# hack23/isms-public architecture

> Architecture diagram of the GitHub repository hack23/isms-public, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hack23/isms-public
- Repository: https://github.com/hack23/isms-public

## Overview

1. **Repository role**
   - This is not an application runtime repo; it is the public documentation backbone for Hack23 AB’s ISMS.
   - The repository’s main artifact is a structured set of Markdown policies, plans, registers, and dashboards that together define governance and evidence for security management.

2. **Top-level architecture**
   - The repo is organized around a hierarchy from strategy to operations:
     - strategic policies and governance
     - risk/compliance artifacts
     - operational resilience and incident handling
     - technical security controls
     - supporting quality and transparency documents
   - The README’s document hierarchy is the best source for diagramming the overall ISMS structure.

3. **Strategic and governance layer**
   - Core root documents include **Information Security Policy**, **Information Security Strategy**, and **CLASSIFICATION**.
   - These define the security model, decision criteria, and how control selection is driven by business impact and confidentiality classification.
   - This layer acts as the policy source of truth for the rest of the repository.

4. **Risk and compliance layer**
   - **Risk_Register**, **Risk_Assessment_Methodology**, **Compliance_Checklist**, **Threat_Modeling**, and **External_Stakeholder_Registry** form the governance control plane.
   - They connect framework mapping (ISO 27001, NIST CSF, CIS Controls) to identified risks and external obligations.
   - The compliance checklist is the main cross-reference document for audit evidence.

5. **Operational security layer**
   - **Incident_Response_Plan**, **Business_Continuity_Plan**, **Disaster_Recovery_Plan**, and **Change_Management** define how the organization handles disruption and security events.
   - **Backup_Recovery_Policy** and **Segregation_of_Duties_Policy** support resilience in a single-person operating model.
   - This layer is where policy becomes operating procedure.

6. **Technical control layer**
   - **Access_Control_Policy**, **Cryptography_Policy**, **Network_Security_Policy**, **Secure_Development_Policy**, **Vulnerability_Management**, **Data_Classification_Policy**, and **Mobile_Device_Management_Policy** specify concrete control domains.
   - These are the documents you would treat as technical safeguards in the architecture diagram.
   - They encode the repo’s practical security boundaries: identity, endpoint, network, code, data, and cryptographic protection.

7. **Supplier, partnership, and open-source boundary**
   - **Third_Party_Management**, **SUPPLIER**, **Partnership_Framework**, and **Open_Source_Policy** define the external dependency boundary.
   - The repo explicitly treats suppliers, partners, and open-source components as managed risk surfaces.
   - This is important because the ISMS spans the company’s own operations plus its ecosystem of software and service dependencies.

8. **Metrics and health monitoring**
   - **Security_Metrics** and **ISMS_METRICS_DASHBOARD** provide the reporting plane.
   - The dashboards track document status, review cycles, compliance coverage, and policy health.
   - In architecture terms, these are the observable outputs fed by the underlying policy corpus and review metadata.

9. **Quality, transparency, and document control**
   - **STYLE_GUIDE**, **ISMS_QA_CHECKLIST**, and **ISMS_Transparency_Plan** establish documentation standards and public disclosure rules.
   - The repository is intentionally public for a large portion of its content, with sensitive items redacted.
   - This creates a clear boundary between public evidence and confidential operational details.

10. **Automation and validation**
    - GitHub Actions workflows referenced in the README validate links, documentation structure, and CI status.
    - The repo also integrates external verification sources such as OpenSSF Scorecard and security scorecard badges.
    - Data flow here is: authored policy documents and metadata → validation checks → published badges/dashboards → audit and client-facing evidence.

11. **Cross-repository architecture boundary**
    - Several “Security Architecture” links point to separate Hack23 product repositories, not this repo.
    - This repo is the ISMS control framework; the product repos contain implementation-specific architectures for individual systems.
    - For a diagram, depict this repository as the governance and evidence hub connected outward to product/system repos and external validation services.

12. **Diagramming takeaway**
    - The clearest architectural model is a layered documentation system with three flows:
      - policy creation and maintenance
      - control mapping and risk/compliance evidence
      - automated validation and public reporting
    - The central boundary is between the public ISMS corpus in this repo and the operational/product-specific systems it governs externally.

