compliance-frameworks

name	compliance-frameworks
description	ISO 27001, NIST CSF 2.0, CIS Controls v8.1, EU CRA compliance mapping, multi-standard alignment per Hack23 ISMS policies
license	MIT

Compliance Frameworks Skill

Context

This skill applies when:

• Mapping security controls to compliance frameworks
• Creating compliance documentation
• Conducting compliance audits
• Implementing EU Cyber Resilience Act (CRA) requirements
• Generating compliance evidence portfolios
• Responding to compliance questionnaires
• Preparing for security certifications

This skill enforces Hack23 ISMS policies for multi-standard compliance alignment.

Rules

1. ISO 27001:2022 (Secure Development Policy 📜)

1. A.5: Organizational controls (policies, roles)
2. A.8: Asset management (handling, classification, deletion)
3. A.12: Operations security (change management, vulnerabilities)
4. A.13: Communications security (network controls, encryption)
5. A.14: System acquisition and development (secure SDLC)

2. NIST Cybersecurity Framework 2.0 (Secure Development Policy 📜)

6. GOVERN: Risk management, policy, oversight
7. IDENTIFY: Asset management, risk assessment
8. PROTECT: Access control, data security, awareness
9. DETECT: Continuous monitoring, anomaly detection
10. RESPOND: Incident analysis, mitigation, communication
11. RECOVER: Recovery planning, improvements, communications

3. CIS Controls v8.1 (Secure Development Policy 📜)

12. IG1 (Implementation Group 1): Basic cyber hygiene (8 controls)
13. IG2 (Implementation Group 2): Medium-sized organizations (56 additional controls)
14. IG3 (Implementation Group 3): Large organizations/high security (additional 64 controls)

4. EU Cyber Resilience Act (Open Source Policy 🛡️)

15. Conformity Assessment: CE marking for digital products
16. Security Updates: Timely vulnerability patching
17. Risk Management: Classification-based security requirements
18. Documentation: Technical documentation for 10 years
19. Incident Reporting: Report actively exploited vulnerabilities

Examples

✅ Good Pattern: ISO 27001:2022 Control Mapping

/**
 * ISO 27001:2022 Control Implementation Matrix
 * 
 * ISMS Policy: Compliance Framework Integration
 * Evidence: https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md#compliance-framework-integration
 */

const iso27001Controls = {
  // A.5 Organizational Controls
  'A.5.1': {
    control: 'Policies for information security',
    implementation: 'SECURITY.md, Open_Source_Policy.md, Secure_Development_Policy.md',
    evidence: [
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/SECURITY.md',
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/Open_Source_Policy.md'
    ],
    status: 'Implemented',
    lastReview: '2026-02-16'
  },
  
  // A.8 Asset Management
  'A.8.3': {
    control: 'Handling of assets',
    implementation: 'Input validation with Zod, data classification per Data_Classification_Policy.md',
    evidence: [
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/src/validation/',
      'https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md'
    ],
    status: 'Implemented',
    lastReview: '2026-02-16'
  },
  
  'A.8.10': {
    control: 'Information deletion',
    implementation: 'LRU cache with TTL, GDPR right to erasure support',
    evidence: [
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/src/cache.ts',
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/.github/skills/gdpr-compliance/SKILL.md'
    ],
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : [
      ,
      
    ],
    : ,
    : 
  },
  
  : {
    : ,
    : ,
    : [
      ,
      ,
      
    ],
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : [
      ,
      
    ],
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : [
      ,
      
    ],
    : ,
    : 
  },
  
  : {
    : ,
    : ,
    : [
      ,
      
    ],
    : ,
    : 
  }
};


  ():  {
   implemented = .(iso27001Controls).( c. === ).;
   total = .(iso27001Controls).;
  
