isms-compliance-checking

# ISMS Compliance Checking Skill ## Purpose This skill ensures that Black Trigram maintains comprehensive compliance with Hack23 AB's Information Security Management System (ISMS), international security frameworks (ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1), and regulatory requirements (GDPR, NIS2, EU Cyber Resilience Act). ## 📚 Icon Reference Guide This skill uses standardized icons from [Hack23 ISMS Style Guide](https://github.com/Hack23/ISMS-PUBLIC/blob/main/STYLE_GUIDE.md): - 🔐 Information Security - 🛡️ Security Controls - 🔑 Access Control - 🔒 Cryptography - 🛠️ Secure Development - 📊 Compliance Framework - ✅ Approved/Compliant - ⚠️ Warning/Caution - ❌ Non-Compliant - 📋 Documentation - 🌐 Network Security - 💾 Backup & Recovery - 🏷️ Data Classification - 🔓 Open Source - 🎯 Threat Modeling - 🚨 Incident Response - 🔄 Business Continuity - 🔍 Vulnerability Management - 🤝 Third Party Management - 📱 Mobile Device Management - 🏢 Physical Security - 📝 Change Management - 💻 Asset Management - 📉 Risk Management ## When to Apply **Automatically trigger this skill when:** - Creating or modifying any code or documentation - Adding new features or components - Implementing security controls - Working with user data or authentication - Adding third-party dependencies - Updating architecture documentation - Creating pull requests - Conducting security reviews - Planning new features or systems ## 🔗 Related Skills This skill works together with other ISMS enforcement skills: - **[compliance-framework-alignment](../compliance-framework-alignment/SKILL.md)** - Multi-framework compliance mapping (ISO 27001:2022 ↔ NIST CSF 2.0 ↔ CIS Controls v8.1) - **[classification-framework-enforcement](../classification-framework-enforcement/SKILL.md)** - Security classification and Business Impact Analysis (BIA) - **[secure-development-lifecycle](../secure-development-lifecycle/SKILL.md)** - SDLC security integration and secure coding practices - **[open-source-governance](../open-source-governance/SKILL.md)** - Supply chain security (OSSF Scorecard, SLSA, SBOM) - **[threat-modeling-enforcement](../threat-modeling-enforcement/SKILL.md)** - STRIDE and MITRE ATT&CK threat analysis - **[security-architecture-validation](../security-architecture-validation/SKILL.md)** - Architecture security design and validation **Delegation Strategy:** - Use **classification-framework-enforcement** for determining security levels (Confidentiality, Integrity, Availability) - Use **compliance-framework-alignment** for cross-framework control mapping - Use **secure-development-lifecycle** for secure coding patterns and SAST/DAST - Use **threat-modeling-enforcement** for threat analysis and attack surface mapping - Use **open-source-governance** for dependency vetting and SBOM generation ## Core Principles ### ISMS Policy Coverage Complete coverage of all 35+ Hack23 ISMS-PUBLIC policies: | Policy Document | Icon | Primary Controls | Skill Reference | Status | | --------------- | ---- | ---------------- | --------------- | ------ | | **Information Security Policy** | 🔐 | A.5.1, GV.PO, CIS-1 | [compliance-framework-alignment](../compliance-framework-alignment/SKILL.md) | ✅ Core | | **Classification Framework** | 🏷️ | A.5.12, A.5.13, ID.AM-05, CIS-3 | [classification-framework-enforcement](../classification-framework-enforcement/SKILL.md) | ✅ Specialized | | **Secure Development Policy** | 🛠️ | A.8.25-33, PR.DS, CIS-16 | [secure-development-lifecycle](../secure-development-lifecycle/SKILL.md) | ✅ Specialized | | **Open Source Policy** | 🔓 | A.5.19-22, GV.SC, CIS-2 | [open-source-governance](../open-source-governance/SKILL.md) | ✅ Specialized | | **Threat Modeling** | 🎯 | A.5.7, ID.RA-03, CIS-18 | [threat-modeling-enforcement](../threat-modeling-enforcement/SKILL.md) | ✅ Specialized | | **Security Architecture** | 🏗️ | A.8.9, PR.PT-01, CIS-4 | [security-architecture-validation](../security-architecture-validation/SKILL.md) | ✅ Specialized | | **Access Control Policy** | 🔑 | A.5.15-18, A.8.2-5, PR.AC | Core | ✅ Core | | **Cryptography Policy** | 🔒 | A.8.24, PR.DS-01, PR.DS-05 | Core | ✅ Core | | **Network Security Policy** | 🌐 | A.8.20-22, PR.AC-05, CIS-12 | Core | ✅ Core | | **Vulnerability Management** | 🔍 | A.8.8, DE.CM-08, CIS-7 | Core | ✅ Core | | **Incident Response Plan** | 🚨 | A.5.24-28, RS.MA, CIS-17 | Core | ✅ Core | | **Business Continuity Plan** | 🔄 | A.5.29-30, RC.RP, CIS-11 | Core | ✅ Core | | **Data Classification Policy** | 🏷️ | A.5.12, PR.DS-02, CIS-3 | Core | ✅ Core | | **Backup Recovery Policy** | 💾 | A.8.13, PR.IP-04, RC.RP-01 | Core | ✅ Core | | **Change Management** | 📝 | A.8.32, PR.IP-03, CIS-4.7 | Core | ✅ Core | | **Asset Management Policy** | 💻 | A.5.9, ID.AM-01, CIS-1 | Core | ✅ Core | | **Risk Management Policy** | 📉 | A.5.7, GV.RM, ID.RA-01 | Core | ✅ Core | | **Third Party Management** | 🤝 | A.5.19-22, GV.SC-03 | Core | ✅ Core | | **Supplier Security** | 🔗 | A.5.19-23, GV.SC-04, CIS-15 | Core | ✅ Core | | **Mobile Device Management** | 📱 | A.6.2.1, A.8.1, PR.AC-03 | Core | ✅ Core | | **Physical Security Policy** | 🏢 | A.7.1-14, PR.AC-02 | Core | ✅ Core | | **GDPR Data Protection** | 🛡️ | A.5.34, PR.DS, GV.PO-04 | Core | ✅ Core | | **NIS2 Implementation** | 🇪🇺 | A.5.7, GV.RM, ID.RA | Core | ✅ Core | | **EU CRA Compliance** | 🇪🇺 | A.8.25-33, PR.DS, GV.PO | Core | ✅ Core | | **Privacy Impact Assessment** | 🔏 | A.5.34, PR.IP-12, GDPR-35 | Core | ✅ Core | | **Security Training Policy** | 🎓 | A.6.3, PR.AT, CIS-14 | Core | ✅ Core | | **Acceptable Use Policy** | 📋 | A.6.2, PR.AT-01 | Core | ✅ Core | | **Remote Work Policy** | 🏠 | A.6.7, A.8.1 | Core | ✅ Core | | **BYOD Policy** | 📲 | A.6.2.1, PR.AC-03 | Core | ✅ Core | | **Email Security Policy** | 📧 | A.8.5, PR.AC-07, CIS-9 | Core | ✅ Core | | **Web Security Policy** | 🌐 | A.8.23, PR.AC-05, CIS-9 | Core | ✅ Core | | **Logging & Monitoring** | 📊 | A.8.15-16, DE.CM, CIS-8 | Core | ✅ Core | | **Secure Disposal Policy** | 🗑️ | A.8.10, PR.IP-06 | Core | ✅ Core | | **Records Management** | 📁 | A.5.33, PR.IP-09 | Core | ✅ Core | | **Compliance Management** | ✅ | A.5.36, GV.OV, All | Core | ✅ Core | **Legend:** - ✅ Core: Enforced by this skill (isms-compliance-checking) - ✅ Specialized: Enforced by dedicated skill (linked) **Framework Control Notation:** - **A.X.Y**: ISO 27001:2022 Annex A controls - **XX.YY**: NIST CSF 2.0 Functions and Categories - **CIS-X**: CIS Controls v8.1 - **GDPR-X**: GDPR Articles ### 1. ISMS Policy Compliance Matrix **ALWAYS reference and comply with Hack23 ISMS policies:** ✅ **Required ISMS Policy References** ```typescript // ALWAYS document which ISMS policies apply to your changes interface ISMSPolicyReference { readonly policy: string; readonly url: string; readonly applicableControls: string[]; readonly implementationStatus: 'Compliant' | 'Partial' | 'Not Applicable'; } // Example: Authentication implementation // ... (see full reference in Hack23 ISMS) ``` ✅ **ISMS Policy Checklist for All Changes** ```markdown ## ISMS Compliance Checklist - [ ] **Information Security Policy** - General security requirements followed - [ ] **Access Control Policy** - Authentication/authorization properly implemented - [ ] **Cryptography Policy** - Encryption standards followed - [ ] **Secure Development Policy** - Security in SDLC enforced - [ ] **Vulnerability Management** - Known vulnerabilities addressed - [ ] **Change Management** - Change process followed - [ ] **Incident Management** - Incident response procedures documented - [ ] **Business Continuity** - Backup and recovery considered - [ ] **Supplier Security** - Third-party dependencies vetted - [ ] **Data Protection Policy** - User data protection enforced (GDPR) ``` ### 2. ISO 27001:2022 Control Mapping **ALWAYS map code changes to ISO 27001:2022 Annex A