compliance-checklist

# Compliance Checklist Skill ## 🔴 AI FIRST Quality Principle > **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.** ## Purpose This skill provides comprehensive guidance for multi-framework compliance alignment, demonstrating how a single set of ISMS controls can satisfy multiple international frameworks and regulatory requirements simultaneously. ## Strategic Principles ### 1. Unified Compliance Framework - **Single Control Set**: One ISMS architecture satisfies multiple frameworks - **Evidence-Based Mapping**: Traceable controls to requirements - **Continuous Compliance**: Not one-time certification - **Transparency**: Public ISMS demonstrates capability ### 2. Framework Coverage | Framework | Purpose | Key Focus | |-----------|---------|-----------| | **ISO 27001:2022** | Control backbone (Annex A) | Organizational, people, physical, technological controls | | **NIST CSF 2.0** | Risk-based framework | 6 functions (Govern, Identify, Protect, Detect, Respond, Recover) | | **CIS Controls v8.1** | Operational security | Implementation Groups (IG1, IG2, IG3) | | **NIS2 Directive** | EU cybersecurity | Governance, risk management, incident handling | | **EU CRA** | Product cybersecurity | Annex I essential requirements, Annex II critical products | | **GDPR** | Data protection | Privacy by design/default, breach notification | | **SOC 2 Type II** | Trust services | Operational effectiveness over time | | **PCI DSS v4.0** | Payment security | Cardholder data protection (SAQ A focus) | | **HIPAA** | Healthcare data | PHI safeguards (consulting readiness) | ## ISO 27001:2022 Annex A Control Mapping ### Organizational Controls (A.5) **A.5.1 Policies for Information Security** - **Implementation**: Information Security Policy - **NIST CSF 2.0**: GV.PO-01 (Policy established and communicated) - **CIS v8.1**: 14.1 (Security policy dissemination) - **Evidence**: Policy documents, version control, approval records **A.5.2 Roles & Responsibilities** - **Implementation**: Security roles defined in Information Security Policy - **NIST CSF 2.0**: GV.RR-02 (Roles and authorities established) - **CIS v8.1**: 14.3 (Document security responsibilities) - **Evidence**: Role descriptions, RACI matrix, responsibility assignments **A.5.3 Segregation of Duties** - **Implementation**: Segregation of Duties Policy with compensating controls - **NIST CSF 2.0**: PR.AC-03 (Privileged access managed) - **CIS v8.1**: 6.1 (Access workflow enforcing SoD) - **Evidence**: SoD matrix, compensating controls, audit logs **A.5.4 Management Responsibilities** - **Implementation**: Management commitment in Information Security Policy - **NIST CSF 2.0**: GV.OV-01 (Leadership supports risk management) - **CIS v8.1**: 17.1 (Designate incident handling leadership) - **Evidence**: Management review records, resource allocation **A.5.7 Threat Intelligence** - **Implementation**: Risk Register, Threat Modeling Policy - **NIST CSF 2.0**: ID.RA-04 (Threat intelligence informs risk) - **CIS v8.1**: 7.1 (Vulnerability/threat intake) - **Evidence**: Threat assessments, risk register updates **A.5.8 Security in Project Management** - **Implementation**: Secure Development Policy, Change Management - **NIST CSF 2.0**: PR.IP-01 (System development processes) - **CIS v8.1**: 16.1 (Secure application development) - **Evidence**: SDLC documentation, security requirements **A.5.9 Asset Inventory** - **Implementation**: Asset Register - **NIST CSF 2.0**: ID.AM-01 (Assets inventoried) - **CIS v8.1**: 1.1 (Enterprise asset inventory) - **Evidence**: Asset register, discovery scans **A.5.10 Acceptable Use** - **Implementation**: Acceptable Use Policy - **NIST CSF 2.0**: PR.AC-01 (Identities managed) - **CIS v8.1**: 14.1 (Security awareness including acceptable use) - **Evidence**: Policy acceptance records, training logs **A.5.12 Information Classification** - **Implementation**: Data Classification Policy, CLASSIFICATION framework - **NIST CSF 2.0**: ID.AM-03 (Data assets classified) - **CIS v8.1**: 3.4 (Data classification scheme) - **Evidence**: Classification schema, labeled assets ### People Controls (A.6) **A.6.2 Terms & Conditions of Employment** - **Implementation**: Access Control Policy, employment contracts - **NIST CSF 2.0**: GV.RR-01 (Policies for managing cybersecurity workforce) - **CIS v8.1**: 14.2 (Security awareness training) - **Evidence**: Employment agreements, security clauses **A.6.4 Access to Assets** - **Implementation**: Access Control Policy - **NIST CSF 2.0**: PR.AC-04 (Access permissions managed) - **CIS v8.1**: 6.1 (Least privilege access) - **Evidence**: Access control lists, permission reviews ### Physical Controls (A.7) **A.7.1 Physical Security Perimeters** - **Implementation**: Physical Security Policy (home office + AWS inherited controls) - **NIST CSF 2.0**: PR.AC-02 (Physical access managed) - **CIS v8.1**: 4.1 (Secure configuration baseline) - **Evidence**: Office security measures, cloud certifications ### Technological Controls (A.8) **A.8.2 Privileged Access Rights** - **Implementation**: Access Control Policy with MFA - **NIST CSF 2.0**: PR.AC-03 (Privileged access managed) - **CIS v8.1**: 6.8 (Role-based access control) - **Evidence**: MFA implementation, access reviews **A.8.3 Information Access Restriction** - **Implementation**: Access Control Policy, Network Security Policy - **NIST CSF 2.0**: PR.AC-04 (Access permissions) - **CIS v8.1**: 6.1 (Access control implementation) - **Evidence**: Firewall rules, access logs **A.8.9 Configuration Management** - **Implementation**: Change