How hack23/isms-public works
1. Repository role
- This is not an application runtime repo; it is the public documentation backbone for Hack23 AB’s ISMS.
- The repository’s main artifact is a structured set of Markdown policies, plans, registers, and dashboards that together define governance and evidence for security management.
2. Top-level architecture
- The repo is organized around a hierarchy from strategy to operations:
- strategic policies and governance
- risk/compliance artifacts
- operational resilience and incident handling
- technical security controls
- supporting quality and transparency documents
- The README’s document hierarchy is the best source for diagramming the overall ISMS structure.
3. Strategic and governance layer
- Core root documents include Information Security Policy, Information Security Strategy, and CLASSIFICATION.
- These define the security model, decision criteria, and how control selection is driven by business impact and confidentiality classification.
- This layer acts as the policy source of truth for the rest of the repository.
4. Risk and compliance layer
- Risk_Register, Risk_Assessment_Methodology, Compliance_Checklist, Threat_Modeling, and External_Stakeholder_Registry form the governance control plane.
- They connect framework mapping (ISO 27001, NIST CSF, CIS Controls) to identified risks and external obligations.
- The compliance checklist is the main cross-reference document for audit evidence.
5. Operational security layer
- Incident_Response_Plan, Business_Continuity_Plan, Disaster_Recovery_Plan, and Change_Management define how the organization handles disruption and security events.
- Backup_Recovery_Policy and Segregation_of_Duties_Policy support resilience in a single-person operating model.
- This layer is where policy becomes operating procedure.
6. Technical control layer
- Access_Control_Policy, Cryptography_Policy, Network_Security_Policy, Secure_Development_Policy, Vulnerability_Management, Data_Classification_Policy, and Mobile_Device_Management_Policy specify concrete control domains.
- These are the documents you would treat as technical safeguards in the architecture diagram.
- They encode the repo’s practical security boundaries: identity, endpoint, network, code, data, and cryptographic protection.
7. Supplier, partnership, and open-source boundary
- Third_Party_Management, SUPPLIER, Partnership_Framework, and Open_Source_Policy define the external dependency boundary.
- The repo explicitly treats suppliers, partners, and open-source components as managed risk surfaces.
- This is important because the ISMS spans the company’s own operations plus its ecosystem of software and service dependencies.
8. Metrics and health monitoring
- Security_Metrics and ISMS_METRICS_DASHBOARD provide the reporting plane.
- The dashboards track document status, review cycles, compliance coverage, and policy health.
- In architecture terms, these are the observable outputs fed by the underlying policy corpus and review metadata.
9. Quality, transparency, and document control
- STYLE_GUIDE, ISMS_QA_CHECKLIST, and ISMS_Transparency_Plan establish documentation standards and public disclosure rules.
- The repository is intentionally public for a large portion of its content, with sensitive items redacted.
- This creates a clear boundary between public evidence and confidential operational details.
10. Automation and validation
- GitHub Actions workflows referenced in the README validate links, documentation structure, and CI status.
- The repo also integrates external verification sources such as OpenSSF Scorecard and security scorecard badges.
- Data flow here is: authored policy documents and metadata → validation checks → published badges/dashboards → audit and client-facing evidence.
11. Cross-repository architecture boundary
- Several “Security Architecture” links point to separate Hack23 product repositories, not this repo.
- This repo is the ISMS control framework; the product repos contain implementation-specific architectures for individual systems.
- For a diagram, depict this repository as the governance and evidence hub connected outward to product/system repos and external validation services.
12. Diagramming takeaway
- The clearest architectural model is a layered documentation system with three flows:
- policy creation and maintenance
- control mapping and risk/compliance evidence
- automated validation and public reporting
- The central boundary is between the public ISMS corpus in this repo and the operational/product-specific systems it governs externally.
Main entry points: Information_Security_Policy.md Info Security Policy · README.md README · ISMS_METRICS_DASHBOARD.md Metrics Dashboard · Compliance_Checklist.md Compliance Checklist
Components 33
Governance
Strategy, policy, and document hierarchy that define the ISMS baseline.
- README · Top-level map of the public ISMS documentation set.
README.md - Info Security Policy · Primary policy source of truth for the ISMS.
Information_Security_Policy.md - Security Strategy · Direction and priorities for the security program.
Information_Security_Strategy.md - CLASSIFICATION · Confidentiality and handling model used across the corpus.
CLASSIFICATION.md
Risk & Compliance
Registers, assessments, and control mapping for audit and governance.
- Risk Register · Central inventory of identified risks and treatments.
Risk_Register.md - Risk Methodology · How risks are assessed, scored, and reviewed.
Risk_Assessment_Methodology.md - Threat Modeling · Threat identification and scenario framing for security decisions.
Threat_Modeling.md - Compliance Checklist · Cross-reference for framework mapping and audit evidence.
Compliance_Checklist.md
Operations
Incident, continuity, recovery, and change handling.
- Incident Response · Process for handling security events and incidents.
Incident_Response_Plan.md - Business Continuity · Operational continuity planning for disruptions.
