{
  "meta": {
    "company": "Výroba Novák & Syn s.r.o.",
    "company_short": "Novák & Syn",
    "ico": "12345678",
    "domain": "novak-syn.cz",
    "tenant": "novaksynvyroba.onmicrosoft.com",
    "generated": "2026-08-14",
    "version": "1.5",
    "doc_title": "IT documentation — operations overview",
    "disclaimer": "Sample documentation by ICT-GROUP. Výroba Novák & Syn s.r.o. is a fictional company — all names, addresses, IP addresses and figures are made up.",
    "about": "A Czech manufacturing company, 45 employees, one internal IT administrator (Martin Doubek) and an external supplier (Nováček IT s.r.o.). The environment is hybrid: on-premises servers (Active Directory) + Microsoft 365 in the cloud, connected by Entra Connect synchronization.",
    "how_to_read": [
      "This document is one page: everything an outside technician needs to take over operations within 48 hours — and everything the company's management needs to know what it owns.",
      "No human drew it: it is generated from machine-readable source data (seed data), so after every change to the environment you simply regenerate the document — and it is current again.",
      "The text is written for a regular reader; technical details (ports, protocols) live in the hover tooltips and in the small print."
    ]
  },
  "profile": {
    "employees": 45,
    "endpoints": 41,
    "endpoints_note": "desktops and laptops managed by Intune",
    "note": "One site + cloud. Internal IT administrator: Martin Doubek. External supplier: Nováček IT s.r.o. (24/7 on-call)."
  },
  "sites": [
    {"name": "Headquarters and production plant", "detail": "Průmyslová 1420, 537 01 Chrudim, Czech Republic (fictional address) — office building + production hall; server room on the ground floor of the office building"},
    {"name": "Cloud", "detail": "Microsoft 365 (tenant novaksynvyroba.onmicrosoft.com) + Azure (immutable backup storage)"}
  ],
  "categories": [
    {"id": "ad",     "label": "Identity and names (AD, DNS)", "color": "#2a78d6", "color_dark": "#5b9be0"},
    {"id": "file",   "label": "Files (SMB)",                  "color": "#eb6834", "color_dark": "#f08a5e"},
    {"id": "erp",    "label": "ERP and databases",            "color": "#1baf7a", "color_dark": "#3fc795"},
    {"id": "print",  "label": "Printing and scanning",        "color": "#eda100", "color_dark": "#f5b83d"},
    {"id": "backup", "label": "Backup",                       "color": "#e87ba4", "color_dark": "#f09cbb"},
    {"id": "mgmt",   "label": "Management and monitoring",    "color": "#4a3aa7", "color_dark": "#7a6cd0"},
    {"id": "web",    "label": "Internet and cloud (HTTPS)",   "color": "#0d8ba3", "color_dark": "#3aacc4"},
    {"id": "cam",    "label": "Cameras",                      "color": "#008300", "color_dark": "#2ea52e"}
  ],
  "vlans": [
    {"id": 10, "name": "Servers",       "subnet": "10.10.10.0/24", "desc": "servers, virtualization, NAS", "noinit": false},
    {"id": 20, "name": "Offices",       "subnet": "10.10.20.0/24", "desc": "employee desktops and laptops", "noinit": false},
    {"id": 30, "name": "Production/OT", "subnet": "10.10.30.0/24", "desc": "production terminals, machines, attendance terminals", "noinit": false},
    {"id": 40, "name": "Print",         "subnet": "10.10.40.0/24", "desc": "printers and multifunction devices", "noinit": false},
    {"id": 50, "name": "Cameras",       "subnet": "10.10.50.0/24", "desc": "IP cameras + recording unit (NVR)", "noinit": true},
    {"id": 60, "name": "Backups",       "subnet": "10.10.60.0/24", "desc": "backup server and backup NAS", "noinit": false},
    {"id": 70, "name": "Management",    "subnet": "10.10.70.0/24", "desc": "network device management; IT workstations only", "noinit": false},
    {"id": 80, "name": "Guest",         "subnet": "10.10.80.0/24", "desc": "guest Wi-Fi — isolated, internet only", "noinit": false, "outside": true}
  ],
  "flows": [
    {"src": "Offices",       "dst": "Servers",       "cat": "ad",     "ports": "TCP/UDP 53, 88, 389, 445, 636", "purpose": "domain sign-in, DNS, company policies (GPO)", "confirmed": true},
    {"src": "Offices",       "dst": "Servers",       "cat": "file",   "ports": "TCP 445",             "purpose": "shared folders on NS-NAS01", "confirmed": true},
    {"src": "Offices",       "dst": "Servers",       "cat": "erp",    "ports": "TCP 8080",            "purpose": "ERP client → application server NS-ERP01", "confirmed": true},
    {"src": "Offices",       "dst": "Cameras",       "cat": "cam",    "ports": "TCP 443",             "purpose": "viewing recordings on NS-NVR01 — Management group only", "confirmed": true},
    {"src": "Offices",       "dst": "INTERNET",      "cat": "web",    "ports": "TCP 443",             "purpose": "Microsoft 365, web — through the firewall", "confirmed": true},
    {"src": "Production/OT", "dst": "Servers",       "cat": "erp",    "ports": "TCP 8080",            "purpose": "production terminals: reporting production into ERP", "confirmed": true},
    {"src": "Production/OT", "dst": "Servers",       "cat": "ad",     "ports": "UDP 53",              "purpose": "DNS only (terminals are not domain-joined)", "confirmed": true},
    {"src": "Print",         "dst": "Servers",       "cat": "file",   "ports": "TCP 445",             "purpose": "scanning to a shared folder (scan-to-folder)", "confirmed": true},
    {"src": "Servers",       "dst": "Print",         "cat": "print",  "ports": "TCP 9100, 631",       "purpose": "print server sends jobs to printers", "confirmed": true},
    {"src": "Servers",       "dst": "Production/OT", "cat": "print",  "ports": "TCP 9100",            "purpose": "ERP prints labels on label printers in production — flow reported by production, not yet verified in the firewall", "confirmed": false},
