Hack23 ISMS Compliance Skill

Purpose

Ensure all Hack23 organization projects comply with the Information Security Management System (ISMS) requirements. Covers ISO 27001:2022, NIST CSF 2.0, CIS Controls v8, NIS2, and GDPR compliance across the development lifecycle. Provides actionable guidance for audit preparation and policy enforcement.

When to Use

• ✅ Starting new projects or repositories under Hack23
• ✅ Preparing for internal or external security audits
• ✅ Reviewing compliance status of existing projects
• ✅ Implementing security controls for new features
• ✅ Creating or updating security policies and procedures
• ✅ Responding to security incidents

Do NOT use for:

• ❌ Specific code-level security patterns (use secure-code-review skill)
• ❌ Threat modeling exercises (use threat-modeling skill)
• ❌ Infrastructure security (use aws-cloudwatch-monitoring skill)

ISMS Framework Overview

┌─────────────────────────────────────────────────────────┐
│                  Hack23 ISMS Framework                   │
├─────────────────────────────────────────────────────────┤
│                                                         │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │ ISO 27001    │  │ NIST CSF 2.0 │  │ CIS Controls │  │
│  │ :2022        │  │              │  │ v8           │  │
│  │ 93 Controls  │  │ 6 Functions  │  │ 18 Controls  │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
│                                                         │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │ NIS2         │  │ GDPR         │  │ EU CRA       │  │
│  │ Directive    │  │              │  │              │  │
│  │              │  │ Data Privacy │  │ Cyber        │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
│                                                         │
│  Reference: github.com/Hack23/ISMS-PUBLIC               │
└─────────────────────────────────────────────────────────┘

Compliance Checklist Per Repository

Mandatory Documents

Required GitHub Settings

• Branch protection on main — require PR reviews
• Secret scanning enabled with push protection
• Dependabot alerts enabled for all ecosystems
• Code scanning (CodeQL) enabled
• OSSF Scorecard action configured
• Signed commits required (recommended)

Required CI/CD Controls

• OWASP Dependency Check in pipeline
• SAST scanning (CodeQL or SonarCloud)
• License compliance check
• SBOM generation (CycloneDX)
• Container scanning (if applicable)

ISO 27001:2022 Control Mapping

Key Controls for Development

NIST CSF 2.0 Mapping

GDPR Compliance for Political Data

Data Classification

GDPR Requirements Checklist

• Data Processing Register maintained
• Privacy Impact Assessment for new features
• Data retention periods defined and enforced
• Right to erasure implemented for user data
• Data breach notification procedure documented
• Third-party data processor agreements in place

Audit Preparation Guide

Pre-Audit Checklist

1. Documentation Review

   • All mandatory documents up to date
   • Architecture diagrams current
   • Risk register reviewed within 90 days

2. Technical Controls Verification

   • Run full security scan suite
   • Verify all CI/CD security gates active
   • Check dependency vulnerability status
   • Review access control configuration

3. Evidence Collection

   # Generate compliance evidence
   mvn dependency-check:check           # Vulnerability scan
   mvn org.cyclonedx:cyclonedx-maven-plugin:makeBom  # SBOM
   mvn site                             # Project reports
   

4. Metrics Preparation

   • Mean time to remediate vulnerabilities
   • Code coverage percentages
   • Open security issue count and age
   • Dependency update compliance rate

Policy Enforcement

Automated Enforcement

# Branch protection rules (enforce via GitHub API)
protection:
  required_reviews: 1
  dismiss_stale_reviews: true
  require_code_owner_reviews: true
  required_status_checks:
    - "build"
    - "codeql"
    - "dependency-check"
  enforce_admins: true

Manual Review Requirements

Incident Response Alignment

When a security incident occurs:

1. Detect — CodeQL alerts, Dependabot alerts, manual report via SECURITY.md
2. Contain — Disable affected component, revoke compromised credentials
3. Eradicate — Fix vulnerability, update dependencies
4. Recover — Deploy fix, verify resolution
5. Lessons Learned — Update threat model, create ADR if architectural change needed

ISMS Reference

The authoritative ISMS documentation is maintained at:

• Repository: github.com/Hack23/ISMS-PUBLIC
• Secure Development Policy: Secure_Development_Policy.md
• Key Management Policy: Key_Management_Policy.md
• Access Control Policy: Access_Control_Policy.md

All Hack23 projects must align with these organization-wide policies.