compliance-framework-alignment

# Compliance Framework Alignment Skill ## Purpose This skill ensures Black Trigram maintains comprehensive alignment with Hack23 AB's compliance framework, implementing ISO 27001:2022 controls, NIST Cybersecurity Framework 2.0 functions, and CIS Controls v8.1 safeguards through systematic evidence collection and documentation. **Core Reference**: [Hack23 ISMS Compliance Checklist](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Compliance_Checklist.md) ## When to Apply **Automatically trigger this skill when:** - Implementing security controls or features - Creating or modifying security documentation - Conducting security reviews or audits - Adding compliance evidence to documentation - Updating architecture or data models - Planning security improvements or roadmap - Reviewing pull requests with security implications ## Core Principles ### 1. Multi-Framework Unified Compliance **ALWAYS maintain alignment across all three frameworks simultaneously:** ✅ **Compliance Triad Pattern** ```typescript interface ComplianceMapping { readonly feature: string; readonly iso27001Controls: string[]; // A.X.Y format readonly nistCsfFunctions: string[]; // GV.XX, ID.XX, PR.XX, etc. readonly cisControls: number[]; // Control numbers 1-18 readonly implementation: string; readonly evidence: string; readonly status: 'Implemented' | 'Partial' | 'Planned' | 'Not Applicable'; } // Example: Authentication system compliance const authCompliance: ComplianceMapping = { feature: 'JWT Authentication System', iso27001Controls: ['A.5.15', 'A.5.16', 'A.8.2', 'A.8.3', 'A.8.5'], nistCsfFunctions: ['PR.AC-01', 'PR.AC-07', 'PR.DS-02', 'DE.CM-03'], cisControls: [5, 6, 16], implementation: 'JWT tokens with secure storage, role-based access control', evidence: 'src/auth/AuthProvider.tsx, SECURITY_ARCHITECTURE.md#3.2', status: 'Implemented', }; ``` ### 2. ISO 27001:2022 Annex A Control Mapping **Reference**: [Information Security Policy §📊 Document Integration Matrix](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) ✅ **ISO 27001:2022 Control Categories** ```typescript export const ISO27001_2022_CONTROLS = { // Organizational Controls (A.5) A_5: { 'A.5.1': 'Policies for information security', 'A.5.7': 'Threat intelligence', 'A.5.10': 'Acceptable use of information and other associated assets', 'A.5.12': 'Classification of information', 'A.5.13': 'Labelling of information', 'A.5.14': 'Information transfer', 'A.5.15': 'Access control', 'A.5.16': 'Identity management', 'A.5.17': 'Authentication information', 'A.5.18': 'Access rights', 'A.5.23': 'Information security for use of cloud services', }, // People Controls (A.6) A_6: { 'A.6.1': 'Screening', 'A.6.2': 'Terms and conditions of employment', 'A.6.3': 'Information security awareness, education and training', 'A.6.4': 'Disciplinary process', 'A.6.5': 'Responsibilities after termination or change of employment', 'A.6.8': 'Information security event reporting', }, // Physical Controls (A.7) A_7: { 'A.7.1': 'Physical security perimeters', 'A.7.2': 'Physical entry', 'A.7.3': 'Securing offices, rooms and facilities', 'A.7.4': 'Physical security monitoring', }, // Technological Controls (A.8) A_8: { 'A.8.1': 'User endpoint devices', 'A.8.2': 'Privileged access rights', 'A.8.3': 'Information access restriction', 'A.8.4': 'Access to source code', 'A.8.5': 'Secure authentication', 'A.8.6': 'Capacity management', 'A.8.9': 'Configuration management', 'A.8.10': 'Information deletion', 'A.8.23': 'Web filtering', 'A.8.24': 'Use of cryptography', }, } as const; // ALWAYS map features to specific controls interface ISO27001Implementation { readonly control: string; readonly requirement: string; readonly implementation: string; readonly evidence: string[]; readonly testCoverage: