| name | information-security-strategy |
| description | Information security strategy, risk management, security program governance, and compliance framework integration |
| license | Apache-2.0 |
Information Security Strategy Skill
🔴 AI FIRST Quality Principle
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
Purpose
Defines the information security strategy framework for Hack23 projects, integrating risk management with compliance requirements.
Security Strategy Pillars
- Governance — Policies, procedures, roles
- Risk Management — Identify, assess, treat risks
- Compliance — ISO 27001, NIST CSF, CIS Controls
- Operations — Monitoring, incident response
- Assurance — Audits, testing, continuous improvement
Risk Management Process
- Context — Scope, stakeholders, criteria
- Assessment — Identify, analyze, evaluate risks
- Treatment — Accept, mitigate, transfer, avoid
- Monitoring — Continuous risk review
- Communication — Stakeholder reporting
Compliance Framework Integration
| Framework | Focus | Key Controls |
|---|
| ISO 27001:2022 | ISMS | 93 controls in 4 themes |
| NIST CSF 2.0 | Cybersecurity | Govern, Identify, Protect, Detect, Respond, Recover |
| CIS Controls v8.1 | Implementation | 18 control groups |
| GDPR | Privacy | Data protection, rights |
| NIS2 | Critical infra | Supply chain, incident reporting |
Security Metrics
- Mean Time to Detect (MTTD)
- Mean Time to Respond (MTTR)
- Vulnerability remediation SLA compliance
- Security training completion rate
- Audit finding closure rate
Continuous Improvement
- Regular policy reviews (annual minimum)
- Lessons learned from incidents
- Benchmark against industry standards
- Security awareness program updates
- Technology evolution tracking
Related Hack23 ISMS Policies
Strategy execution requires cross-policy alignment across the ISMS-PUBLIC suite:
Governance & Classification
Operational
Strategic Alignment Principle
Every strategic initiative MUST map to: (a) one or more ISMS policies, (b) measurable KPI in Security_Metrics.md, (c) at least one compliance framework (ISO 27001 / NIST CSF 2.0 / CIS Controls v8.1 / GDPR / NIS2 / EU CRA), and (d) risk-treatment action in the risk register.