Management, Secure Development Policy - **NIST CSF 2.0**: PR.IP-01 (Configuration management) - **CIS v8.1**: 4.1 (Secure configuration) - **Evidence**: Configuration baselines, change records **A.8.10 Information Deletion** - **Implementation**: Data Classification Policy, Asset Register - **NIST CSF 2.0**: PR.DS-03 (Data disposal) - **CIS v8.1**: 3.12 (Data disposal processes) - **Evidence**: Data retention policy, disposal logs **A.8.12 Data Leak Prevention** - **Implementation**: Cryptography Policy, Network Security Policy - **NIST CSF 2.0**: PR.DS-01 (Data at rest protected) - **CIS v8.1**: 3.10 (Encrypt data in transit) - **Evidence**: Encryption implementation, DLP controls **A.8.19 Security in Development** - **Implementation**: Secure Development Policy - **NIST CSF 2.0**: PR.IP-01 (Secure development practices) - **CIS v8.1**: 16.1 (Secure development process) - **Evidence**: SAST/DAST results, code reviews **A.8.23 Web Filtering** - **Implementation**: Network Security Policy - **NIST CSF 2.0**: PR.PT-04 (Communications protected) - **CIS v8.1**: 9.2 (DNS filtering) - **Evidence**: Content filtering rules, logs **A.8.28 Secure Coding** - **Implementation**: Secure Development Policy - **NIST CSF 2.0**: PR.IP-01 (Secure coding standards) - **CIS v8.1**: 16.1 (Secure development) - **Evidence**: Coding standards, security reviews ## NIST CSF 2.0 Function Mapping ### GOVERN (GV) - **GV.PO**: Policies establish cybersecurity expectations - **GV.RR**: Roles and responsibilities defined - **GV.OV**: Leadership provides oversight - **GV.RM**: Risk management strategy implemented ### IDENTIFY (ID) - **ID.AM**: Assets inventoried and classified - **ID.RA**: Risks assessed and prioritized - **ID.IM**: Improvements identified - **ID.BE**: Business environment understood ### PROTECT (PR) - **PR.AC**: Access controls implemented - **PR.DS**: Data security measures in place - **PR.IP**: Information protection processes - **PR.PT**: Protective technology deployed ### DETECT (DE) - **DE.AE**: Anomalies detected - **DE.CM**: Continuous monitoring active - **DE.DP**: Detection processes established ### RESPOND (RS) - **RS.MA**: Response management coordinated - **RS.AN**: Incidents analyzed - **RS.CO**: Response communications managed - **RS.MI**: Mitigation activities performed ### RECOVER (RC) - **RC.RP**: Recovery planning documented - **RC.IM**: Improvements identified - **RC.CO**: Recovery communications managed ## CIS Controls v8.1 Implementation Groups ### IG1 (Basic Cyber Hygiene) - **1.1**: Inventory of Assets ✅ - **2.1**: Inventory of Software ✅ - **3.10**: Encrypt Data in Transit ✅ - **4.1**: Secure Configuration ✅ - **5.1**: Account Inventory ✅ - **6.8**: Role-Based Access Control ✅ ### IG2 (Enterprise Security) - **8.2**: Collect Audit Logs ✅ - **10.1**: Deploy Anti-Malware ✅ - **13.1**: Security Event Alerting ✅ - **16.1**: Secure Development Process ✅ ### IG3 (Advanced/Enterprise) - **7.1**: Threat Intelligence ✅ - **11.1**: Data Recovery Capability ✅ - **14.1**: Security Awareness Program ✅ - **17.1**: Incident Response Planning ✅ ## NIS2 Directive Compliance ### Article 20: Governance - Risk management measures approved by management - Business continuity plans documented - Supply chain security managed - **Evidence**: [Business Continuity Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Business_Continuity_Plan.md), [Third Party Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Third_Party_Management.md) ### Article 21: Technical/Operational Measures - Incident handling policies - Business continuity and disaster recovery - Security of network and information systems - **Evidence**: [Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md), [Network Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Network_Security_Policy.md) ### Article 23: Incident Reporting - 24-hour early warning for significant incidents - 72-hour formal notification - Progress reports and final reports - **Evidence**: [Incident Response Plan § Reporting](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md) ## EU Cyber Resilience Act (CRA) ### Annex I Essential Requirements - **Secure by Design**: Security throughout product lifecycle - **Vulnerability Management**: Handling and disclosure process - **Security Updates**: Automated update mechanisms - **Evidence**: [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md), [Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) ### Annex II Critical Products (Art. 6, 11) - Enhanced security requirements for critical products - Third-party conformity assessment - Continuous monitoring obligations - **Evidence**: [CRA Conformity Assessment Process](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CRA_Conformity_Assessment_Process.md) ## GDPR Compliance ### Core Articles - **Art. 5**: Data processing principles (lawfulness, fairness, transparency) - **Art. 25**: Data protection by design and by default - **Art. 32**: Security of processing - **Art. 33**: Breach notification (72 hours) - **Evidence**: [Data Classification Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md), [Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) ### Swedish Dataskyddslagen - Local DPA notification requirements - Swedish-specific privacy considerations - **Evidence**: [External Stakeholder Registry](https://github.com/Hack23/ISMS-PUBLIC/blob/main/External_Stakeholder_Registry.md) ## SOC 2 Type II Trust Services Criteria ### Common Criteria (CC) - **CC1.1-1.5**: Control environment - **CC2.1-2.3**: Communication and information - **CC3.1-3.4**: Risk assessment