string; readonly gaps?: string; } const cryptoImplementation: ISO27001Implementation = { control: 'A.8.24', requirement: 'Use of cryptography', implementation: 'Web Crypto API with AES-256-GCM for sensitive data', evidence: [ 'src/utils/crypto.ts', 'SECURITY_ARCHITECTURE.md section 4.2', 'Cryptography Policy alignment documented', ], testCoverage: 'src/utils/__tests__/crypto.test.ts', gaps: undefined, }; ``` ### 3. NIST Cybersecurity Framework 2.0 Functions **Reference**: [Compliance Checklist - NIST CSF 2.0 Section](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Compliance_Checklist.md) ✅ **NIST CSF 2.0 Complete Framework** ```typescript export const NIST_CSF_2_0 = { // GOVERN: Establish and monitor cybersecurity governance GOVERN: { 'GV.OC': 'Organizational Context - Mission, stakeholder expectations understood', 'GV.RM': 'Risk Management Strategy - Priorities, constraints, risk tolerances established', 'GV.RR': 'Roles, Responsibilities, and Authorities - Defined and communicated', 'GV.PO': 'Policy - Organizational cybersecurity policy established', 'GV.OV': 'Oversight - Results of risk management activities reviewed', 'GV.SC': 'Cybersecurity Supply Chain Risk Management - Established and managed', }, // IDENTIFY: Understand cybersecurity risks IDENTIFY: { 'ID.AM': 'Asset Management - Physical devices and systems inventoried', 'ID.RA': 'Risk Assessment - Risks identified and documented', 'ID.IM': 'Improvement - Improvements identified from activities', }, // PROTECT: Implement safeguards PROTECT: { 'PR.AA': 'Identity Management, Authentication and Access Control', 'PR.AT': 'Awareness and Training', 'PR.DS': 'Data Security', 'PR.PS': 'Platform Security - Hardware, software protected', 'PR.IR': 'Technology Infrastructure Resilience', }, // DETECT: Find and analyze cybersecurity events DETECT: { 'DE.AE': 'Adverse Event Analysis', 'DE.CM': 'Security Continuous Monitoring', }, // RESPOND: Take action regarding detected cybersecurity incidents RESPOND: { 'RS.MA': 'Incident Management', 'RS.AN': 'Incident Analysis', 'RS.MI': 'Incident Mitigation', 'RS.RP': 'Incident Reporting', }, // RECOVER: Restore capabilities or services impaired RECOVER: { 'RC.RP': 'Recovery Planning', 'RC.IM': 'Incident Recovery Plan Execution', 'RC.CO': 'Incident Recovery Communication', }, } as const; // Example: Map vital point system to NIST CSF 2.0 interface NISTCSFMapping { readonly feature: string; readonly function: keyof typeof NIST_CSF_2_0; readonly categories: string[]; readonly rationale: string; readonly evidence: string; } const vitalPointMapping: NISTCSFMapping = { feature: '70 Vital Points Anatomical Targeting System', function: 'PROTECT', categories: ['PR.DS-01', 'PR.DS-05', 'PR.DS-06', 'PR.PS-01'], rationale: 'Input validation, data integrity, secure configuration', evidence: 'src/combat/VitalPointSystem.ts, DATA_MODEL.md#vital-points', }; ``` ### 4. CIS Controls v8.1 Implementation **Reference**: [Compliance Checklist - CIS Controls v8.1 Section](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Compliance_Checklist.md) ✅ **CIS Controls v8.1 Complete Framework** ```typescript export const CIS_CONTROLS_V8_1 = { // Implementation Groups (IG1, IG2, IG3) BASIC: [ { id: 1, name: 'Inventory and Control of Enterprise Assets', ig: 1 }, { id: 2, name: 'Inventory and Control of Software Assets', ig: 1 }, { id: 3, name: 'Data Protection', ig: 1 }, { id: 4, name: 'Secure Configuration of Enterprise Assets and Software', ig: 1 }, { id: 5, name: 'Account Management', ig: 1 }, { id: 6, name: 'Access Control Management', ig: 1 }, ], FOUNDATIONAL: [ { id: 7, name: 'Continuous Vulnerability Management', ig: 2 }, { id: 8, name: 'Audit Log Management', ig: 2 }, { id: 9, name: 'Email and Web Browser Protections', ig: 2 }, { id: 10, name: 