Compliance Checklist Skill

Purpose

This skill provides comprehensive guidance for multi-framework compliance alignment, demonstrating how a single set of ISMS controls can satisfy multiple international frameworks and regulatory requirements simultaneously.

Strategic Principles

1. Unified Compliance Framework

Single Control Set: One ISMS architecture satisfies multiple frameworks
Evidence-Based Mapping: Traceable controls to requirements
Continuous Compliance: Not one-time certification
Transparency: Public ISMS demonstrates capability

2. Framework Coverage

Framework	Purpose	Key Focus
ISO 27001:2022	Control backbone (Annex A)	Organizational, people, physical, technological controls
NIST CSF 2.0	Risk-based framework	6 functions (Govern, Identify, Protect, Detect, Respond, Recover)
CIS Controls v8.1	Operational security	Implementation Groups (IG1, IG2, IG3)
NIS2 Directive	EU cybersecurity	Governance, risk management, incident handling
EU CRA	Product cybersecurity	Annex I essential requirements, Annex II critical products
GDPR	Data protection	Privacy by design/default, breach notification
SOC 2 Type II	Trust services	Operational effectiveness over time
PCI DSS v4.0	Payment security	Cardholder data protection (SAQ A focus)
HIPAA	Healthcare data	PHI safeguards (consulting readiness)

ISO 27001:2022 Annex A Control Mapping

Organizational Controls (A.5)

A.5.1 Policies for Information Security

Implementation: Information Security Policy
NIST CSF 2.0: GV.PO-01 (Policy established and communicated)
CIS v8.1: 14.1 (Security policy dissemination)
Evidence: Policy documents, version control, approval records

A.5.2 Roles & Responsibilities

Implementation: Security roles defined in Information Security Policy
NIST CSF 2.0: GV.RR-02 (Roles and authorities established)
CIS v8.1: 14.3 (Document security responsibilities)
Evidence: Role descriptions, RACI matrix, responsibility assignments

A.5.3 Segregation of Duties

Implementation: Segregation of Duties Policy with compensating controls
NIST CSF 2.0: PR.AC-03 (Privileged access managed)
CIS v8.1: 6.1 (Access workflow enforcing SoD)
Evidence: SoD matrix, compensating controls, audit logs

A.5.4 Management Responsibilities

Implementation: Management commitment in Information Security Policy
NIST CSF 2.0: GV.OV-01 (Leadership supports risk management)
CIS v8.1: 17.1 (Designate incident handling leadership)
Evidence: Management review records, resource allocation

A.5.7 Threat Intelligence

Implementation: Risk Register, Threat Modeling Policy
NIST CSF 2.0: ID.RA-04 (Threat intelligence informs risk)
CIS v8.1: 7.1 (Vulnerability/threat intake)
Evidence: Threat assessments, risk register updates

A.5.8 Security in Project Management

Implementation: Secure Development Policy, Change Management
NIST CSF 2.0: PR.IP-01 (System development processes)
CIS v8.1: 16.1 (Secure application development)
Evidence: SDLC documentation, security requirements

A.5.9 Asset Inventory

Implementation: Asset Register
NIST CSF 2.0: ID.AM-01 (Assets inventoried)
CIS v8.1: 1.1 (Enterprise asset inventory)
Evidence: Asset register, discovery scans

A.5.10 Acceptable Use

Implementation: Acceptable Use Policy
NIST CSF 2.0: PR.AC-01 (Identities managed)
CIS v8.1: 14.1 (Security awareness including acceptable use)
Evidence: Policy acceptance records, training logs

A.5.12 Information Classification

Implementation: Data Classification Policy, CLASSIFICATION framework
NIST CSF 2.0: ID.AM-03 (Data assets classified)
CIS v8.1: 3.4 (Data classification scheme)
Evidence: Classification schema, labeled assets

People Controls (A.6)

A.6.2 Terms & Conditions of Employment

Implementation: Access Control Policy, employment contracts
NIST CSF 2.0: GV.RR-01 (Policies for managing cybersecurity workforce)
CIS v8.1: 14.2 (Security awareness training)
Evidence: Employment agreements, security clauses

A.6.4 Access to Assets

Implementation: Access Control Policy
NIST CSF 2.0: PR.AC-04 (Access permissions managed)
CIS v8.1: 6.1 (Least privilege access)
Evidence: Access control lists, permission reviews

Physical Controls (A.7)

A.7.1 Physical Security Perimeters

Implementation: Physical Security Policy (home office + AWS inherited controls)
NIST CSF 2.0: PR.AC-02 (Physical access managed)
CIS v8.1: 4.1 (Secure configuration baseline)
Evidence: Office security measures, cloud certifications

Technological Controls (A.8)

A.8.2 Privileged Access Rights

Implementation: Access Control Policy with MFA
NIST CSF 2.0: PR.AC-03 (Privileged access managed)
CIS v8.1: 6.8 (Role-based access control)
Evidence: MFA implementation, access reviews