    {"src": "Servers",       "dst": "INTERNET",      "cat": "web",    "ports": "TCP 443",             "purpose": "system updates, Entra Connect synchronization, Microsoft 365", "confirmed": true},
    {"src": "Backups",       "dst": "Servers",       "cat": "backup", "ports": "TCP 445, 10005–10006", "purpose": "NS-BCK01 pulls backups from hosts and the NAS (Veeam)", "confirmed": true},
    {"src": "Backups",       "dst": "INTERNET",      "cat": "backup", "ports": "TCP 443",             "purpose": "immutable copy of backups to Azure", "confirmed": true},
    {"src": "Management",    "dst": "Servers",       "cat": "mgmt",   "ports": "TCP 443, 3389, 5985–5986", "purpose": "server management (RDP, WinRM, web consoles)", "confirmed": true},
    {"src": "Management",    "dst": "Offices",       "cat": "mgmt",   "ports": "TCP 3389",            "purpose": "remote assistance for users", "confirmed": true},
    {"src": "Management",    "dst": "Production/OT", "cat": "mgmt",   "ports": "TCP 22, 443",         "purpose": "management of terminals and machines", "confirmed": true},
    {"src": "Management",    "dst": "Print",         "cat": "mgmt",   "ports": "TCP 443",             "purpose": "web management of printers", "confirmed": true},
    {"src": "Management",    "dst": "Cameras",       "cat": "mgmt",   "ports": "TCP 443",             "purpose": "management of the NVR and cameras", "confirmed": true},
    {"src": "Management",    "dst": "Backups",       "cat": "mgmt",   "ports": "TCP 443, 3389",       "purpose": "management of the backup server", "confirmed": true},
    {"src": "Management",    "dst": "INTERNET",      "cat": "web",    "ports": "TCP 443",             "purpose": "web, downloading updates", "confirmed": true},
    {"src": "Guest",         "dst": "INTERNET",      "cat": "web",    "ports": "TCP 80, 443; UDP 443", "purpose": "internet only — visitors and personal devices", "confirmed": true}
  ],
  "drops": [
    {"src": "Servers",       "dst": "Backups",   "reason": "Production must not initiate connections into the backup network — protecting backups from ransomware. The backup server pulls the data itself, in the opposite direction."},
    {"src": "Cameras",       "dst": "INTERNET",  "reason": "Cameras must not communicate with the internet (no “phoning home”)."},
    {"src": "Production/OT", "dst": "INTERNET",  "reason": "Production machines and terminals have no direct internet access; IT handles updates through the management network."},
    {"src": "Guest",         "dst": "Servers",   "reason": "The guest Wi-Fi is isolated from the internal network."},
    {"src": "Guest",         "dst": "Offices",   "reason": "The guest Wi-Fi is isolated from the internal network."}
  ],
  "network": {
    "matrix_note": "Row = from, column = to. Every dot is one allowed traffic category — hover to see ports and purpose. An empty cell means: the connection is denied (default deny) — the firewall only allows what is in this matrix.",
    "diagram_note": "The same data as the matrix, just as a map. Hover over a segment or a link to highlight the related communication; click a legend item to hide that category.",
    "highlight": "Note: the servers must not initiate connections into the backup network themselves (the red ✕ in the matrix). The backup server pulls the data itself — so ransomware that took over the servers cannot reach the backups. And the immutable copy in Azure is insurance even against deletion with admin rights."
  },
  "devices": [
    {"name": "NS-FW01",    "type": "MikroTik CCR2116",              "ip": "10.10.70.1",     "vlan": "Management", "role": "firewall and router between VLANs; backup LTE connection"},
    {"name": "NS-SW01",    "type": "MikroTik CRS326-24S+",          "ip": "10.10.70.2",     "vlan": "Management", "role": "core switch — server room"},
    {"name": "NS-SW02",    "type": "MikroTik CRS326-24G",           "ip": "10.10.70.3",     "vlan": "Management", "role": "switch — office building"},
    {"name": "NS-SW03",    "type": "MikroTik CRS112-8P",            "ip": "10.10.70.4",     "vlan": "Management", "role": "switch — production hall (PoE for cameras and APs)"},
    {"name": "NS-AP01–04", "type": "MikroTik cAP ax (4 pcs)",       "ip": "10.10.70.11–14", "vlan": "Management", "role": "Wi-Fi — SSIDs NovakSyn (internal) and NovakSyn-guest"},
    {"name": "NS-HV01",    "type": "Dell PowerEdge R450",           "ip": "10.10.10.5",     "vlan": "Servers",    "role": "Hyper-V host 1 (VMs: DC01, ERP01)"},
    {"name": "NS-HV02",    "type": "Dell PowerEdge R450",           "ip": "10.10.10.6",     "vlan": "Servers",    "role": "Hyper-V host 2 (VMs: DC02, SQL01, SYNC)"},
    {"name": "NS-DC01",    "type": "VM — Windows Server 2022",      "ip": "10.10.10.11",    "vlan": "Servers",    "role": "domain controller, DNS, DHCP"},
    {"name": "NS-DC02",    "type": "VM — Windows Server 2022",      "ip": "10.10.10.12",    "vlan": "Servers",    "role": "second domain controller, DNS"},
    {"name": "NS-SQL01",   "type": "VM — WS 2022 + SQL Server 2022","ip": "10.10.10.21",    "vlan": "Servers",    "role": "ERP database"},
    {"name": "NS-ERP01",   "type": "VM — Windows Server 2022",      "ip": "10.10.10.22",    "vlan": "Servers",    "role": "ERP application server + attendance module"},
    {"name": "NS-SYNC",    "type": "VM — Windows Server 2022",      "ip": "10.10.10.15",    "vlan": "Servers",    "role": "Entra Connect — AD synchronization to Microsoft 365"},
    {"name": "NS-NAS01",   "type": "Synology RS1221+",              "ip": "10.10.10.31",    "vlan": "Servers",    "role": "shared files"},
    {"name": "NS-BCK01",   "type": "Dell PowerEdge T350",           "ip": "10.10.60.11",    "vlan": "Backups",    "role": "backup server (Veeam B&R + Veeam for M365)"},
    {"name": "NS-NAS-BCK", "type": "Synology DS923+",               "ip": "10.10.60.21",    "vlan": "Backups",    "role": "second backup medium"},
