Skip to main content
compliance-checklist Unified compliance mapping across ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1, NIS2, EU CRA, GDPR, SOC 2, PCI DSS, HIPAA
Aller à l'installation Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/Hack23/riksdagsmonitor --skill compliance-checklistLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... SOC
Basé sur la classification professionnelle SOC
name compliance-checklist description Unified compliance mapping across ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1, NIS2, EU CRA, GDPR, SOC 2, PCI DSS, HIPAA license Apache-2.0
Compliance Checklist Skill
🔴 AI FIRST Quality Principle
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
Purpose
This skill provides comprehensive guidance for multi-framework compliance alignment, demonstrating how a single set of ISMS controls can satisfy multiple international frameworks and regulatory requirements simultaneously.
Strategic Principles
1. Unified Compliance Framework
Single Control Set : One ISMS architecture satisfies multiple frameworksEvidence-Based Mapping : Traceable controls to requirementsContinuous Compliance : Not one-time certificationTransparency : Public ISMS demonstrates capability
2. Framework Coverage
Framework Purpose Key Focus ISO 27001:2022 Control backbone (Annex A) Organizational, people, physical, technological controls NIST CSF 2.0 Risk-based framework 6 functions (Govern, Identify, Protect, Detect, Respond, Recover) CIS Controls v8.1
Implementation Groups (IG1, IG2, IG3)
NIS2 Directive EU cybersecurity Governance, risk management, incident handling
EU CRA Product cybersecurity Annex I essential requirements, Annex II critical products
GDPR Data protection Privacy by design/default, breach notification
SOC 2 Type II Trust services Operational effectiveness over time
PCI DSS v4.0 Payment security Cardholder data protection (SAQ A focus)
HIPAA Healthcare data PHI safeguards (consulting readiness)
ISO 27001:2022 Annex A Control Mapping
Organizational Controls (A.5) A.5.1 Policies for Information Security
Implementation : Information Security PolicyNIST CSF 2.0 : GV.PO-01 (Policy established and communicated)CIS v8.1 : 14.1 (Security policy dissemination)Evidence : Policy documents, version control, approval records A.5.2 Roles & Responsibilities
Implementation : Security roles defined in Information Security PolicyNIST CSF 2.0 : GV.RR-02 (Roles and authorities established)CIS v8.1 : 14.3 (Document security responsibilities)Evidence : Role descriptions, RACI matrix, responsibility assignments A.5.3 Segregation of Duties
Implementation : Segregation of Duties Policy with compensating controlsNIST CSF 2.0 : PR.AC-03 (Privileged access managed)CIS v8.1 : 6.1 (Access workflow enforcing SoD)Evidence : SoD matrix, compensating controls, audit logs A.5.4 Management Responsibilities
Implementation : Management commitment in Information Security PolicyNIST CSF 2.0 : GV.OV-01 (Leadership supports risk management)CIS v8.1 : 17.1 (Designate incident handling leadership)Evidence : Management review records, resource allocation A.5.7 Threat Intelligence
Implementation : Risk Register, Threat Modeling PolicyNIST CSF 2.0 : ID.RA-04 (Threat intelligence informs risk)CIS v8.1 : 7.1 (Vulnerability/threat intake)Evidence : Threat assessments, risk register updates A.5.8 Security in Project Management
Implementation : Secure Development Policy, Change ManagementNIST CSF 2.0 : PR.IP-01 (System development processes)CIS v8.1 : 16.1 (Secure application development)Evidence : SDLC documentation, security requirements
Implementation : Asset RegisterNIST CSF 2.0 : ID.AM-01 (Assets inventoried)CIS v8.1 : 1.1 (Enterprise asset inventory)Evidence : Asset register, discovery scans
Implementation : Acceptable Use PolicyNIST CSF 2.0 : PR.AC-01 (Identities managed)CIS v8.1 : 14.1 (Security awareness including acceptable use)Evidence : Policy acceptance records, training logs A.5.12 Information Classification
Implementation : Data Classification Policy, CLASSIFICATION frameworkNIST CSF 2.0 : ID.AM-03 (Data assets classified)CIS v8.1 : 3.4 (Data classification scheme)Evidence : Classification schema, labeled assets