controls:** ✅ **ISO 27001:2022 Control Categories** ```typescript export const ISO27001_CONTROLS = { // Organizational Controls (A.5) A_5: { 'A.5.1': 'Policies for information security', 'A.5.7': 'Threat intelligence', 'A.5.23': 'Information security for cloud services', }, // People Controls (A.6) // ... (see full reference in Hack23 ISMS) ``` ✅ **ISO 27001 Compliance Validation** ```typescript // ALWAYS validate that security controls map to ISO 27001 interface ControlImplementation { readonly control: string; readonly status: 'Implemented' | 'Partial' | 'Planned' | 'Not Applicable'; readonly location: string; // File path or documentation section readonly evidence: string; readonly gaps?: string; } // ... (see full reference in Hack23 ISMS) ``` ### 3. NIST Cybersecurity Framework 2.0 Alignment **ALWAYS align with NIST CSF 2.0 Functions:** ✅ **NIST CSF 2.0 Functions and Categories** ```typescript export const NIST_CSF_2_0 = { GOVERN: { 'GV.OC': 'Organizational Context', 'GV.RM': 'Risk Management Strategy', 'GV.PO': 'Policy', 'GV.OV': 'Oversight', 'GV.SC': 'Cybersecurity Supply Chain Risk Management', }, // ... (see full reference in Hack23 ISMS) ``` ### 4. CIS Controls v8.1 Alignment **ALWAYS implement relevant CIS Controls:** ✅ **CIS Controls Critical Security Controls** ```typescript export const CIS_CONTROLS_V8_1 = { // Basic CIS Controls BASIC: [ { id: 1, name: 'Inventory and Control of Enterprise Assets' }, { id: 2, name: 'Inventory and Control of Software Assets' }, { id: 3, name: 'Data Protection' }, { id: 4, name: 'Secure Configuration of Enterprise Assets and Software' }, { id: 5, name: 'Account Management' }, { id: 6, name: 'Access Control Management' }, // ... (see full reference in Hack23 ISMS) ``` ### 5. GDPR, NIS2, and EU Cyber Resilience Act Compliance **ALWAYS ensure regulatory compliance:** ✅ **GDPR Compliance Requirements** ```typescript // ALWAYS implement GDPR principles export const GDPR_PRINCIPLES = { LAWFULNESS: 'Lawfulness, fairness and transparency', PURPOSE_LIMITATION: 'Purpose limitation', DATA_MINIMIZATION: 'Data minimisation', ACCURACY: 'Accuracy', STORAGE_LIMITATION: 'Storage limitation', INTEGRITY_CONFIDENTIALITY: 'Integrity and confidentiality', ACCOUNTABILITY: 'Accountability', // ... (see full reference in Hack23 ISMS) ``` ✅ **NIS2 Directive Requirements** ```typescript // ALWAYS implement NIS2 security measures export const NIS2_REQUIREMENTS = { RISK_MANAGEMENT: 'Risk analysis and information system security policies', INCIDENT_HANDLING: 'Incident handling and reporting', BUSINESS_CONTINUITY: 'Business continuity and disaster recovery', SUPPLY_CHAIN_SECURITY: 'Supply chain security', SECURITY_POLICIES: 'Security in network and information systems acquisition', ACCESS_CONTROL: 'Policies and procedures to assess access control', CRYPTOGRAPHY: 'Use of cryptography and encryption', // ... (see full reference in Hack23 ISMS) ``` ✅ **EU Cyber Resilience Act (CRA) Compliance** ```typescript // ALWAYS follow EU CRA essential requirements export const EU_CRA_REQUIREMENTS = { SECURITY_BY_DESIGN: 'Products with digital elements must be secure by design', VULNERABILITY_HANDLING: 'Manufacturers must handle vulnerabilities throughout lifecycle', SECURITY_UPDATES: 'Provide security updates for expected product lifetime', REPORTING_OBLIGATIONS: 'Report actively exploited vulnerabilities within 24 hours', CE_MARKING: 'Products must carry CE marking', DOCUMENTATION: 'Provide security documentation and instructions to users', } as const; // ... (see full reference in Hack23 ISMS) ``` ### 6. Supply Chain Security (OSSF Scorecard, SLSA, SBOM) **ALWAYS enforce supply chain security:** ✅ **OSSF Scorecard Requirements** ```yaml # .github/workflows/ossf-scorecard.yml name: OSSF Scorecard on: branch_protection_rule: schedule: - cron: '0 2 * * 0' # Weekly on Sunday push: branches: [main] // ... (see full reference in Hack23 ISMS) ```