information-security-strategy

name	information-security-strategy
description	Information security strategy, risk management, security program governance, and compliance framework integration
license	Apache-2.0

Information Security Strategy Skill

🔴 AI FIRST Quality Principle

Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.

Purpose

Defines the information security strategy framework for Hack23 projects, integrating risk management with compliance requirements.

Security Strategy Pillars

1. Governance — Policies, procedures, roles
2. Risk Management — Identify, assess, treat risks
3. Compliance — ISO 27001, NIST CSF, CIS Controls
4. Operations — Monitoring, incident response
5. Assurance — Audits, testing, continuous improvement

Risk Management Process

1. Context — Scope, stakeholders, criteria
2. Assessment — Identify, analyze, evaluate risks
3. Treatment — Accept, mitigate, transfer, avoid
4. Monitoring — Continuous risk review
5. Communication — Stakeholder reporting

Compliance Framework Integration

Framework	Focus	Key Controls
ISO 27001:2022	ISMS	93 controls in 4 themes
NIST CSF 2.0	Cybersecurity	Govern, Identify, Protect, Detect, Respond, Recover
CIS Controls v8.1	Implementation	18 control groups
GDPR	Privacy	Data protection, rights
NIS2	Critical infra	Supply chain, incident reporting

Security Metrics

• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Vulnerability remediation SLA compliance
• Security training completion rate
• Audit finding closure rate

Continuous Improvement

• Regular policy reviews (annual minimum)
• Lessons learned from incidents
• Benchmark against industry standards
• Security awareness program updates
• Technology evolution tracking

Related Hack23 ISMS Policies

Strategy execution requires cross-policy alignment across the ISMS-PUBLIC suite:

Governance & Classification

• Information_Security_Policy.md — master policy: scope, roles, risk management, continuous improvement (master strategy document)
• CLASSIFICATION.md — CIA triad ratings + RTO/RPO drive control selection
• AI_Policy.md — AI governance, human-in-the-loop, agent-activity logging

Operational

• Secure_Development_Policy.md — SDLC security
• Open_Source_Policy.md — supply chain, SBOM, licence approvals
• Access_Control_Policy.md · Cryptography_Policy.md · Change_Management.md
• Threat_Modeling.md · Vulnerability_Management.md
• Incident_Response_Plan.md · Security_Metrics.md

Strategic Alignment Principle

Every strategic initiative MUST map to: (a) one or more ISMS policies, (b) measurable KPI in Security_Metrics.md, (c) at least one compliance framework (ISO 27001 / NIST CSF 2.0 / CIS Controls v8.1 / GDPR / NIS2 / EU CRA), and (d) risk-treatment action in the risk register.