A.8.3 Information Access Restriction

Implementation: Access Control Policy, Network Security Policy
NIST CSF 2.0: PR.AC-04 (Access permissions)
CIS v8.1: 6.1 (Access control implementation)
Evidence: Firewall rules, access logs

A.8.9 Configuration Management

Implementation: Change Management, Secure Development Policy
NIST CSF 2.0: PR.IP-01 (Configuration management)
CIS v8.1: 4.1 (Secure configuration)
Evidence: Configuration baselines, change records

A.8.10 Information Deletion

Implementation: Data Classification Policy, Asset Register
NIST CSF 2.0: PR.DS-03 (Data disposal)
CIS v8.1: 3.12 (Data disposal processes)
Evidence: Data retention policy, disposal logs

A.8.12 Data Leak Prevention

Implementation: Cryptography Policy, Network Security Policy
NIST CSF 2.0: PR.DS-01 (Data at rest protected)
CIS v8.1: 3.10 (Encrypt data in transit)
Evidence: Encryption implementation, DLP controls

A.8.19 Security in Development

Implementation: Secure Development Policy
NIST CSF 2.0: PR.IP-01 (Secure development practices)
CIS v8.1: 16.1 (Secure development process)
Evidence: SAST/DAST results, code reviews

A.8.23 Web Filtering

Implementation: Network Security Policy
NIST CSF 2.0: PR.PT-04 (Communications protected)
CIS v8.1: 9.2 (DNS filtering)
Evidence: Content filtering rules, logs

A.8.28 Secure Coding

Implementation: Secure Development Policy
NIST CSF 2.0: PR.IP-01 (Secure coding standards)
CIS v8.1: 16.1 (Secure development)
Evidence: Coding standards, security reviews

NIST CSF 2.0 Function Mapping

GOVERN (GV)

GV.PO: Policies establish cybersecurity expectations
GV.RR: Roles and responsibilities defined
GV.OV: Leadership provides oversight
GV.RM: Risk management strategy implemented

IDENTIFY (ID)

ID.AM: Assets inventoried and classified
ID.RA: Risks assessed and prioritized
ID.IM: Improvements identified
ID.BE: Business environment understood

PROTECT (PR)

PR.AC: Access controls implemented
PR.DS: Data security measures in place
PR.IP: Information protection processes
PR.PT: Protective technology deployed

DETECT (DE)

DE.AE: Anomalies detected
DE.CM: Continuous monitoring active
DE.DP: Detection processes established

RESPOND (RS)

RS.MA: Response management coordinated
RS.AN: Incidents analyzed
RS.CO: Response communications managed
RS.MI: Mitigation activities performed

RECOVER (RC)

RC.RP: Recovery planning documented
RC.IM: Improvements identified
RC.CO: Recovery communications managed

CIS Controls v8.1 Implementation Groups

IG1 (Basic Cyber Hygiene)

1.1: Inventory of Assets ✅
2.1: Inventory of Software ✅
3.10: Encrypt Data in Transit ✅
4.1: Secure Configuration ✅
5.1: Account Inventory ✅
6.8: Role-Based Access Control ✅

IG2 (Enterprise Security)

8.2: Collect Audit Logs ✅
10.1: Deploy Anti-Malware ✅
13.1: Security Event Alerting ✅
16.1: Secure Development Process ✅

IG3 (Advanced/Enterprise)

7.1: Threat Intelligence ✅
11.1: Data Recovery Capability ✅
14.1: Security Awareness Program ✅
17.1: Incident Response Planning ✅

NIS2 Directive Compliance

Article 20: Governance

Risk management measures approved by management
Business continuity plans documented
Supply chain security managed
Evidence: Business Continuity Plan, Third Party Management

Article 21: Technical/Operational Measures

Incident handling policies
Business continuity and disaster recovery
Security of network and information systems
Evidence: Incident Response Plan, Network Security Policy

Article 23: Incident Reporting

24-hour early warning for significant incidents
72-hour formal notification
Progress reports and final reports
Evidence: Incident Response Plan § Reporting

EU Cyber Resilience Act (CRA)

Annex I Essential Requirements

Secure by Design: Security throughout product lifecycle
Vulnerability Management: Handling and disclosure process
Security Updates: Automated update mechanisms
Evidence: Secure Development Policy, Vulnerability Management

Annex II Critical Products (Art. 6, 11)

Enhanced security requirements for critical products
Third-party conformity assessment
Continuous monitoring obligations
Evidence: CRA Conformity Assessment Process

GDPR Compliance

Core Articles

Art. 5: Data processing principles (lawfulness, fairness, transparency)
Art. 25: Data protection by design and by default
Art. 32: Security of processing
Art. 33: Breach notification (72 hours)
Evidence: Data Classification Policy, Privacy Policy