    {"name": "NS-NVR01",   "type": "NVR — 14 cameras",              "ip": "10.10.50.11",    "vlan": "Cameras",    "role": "camera recording (30-day retention)"},
    {"name": "NS-UPS01",   "type": "APC Smart-UPS SRT 3000",        "ip": "10.10.70.21",    "vlan": "Management", "role": "server room backup power (runtime ~20 min)"}
  ],
  "systems": [
    {"name": "ERP Helios Orange",                 "purpose": "production, warehouse, invoicing, accounting",        "runs_on": "NS-ERP01 + NS-SQL01",                          "owner": "Jana Melicharová (finance manager)",  "admin": "Martin Doubek + service contract with the ERP vendor", "docs": "SharePoint → IT documentation → ERP.md"},
    {"name": "Microsoft 365 Business Premium",    "purpose": "mail, Teams, SharePoint/OneDrive, Intune, Defender", "runs_on": "cloud — tenant novaksynvyroba.onmicrosoft.com", "owner": "Petr Havlena (managing director)",    "admin": "Martin Doubek + Nováček IT (delegated access via GDAP)", "docs": "SharePoint → IT documentation → M365.md"},
    {"name": "Active Directory (Novák & Syn)",    "purpose": "accounts, computer sign-in, company policies",        "runs_on": "NS-DC01 + NS-DC02",                            "owner": "Petr Havlena (managing director)",    "admin": "Martin Doubek",                                       "docs": "SharePoint → IT documentation → AD.md"},
    {"name": "Shared files",                      "purpose": "documents, drawings, department data",                "runs_on": "NS-NAS01",                                      "owner": "department heads",                    "admin": "Martin Doubek",                                       "docs": "SharePoint → IT documentation → NAS.md"},
    {"name": "Backup (Veeam B&R + for M365)",     "purpose": "backups of servers, NAS and cloud",                   "runs_on": "NS-BCK01",                                      "owner": "Petr Havlena (managing director)",    "admin": "Martin Doubek; oversight: Nováček IT",                "docs": "SharePoint → IT documentation → Backup.md"},
    {"name": "Attendance system",                 "purpose": "attendance, payroll inputs",                          "runs_on": "terminals at entrances + module on NS-ERP01",   "owner": "Jana Melicharová",                    "admin": "attendance vendor (service contract)",                "docs": "SharePoint → IT documentation → Attendance.md"},
    {"name": "Camera system",                     "purpose": "site recording — 14 cameras, 30-day retention",       "runs_on": "NS-NVR01",                                      "owner": "Petr Havlena (managing director)",    "admin": "security vendor (service contract)",                  "docs": "SharePoint → IT documentation → Cameras.md"},
    {"name": "Company website",                   "purpose": "www.novak-syn.cz — company presentation",             "runs_on": "external hosting (WordPress)",                  "owner": "Lucie Vávrová (sales)",               "admin": "web studio (contract)",                               "docs": "SharePoint → IT documentation → Web.md"},
    {"name": "Payroll",                           "purpose": "payroll processing",                                  "runs_on": "external — accounting firm",                    "owner": "Jana Melicharová",                    "admin": "accounting firm",                                     "docs": "SharePoint → IT documentation → Payroll.md"}
  ],
  "identity": {
    "ad": {
      "domain": "ad.novak-syn.cz",
      "netbios": "Novák & Syn",
      "users": 45,
      "service_accounts": 7,
      "admin_accounts": 4,
      "dcs": "NS-DC01, NS-DC02"
    },
    "entra": {
      "tenant": "novaksynvyroba.onmicrosoft.com",
      "licensed": 45,
      "license": "Microsoft 365 Business Premium",
      "guests": 3,
      "guests_note": "external accounting firm, ERP vendor"
    },
    "sync": {
      "tool": "Entra Connect v2",
      "server": "NS-SYNC",
      "interval": "every 30 minutes",
      "method": "password hash sync — cloud sign-in keeps working even when the on-premises servers are down",
      "scope_included": ["OU Users (45 accounts)", "OU Groups"],
      "scope_excluded": ["service accounts", "admin accounts (adm-*)", "OU Retired"],
      "sspr": "self-service password reset with write-back to AD — enabled"
    },
    "privileged": [
      {"role": "Global Administrator (Microsoft 365)", "who": "bg-admin-01, bg-admin-02 (emergency) · adm.doubek (Martin Doubek)", "note": "adm.doubek is a separate cloud-only admin account — Martin does not use it for everyday work"},
      {"role": "Domain Admins (Active Directory)",     "who": "adm-doubek (Martin Doubek) · adm-onovacek (Ondřej Nováček, supplier)", "note": "both are named accounts — no shared “administrator” for everyday work"},
      {"role": "Delegated supplier access (GDAP)",     "who": "Nováček IT s.r.o. — roles User Administrator, Exchange Administrator, Intune Administrator", "note": "without the Global Administrator role; the company can unilaterally revoke the delegation at any time"},
      {"role": "Emergency account for AD (on-prem)",   "who": "nouzovy-admin (member of Domain Admins)", "note": "password in a sealed envelope in the safe; rotated after every use"}
    ],
    "ca_policies": [
      {"name": "CA01 — MFA for all users",                    "what": "every sign-in is confirmed with a second factor (Authenticator app)",                    "state": "Enabled", "exceptions": "bg-admin-01/02 (they have their own FIDO2 keys)"},
      {"name": "CA02 — Block legacy protocols",               "what": "old sign-in methods without MFA support (IMAP/POP/SMTP basic) are blocked",              "state": "Enabled", "exceptions": "no exceptions"},
