isms-compliance

name	isms-compliance
description	Hack23 ISMS alignment — ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1, GDPR, NIS2, EU CRA — with policy citations
license	MIT

ISMS Compliance Skill

Context

Applies when adding features, dependencies, or security controls; editing security code; documenting architecture; touching CI/CD; or handling any sensitive data.

All practices align with Hack23 AB's ISMS-PUBLIC, implementing ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1, GDPR, NIS2, and EU CRA readiness.

Policy Catalogue (cite the one that applies)

Concern	Policy
Overarching governance / incident / transparency	Information Security Policy
SDLC / CI / testing / deployment / threat modeling	Secure Development Policy
Dependencies / licenses / SBOM / supply chain	Open Source Policy
Auth / identity / access	Access Control Policy
Encryption / keys / hashing	Cryptography Policy
Data handling / classification	Data Classification Policy
Personal data / GDPR	Privacy Policy
STRIDE / abuse cases / MITRE ATT&CK	Threat Modeling
Vulnerability triage + patch SLAs	Vulnerability Management
Copilot / LLM / MCP governance	AI Policy
Agent / MCP / workflow edits	Change Management
BCP / DR / backup	Business Continuity / Disaster Recovery / Backup Recovery

Rules

1. Reference ISMS Policies — security-relevant code, docs, and PRs must cite the applicable policy (e.g., "ISMS: SDP §Phase 3")
2. Defense in Depth — stack validation + sanitization + encoding + CSP + headers
3. Document Decisions — ADRs and threat models cite ISMS policies
4. Verify Dependencies — npm audit + npm run test:licenses + GitHub Advisory DB before adding
5. Security Headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options (see SECURITY_HEADERS.md)
6. Secure Defaults — unused features off; risky options explicit opt-in
7. Least Privilege — minimum token scopes, minimum workflow permissions, minimum tool scopes
8. Validate All Inputs — never trust user input (validate / sanitize / encode)
9. Encrypt Sensitive Data — AES-256 at rest, TLS 1.3+ in transit, SHA-256+ hashing
10. Log Security Events — auth, authorization failures, security-relevant events; never secrets/PII
11. Secure SDLC — security baked into design → dev → test → deploy → operate
12. Test Security Controls — ≥ 95 % coverage on security-sensitive paths
13. Patch within SLA — Critical ≤ 7 d, High ≤ 30 d, Medium ≤ 90 d
14. No Production Data in Tests — anonymize / synthesize

Secure SDLC Phase Gates (per SDP)

Phase	Gate
Plan & Design	Classification (CIA triad) + threat model + policy links
Develop	OWASP-aligned, typed, no hardcoded secrets, least-privilege tokens
Test	CodeQL clean, npm audit clean, coverage ≥ 80 / 70 (≥ 95 % security)
Deploy	SHA-pinned Actions, SLSA L3 attestations, SBOM + SBOMQS ≥ 7.0
Operate	Scorecard ≥ 8.0, Dependabot green, patch SLAs honored, incident drills

Compliance Framework Mapping

ISO 27001:2022 — A.5.23, A.5.30, A.8.25, A.8.28, A.8.29, A.8.30, A.8.31, A.8.32

NIST CSF 2.0 — GV (govern), ID.AM, PR.DS, PR.IR, DE.CM, RS.AN, RC.RP

CIS Controls v8.1 — 2, 3, 4, 6, 7, 8, 11, 16, 18

EU CRA — SBOM, CVE handling, security updates, conformity self-assessment

Example: ISMS-Cited Code

/**
 * Persist the high score.
 * ISMS: Secure Development Policy §Phase 2 — Secure Coding (input validation)
 * ISMS: Data Classification Policy — local-only, non-PII
 * Compliance: ISO 27001:2022 A.8.28, NIST CSF PR.DS-1
 */
export function saveHighScore(score: number): void {
  if (!Number.isFinite(score) || score < 0) {
    throw new RangeError('Invalid score value');
  }
  localStorage.setItem('highScore', String(Math.floor(score)));
}

Validation Checklist

• Applicable ISMS policy cited in code, commit, or PR description
• Threat model reviewed if attack surface changed (STRIDE)
• Dependency audit clean; licenses approved
• Security coverage ≥ 95 % on changed security code
• CodeQL + Scorecard + Dependabot status green
• No PII / production data in code, fixtures, or tests
• Docs updated (README / ISMS_POLICY_MAPPING.md / SECURITY.md as applicable)