Main entry points: [`Information_Security_Policy.md`](https://github.com/hack23/isms-public/blob/main/Information_Security_Policy.md) (Info Security Policy), [`README.md`](https://github.com/hack23/isms-public/blob/main/README.md) (README), [`ISMS_METRICS_DASHBOARD.md`](https://github.com/hack23/isms-public/blob/main/ISMS_METRICS_DASHBOARD.md) (Metrics Dashboard), [`Compliance_Checklist.md`](https://github.com/hack23/isms-public/blob/main/Compliance_Checklist.md) (Compliance Checklist)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_layer_governance["Governance"]
  node_readme["README<br/>doc hub<br/>[README.md]"]
  node_info_policy["Info Security Policy"]
  node_info_strategy["Security Strategy"]
  node_classification["CLASSIFICATION<br/>[CLASSIFICATION.md]"]
end

subgraph group_layer_risk["Risk & Compliance"]
  node_risk_register[("Risk Register<br/>[Risk_Register.md]")]
  node_risk_method["Risk Methodology"]
  node_threat_modeling["Threat Modeling<br/>analysis<br/>[Threat_Modeling.md]"]
  node_compliance_check["Compliance Checklist<br/>audit map"]
end

subgraph group_layer_ops["Operations"]
  node_incident_response["Incident Response<br/>response plan"]
  node_business_continuity["Business Continuity<br/>continuity plan"]
  node_disaster_recovery["Disaster Recovery<br/>recovery plan"]
  node_change_mgmt["Change Mgmt<br/>process"]
  node_backup_recovery["Backup Policy<br/>resilience policy"]
  node_sod_policy["Segregation of Duties<br/>control policy"]
end

subgraph group_layer_controls["Technical Controls"]
  node_access_control["Access Control<br/>control policy"]
  node_crypto_policy["Cryptography<br/>control policy"]
  node_network_policy["Network Security<br/>control policy"]
  node_secure_dev["Secure Development<br/>control policy"]
  node_vuln_mgmt["Vulnerability Mgmt<br/>control process"]
  node_data_class["Data Classification<br/>control policy"]
  node_mobile_mdm["Mobile Device Mgmt<br/>endpoint control"]
end

subgraph group_layer_boundary["External Boundary"]
  node_stakeholders[("Stakeholders<br/>registry")]
  node_third_party["Third Party<br/>supplier control"]
  node_supplier["SUPPLIER<br/>[SUPPLIER.md]"]
  node_partnership["Partnerships<br/>boundary framework"]
  node_open_source["Open Source<br/>policy"]
  node_validation_services(("Validation Services<br/>external services"))
  node_product_repos(("Product Repos<br/>external systems"))
end

subgraph group_layer_reporting["Reporting & Quality"]
  node_metrics["Security Metrics"]
  node_dashboard["Metrics Dashboard<br/>reporting dashboard"]
  node_qa_check["QA Checklist<br/>quality control"]
  node_transparency["Transparency Plan<br/>publication policy"]
  node_style_guide["Style Guide<br/>documentation standard<br/>[STYLE_GUIDE.md]"]
end

node_readme -->|"documents"| node_info_policy
node_readme -->|"documents"| node_info_strategy
node_readme -->|"documents"| node_classification
node_info_policy -->|"drives"| node_risk_register
node_info_policy -->|"sets baseline"| node_access_control
node_info_policy -->|"bounded by"| node_transparency
node_info_strategy -->|"aligns"| node_risk_method
node_classification -->|"defines"| node_data_class
node_risk_method -->|"maintains"| node_risk_register
node_threat_modeling -->|"informs"| node_risk_register
node_compliance_check -->|"evidence for"| node_metrics
node_stakeholders -->|"feeds"| node_third_party
node_incident_response -->|"coordinates"| node_business_continuity
node_business_continuity -->|"includes"| node_disaster_recovery
node_backup_recovery -->|"supports"| node_disaster_recovery
node_sod_policy -->|"controls"| node_change_mgmt
node_access_control -->|"enforces"| node_mobile_mdm
node_crypto_policy -->|"protects"| node_network_policy
node_secure_dev -->|"feeds"| node_vuln_mgmt
node_third_party -->|"covers"| node_supplier
node_partnership -->|"extends to"| node_product_repos
node_open_source -->|"references"| node_validation_services
node_metrics -->|"published as"| node_dashboard
node_qa_check -->|"uses"| node_style_guide
node_transparency -->|"governs"| node_dashboard
node_info_policy -->|"maps to"| node_compliance_check
node_dashboard -->|"verified by"| node_validation_services
node_compliance_check -->|"cross-checked with"| node_validation_services
node_readme -->|"surfaces"| node_dashboard