      {"name": "CA03 — Company data only from managed devices", "what": "the computer must be managed by Intune and healthy (compliant)",                       "state": "Enabled", "exceptions": "mobiles: only apps with data protection (app protection)"},
      {"name": "CA04 — Geoblocking",                          "what": "sign-ins from countries outside the EU are blocked",                                     "state": "Enabled", "exceptions": "business trips — temporary exception on request"},
      {"name": "CA05 — Admins only with a FIDO2 key",         "what": "privileged roles require phishing-resistant sign-in with a hardware key",                "state": "Enabled", "exceptions": "bg-admin-01/02 (excluded from all policies, they do have FIDO2 keys)"},
      {"name": "CA06 — MFA registration only from a trusted location", "what": "a new second factor can only be registered from the company network or a managed device", "state": "Enabled", "exceptions": "no exceptions"}
    ]
  },
  "break_glass": {
    "intro": "Emergency “break the glass” accounts — the way into Microsoft 365 for the day the IT administrator is not available. Two cloud-only accounts with the Global Administrator role, sign-in exclusively with a FIDO2 hardware key, excluded from all Conditional Access policies.",
    "accounts": [
      {"upn": "bg-admin-01@novaksynvyroba.onmicrosoft.com", "type": "cloud-only, Global Administrator, unlicensed", "auth": "FIDO2 key no. 1 (YubiKey 5 NFC)"},
      {"upn": "bg-admin-02@novaksynvyroba.onmicrosoft.com", "type": "cloud-only, Global Administrator, unlicensed", "auth": "FIDO2 key no. 2 (YubiKey 5 NFC)"}
    ],
    "keys": [
      {"key": "FIDO2 key no. 1", "where": "safe in the managing director's office (with a sealed PIN envelope)", "access": "Petr Havlena (managing director), Jana Melicharová"},
      {"key": "FIDO2 key no. 2", "where": "bank safe-deposit box — bank branch, Chrudim",                        "access": "Petr Havlena; authorized: Jana Melicharová"}
    ],
    "steps": [
      "Verify it really is an emergency: the IT administrator is unavailable and an intervention in Microsoft 365 is needed — restoring access, blocking an attacker, bringing a service back up.",
      "Collect FIDO2 key no. 1 from the safe in the managing director's office. If it is not available, key no. 2 is in the bank safe-deposit box.",
      "On a computer open admin.microsoft.com and sign in as bg-admin-01@novaksynvyroba.onmicrosoft.com — choose “Sign in with a security key” and present the key (the PIN is in the sealed envelope with the key).",
      "An alert is automatically sent to the managing director and to it@ — that is expected, do not dismiss anything.",
      "Do only what the emergency requires. Change nothing beyond that; if unsure, call the supplier's on-call line: Nováček IT s.r.o., +420 555 000 111.",
      "Afterwards: return the key, replace the PIN envelope with a new one, log the intervention (SharePoint → IT documentation → Intervention log) and inform the IT administrator or the supplier within 24 hours — they will assess whether to rotate the account and the key."
    ],
    "alert": "Every sign-in with an emergency account sends an immediate alert to jednatel@novak-syn.cz and it@novak-syn.cz. The alerting is tested together with the accounts.",
    "last_test": "2026-07-15",
    "last_test_note": "both accounts: key sign-in, alert check — OK (logged)",
    "next_test": "2026-10-13",
    "test_rule": "every 90 days + after every personnel change in IT"
  },
  "backup": {
    "strategy": "The 3-2-1 rule: three copies of the data, two different media, one off-site — plus one immutable on top. IT, which manages the backups, has access to them — and so does the managing director with his own account (Veeam console and Azure). The immutable copy is not about access but about deletion: once written, nobody can delete it for 30 days — not the administrator, not an attacker with an admin password.",
    "jobs": [
      {"name": "VMs + NAS — local",      "what": "all VMs from NS-HV01/02 + NAS shared folders",  "to": "NS-BCK01",                           "schedule": "daily 22:00", "retention": "30 days",               "immutable": false, "last_ok": "13 Aug 2026 22:41 — OK"},
      {"name": "Copy to second medium",  "what": "copy of job no. 1",                             "to": "NS-NAS-BCK",                         "schedule": "daily 03:00", "retention": "30 days",               "immutable": false, "last_ok": "14 Aug 2026 03:12 — OK"},
      {"name": "Offsite — immutable",    "what": "VMs + NAS",                                     "to": "Azure Blob (30-day immutability)",   "schedule": "daily 04:30", "retention": "30 days + 12 monthly",  "immutable": true,  "last_ok": "14 Aug 2026 05:03 — OK"},
      {"name": "Microsoft 365",          "what": "Exchange, SharePoint, OneDrive, Teams",         "to": "NS-BCK01 + copy to Azure",           "schedule": "daily 20:00", "retention": "1 year",                "immutable": true,  "last_ok": "13 Aug 2026 20:37 — OK"}
    ],
    "restore_tests": [
      {"type": "Monthly sample",        "date": "2026-08-05", "what": "restore of 3 random files from the NAS",             "result": "OK, 12 minutes",  "next": "2026-09-05"},
      {"type": "Quarterly application", "date": "2026-06-18", "what": "restore of the ERP database into a test VM",         "result": "OK, 74 minutes",  "next": "2026-09-18"},
      {"type": "Annual full exercise",  "date": "2026-03-21", "what": "restore of DC + ERP + files into an isolated network", "result": "OK, 6 h 20 min", "next": "2027-03-21"}
    ]
  },
  "dr": {
    "scenarios": [
      {"name": "Failure of one VM or service",       "action": "restore from the local backup on NS-BCK01 (runbook R1)",                                                  "rto": "4 h",              "rpo": "24 h", "tested": "18 Jun 2026 — ERP database restore, 74 min"},