   ;
}

Policy Reference: Secure Development Policy Section 📜

Evidence: CIA ISO 27001 Mapping

✅ Good Pattern: NIST CSF 2.0 Function Mapping

/**
 * NIST Cybersecurity Framework 2.0 Implementation
 * 
 * Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER
 */

const nistCSF2Mapping = {
  // GOVERN (GV)
  'GV.OC-01': {
    function: 'GOVERN',
    category: 'Organizational Context',
    subcategory: 'Organizational mission, objectives, and activities are understood',
    implementation: 'ISMS policies define organizational security requirements',
    evidence: 'https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md'
  },
  
  'GV.RM-01': {
    function: 'GOVERN',
    category: 'Risk Management',
    subcategory: 'Risk management objectives are established',
    implementation: 'Threat modeling, risk register, classification framework',
    evidence: [
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/THREAT_MODEL.md',
      'https://github.com/Hack23/ISMS-PUBLIC/blob/main/Risk_Register.md'
    ]
  },
  
  // IDENTIFY (ID)
  'ID.AM-01': {
    function: 'IDENTIFY',
    category: 'Asset Management',
    subcategory: 'Physical devices and systems are inventoried',
    implementation: 'SBOM generation, dependency tracking, asset inventory',
    evidence: [
      'https://github.com/Hack23/European-Parliament-MCP-Server/releases',
      'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/package-lock.json'
    ]
  },
  
  : {
    : ,
    : ,
    : ,
    : ,
    : [
      ,
      
    ]
  },
  
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  }
};

Policy Reference: Secure Development Policy Section 📜

Evidence: Black Trigram NIST CSF Mapping

✅ Good Pattern: CIS Controls v8.1 Implementation

/**
 * CIS Controls v8.1 Safeguards
 * Implementation Groups: IG1 (Basic), IG2 (Foundational), IG3 (Organizational)
 */

const cisControlsMapping = {
  // CIS Control 1: Inventory and Control of Enterprise Assets
  '1.1': {
    control: 'Establish and Maintain Detailed Enterprise Asset Inventory',
    safeguard: 'Basic',
    ig: 'IG1',
    implementation: 'SBOM generation with CycloneDX, dependency tracking',
    evidence: 'https://github.com/Hack23/European-Parliament-MCP-Server/releases/latest/download/sbom.json'
  },
  
  // CIS Control 2: Inventory and Control of Software Assets
  '2.1': {
    control: 'Establish and Maintain Software Inventory',
    safeguard: 'Basic',
    ig: 'IG1',
    implementation: 'package.json, package-lock.json, SBOM',
    evidence: 'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/package.json'
  },
  
  '2.3': {
    control: 'Address Unauthorized Software',
    safeguard: 'Basic',
    ig: 'IG1',
    implementation: 'License scanning with FOSSA, approved license list enforcement',
    evidence: [
      'https://app.fossa.com/projects/git%2Bgithub.com%2FHack23%2FEuropean-Parliament-MCP-Server',
      'https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md#approved-licenses'
    ]
  },
  
  // CIS Control 3: Data Protection
  '3.1': {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  
  : {
    : ,
    : ,
    : ,
    : ,
    : 
  },
  
  : {
    : ,
    : ,
    : ,
    : ,
    : [
      ,
      
    ]
  }
};

Policy Reference: Secure Development Policy Section 📜

✅ Good Pattern: EU Cyber Resilience Act (CRA) Compliance

/**
 * EU Cyber Resilience Act Conformity Assessment
 * 
 * ISMS Policy: Open Source Policy Section 🛡️
 * Evidence: https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md#cra-conformity-assessment-evidence
 */

const craCompliance = {
  product: 'European Parliament MCP Server',
  classification: 'Important (Class I)',  // Based on risk assessment
  
