compliance-framework-alignment

The full skill.

Original instructions from the publisher’s SKILL.md

# Compliance Framework Alignment Skill

## Purpose

This skill provides a unified cross-framework compliance alignment for the CIA platform, mapping controls between ISO 27001:2022, NIST CSF 2.0, CIS Controls v8, and GDPR. It enables developers and security teams to understand how a single implementation satisfies multiple compliance requirements simultaneously.

## When to Use This Skill

Apply this skill when:
- ✅ Implementing security controls that must satisfy multiple frameworks
- ✅ Preparing for compliance audits
- ✅ Documenting control implementations
- ✅ Assessing compliance gaps
- ✅ Justifying security investments to stakeholders
- ✅ Reviewing architecture changes for compliance impact
- ✅ Updating ISMS documentation

Do NOT use for:
- ❌ Detailed control implementation (use framework-specific skills)
- ❌ Risk assessment methodology (use risk-assessment-methodology)
- ❌ Incident response procedures (use incident-response)

## Framework Overview

### Frameworks in Scope

| Framework | Version | Focus | Applicability |
|---|---|---|---|
| **ISO 27001** | 2022 | ISMS certification | Mandatory — Hack23 ISMS |
| **NIST CSF** | 2.0 | Cybersecurity risk management | Recommended — best practice |
| **CIS Controls** | v8 | Prioritized cyber defense | Recommended — IG1/IG2 |
| **GDPR** | 2016/679 | Personal data protection | Mandatory — EU data processing |

### Framework Function Mapping

```
ISO 27001 Domains    ←→    NIST CSF Functions    ←→    CIS Controls IG
────────────────           ──────────────────           ──────────────
Organizational (5)   ←→    Govern (GV)            ←→    IG1: Essential
People (6)           ←→    Identify (ID)          ←→    IG2: Foundational
Physical (7)         ←→    Protect (PR)           ←→    IG3: Organizational
Technological (8)    ←→    Detect (DE)
                     ←→    Respond (RS)
                     ←→    Recover (RC)
```

## Cross-Framework Control Mapping

### Access Control

| Requirement | ISO 27001 | NIST CSF | CIS Controls | GDPR |
|---|---|---|---|---|
| Access policy | A.5.15 | PR.AA-1 | CIS 6.1 | Art. 25 |
| User authentication | A.8.5 | PR.AA-3 | CIS 6.3 | Art. 32 |
| Privileged access | A.8.2 | PR.AA-5 | CIS 6.5 | Art. 32 |
| Access review | A.5.18 | PR.AA-6 | CIS 6.2 | Art. 5(1)(f) |
| **CIA Implementation** | Spring Security RBAC, role-based views ||||

### Data Protection

| Requirement | ISO 27001 | NIST CSF | CIS Controls | GDPR |
|---|---|---|---|---|
| Data classification | A.5.12 | ID.AM-5 | CIS 3.1 | Art. 30 |
| Encryption at rest | A.8.24 | PR.DS-1 | CIS 3.11 | Art. 32 |
| Encryption in transit | A.8.24 | PR.DS-2 | CIS 3.10 | Art. 32 |
| Data retention | A.5.33 | PR.IP-6 | CIS 3.4 | Art. 5(1)(e) |
| Data minimization | A.5.31 | — | — | Art. 5(1)(c) |
| **CIA Implementation** | TLS 1.2+, RDS encryption, GDPR-compliant user data ||||

### Secure Development

| Requirement | ISO 27001 | NIST CSF | CIS Controls | GDPR |
|---|---|---|---|---|
| Secure SDLC | A.8.25 | PR.IP-12 | CIS 16.1 | Art. 25 |
| Security testing | A.8.29 | DE.CM-8 | CIS 16.4 | Art. 32 |
| Code review | A.8.28 | PR.IP-12 | CIS 16.11 | Art. 25 |
| Dependency management | A.8.19 | ID.SC-2 | CIS 16.7 | Art. 32 |
| Change management | A.8.32 | PR.IP-3 | CIS 16.3 | Art. 25 |
| **CIA Implementation** | CI/CD gates, CodeQL, OWASP DC, SonarCloud ||||

### Logging & Monitoring

| Requirement | ISO 27001 | NIST CSF | CIS Controls | GDPR |
|---|---|---|---|---|
| Audit logging | A.8.15 | DE.AE-3 | CIS 8.2 | Art. 30 |
| Log protection | A.8.15 | PR.DS-6 | CIS 8.9 | Art. 32 |
| Monitoring | A.8.16 | DE.CM-1 | CIS 8.11 | Art. 32 |
| Alerting | A.8.16 | DE.AE-4 | CIS 8.11 | Art. 33 |
| **CIA Implementation** | SLF4J + Logback, AWS CloudWatch ||||

