGC test scripts from the populations.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| test_id | string | yes | Unique ID. | primary key |
| control_id | string | yes | Control tested. | references control_library.control_id |
| objective | string | yes | Test objective. |  |
| population_size | integer | yes | Population size. |  |
| sampling_method | string | yes | Sampling method. |  |
| sample_size | integer | yes | Sample size. |  |
| test_steps | string | yes | Steps. |  |
| expected_result | string | yes | Expected result. |  |
| actual_result | string | yes | Actual result. |  |
| exceptions | integer | yes | Exception count. |  |
| conclusion | string | yes | Conclusion. |  |
| reviewer_role | string | yes | Reviewer role. |  |
| limitation | string | yes | Limitations. |  |

## findings

File: `findings.csv` (planned, M3). Audit findings with traceable evidence references.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| finding_id | string | yes | Unique ID. | primary key |
| project_id | string | yes | Project. |  |
| title | string | yes | Title. |  |
| severity | string | yes | Severity. |  |
| criteria_reference | string | yes | Criteria. |  |
| condition | string | yes | Condition. |  |
| cause | string | yes | Cause. |  |
| consequence_or_risk | string | yes | Consequence. |  |
| recommendation | string | yes | Recommendation. |  |
| owner_role | string | yes | Owner role. |  |
| target_date | date | yes | Target date. |  |
| status | string | yes | Status. |  |
| evidence_refs | id_list | yes | Evidence IDs. |  |
| retest_status | string | yes | Retest status. |  |

## remediation_actions

File: `remediation_actions.csv` (planned, M3). Management actions and closure evidence.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| action_id | string | yes | Unique ID. | primary key |
| finding_id | string | yes | Finding. | references findings.finding_id |
| action | string | yes | Action. |  |
| owner_role | string | yes | Owner role. |  |
| target_date | date | yes | Target date. |  |
| dependencies | string | yes | Dependencies. |  |
| status | string | yes | Status. |  |
| completion_evidence | string | yes | Closure evidence. |  |
| retest_result | string | yes | Retest result. |  |

## vendor_assessments

File: `vendor_assessments.csv` (planned, M4). Vendor due diligence results and decisions.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| assessment_id | string | yes | Unique ID. | primary key |
| vendor_id | string | yes | Vendor. | references vendors.vendor_id |
| inherent_risk | string | yes | Inherent rating. |  |
| residual_risk | string | yes | Residual rating. |  |
| decision | string | yes | Decision. |  |
| conditions | string | yes | Conditions. |  |
| review_date | date | yes | Next review date. |  |

## ai_risk_assessments

File: `ai_risk_assessments.csv` (planned, M4). AI use-case risk assessments.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| assessment_id | string | yes | Unique ID. | primary key |
| use_case_id | string | yes | Use case. | references ai_use_cases.use_case_id |
| risk_area | string | yes | Risk area. |  |
| rating | string | yes | Rating. |  |
| controls | string | yes | Controls. |  |
| approval_conditions | string | yes | Conditions. |  |
| monitoring_measures | string | yes | Monitoring measures. |  |

## ai_review_cases

File: `ai_review_cases.csv` (planned, M5). Labelled evaluation set for the AI-assisted evidence review prototype.

| Column | Type | Required | Description | Constraint |
|---|---|---|---|---|
| case_id | string | yes | Unique ID. | primary key |
| evidence_id | string | yes | Evidence item. |  |
| ground_truth_label | string | yes | Ground-truth label. |  |
| rule_based_result | string | yes | Deterministic result. |  |
| ai_suggested_label | string | yes | AI/mock suggestion. |  |
| extracted_fields | string | yes | Extracted fields. |  |
| confidence | number | yes | Uncalibrated score, if any. |  |
| reviewer_decision | string | yes | Reviewer decision. |  |
| error_category | string | yes | Error category. |  |
| rationale | string | yes | Rationale. |  |