  // Essential Requirements
  essentialRequirements: {
    security: {
      'Art. 10': {
        requirement: 'Products with digital elements shall be delivered without known exploitable vulnerabilities',
        implementation: 'CodeQL scanning, Dependabot, npm audit, OSSF Scorecard ≥7.0',
        evidence: [
          'https://github.com/Hack23/European-Parliament-MCP-Server/security/code-scanning',
          'https://securityscorecards.dev/viewer/?uri=github.com/Hack23/European-Parliament-MCP-Server'
        ]
      },
      'Art. 11': {
        requirement: 'Products shall be delivered with a secure by default configuration',
        implementation: 'Security by design, threat modeling, input validation mandatory',
        evidence: 'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/THREAT_MODEL.md'
      }
    },
    
    updates: {
      'Art. 12': {
        requirement: 'Manufacturers shall provide security updates for the expected lifetime',
        implementation: 'Dependabot automated updates, 5-year support lifecycle',
        evidence: 'https://github.com/Hack23/European-Parliament-MCP-Server/blob/main/SECURITY.md#supported-versions'
      }
    },
    
    documentation: {
      : {
        : ,
        : ,
        : 
      }
    },
    
    : {
      : {
        : ,
        : ,
        : 
      }
    }
  },
  
  
  : {
    : ,  
    : ,  
    : ,
    : {
      : ,
      : ,
      : ,
      : 
    }
  }
};

Policy Reference: Open Source Policy Section 🛡️

Anti-Patterns

❌ Bad: No Compliance Mapping

// Just code, no compliance documentation

❌ Bad: Outdated Compliance Evidence

Last compliance review: 2022  // More than 1 year old!

Evidence Portfolio

Reference Implementations

1. Citizen Intelligence Agency (CIA)

   • ISO 27001 Mapping: https://github.com/Hack23/cia/blob/master/ISO27001_MAPPING.md
   • NIST CSF: https://github.com/Hack23/cia/blob/master/NIST_CSF_MAPPING.md
   • CIS Controls: https://github.com/Hack23/cia/blob/master/CIS_CONTROLS_MAPPING.md

2. Black Trigram Game

   • Compliance Dashboard: https://github.com/Hack23/blacktrigram/blob/main/COMPLIANCE.md

3. CIA Compliance Manager

   • Multi-Framework Mapping: https://github.com/Hack23/cia-compliance-manager/blob/main/COMPLIANCE_MAPPING.md

Policy Documents

• Secure Development Policy: https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md
• Open Source Policy: https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md
• ISMS-PUBLIC Repository: https://github.com/Hack23/ISMS-PUBLIC

ISMS Compliance

This skill enforces:

• CF-001: ISO 27001:2022 control mapping
• CF-002: NIST CSF 2.0 function alignment
• CF-003: CIS Controls v8.1 safeguards
• CF-004: EU CRA conformity assessment
• CF-005: GDPR / NIS2 linkage

Policy References

Primary:

• Information Security Policy — Top-level frame for multi-standard alignment
• Hack23 ISMS-PUBLIC — Full policy portfolio

All policies contribute to compliance mapping:

• Secure Development Policy → ISO A.8.25 / A.8.28, NIST PR.PS, CIS 16
• Open Source Policy → ISO A.5.19/23, NIST ID.SC, CIS 15
• Privacy Policy → GDPR Art. 5/6/25/30, ISO A.5.34
• Access Control Policy → ISO A.5.15-18, NIST PR.AA, CIS 6
• Cryptography Policy → ISO A.8.24, NIST PR.DS, CIS 3.11
• Vulnerability Management → ISO A.8.8, NIST ID.RA/DE.CM-8, CIS 7
• Incident Response Plan → ISO A.5.24-28, NIST RS, CIS 17
• Change Management → ISO A.8.32, NIST ID.GV
• Threat Modeling → ISO A.8.27, NIST ID.RA
• Business Continuity Plan → ISO A.5.29-30, NIST RC
• Backup Recovery Policy → ISO A.8.13, NIST PR.IP-4
• AI Policy + OWASP LLM Security Policy → EU AI Act, ISO 42001 (emerging)
• Third Party Management → ISO A.5.19-22, NIST ID.SC
• Segregation of Duties Policy → ISO A.5.3, CIS 6.8