### Incident Management

| Requirement | ISO 27001 | NIST CSF | CIS Controls | GDPR |
|---|---|---|---|---|
| Incident plan | A.5.24 | RS.MA-1 | CIS 17.1 | Art. 33 |
| Incident detection | A.5.25 | DE.AE-2 | CIS 17.3 | Art. 33 |
| Incident response | A.5.26 | RS.MA-2 | CIS 17.4 | Art. 33 |
| Lessons learned | A.5.27 | RS.IM-1 | CIS 17.8 | Art. 33(3) |
| Breach notification | A.5.26 | RS.CO-2 | CIS 17.2 | Art. 33, 34 |
| **CIA Implementation** | GitHub Security Advisories, SECURITY.md process ||||

## Compliance Gap Analysis Template

### Per-Control Assessment

```markdown
## Control: [Name]

### Framework References
- ISO 27001: [Control ID]
- NIST CSF: [Function.Category-Subcategory]
- CIS Controls: [Control ID]
- GDPR: [Article]

### Current Implementation
- **Status:** Implemented / Partial / Not Implemented
- **Implementation:** [Description]
- **Evidence:** [Where to find proof]

### Gap Assessment
- **Gap:** [What's missing]
- **Risk:** Critical / High / Medium / Low
- **Remediation:** [What needs to be done]
- **Timeline:** [When]
- **Owner:** [Who]
```

## Audit Preparation

### Evidence Collection Matrix

| Control Area | Evidence Type | Location | Format |
|---|---|---|---|
| Access Control | Security config | `SecurityConfig.java` | Code review |
| Encryption | TLS config | CloudFormation templates | Config review |
| SAST/DAST | Scan reports | GitHub Actions artifacts | Automated reports |
| Code Review | PR reviews | GitHub PR history | Audit trail |
| Dependency Scan | OWASP DC reports | CI/CD artifacts | Automated reports |
| Logging | Log config | `logback.xml` | Config review |
| Change Mgmt | Git history | GitHub commits/PRs | Automated trail |
| Testing | Coverage reports | JaCoCo/SonarCloud | Automated reports |
| Incident Mgmt | Security advisories | GitHub Security tab | Documented process |

### Audit Readiness Checklist

```
□ ISMS documentation current and approved
□ Risk assessment completed within last year
□ Security controls implemented and documented
□ Evidence artifacts collected and organized
□ Training records available
□ Incident response plan tested
□ Business continuity plan reviewed
□ Third-party security assessments completed
□ Corrective actions from previous audit closed
□ Management review conducted
```

## GDPR-Specific Requirements

### CIA Platform GDPR Obligations

| GDPR Requirement | Article | CIA Implementation |
|---|---|---|
| Lawful basis | Art. 6 | Legitimate interest (political transparency) |
| Data minimization | Art. 5(1)(c) | Collect only necessary user data |
| Purpose limitation | Art. 5(1)(b) | Political transparency analysis only |
| Storage limitation | Art. 5(1)(e) | Defined retention periods |
| Integrity & confidentiality | Art. 5(1)(f) | Encryption, access controls |
| Privacy by design | Art. 25 | Built into architecture |
| Data protection officer | Art. 37 | Assessed — not required (small org) |
| Records of processing | Art. 30 | Maintained in ISMS docs |
| Breach notification | Art. 33 | 72-hour notification process |
| Data subject rights | Art. 15-22 | Account deletion, data export |

## Decision Framework

```
Implementing a New Security Control
    │
    ├─→ Identify all applicable framework requirements
    │   └─→ Check ISO 27001, NIST CSF, CIS, GDPR mappings above
    │
    ├─→ Design control to satisfy ALL applicable frameworks
    │   └─→ One implementation, multiple compliance benefits
    │
    ├─→ Document control implementation
    │   └─→ Map to specific control IDs in each framework
    │
    ├─→ Collect evidence of implementation
    │   └─→ Automated where possible (CI/CD, logs, configs)
    │
    └─→ Verify control effectiveness
        └─→ Test, review, and audit periodically
```

## References

- [ISO 27001:2022](https://www.iso.org/standard/27001)
- [NIST CSF 2.0](https://www.nist.gov/cyberframework)
- [CIS Controls v8](https://www.cisecurity.org/controls)
- [GDPR Full Text](https://gdpr-info.eu/)
- [Hack23 ISMS Compliance Mapping](../../ISMS_COMPLIANCE_MAPPING.md)