      {"name": "Ransomware — servers encrypted",     "action": "disconnect the network, pay nothing, restore from the immutable copy in Azure (runbook R2)",              "rto": "24–48 h",          "rpo": "24 h", "tested": "21 Mar 2026 — tabletop exercise + test restore"},
      {"name": "Server room destroyed (fire, water)", "action": "replacement hardware / temporary operation in Azure, restore from the cloud copy (runbook R3)",          "rto": "5 business days",  "rpo": "24 h", "tested": "21 Mar 2026 — tabletop exercise"},
      {"name": "Internet outage",                    "action": "firewall fails over automatically to the backup LTE connection",                                          "rto": "15 min",           "rpo": "—",    "tested": "9 Feb 2026 — live failover test"},
      {"name": "IT administrator unavailable",       "action": "break-glass emergency account (chapter above) + supplier Nováček IT takes over using this documentation", "rto": "24 h",             "rpo": "—",    "tested": "15 Jul 2026 — emergency account test"}
    ],
    "notes": "Printed copy of the DR plan: safe in the managing director's office + at the managing director's home. The plan is known to: Petr Havlena, Martin Doubek, Jana Melicharová. Supplier on-call: Nováček IT s.r.o., +420 555 000 111 (24/7).",
    "tabletop": "Last tabletop exercise: 21 Mar 2026 — scenario: the IT administrator unreachable in the morning and the servers encrypted overnight. Next exercise: March 2027."
  },
  "lifecycle": {
    "intro": "The documentation tracks not only what the company HAS, but also what quietly EXPIRES on it: domains, certificates, licences, warranties, software support and service contracts. Expiry does not hurt — until the day something lapses. It is payment continuity (checklist area 9) in practice: every item has a deadline, a number of days remaining, and the name of whoever pays.",
    "reminders_note": "Reminders for all services go to the shared mailbox it@novak-syn.cz and the deadlines live in the shared “IT expiry” calendar (watched by J. Melicharová + M. Doubek) with reminders 60, 30 and 7 days ahead. No critical service hangs on a personal card or a private e-mail.",
    "domains": [
      {"domain": "novak-syn.cz",        "use": "main domain — web, e-mail, service sign-ins",          "registrar": "Czech registrar — company account (it@)",                 "expires": "2027-03-04", "autorenew": true,  "pays": "company card", "note": "holder: Výroba Novák & Syn s.r.o., company ID 12345678 — verified against WHOIS on 12 Jun 2026"},
      {"domain": "novaksyn.cz",         "use": "defensive registration — redirects to the main site",  "registrar": "same registrar",                                          "expires": "2026-12-02", "autorenew": true,  "pays": "company card", "note": ""},
      {"domain": "novak-syn-shop.cz",   "use": "e-shop pilot (2024) — unused today",                   "registrar": "same registrar",                                          "expires": "2026-10-19", "autorenew": false, "pays": "company card", "note": "decide by September: renew (protects the brand) or let it lapse"},
      {"domain": "presna-mechanika.cz", "use": "from the acquisition of Přesná mechanika s.r.o. (2021) — old customers still e-mail it", "registrar": "different registrar — account transferred to the company in 2022", "expires": "2027-06-30", "autorenew": true, "pays": "company card", "note": "keep at least until 2028, then reassess"}
    ],
    "certificates": [
      {"name": "www.novak-syn.cz (web)",                        "issuer": "Let's Encrypt (via hosting)",   "expires": "renews automatically every 90 days", "owner": "watched by the hosting; checked at the half-yearly review"},
      {"name": "vpn.novak-syn.cz (SSTP VPN on NS-FW01)",        "issuer": "public CA — annual certificate", "expires": "2027-01-22",                        "owner": "renewed by M. Doubek — task in the “IT expiry” calendar"},
      {"name": "erp.ad.novak-syn.cz (ERP web module, intranet)", "issuer": "self-signed",                   "expires": "2028-03-01",                        "owner": "replace with a trusted certificate during the ERP upgrade (Q4 2026)"},
      {"name": "Microsoft 365 (mail, sign-in)",                 "issuer": "managed by Microsoft",           "expires": "no action needed",                  "owner": "—"}
    ],
    "saas": [
      {"service": "Microsoft 365 Business Premium",  "license": "per user",                 "count": "45", "assigned": "all employees — group LIC-M365-BP (dynamic)",              "renewal": "2027-01-31", "renewal_note": "annual commitment", "pays": "invoice — CSP Nováček IT", "note": "the tenant and the data belong to the company; GDAP can be revoked at any time"},
      {"service": "Microsoft Defender for Business", "license": "included in Business Premium", "count": "45", "assigned": "all devices managed by Intune",                         "renewal": "with the M365 licence", "renewal_note": "", "pays": "—",                     "note": "EDR/antivirus — no separate payment"},
      {"service": "Power BI Pro",                    "license": "per user",                 "count": "3",  "assigned": "P. Havlena, J. Melicharová, T. Hruška",                     "renewal": "monthly, no commitment", "renewal_note": "", "pays": "invoice — CSP",        "note": ""},
      {"service": "Adobe Acrobat Standard",          "license": "per user",                 "count": "4",  "assigned": "group LIC-Acrobat (finance + sales)",                       "renewal": "2027-02-15", "renewal_note": "annual", "pays": "company card",              "note": ""},