Swedish Dataskyddslagen

Local DPA notification requirements
Swedish-specific privacy considerations
Evidence: External Stakeholder Registry

SOC 2 Type II Trust Services Criteria

Common Criteria (CC)

CC1.1-1.5: Control environment
CC2.1-2.3: Communication and information
CC3.1-3.4: Risk assessment
CC4.1-4.2: Monitoring activities
CC5.1-5.3: Control activities
CC6.1-6.8: Logical/physical access controls
CC7.1-7.5: System operations
CC8.1: Change management
CC9.1-9.2: Risk mitigation

Trust Services Categories

Security: System protected against unauthorized access
Availability: System available as committed
Processing Integrity: Processing complete, valid, accurate, timely
Confidentiality: Confidential information protected
Privacy: Personal information handled per privacy notice

PCI DSS v4.0 (SAQ A Focus)

SAQ A (Outsourced Card Processing)

Req 1-2: Network security controls (AWS CloudFront, GitHub Pages)
Req 3-4: Cardholder data protection (Stripe handles all CHD)
Req 5-6: Vulnerability management (CodeQL, Dependabot)
Req 7-8: Access controls (GitHub MFA, SSH keys, GPG signing)
Req 9: Physical security (home office, AWS data centers)
Req 10-11: Monitoring and testing (audit logs, vulnerability scanning)
Req 12: Security policies (comprehensive ISMS documented)

Key Attestation

No CHD stored, processed, or transmitted on Hack23 systems
All payment processing via Stripe (PCI DSS certified)
Annual SAQ A completion with attestation

HIPAA Security Rule (Consulting Readiness)

Administrative Safeguards (§164.308)

Risk analysis and management ✅
Information access management ✅
Security awareness training ✅
Contingency planning ✅
Evidence: Risk Assessment Methodology

Physical Safeguards (§164.310)

Facility access controls ✅
Workstation security ✅
Device and media controls ✅
Evidence: Physical Security Policy

Technical Safeguards (§164.312)

Access controls ✅
Audit controls ✅
Integrity controls ✅
Transmission security ✅
Evidence: Cryptography Policy

Note: Hack23 AB does not currently process PHI. These mappings demonstrate consulting readiness for healthcare clients.

Compliance Verification Workflow

1. Quarterly Self-Assessment

Review Compliance Checklist
Update control implementation status
Document gaps and remediation plans
Record in management review

2. Evidence Collection

Policy documents (version controlled)
Configuration files (GitHub)
Audit logs (CloudTrail, GitHub audit)
Scan results (CodeQL, Dependabot, OpenSSF Scorecard)
Test results (backup tests, DR exercises)

3. Gap Analysis

Identify missing controls
Prioritize by risk and regulatory requirement
Create remediation action items
Track in issue management system

4. Continuous Monitoring

OpenSSF Scorecard (weekly)
Dependabot alerts (real-time)
CodeQL scans (on commit)
Backup validation (daily)
Incident detection (continuous)

Audit Readiness Checklist

Before External Audit

Evidence Matrix

Control Domain	Primary Evidence	Secondary Evidence	Location
Policies	Policy documents	Approval records	GitHub repo
Access Control	MFA config, SSH keys	Access reviews	AWS IAM, GitHub
Vulnerability Mgmt	Scan results	Remediation records	CodeQL, Dependabot
Incident Response	IR plan	Incident logs	ISMS repo, GitHub Issues
BCP/DR	BCP/DR plans	Test results	ISMS repo, test logs
Change Management	Change records	Approval logs	GitHub PRs, commits
Asset Management	Asset Register	Discovery scans	ISMS repo, AWS Config
Monitoring	Audit logs	Alerting config	CloudTrail, GitHub audit

References

Hack23 ISMS Documentation

Compliance Checklist - Master compliance mapping
Information Security Policy - ISMS framework
Secure Development Policy - SDLC security
Classification Framework - Data and system classification
Risk Register - Enterprise risk management

Example Implementations

CIA Security Architecture - Full authentication implementation
CIA Compliance Manager Architecture - Frontend-only security
Riksdagsmonitor Security Architecture - Static site security

Framework References

ISO 27001:2022 - Information security management
NIST CSF 2.0 - Cybersecurity Framework
CIS Controls v8.1 - Security best practices
NIS2 Directive - EU cybersecurity requirements
EU CRA - Cyber Resilience Act

Remember

Unified Compliance: One ISMS serves multiple frameworks
Evidence-Based: Document everything, artifacts are proof
Continuous Monitoring: Compliance is ongoing, not annual
Risk-Based: Prioritize by business impact
Transparency: Public ISMS demonstrates capability
Multi-Framework: ISO + NIST + CIS + NIS2 + CRA + GDPR alignment
Audit Ready: Evidence always accessible
Gap Management: Know gaps, document remediation plans

compliance-checklist