Archigov · docs
  1. Docs
  2. Concepts

The Governance Catalogue

Standards, principles, patterns and policies in one catalogue — each a human statement, control references and an optional machine-checkable rule, adopted only by a board.

#Four Kinds, One Engine

KindCodeWhat it saysExtra fields
StandardSTD-001A concrete, checkable expectation of the estateSeverity
PrinciplePRN-001A guiding belief decisions should follow—
PatternPAT-001A proven solution to a recurring problemContext, solution, applicability
PolicyPOL-001An organisational rule, mandatory or recommendedEnforcement

Every artefact has a title, a category (Security, Data, Hosting, Governance…), a statement, a rationale, control references, and optionally a rule in the Rule DSL. Every adopted artefact with a rule is evaluated by the same conformance engine, so a finding can cite a pattern or a policy exactly as it cites a standard.

The Governance Catalogue
The catalogue: four kinds of artefact, their lifecycle, control references and whether each is checkable.

#Control References, Never Control Text

An artefact cites the frameworks it helps you evidence — ISO 27001 A.8.24, DORA Art.8(1), DSPT 2025 A1.a, EU AI Act Annex IV §2(a), NIST, Cyber Essentials and others. Archigov stores references only and never reproduces the text of a control framework. The references flow into the evidence pack and the OSCAL export.

#Lifecycle

Artefact lifecycle — only a board adopts; editing an adopted artefact starts a new versionLanes: Author, Archigov, Board. Steps: Draft (Author); Validate rule; pre-review; dry run (Archigov); Submit (Author); In review (Board); Chair declares (Board); Adopted (Board); Evaluated in every run (Archigov); Edit → new draft version (Author); Retired (Board). Transitions: Draft to Validate rule; pre-review; dry run; Validate rule; pre-review; dry run to Submit; Submit to In review; In review to Chair declares; Chair declares to Adopted (approved); Chair declares to Draft (changes requested); Adopted to Evaluated in every run; Adopted to Edit → new draft version (edit); Adopted to Retired (retire).AuthorArchigovBoardDraftstatement, references, ruleValidate rule;pre-review; dry runSubmitIn reviewChair declaresAdoptedEvaluated in every runwhile adoptedEdit → new draftversionold version stays in forceRetiredhistory keptapprovedchanges requestededitretire
Artefact lifecycle — only a board adopts; editing an adopted artefact starts a new version
Text
draft  →  in_review  →  adopted  →  retired
  • A new artefact is a draft. Its author can edit it, run a pre-review (deterministic checks such as "the rule validates" and "a mandatory policy cites a control"), and dry-run its rule to see what it would find against the estate today.
  • Submitting it creates a review of the matching type (standard, principle, pattern or policy), routed to the board responsible.
  • Only a board adopts it, when the chair declares the review approved.
  • Editing an adopted artefact creates a new draft version; the adopted version stays in force until the new one is adopted.
  • Retiring removes it from evaluation; its history stays.

#Packs

Packs install a curated set of artefacts. The core pack imports as adopted so a first run is useful immediately; every other pack imports as drafts for your boards to adopt.

PackImports asContents
archigov-coreAdoptedFive standards any estate can start with: UK hosting, accountable owners, data-store decisions and their conformance, and the technology radar
archigov-governance-starterDraftThree principles, two patterns and two policies an architecture function can adopt on day one; two are checkable
azure-waf-architectureDraftEight standards aligned to the Azure Well-Architected checklists: transport security, data-store isolation, deletion protection, supported platforms, zone redundancy and more — several asserting on imported Defender and Policy evidence
dora-ict-architectureDraftFive standards for what DORA Articles 8, 9, 11, 12 and 28 expect the architecture to evidence: hosting decisions, geo-redundant backup, the third-party register, recovery objectives, change review
ai-act-annex-iv-designDraftFive standards for the technical documentation a high-risk AI system's architecture must produce: a decided system, design specifications, human oversight, logging, lifecycle evidence

Install packs under Settings → Import (platform admin, for first-run bootstrap) or from the catalogue (authors).

#Importing Your Own

Artefacts of any kind can be imported from CSV, JSON, or the motivation elements of an ArchiMate Open Exchange file. Imports arrive as drafts with their provenance recorded. See Importing.

#How Artefacts Shape Reviews

  • An artefact's category maps to an area of responsibility on the board (Security → security; Data, Storage, Database → data; Hosting, Compute, Platform → infrastructure; Governance, Compliance, Privacy → compliance; and so on). A review that cites the artefact touches that area, so the right decision maker is asked.
  • Pre-review findings cite artefacts by code, and those citations are checked: a citation that does not resolve to a real artefact is discarded.
  • Routing rules can send reviews of a particular kind or category to a particular board.