      {"service": "Bitwarden (password manager)",    "license": "organization",             "count": "8",  "assigned": "management + IT — collections by department",               "renewal": "2026-09-30", "renewal_note": "annual", "pays": "company card",              "note": "organization owner: the company (managing director + IT)"},
      {"service": "ERP Helios Orange — maintenance", "license": "concurrent users",         "count": "20", "assigned": "production, warehouse, finance — named list in ERP.md",     "renewal": "2026-12-31", "renewal_note": "annual", "pays": "invoice",                   "note": "support + updates; upgrade Q4 2026"},
      {"service": "Veeam Data Platform",             "license": "instances (VUL)",          "count": "10", "assigned": "servers + NAS — jobs see the DR card",                      "renewal": "2027-05-15", "renewal_note": "annual", "pays": "invoice",                   "note": ""},
      {"service": "Azure — immutable backup storage", "license": "pay-as-you-go",           "count": "—",  "assigned": "backup jobs no. 3 and 4",                                   "renewal": "ongoing (monthly)", "renewal_note": "", "pays": "company card",             "note": "30-day immutability"},
      {"service": "Web hosting",                     "license": "package",                  "count": "1",  "assigned": "company website",                                           "renewal": "2027-02-28", "renewal_note": "annual", "pays": "company card",              "note": ""},
      {"service": "Attendance system",               "license": "per terminal",             "count": "3",  "assigned": "terminals at the entrances",                                "renewal": "service contract — see Connectivity, service and insurance", "renewal_note": "", "pays": "invoice", "note": ""}
    ],
    "hardware": [
      {"device": "NS-HV01",    "model": "Dell PowerEdge R450",   "serial": "ST 7GX2Q34",       "support": "Dell ProSupport NBD",   "expires": "2027-09-30", "plan": "extend by 2 years when the contract renews"},
      {"device": "NS-HV02",    "model": "Dell PowerEdge R450",   "serial": "ST 7GX2Q41",       "support": "Dell ProSupport NBD",   "expires": "2027-09-30", "plan": "extend by 2 years when the contract renews"},
      {"device": "NS-BCK01",   "model": "Dell PowerEdge T350",   "serial": "ST JW4T2P3",       "support": "Dell Basic NBD",        "expires": "2026-11-15", "plan": "upgrade to ProSupport — quote requested"},
      {"device": "NS-NAS01",   "model": "Synology RS1221+",      "serial": "SN 2150SGR445901", "support": "manufacturer warranty", "expires": "2026-06-30", "plan": "out of warranty — replacement planned Q2 2027, quote with the supplier"},
      {"device": "NS-NAS-BCK", "model": "Synology DS923+",       "serial": "SN 2320TQK118002", "support": "manufacturer warranty", "expires": "2028-02-10", "plan": "—"},
      {"device": "NS-FW01",    "model": "MikroTik CCR2116",      "serial": "SN D4E8-9F21",     "support": "warranty",              "expires": "2027-04-22", "plan": "on failure, replacement within 24 h from the supplier; the configuration is exported daily"},
      {"device": "NS-UPS01",   "model": "APC Smart-UPS SRT 3000", "serial": "SN AS2405123456", "support": "manufacturer warranty", "expires": "2027-05-15", "plan": "battery replacement 5/2028 (after 4 years) — see Connectivity, service and insurance"}
    ],
    "software_eol": [
      {"software": "Windows Server 2022",      "where": "NS-DC01/02, SQL01, ERP01, SYNC", "end": "2026-10-13", "end_label": "end of mainstream support",   "extended": "extended support until 14 Oct 2031", "plan": "fine — security patches continue; OS upgrade with the server refresh (2028)"},
      {"software": "SQL Server 2022",          "where": "NS-SQL01",                       "end": "2028-01-11", "end_label": "end of mainstream support",   "extended": "extended support until 11 Jan 2033", "plan": "fine"},
      {"software": "Windows 11 Pro 25H2",      "where": "41 computers",                   "end": "2027-10-12", "end_label": "end of support for this version", "extended": "the version renews annually",    "plan": "Intune upgrades versions automatically"},
      {"software": "ERP Helios Orange 2024.2", "where": "NS-ERP01",                       "end": "2026-12-31", "end_label": "end of vendor support",       "extended": "—",                                  "plan": "upgrade to the new version planned for Q4 2026"},
      {"software": "MikroTik RouterOS 7",      "where": "firewall, switches, APs",        "end": "rolling updates", "end_label": "",                       "extended": "—",                                  "plan": "firmware check at the quarterly maintenance"},
      {"software": "Synology DSM 7.2",         "where": "NS-NAS01, NS-NAS-BCK",           "end": "rolling updates", "end_label": "",                       "extended": "—",                                  "plan": "firmware check at the quarterly maintenance"}
    ],
    "services": [
      {"service": "Internet — fibre 500/500 Mb/s",             "provider": "connectivity provider",  "term": "open-ended, 3-month notice period",           "expires": "",           "pays": "invoice",         "note": ""},
      {"service": "Backup LTE connection",                     "provider": "mobile operator",        "term": "commitment until 30 Jun 2027",                "expires": "2027-06-30", "pays": "invoice",         "note": "failover tested 9 Feb 2026"},
      {"service": "Mobile tariffs (18 SIMs)",                  "provider": "mobile operator",        "term": "framework contract until 31 Mar 2027",        "expires": "2027-03-31", "pays": "invoice",         "note": ""},
      {"service": "UPS — service and batteries",               "provider": "service partner",        "term": "annual inspection — last 6 May 2026, next 5/2027",  "expires": "", "pays": "invoice",         "note": "battery replacement 5/2028 (after 4 years)"},
