hack23-isms-compliance

The full skill.

Original instructions from the publisher’s SKILL.md

# Hack23 ISMS Compliance Skill

## Purpose

Ensure all Hack23 organization projects comply with the Information Security Management System (ISMS) requirements. Covers ISO 27001:2022, NIST CSF 2.0, CIS Controls v8, NIS2, and GDPR compliance across the development lifecycle. Provides actionable guidance for audit preparation and policy enforcement.

## When to Use

- ✅ Starting new projects or repositories under Hack23
- ✅ Preparing for internal or external security audits
- ✅ Reviewing compliance status of existing projects
- ✅ Implementing security controls for new features
- ✅ Creating or updating security policies and procedures
- ✅ Responding to security incidents

Do NOT use for:
- ❌ Specific code-level security patterns (use secure-code-review skill)
- ❌ Threat modeling exercises (use threat-modeling skill)
- ❌ Infrastructure security (use aws-cloudwatch-monitoring skill)

## ISMS Framework Overview

```
┌─────────────────────────────────────────────────────────┐
│                  Hack23 ISMS Framework                   │
├─────────────────────────────────────────────────────────┤
│                                                         │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │ ISO 27001    │  │ NIST CSF 2.0 │  │ CIS Controls │  │
│  │ :2022        │  │              │  │ v8           │  │
│  │ 93 Controls  │  │ 6 Functions  │  │ 18 Controls  │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
│                                                         │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │ NIS2         │  │ GDPR         │  │ EU CRA       │  │
│  │ Directive    │  │              │  │              │  │
│  │              │  │ Data Privacy │  │ Cyber        │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
│                                                         │
│  Reference: github.com/Hack23/ISMS-PUBLIC               │
└─────────────────────────────────────────────────────────┘
```

## Compliance Checklist Per Repository

### Mandatory Documents

| Document | Status | Description |
|----------|--------|-------------|
| `SECURITY.md` | Required | Security policy and vulnerability reporting |
| `SECURITY_ARCHITECTURE.md` | Required | Security architecture documentation |
| `THREAT_MODEL.md` | Required | Threat model using STRIDE framework |
| `LICENSE.txt` | Required | Apache 2.0 license file |
| `CODEOWNERS` | Required | Code ownership and review requirements |
| `CODE_OF_CONDUCT.md` | Required | Community standards |

### Required GitHub Settings

- [ ] Branch protection on `main` — require PR reviews
- [ ] Secret scanning enabled with push protection
- [ ] Dependabot alerts enabled for all ecosystems
- [ ] Code scanning (CodeQL) enabled
- [ ] OSSF Scorecard action configured
- [ ] Signed commits required (recommended)

### Required CI/CD Controls

- [ ] OWASP Dependency Check in pipeline
- [ ] SAST scanning (CodeQL or SonarCloud)
- [ ] License compliance check
- [ ] SBOM generation (CycloneDX)
- [ ] Container scanning (if applicable)

## ISO 27001:2022 Control Mapping

### Key Controls for Development

| Control ID | Control Name | Implementation |
|------------|-------------|----------------|
| A.5.1 | Policies for information security | `SECURITY.md`, ISMS policies |
| A.8.4 | Access to source code | GitHub branch protection, CODEOWNERS |
| A.8.9 | Configuration management | Infrastructure as Code, version control |
| A.8.25 | Secure development lifecycle | CI/CD pipeline with security gates |
| A.8.26 | Application security requirements | Input validation, OWASP Top 10 |
| A.8.28 | Secure coding | Code review, SAST scanning |
| A.8.31 | Separation of environments | Dev/staging/prod separation |
| A.8.33 | Test information | No production data in test environments |

## NIST CSF 2.0 Mapping

| Function | Category | CIA Platform Implementation |
|----------|----------|----------------------------|
| **Identify** | Asset Management | Repository inventory, SBOM |
| **Protect** | Access Control | Spring Security, RBAC |
| **Protect** | Data Security | Encryption, input validation |
| **Detect** | Continuous Monitoring | CodeQL, Dependabot, OSSF |
| **Respond** | Incident Response | `SECURITY.md` reporting process |
| **Recover** | Recovery Planning | Backup procedures, DR plans |

## GDPR Compliance for Political Data

### Data Classification

| Category | Examples | Handling |
|----------|----------|----------|
| Public political data | Votes, speeches, motions | Open access, no restrictions |
| Politician profiles | Name, party, committee | Public figure exception applies |
| User accounts | Email, preferences | Minimize, encrypt, consent required |
| Analytics data | Usage patterns | Anonymize, aggregate |

### GDPR Requirements Checklist

- [ ] Data Processing Register maintained
- [ ] Privacy Impact Assessment for new features
- [ ] Data retention periods defined and enforced
- [ ] Right to erasure implemented for user data
- [ ] Data breach notification procedure documented
- [ ] Third-party data processor agreements in place

## Audit Preparation Guide

### Pre-Audit Checklist

1. **Documentation Review**
   - All mandatory documents up to date
   - Architecture diagrams current
   - Risk register reviewed within 90 days

2. **Technical Controls Verification**
   - Run full security scan suite
   - Verify all CI/CD security gates active
   - Check dependency vulnerability status
   - Review access control configuration

3. **Evidence Collection**
   ```bash
   # Generate compliance evidence
   mvn dependency-check:check           # Vulnerability scan
   mvn org.cyclonedx:cyclonedx-maven-plugin:makeBom  # SBOM
   mvn site                             # Project reports
   ```

4. **Metrics Preparation**
   - Mean time to remediate vulnerabilities
   - Code coverage percentages
   - Open security issue count and age
   - Dependency update compliance rate

## Policy Enforcement

### Automated Enforcement

```yaml
# Branch protection rules (enforce via GitHub API)
protection:
  required_reviews: 1
  dismiss_stale_reviews: true
  require_code_owner_reviews: true
  required_status_checks:
    - "build"
    - "codeql"
    - "dependency-check"
  enforce_admins: true
```

### Manual Review Requirements

| Change Type | Reviewer | Approval |
|-------------|----------|----------|
| Security policy | Security lead | Required |
| Architecture change | Tech lead | Required |
| New dependency | Any reviewer | Required + security scan |
| CI/CD pipeline | DevOps + Security | Both required |
| Data model change | Tech lead | Required |

## Incident Response Alignment

When a security incident occurs:

1. **Detect** — CodeQL alerts, Dependabot alerts, manual report via `SECURITY.md`
2. **Contain** — Disable affected component, revoke compromised credentials
3. **Eradicate** — Fix vulnerability, update dependencies
4. **Recover** — Deploy fix, verify resolution
5. **Lessons Learned** — Update threat model, create ADR if architectural change needed

## ISMS Reference

The authoritative ISMS documentation is maintained at:
- **Repository**: `github.com/Hack23/ISMS-PUBLIC`
- **Secure Development Policy**: `Secure_Development_Policy.md`
- **Key Management Policy**: `Key_Management_Policy.md`
- **Access Control Policy**: `Access_Control_Policy.md`

All Hack23 projects must align with these organization-wide policies.