'Malware Defenses', ig: 2 }, { id: 11, name: 'Data Recovery', ig: 2 }, { id: 12, name: 'Network Infrastructure Management', ig: 2 }, { id: 13, name: 'Network Monitoring and Defense', ig: 2 }, { id: 14, name: 'Security Awareness and Skills Training', ig: 2 }, { id: 15, name: 'Service Provider Management', ig: 2 }, { id: 16, name: 'Application Software Security', ig: 2 }, ], ORGANIZATIONAL: [ { id: 17, name: 'Incident Response Management', ig: 3 }, { id: 18, name: 'Penetration Testing', ig: 3 }, ], } as const; // Example: Three.js rendering security aligns with CIS Control 16 interface CISControlMapping { readonly control: number; readonly safeguard: string; readonly implementation: string; readonly evidence: string; readonly automationLevel: 'Manual' | 'Semi-Automated' | 'Fully Automated'; } const appSecurityMapping: CISControlMapping = { control: 16, safeguard: '16.6 - Establish and Maintain a Secure Application Development Process', implementation: 'Secure SDLC with CodeQL, Dependabot, OSSF Scorecard monitoring', evidence: '.github/workflows/codeql.yml, Secure_Development_Policy.md', automationLevel: 'Fully Automated', }; ``` ### 5. Evidence Documentation Requirements **ALWAYS provide concrete evidence for compliance claims:** ✅ **Evidence Collection Pattern** ```typescript interface ComplianceEvidence { readonly control: string; readonly framework: 'ISO 27001' | 'NIST CSF 2.0' | 'CIS Controls v8.1'; readonly evidenceType: 'Documentation' | 'Implementation' | 'Testing' | 'Monitoring'; readonly location: string; readonly description: string; readonly verifiable: boolean; readonly lastVerified: string; // ISO 8601 date } // Example: Compliance evidence for Korean theming const themingEvidence: ComplianceEvidence[] = [ { control: 'A.8.9', framework: 'ISO 27001', evidenceType: 'Documentation', location: 'korean-theming-standards/SKILL.md', description: 'Configuration management standards for Korean color constants', verifiable: true, lastVerified: '2026-02-10', }, { control: 'PR.PS-01', framework: 'NIST CSF 2.0', evidenceType: 'Implementation', location: 'src/types/constants.ts KOREAN_COLORS', description: 'Secure configuration of UI color palette', verifiable: true, lastVerified: '2026-02-10', }, { control: 16, framework: 'CIS Controls v8.1', evidenceType: 'Testing', location: 'src/__tests__/constants.test.ts', description: 'Test coverage for configuration constants', verifiable: true, lastVerified: '2026-02-10', }, ]; ``` ### 6. Compliance Checklist Integration **Reference all applicable controls in PR descriptions:** ✅ **PR Compliance Template** ```markdown ## Compliance Framework Alignment ### ISO 27001:2022 Controls - [ ] **A.5.12** - Classification of information - [ ] **A.8.9** - Configuration management - [ ] **A.14.2.1** - Secure development policy ### NIST CSF 2.0 Functions - [ ] **PR.DS-01** - Data-at-rest is protected - [ ] **PR.PS-01** - Configuration management processes established - [ ] **DE.CM-07** - Monitoring for unauthorized activity performed ### CIS Controls v8.1 - [ ] **Control 3** - Data Protection - [ ] **Control 4** - Secure Configuration - [ ] **Control 16** - Application Software Security ### Evidence References - Implementation: `src/path/to/file.ts` - Documentation: `SECURITY_ARCHITECTURE.md section X.Y` - Tests: `src/__tests__/file.test.ts` ### Compliance Status - **Status**: [Implemented / Partial / Planned] - **Gaps**: [None / List any gaps] - **Next Steps**: [Any follow-up actions] ``` ## Enforcement Rules ### Rule 1: All Security Features Must Map to All Three Frameworks ``` IF (implementing security feature OR control) THEN (map to ISO 27001 AND NIST CSF 2.0 AND CIS Controls v8.1) ELSE (reject - incomplete compliance mapping) ``` ### Rule 2: Evidence Must Be Verifiable and Current