click node_readme "https://github.com/hack23/isms-public/blob/main/README.md"
click node_info_policy "https://github.com/hack23/isms-public/blob/main/Information_Security_Policy.md"
click node_info_strategy "https://github.com/hack23/isms-public/blob/main/Information_Security_Strategy.md"
click node_classification "https://github.com/hack23/isms-public/blob/main/CLASSIFICATION.md"
click node_risk_register "https://github.com/hack23/isms-public/blob/main/Risk_Register.md"
click node_risk_method "https://github.com/hack23/isms-public/blob/main/Risk_Assessment_Methodology.md"
click node_threat_modeling "https://github.com/hack23/isms-public/blob/main/Threat_Modeling.md"
click node_compliance_check "https://github.com/hack23/isms-public/blob/main/Compliance_Checklist.md"
click node_stakeholders "https://github.com/hack23/isms-public/blob/main/External_Stakeholder_Registry.md"
click node_incident_response "https://github.com/hack23/isms-public/blob/main/Incident_Response_Plan.md"
click node_business_continuity "https://github.com/hack23/isms-public/blob/main/Business_Continuity_Plan.md"
click node_disaster_recovery "https://github.com/hack23/isms-public/blob/main/Disaster_Recovery_Plan.md"
click node_change_mgmt "https://github.com/hack23/isms-public/blob/main/Change_Management.md"
click node_backup_recovery "https://github.com/hack23/isms-public/blob/main/Backup_Recovery_Policy.md"
click node_sod_policy "https://github.com/hack23/isms-public/blob/main/Segregation_of_Duties_Policy.md"
click node_access_control "https://github.com/hack23/isms-public/blob/main/Access_Control_Policy.md"
click node_crypto_policy "https://github.com/hack23/isms-public/blob/main/Cryptography_Policy.md"
click node_network_policy "https://github.com/hack23/isms-public/blob/main/Network_Security_Policy.md"
click node_secure_dev "https://github.com/hack23/isms-public/blob/main/Secure_Development_Policy.md"
click node_vuln_mgmt "https://github.com/hack23/isms-public/blob/main/Vulnerability_Management.md"
click node_data_class "https://github.com/hack23/isms-public/blob/main/Data_Classification_Policy.md"
click node_mobile_mdm "https://github.com/hack23/isms-public/blob/main/Mobile_Device_Management_Policy.md"
click node_third_party "https://github.com/hack23/isms-public/blob/main/Third_Party_Management.md"
click node_supplier "https://github.com/hack23/isms-public/blob/main/SUPPLIER.md"
click node_partnership "https://github.com/hack23/isms-public/blob/main/Partnership_Framework.md"
click node_open_source "https://github.com/hack23/isms-public/blob/main/Open_Source_Policy.md"
click node_metrics "https://github.com/hack23/isms-public/blob/main/Security_Metrics.md"
click node_dashboard "https://github.com/hack23/isms-public/blob/main/ISMS_METRICS_DASHBOARD.md"
click node_qa_check "https://github.com/hack23/isms-public/blob/main/ISMS_QA_CHECKLIST.md"
click node_transparency "https://github.com/hack23/isms-public/blob/main/ISMS_Transparency_Plan.md"
click node_style_guide "https://github.com/hack23/isms-public/blob/main/STYLE_GUIDE.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_readme,node_info_policy,node_info_strategy,node_classification toneBlue
class node_risk_register,node_risk_method,node_threat_modeling,node_compliance_check toneAmber
class node_incident_response,node_business_continuity,node_disaster_recovery,node_change_mgmt,node_backup_recovery,node_sod_policy toneMint
class node_access_control,node_crypto_policy,node_network_policy,node_secure_dev,node_vuln_mgmt,node_data_class,node_mobile_mdm toneRose
class node_stakeholders,node_third_party,node_supplier,node_partnership,node_open_source,node_validation_services,node_product_repos toneIndigo
class node_metrics,node_dashboard,node_qa_check,node_transparency,node_style_guide toneTeal
```

## Components

### Governance

Strategy, policy, and document hierarchy that define the ISMS baseline.

- [README](https://github.com/hack23/isms-public/blob/main/README.md): doc hub · Top-level map of the public ISMS documentation set. · `README.md`
- [Info Security Policy](https://github.com/hack23/isms-public/blob/main/Information_Security_Policy.md): policy · Primary policy source of truth for the ISMS. · `Information_Security_Policy.md`
- [Security Strategy](https://github.com/hack23/isms-public/blob/main/Information_Security_Strategy.md): strategy · Direction and priorities for the security program. · `Information_Security_Strategy.md`