      {"service": "Server room air conditioning — service",    "provider": "service company",        "term": "annual service — last 12 May 2026, next 5/2027",    "expires": "", "pays": "invoice",         "note": ""},
      {"service": "Lease of multifunction printers (3 pcs)",   "provider": "leasing company",        "term": "contract until 30 Sep 2027",                  "expires": "2027-09-30", "pays": "invoice",         "note": "decide before the end: buy out / replace"},
      {"service": "Cyber insurance",                           "provider": "insurer",                "term": "renewal 1 Apr 2027 — coverage limit CZK 10 million", "expires": "2027-04-01", "pays": "invoice", "note": "the insurer requires MFA, backups and restore tests — evidenced by this documentation; supported software is a condition of coverage"},
      {"service": "IT supplier — service contract (Nováček IT)", "provider": "Nováček IT s.r.o.",    "term": "open-ended — 60-day exit, fixed rates (art. 12)", "expires": "",       "pays": "monthly invoice", "note": "24/7 on-call: +420 555 000 111"}
    ]
  },
  "evidence": {
    "filled_by": "Martin Doubek (generated from source data, reviewed)",
    "filled_date": "2026-08-14",
    "next_review": "2027-02-14",
    "principle": "A copy of this register must not live only on the server it describes. Printed copy: safe in the managing director's office; second copy: bank safe-deposit box. After every regeneration of the documentation, both copies are swapped for the current one.",
    "domains": [
      {"n": 1, "title": "Domains and DNS", "critical": true, "why": "The domain carries the website, e-mail and sign-ins to most services. The holder must be the company (company ID), not a person.", "rows": [
        ["Account at the domain registrar (novak-syn.cz)", "Bitwarden — collection “Company – critical”", "managing director, M. Doubek", "2026-06-12", "2027-06-12"],
        ["Domain holder in the WHOIS record", "Výroba Novák & Syn s.r.o., company ID 12345678 — extract: SharePoint → IT documentation → Domain", "the record is public", "2026-06-12", "2027-06-12"],
        ["DNS hosting (where the domain records live)", "at the registrar; record export: SharePoint → IT documentation → DNS.md", "M. Doubek, Nováček IT", "2026-06-12", "2027-06-12"],
        ["Domain expiry and whose card pays for it", "4 Mar 2027 — company card; see the Expiry and lifecycle chapter", "J. Melicharová (card)", "2026-06-12", "2027-06-12"],
        ["Contact e-mail at the registrar", "it@novak-syn.cz (shared mailbox, not personal)", "managing director, M. Doubek, Nováček IT", "2026-06-12", "2027-06-12"]
      ]},
      {"n": 2, "title": "Tenant and licence ownership", "critical": true, "why": "The tenant — the Microsoft 365 environment — and the data belong to the company. The managing director can sign in to the admin portal even without the supplier.", "rows": [
        ["Managing director's sign-in to the Microsoft 365 admin portal", "havlena@novak-syn.cz — Global Reader role (sees everything, changes nothing; interventions go through break-glass)", "Petr Havlena", "2026-05-20", "2027-05-20"],
        ["List of global administrators", "the Identity map chapter of this document (generated)", "management + IT", "2026-08-14", "2027-02-14"],
        ["Contract with the partner (CSP) and a list of their permissions", "SharePoint → Contracts → Nováček IT; GDAP permissions in the Identity map chapter", "managing director, J. Melicharová", "2026-05-20", "2027-05-20"],
        ["Licence overview and subscription renewal dates", "45× Business Premium, renewal 31 Jan 2027 — the Expiry and lifecycle chapter (incl. licence assignments)", "managing director, M. Doubek", "2026-05-20", "2027-05-20"]
      ]},
      {"n": 3, "title": "Systems documentation", "critical": false, "why": "The yardstick: an outside technician takes over operations within 48 hours using it. A copy belongs outside the systems it describes.", "rows": [
        ["Systems inventory (everything the company runs)", "this document — the Systems inventory chapter (generated from seed data)", "management + IT", "2026-08-14", "2027-02-14"],
        ["Network diagram", "this document — the Network matrix and Network diagram (generated)", "management + IT", "2026-08-14", "2027-02-14"],
        ["List of admin accounts and their owners", "this document — the Identity map chapter", "management + IT", "2026-08-14", "2027-02-14"],
        ["Supplier contacts", "the Systems inventory and DR card chapters", "management + IT", "2026-08-14", "2027-02-14"],
        ["Step-by-step recovery procedure", "runbooks R1–R3: SharePoint → IT documentation → DR; summary in the DR card chapter", "IT; printed copy with the managing director", "2026-03-21", "2027-03-21"],
        ["Copy of the documentation outside the systems it describes", "PDF export: safe + bank safe-deposit box; swapped after every regeneration", "managing director", "2026-08-14", "2027-02-14"]
      ]},
      {"n": 4, "title": "Emergency admin accounts", "critical": true, "why": "Break-glass — the way into Microsoft 365 even if the admin does not show up tomorrow. Detailed procedure: the Break-glass runbook chapter.", "rows": [
        ["Emergency account no. 1 (sign-in name)", "bg-admin-01@novaksynvyroba.onmicrosoft.com", "holders of key no. 1", "2026-07-15", "2026-10-13"],
        ["Emergency account no. 2 (sign-in name)", "bg-admin-02@novaksynvyroba.onmicrosoft.com", "holders of key no. 2", "2026-07-15", "2026-10-13"],
        ["FIDO2 hardware key no. 1 — location", "safe in the managing director's office (+ sealed PIN envelope)", "P. Havlena, J. Melicharová", "2026-07-15", "2026-10-13"],
        ["FIDO2 hardware key no. 2 — a second, separate location", "bank safe-deposit box, Chrudim branch", "P. Havlena", "2026-07-15", "2026-10-13"],
