Compliance Checklist Skill

Purpose

This skill provides comprehensive multi-framework compliance verification aligned with Hack23 AB's ISMS architecture. It enables systematic assessment of security controls across eight major frameworks simultaneously, demonstrating that robust ISMS design becomes a competitive advantage for cybersecurity consulting services.

When to Use This Skill

Apply this skill when:

• ✅ Conducting quarterly ISMS compliance reviews
• ✅ Preparing for ISO 27001 certification audits
• ✅ Responding to client due diligence requests
• ✅ Validating control implementation status
• ✅ Creating compliance evidence packages
• ✅ Mapping new controls to multiple frameworks
• ✅ Updating Statement of Applicability (SOA)
• ✅ Assessing regulatory readiness (NIS2, CRA, GDPR)

Do NOT use for:

• ❌ Specific technical vulnerability assessments (use vulnerability-management skill)
• ❌ Code security reviews (use secure-code-review skill)
• ❌ Incident response procedures (use incident-response skill)

Multi-Framework Alignment Architecture

mindmap
  root(("✅ ISMS Compliance"))
    ISO_27001_2022(("🔵 ISO 27001:2022"))
      A5_Organizational(("🟢 A.5 Organizational"))
      A6_People(("🟡 A.6 People"))
      A7_Physical(("🟢 A.7 Physical"))
      A8_Technological(("🟢 A.8 Technological"))
    NIST_CSF_2_0(("🔵 NIST CSF 2.0"))
      NIST_Govern(("🟢 Govern"))
      NIST_Protect(("🟢 Protect"))
      NIST_Detect(("🟢 Detect"))
      NIST_Respond(("🟢 Respond"))
    CIS_Controls_v8_1(("🔵 CIS Controls v8.1"))
      CIS_IG1(("🟢 IG1 Basic"))
      CIS_IG2(("🟢 IG2 Advanced"))
    NIS2(("🔵 NIS2 Directive"))
      NIS2_Art20(("🟢 Governance"))
      NIS2_Art21(("🟢 Risk Mgmt"))
    EU_CRA(("🔵 EU CRA"))
      CRA_Annex1(("🟢 Essential Reqs"))
    GDPR(("🔵 GDPR"))
      GDPR_Core(("🟢 Core Articles"))

ISO 27001:2022 Control Verification

A.5 Organizational Controls Priority Matrix

Control	Hack23 Policy/Evidence	Status	NIST CSF	CIS v8.1
A.5.1 Policies for information security	Information Security Policy	✅ Implemented	GV.PO-01	14.1
A.5.2 Roles & responsibilities	Information Security Policy § Roles	✅ Implemented	GV.RR-02	14.3
A.5.3 Segregation of duties	Segregation of Duties Policy	✅ Implemented	PR.AC-03	6.1
A.5.7 Threat intelligence	Risk Register • Threat Modeling	✅ Implemented	ID.RA-04	7.1
A.5.8 Security in project mgmt	Secure Development Policy • Change Management	✅ Implemented	PR.IP-01	16.1

Hack23 ISMS Policy References

Comprehensive Compliance Documentation:

• Compliance Checklist - Complete multi-framework mapping
• Information Security Policy - Master governance framework
• Information Security Strategy - Strategic security planning

All Hack23 ISMS Policies: https://github.com/Hack23/ISMS-PUBLIC