- [CLASSIFICATION](https://github.com/hack23/isms-public/blob/main/CLASSIFICATION.md): classification · Confidentiality and handling model used across the corpus. · `CLASSIFICATION.md`

### Risk & Compliance

Registers, assessments, and control mapping for audit and governance.

- [Risk Register](https://github.com/hack23/isms-public/blob/main/Risk_Register.md): risk register · Central inventory of identified risks and treatments. · `Risk_Register.md`
- [Risk Methodology](https://github.com/hack23/isms-public/blob/main/Risk_Assessment_Methodology.md): methodology · How risks are assessed, scored, and reviewed. · `Risk_Assessment_Methodology.md`
- [Threat Modeling](https://github.com/hack23/isms-public/blob/main/Threat_Modeling.md): analysis · Threat identification and scenario framing for security decisions. · `Threat_Modeling.md`
- [Compliance Checklist](https://github.com/hack23/isms-public/blob/main/Compliance_Checklist.md): audit map · Cross-reference for framework mapping and audit evidence. · `Compliance_Checklist.md`

### Operations

Incident, continuity, recovery, and change handling.

- [Incident Response](https://github.com/hack23/isms-public/blob/main/Incident_Response_Plan.md): response plan · Process for handling security events and incidents. · `Incident_Response_Plan.md`
- [Business Continuity](https://github.com/hack23/isms-public/blob/main/Business_Continuity_Plan.md): continuity plan · Operational continuity planning for disruptions. · `Business_Continuity_Plan.md`
- [Disaster Recovery](https://github.com/hack23/isms-public/blob/main/Disaster_Recovery_Plan.md): recovery plan · Restoration planning for major service or data loss. · `Disaster_Recovery_Plan.md`
- [Change Mgmt](https://github.com/hack23/isms-public/blob/main/Change_Management.md): process · Controlled change handling for the operating model. · `Change_Management.md`
- [Backup Policy](https://github.com/hack23/isms-public/blob/main/Backup_Recovery_Policy.md): resilience policy · Backup and recovery expectations supporting continuity. · `Backup_Recovery_Policy.md`
- [Segregation of Duties](https://github.com/hack23/isms-public/blob/main/Segregation_of_Duties_Policy.md): control policy · Compensating control for a small operating team. · `Segregation_of_Duties_Policy.md`

### Technical Controls

Concrete security control domains and safeguard policies.

- [Access Control](https://github.com/hack23/isms-public/blob/main/Access_Control_Policy.md): control policy · Identity and authorization boundaries. · `Access_Control_Policy.md`
- [Cryptography](https://github.com/hack23/isms-public/blob/main/Cryptography_Policy.md): control policy · Encryption, keys, and cryptographic handling rules. · `Cryptography_Policy.md`
- [Network Security](https://github.com/hack23/isms-public/blob/main/Network_Security_Policy.md): control policy · Network boundary and communications protections. · `Network_Security_Policy.md`
- [Secure Development](https://github.com/hack23/isms-public/blob/main/Secure_Development_Policy.md): control policy · Security expectations for code and delivery practices. · `Secure_Development_Policy.md`
- [Vulnerability Mgmt](https://github.com/hack23/isms-public/blob/main/Vulnerability_Management.md): control process · Identification and remediation of security weaknesses. · `Vulnerability_Management.md`
- [Data Classification](https://github.com/hack23/isms-public/blob/main/Data_Classification_Policy.md): control policy · Data handling rules tied to classification levels. · `Data_Classification_Policy.md`
- [Mobile Device Mgmt](https://github.com/hack23/isms-public/blob/main/Mobile_Device_Management_Policy.md): endpoint control · Endpoint and mobile device safeguards. · `Mobile_Device_Management_Policy.md`

### External Boundary

Suppliers, partners, open source, and external validation or system boundaries.

- [Stakeholders](https://github.com/hack23/isms-public/blob/main/External_Stakeholder_Registry.md): registry · External obligations and stakeholder relationships. · `External_Stakeholder_Registry.md`
- [Third Party](https://github.com/hack23/isms-public/blob/main/Third_Party_Management.md): supplier control · Governance for suppliers and external service dependencies. · `Third_Party_Management.md`
- [SUPPLIER](https://github.com/hack23/isms-public/blob/main/SUPPLIER.md): supplier register · Supplier-facing requirements and evidence. · `SUPPLIER.md`
- [Partnerships](https://github.com/hack23/isms-public/blob/main/Partnership_Framework.md): boundary framework · Rules for external collaborations and shared responsibility. · `Partnership_Framework.md`