People Controls (A.6) A.6.2 Terms & Conditions of Employment
Implementation : Access Control Policy, employment contractsNIST CSF 2.0 : GV.RR-01 (Policies for managing cybersecurity workforce)CIS v8.1 : 14.2 (Security awareness training)Evidence : Employment agreements, security clauses
Implementation : Access Control PolicyNIST CSF 2.0 : PR.AC-04 (Access permissions managed)CIS v8.1 : 6.1 (Least privilege access)Evidence : Access control lists, permission reviews
Physical Controls (A.7) A.7.1 Physical Security Perimeters
Implementation : Physical Security Policy (home office + AWS inherited controls)NIST CSF 2.0 : PR.AC-02 (Physical access managed)CIS v8.1 : 4.1 (Secure configuration baseline)Evidence : Office security measures, cloud certifications
Technological Controls (A.8) A.8.2 Privileged Access Rights
Implementation : Access Control Policy with MFANIST CSF 2.0 : PR.AC-03 (Privileged access managed)CIS v8.1 : 6.8 (Role-based access control)Evidence : MFA implementation, access reviews A.8.3 Information Access Restriction
Implementation : Access Control Policy, Network Security PolicyNIST CSF 2.0 : PR.AC-04 (Access permissions)CIS v8.1 : 6.1 (Access control implementation)Evidence : Firewall rules, access logs A.8.9 Configuration Management
Implementation : Change Management, Secure Development PolicyNIST CSF 2.0 : PR.IP-01 (Configuration management)CIS v8.1 : 4.1 (Secure configuration)Evidence : Configuration baselines, change records A.8.10 Information Deletion
Implementation : Data Classification Policy, Asset RegisterNIST CSF 2.0 : PR.DS-03 (Data disposal)CIS v8.1 : 3.12 (Data disposal processes)Evidence : Data retention policy, disposal logs A.8.12 Data Leak Prevention
Implementation : Cryptography Policy, Network Security PolicyNIST CSF 2.0 : PR.DS-01 (Data at rest protected)CIS v8.1 : 3.10 (Encrypt data in transit)Evidence : Encryption implementation, DLP controls A.8.19 Security in Development
Implementation : Secure Development PolicyNIST CSF 2.0 : PR.IP-01 (Secure development practices)CIS v8.1 : 16.1 (Secure development process)Evidence : SAST/DAST results, code reviews
Implementation : Network Security PolicyNIST CSF 2.0 : PR.PT-04 (Communications protected)CIS v8.1 : 9.2 (DNS filtering)Evidence : Content filtering rules, logs
Implementation : Secure Development PolicyNIST CSF 2.0 : PR.IP-01 (Secure coding standards)CIS v8.1 : 16.1 (Secure development)Evidence : Coding standards, security reviews
NIST CSF 2.0 Function Mapping
GOVERN (GV)
GV.PO : Policies establish cybersecurity expectationsGV.RR : Roles and responsibilities definedGV.OV : Leadership provides oversightGV.RM : Risk management strategy implemented
IDENTIFY (ID)
ID.AM : Assets inventoried and classifiedID.RA : Risks assessed and prioritizedID.IM : Improvements identifiedID.BE : Business environment understood
PROTECT (PR)
PR.AC : Access controls implementedPR.DS : Data security measures in placePR.IP : Information protection processesPR.PT : Protective technology deployed
DETECT (DE)
DE.AE : Anomalies detectedDE.CM : Continuous monitoring activeDE.DP : Detection processes established
RESPOND (RS)
RS.MA : Response management coordinatedRS.AN : Incidents analyzedRS.CO : Response communications managedRS.MI : Mitigation activities performed
RECOVER (RC)
RC.RP : Recovery planning documentedRC.IM : Improvements identifiedRC.CO : Recovery communications managed
CIS Controls v8.1 Implementation Groups
IG1 (Basic Cyber Hygiene)
1.1 : Inventory of Assets ✅2.1 : Inventory of Software ✅3.10 : Encrypt Data in Transit ✅4.1 : Secure Configuration ✅5.1 : Account Inventory ✅6.8 : Role-Based Access Control ✅
IG2 (Enterprise Security)
8.2 : Collect Audit Logs ✅10.1 : Deploy Anti-Malware ✅13.1 : Security Event Alerting ✅16.1 : Secure Development Process ✅
IG3 (Advanced/Enterprise)
7.1 : Threat Intelligence ✅11.1 : Data Recovery Capability ✅14.1 : Security Awareness Program ✅17.1 : Incident Response Planning ✅
NIS2 Directive Compliance
Article 20: Governance
Article 21: Technical/Operational Measures
Article 23: Incident Reporting