Business_Continuity_Plan.md - Disaster Recovery · Restoration planning for major service or data loss.
Disaster_Recovery_Plan.md - Change Mgmt · Controlled change handling for the operating model.
Change_Management.md - Backup Policy · Backup and recovery expectations supporting continuity.
Backup_Recovery_Policy.md - Segregation of Duties · Compensating control for a small operating team.
Segregation_of_Duties_Policy.md
Technical Controls
Concrete security control domains and safeguard policies.
- Access Control · Identity and authorization boundaries.
Access_Control_Policy.md - Cryptography · Encryption, keys, and cryptographic handling rules.
Cryptography_Policy.md - Network Security · Network boundary and communications protections.
Network_Security_Policy.md - Secure Development · Security expectations for code and delivery practices.
Secure_Development_Policy.md - Vulnerability Mgmt · Identification and remediation of security weaknesses.
Vulnerability_Management.md - Data Classification · Data handling rules tied to classification levels.
Data_Classification_Policy.md - Mobile Device Mgmt · Endpoint and mobile device safeguards.
Mobile_Device_Management_Policy.md
External Boundary
Suppliers, partners, open source, and external validation or system boundaries.
- Stakeholders · External obligations and stakeholder relationships.
External_Stakeholder_Registry.md - Third Party · Governance for suppliers and external service dependencies.
Third_Party_Management.md - SUPPLIER · Supplier-facing requirements and evidence.
SUPPLIER.md - Partnerships · Rules for external collaborations and shared responsibility.
Partnership_Framework.md - Open Source · Open-source usage and dependency governance.
Open_Source_Policy.md - Validation Services · External verification and scoring sources used by the repository.
- Product Repos · Separate system-specific repositories governed by this ISMS.
Reporting & Quality
Metrics, transparency, and documentation standards.
- Security Metrics · Measures used to track ISMS health and coverage.
Security_Metrics.md - Metrics Dashboard · Published status view for document and control health.
ISMS_METRICS_DASHBOARD.md - QA Checklist · Documentation quality and consistency checks.
ISMS_QA_CHECKLIST.md - Transparency Plan · Rules for what is public, redacted, or withheld.
ISMS_Transparency_Plan.md - Style Guide · Formatting and authoring conventions for the corpus.
STYLE_GUIDE.md
Connections 29
- README → Info Security Policy: documents · README organizes the policy corpus starting from the top-level policy.
- README → Security Strategy: documents · Strategy is part of the root governance layer.
- README → CLASSIFICATION: documents · Classification defines the handling model used by the corpus.
- Info Security Policy → Risk Register: drives · Policy informs identified risks and treatments.
- Info Security Policy → Access Control: sets baseline · Primary policy governs control selection.
- Info Security Policy → Transparency Plan: bounded by · Public disclosure is constrained by policy and redaction rules.
- Security Strategy → Risk Methodology: aligns · Strategy shapes how risk is assessed and prioritized.
- CLASSIFICATION → Data Classification: defines · Corpus-wide classification model feeds the data handling policy.
- Risk Methodology → Risk Register: maintains · Methodology is used to populate and review the register.
- Threat Modeling → Risk Register: informs · Threat scenarios feed risk entries and treatments.
- Compliance Checklist → Security Metrics: evidence for · Checklist cross-references controls and obligations into reportable evidence.
- Stakeholders → Third Party: feeds · External obligations and counterparties inform supplier governance.
- Incident Response → Business Continuity: coordinates · Incident handling ties into continuity response.
- Business Continuity → Disaster Recovery: includes · Continuity depends on recovery planning.
- Backup Policy → Disaster Recovery: supports · Backups underpin recovery execution.
- Segregation of Duties → Change Mgmt: controls · Segregation of duties constrains operational changes.
- Access Control → Mobile Device Mgmt: enforces · Device governance supports identity and access boundaries.
- Cryptography → Network Security: protects · Cryptographic safeguards support secure communications.
- Secure Development → Vulnerability Mgmt: feeds · Development practices connect to vulnerability handling.
- Third Party → SUPPLIER: covers · Supplier management is evidenced by supplier-facing artifacts.
- Partnerships → Product Repos: extends to · Partnership rules apply beyond this repository to external systems.
- Open Source → Validation Services: references · Open-source governance is paired with external verification and scoring.
- Security Metrics → Metrics Dashboard: published as · Measures are surfaced in the public metrics dashboard.
- QA Checklist → Style Guide: uses · Quality checks depend on shared documentation standards.
- Transparency Plan → Metrics Dashboard: governs · Transparency rules shape what the dashboard can expose.
- Info Security Policy → Compliance Checklist: maps to · Policy requirements are cross-walked to audit evidence.
- Metrics Dashboard → Validation Services: verified by · Published status is supported by external checks and badges.
- Compliance Checklist → Validation Services: cross-checked with · Audit mapping is corroborated by external validation sources.
- README → Metrics Dashboard: surfaces · README links the documentation corpus to its observable reporting plane.