- [Open Source](https://github.com/hack23/isms-public/blob/main/Open_Source_Policy.md): policy · Open-source usage and dependency governance. · `Open_Source_Policy.md`
- **Validation Services**: external services · External verification and scoring sources used by the repository.
- **Product Repos**: external systems · Separate system-specific repositories governed by this ISMS.

### Reporting & Quality

Metrics, transparency, and documentation standards.

- [Security Metrics](https://github.com/hack23/isms-public/blob/main/Security_Metrics.md): metrics · Measures used to track ISMS health and coverage. · `Security_Metrics.md`
- [Metrics Dashboard](https://github.com/hack23/isms-public/blob/main/ISMS_METRICS_DASHBOARD.md): reporting dashboard · Published status view for document and control health. · `ISMS_METRICS_DASHBOARD.md`
- [QA Checklist](https://github.com/hack23/isms-public/blob/main/ISMS_QA_CHECKLIST.md): quality control · Documentation quality and consistency checks. · `ISMS_QA_CHECKLIST.md`
- [Transparency Plan](https://github.com/hack23/isms-public/blob/main/ISMS_Transparency_Plan.md): publication policy · Rules for what is public, redacted, or withheld. · `ISMS_Transparency_Plan.md`
- [Style Guide](https://github.com/hack23/isms-public/blob/main/STYLE_GUIDE.md): documentation standard · Formatting and authoring conventions for the corpus. · `STYLE_GUIDE.md`

## Connections

- README → Info Security Policy: documents · README organizes the policy corpus starting from the top-level policy.
- README → Security Strategy: documents · Strategy is part of the root governance layer.
- README → CLASSIFICATION: documents · Classification defines the handling model used by the corpus.
- Info Security Policy → Risk Register: drives · Policy informs identified risks and treatments.
- Info Security Policy → Access Control: sets baseline · Primary policy governs control selection.
- Info Security Policy → Transparency Plan: bounded by · Public disclosure is constrained by policy and redaction rules.
- Security Strategy → Risk Methodology: aligns · Strategy shapes how risk is assessed and prioritized.
- CLASSIFICATION → Data Classification: defines · Corpus-wide classification model feeds the data handling policy.
- Risk Methodology → Risk Register: maintains · Methodology is used to populate and review the register.
- Threat Modeling → Risk Register: informs · Threat scenarios feed risk entries and treatments.
- Compliance Checklist → Security Metrics: evidence for · Checklist cross-references controls and obligations into reportable evidence.
- Stakeholders → Third Party: feeds · External obligations and counterparties inform supplier governance.
- Incident Response → Business Continuity: coordinates · Incident handling ties into continuity response.
- Business Continuity → Disaster Recovery: includes · Continuity depends on recovery planning.
- Backup Policy → Disaster Recovery: supports · Backups underpin recovery execution.
- Segregation of Duties → Change Mgmt: controls · Segregation of duties constrains operational changes.
- Access Control → Mobile Device Mgmt: enforces · Device governance supports identity and access boundaries.
- Cryptography → Network Security: protects · Cryptographic safeguards support secure communications.
- Secure Development → Vulnerability Mgmt: feeds · Development practices connect to vulnerability handling.
- Third Party → SUPPLIER: covers · Supplier management is evidenced by supplier-facing artifacts.
- Partnerships → Product Repos: extends to · Partnership rules apply beyond this repository to external systems.
- Open Source → Validation Services: references · Open-source governance is paired with external verification and scoring.
- Security Metrics → Metrics Dashboard: published as · Measures are surfaced in the public metrics dashboard.
- QA Checklist → Style Guide: uses · Quality checks depend on shared documentation standards.
- Transparency Plan → Metrics Dashboard: governs · Transparency rules shape what the dashboard can expose.
- Info Security Policy → Compliance Checklist: maps to · Policy requirements are cross-walked to audit evidence.
- Metrics Dashboard → Validation Services: verified by · Published status is supported by external checks and badges.
- Compliance Checklist → Validation Services: cross-checked with · Audit mapping is corroborated by external validation sources.
- README → Metrics Dashboard: surfaces · README links the documentation corpus to its observable reporting plane.