EU Cyber Resilience Act (CRA)
Annex I Essential Requirements
Annex II Critical Products (Art. 6, 11)
GDPR Compliance
Core Articles
Art. 5 : Data processing principles (lawfulness, fairness, transparency)Art. 25 : Data protection by design and by defaultArt. 32 : Security of processingArt. 33 : Breach notification (72 hours)Evidence : Data Classification Policy , Privacy Policy
Swedish Dataskyddslagen
SOC 2 Type II Trust Services Criteria
Common Criteria (CC)
CC1.1-1.5 : Control environmentCC2.1-2.3 : Communication and informationCC3.1-3.4 : Risk assessmentCC4.1-4.2 : Monitoring activitiesCC5.1-5.3 : Control activitiesCC6.1-6.8 : Logical/physical access controlsCC7.1-7.5 : System operationsCC8.1 : Change managementCC9.1-9.2 : Risk mitigation
Trust Services Categories
Security : System protected against unauthorized accessAvailability : System available as committedProcessing Integrity : Processing complete, valid, accurate, timelyConfidentiality : Confidential information protectedPrivacy : Personal information handled per privacy notice
PCI DSS v4.0 (SAQ A Focus)
SAQ A (Outsourced Card Processing)
Req 1-2 : Network security controls (AWS CloudFront, GitHub Pages)Req 3-4 : Cardholder data protection (Stripe handles all CHD)Req 5-6 : Vulnerability management (CodeQL, Dependabot)Req 7-8 : Access controls (GitHub MFA, SSH keys, GPG signing)Req 9 : Physical security (home office, AWS data centers)Req 10-11 : Monitoring and testing (audit logs, vulnerability scanning)Req 12 : Security policies (comprehensive ISMS documented)
Key Attestation
No CHD stored, processed, or transmitted on Hack23 systems
All payment processing via Stripe (PCI DSS certified)
Annual SAQ A completion with attestation
HIPAA Security Rule (Consulting Readiness)
Administrative Safeguards (§164.308)
Risk analysis and management ✅
Information access management ✅
Security awareness training ✅
Contingency planning ✅
Evidence : Risk Assessment Methodology
Physical Safeguards (§164.310)
Technical Safeguards (§164.312)
Access controls ✅
Audit controls ✅
Integrity controls ✅
Transmission security ✅
Evidence : Cryptography Policy Note : Hack23 AB does not currently process PHI. These mappings demonstrate consulting readiness for healthcare clients.
Compliance Verification Workflow
1. Quarterly Self-Assessment
Review Compliance Checklist
Update control implementation status
Document gaps and remediation plans
Record in management review
2. Evidence Collection
Policy documents (version controlled)
Configuration files (GitHub)
Audit logs (CloudTrail, GitHub audit)
Scan results (CodeQL, Dependabot, OpenSSF Scorecard)
Test results (backup tests, DR exercises)
3. Gap Analysis
Identify missing controls
Prioritize by risk and regulatory requirement
Create remediation action items
Track in issue management system
4. Continuous Monitoring
OpenSSF Scorecard (weekly)
Dependabot alerts (real-time)
CodeQL scans (on commit)
Backup validation (daily)
Incident detection (continuous)
Audit Readiness Checklist
Before External Audit
Evidence Matrix Control Domain Primary Evidence Secondary Evidence Location Policies Policy documents Approval records GitHub repo Access Control MFA config, SSH keys Access reviews AWS IAM, GitHub Vulnerability Mgmt Scan results Remediation records CodeQL, Dependabot Incident Response IR plan Incident logs ISMS repo, GitHub Issues BCP/DR BCP/DR plans Test results ISMS repo, test logs Change Management Change records Approval logs GitHub PRs, commits Asset Management Asset Register Discovery scans ISMS repo, AWS Config Monitoring Audit logs Alerting config CloudTrail, GitHub audit
References
Hack23 ISMS Documentation
Example Implementations
Framework References
Remember
Unified Compliance : One ISMS serves multiple frameworksEvidence-Based : Document everything, artifacts are proofContinuous Monitoring : Compliance is ongoing, not annualRisk-Based : Prioritize by business impactTransparency : Public ISMS demonstrates capabilityMulti-Framework : ISO + NIST + CIS + NIS2 + CRA + GDPR alignmentAudit Ready : Evidence always accessibleGap Management : Know gaps, document remediation plans 