        ["Sign-in alerts — where they go", "e-mail to the managing director + it@ (immediately)", "—", "2026-07-15", "2026-10-13"]
      ]},
      {"n": 5, "title": "Backups you can reach yourself", "critical": true, "why": "Three copies, two media, one off-site — plus one immutable. IT has access to the backups; so does the managing director.", "rows": [
        ["What is backed up (list of data and systems)", "the Backup jobs table in this document (generated)", "IT + managing director", "2026-08-14", "2027-02-14"],
        ["Where the backups live (media and locations)", "NS-BCK01, NS-NAS-BCK, Azure (off-site)", "IT + managing director", "2026-08-05", "2026-09-05"],
        ["Immutable copy — where it is", "Azure Blob — 30-day immutability", "IT + managing director (own account)", "2026-06-18", "2026-09-18"],
        ["The company's own access to the backups", "the managing director has his own account for the Veeam console and Azure", "Petr Havlena", "2026-08-05", "2026-09-05"],
        ["Password or key for decrypting the backups", "sealed envelope in the safe; also known to the managing director (outside IT)", "P. Havlena + IT", "2026-04-03", "2026-10-03"],
        ["Record of the last test restore", "the Test restores table + the log on SharePoint", "IT + managing director", "2026-08-05", "2026-09-05"]
      ]},
      {"n": 6, "title": "Disaster recovery plan", "critical": false, "why": "Who restores what and in what order — available even during an IT outage, printed, known to at least two people.", "rows": [
        ["Written recovery (DR) plan — printed copy", "safe in the managing director's office", "P. Havlena, J. Melicharová", "2026-03-21", "2027-03-21"],
        ["Copy of the plan outside the company", "at the managing director's home + bank safe-deposit box", "P. Havlena", "2026-03-21", "2027-03-21"],
        ["Who knows the plan (at least two people)", "P. Havlena, M. Doubek, J. Melicharová", "—", "2026-03-21", "2027-03-21"],
        ["Minutes of the last tabletop exercise", "SharePoint → IT documentation → DR → exercise 2026", "management", "2026-03-21", "2027-03-21"]
      ]},
      {"n": 7, "title": "Password management and access escrow", "critical": false, "why": "The password vaults belong to the company, not to one person's head — with an emergency mechanism on top.", "rows": [
        ["Company password manager — who owns the vaults", "Bitwarden — organization Novák & Syn (owner: the company; admins: managing director + M. Doubek)", "everyone per collections", "2026-07-01", "2026-10-01"],
        ["Sealed envelope in the safe — date of last rotation", "safe in the managing director's office", "P. Havlena, J. Melicharová", "2026-04-03", "2026-10-03"],
        ["Emergency access (Bitwarden Emergency Access)", "P. Havlena is the emergency contact for M. Doubek's account (3-day waiting period)", "Petr Havlena", "2026-07-01", "2026-10-01"],
        ["Third-party escrow", "not used — covered by the envelope and emergency access", "—", "—", "—"]
      ]},
      {"n": 8, "title": "Contract with your IT supplier", "critical": false, "why": "Continuity is negotiated while the relationship is good. Access and documentation are handed over continuously, not at the break-up.", "rows": [
        ["Contract with the IT supplier — where it is stored", "SharePoint → Contracts → Nováček IT s.r.o.", "managing director, J. Melicharová", "2026-05-20", "2027-05-20"],
        ["Clause: data, backups and documentation belong to the client", "art. 7 of the contract — explicitly", "—", "2026-05-20", "2027-05-20"],
        ["Cooperation on termination (notice period, rates)", "art. 12 — 60 days, fixed rates", "—", "2026-05-20", "2027-05-20"],
        ["Last continuous hand-over of access and documentation", "14 Aug 2026 — regeneration of this documentation + spot check of access", "managing director", "2026-08-14", "2027-02-14"]
      ]},
      {"n": 9, "title": "Payment continuity", "critical": false, "why": "Expiry does not hurt — until the day a certificate lapses. Everything on the company card and role-based e-mail, not a person.", "rows": [
        ["Domains — whose card pays, when they expire", "the Expiry and lifecycle chapter — all 4 domains (company card)", "J. Melicharová", "2026-06-12", "2026-12-12"],
        ["Certificates — who renews them, when they expire", "web: Let's Encrypt, renews automatically; watched by the hosting", "—", "2026-06-12", "2026-12-12"],
        ["Hosting and other key services — whose card", "everything on the company card or invoice; no personal cards", "J. Melicharová", "2026-06-12", "2026-12-12"],
        ["Reminder e-mail (a role, not a personal mailbox)", "it@novak-syn.cz (shared mailbox)", "IT + finance manager", "2026-06-12", "2026-12-12"],
        ["Expiry calendar — who watches it", "shared “IT expiry” calendar in Microsoft 365", "J. Melicharová + M. Doubek", "2026-06-12", "2026-12-12"]
      ]},
      {"n": 10, "title": "Offboarding and secret rotation", "critical": false, "why": "At every departure from IT: revoke privileged access within an hour, rotate shared passwords and keys.", "rows": [
        ["Written procedure for a departure from IT", "SharePoint → IT documentation → Offboarding.md", "management + IT", "2026-06-30", "at the next departure"],
        ["Shared passwords — list to rotate on departure", "Bitwarden — collections tagged “rotation”", "IT", "2026-06-30", "at the next departure"],
        ["API keys and service accounts — list to rotate", "the Identity map chapter + ERP documentation (Veeam→Azure, attendance→ERP)", "IT", "2026-06-30", "at the next departure"],
        ["Record of the last departure", "30 Jun 2026 — temporary worker (IT support): accounts disabled the same day, shared passwords rotated", "management", "2026-06-30", "—"]
      ]}
    ]
  }
}