ISMS_METRICS_DASHBOARD.md

July 17, 2026 · View on GitHub

Hack23 Logo

📊 Hack23 AB — ISMS Metrics Dashboard

Real-Time Policy Health Monitoring
Automated Review Tracking • Compliance Coverage • Proactive ISMS Management

Owner Version Auto-Generated Update Frequency

📋 Document Owner: CEO | 📄 Version: 1.1 | 🤖 Last Generated: 2026-07-17 07:52 UTC
🔄 Update Frequency: Weekly (Automated) | 📊 Data Source: All ISMS *.md files

🎯 Purpose Statement

Hack23 AB's ISMS Metrics Dashboard provides real-time visibility into our Information Security Management System health through automated policy review tracking and compliance monitoring. This dashboard embodies our 🌟 transparency principle - making our security governance posture publicly visible demonstrates operational excellence and proactive risk management.

Our automated metrics collection eliminates manual policy tracking overhead, enabling 💰 cost efficiency through reduced administrative burden while ensuring 🛡️ risk reduction through proactive identification of overdue reviews. This systematic approach to ISMS governance showcases the 🏆 competitive advantage of our cybersecurity consulting methodology.

By maintaining 📊 live ISMS monitoring with ⚡ automated weekly updates, we demonstrate the operational maturity that our consulting clients expect.

— James Pether Sörling, CEO/Founder

🚦 Review Status Summary

Current Status as of 2026-07-17:

StatusCountDescription
🔴 Overdue1Policy reviews past their due date - immediate action required
🟡 Due Soon (< 30 days)6Policy reviews approaching deadline - plan review activities
🟢 Current35Policy reviews on schedule - no immediate action needed
📊 Total Documents42Total active ISMS policy documents

🚨 Overdue Policy Reviews - Action Required

🚨 Oversized Documents Alert

Documents exceeding 40KB threshold requiring consolidation:

DocumentCurrent SizeStatusRecommendation
Compliance_Checklist.md243 KB🔴 OversizedSplit into focused sub-documents
Secure_Development_Policy.md142 KB🔴 OversizedSplit into focused sub-documents
Information_Security_Strategy.md122 KB🔴 OversizedSplit into focused sub-documents
Risk_Register.md107 KB🔴 OversizedSplit into focused sub-documents
SUPPLIER.md100 KB🔴 OversizedSplit into focused sub-documents
Security_Metrics.md96 KB🔴 OversizedSplit into focused sub-documents
Vulnerability_Management.md82 KB🔴 OversizedSplit into focused sub-documents
Threat_Modeling.md79 KB🔴 OversizedSplit into focused sub-documents
OWASP_LLM_Security_Policy.md79 KB🔴 OversizedSplit into focused sub-documents
Incident_Response_Plan.md77 KB🔴 OversizedSplit into focused sub-documents
ISO_5230_Self_Certification.md69 KB🔴 OversizedSplit into focused sub-documents
Open_Source_Policy.md68 KB🔴 OversizedSplit into focused sub-documents
Asset_Register.md68 KB🔴 OversizedSplit into focused sub-documents
CLASSIFICATION.md62 KB🔴 OversizedSplit into focused sub-documents
Data_Classification_Policy.md61 KB🔴 OversizedSplit into focused sub-documents
Partnership_Framework.md60 KB🔴 OversizedSplit into focused sub-documents
Business_Continuity_Plan.md53 KB🔴 OversizedSplit into focused sub-documents
Risk_Assessment_Methodology.md52 KB🔴 OversizedSplit into focused sub-documents
Network_Security_Policy.md51 KB🔴 OversizedSplit into focused sub-documents
Third_Party_Management.md50 KB🔴 OversizedSplit into focused sub-documents
SWOT.md50 KB🔴 OversizedSplit into focused sub-documents
CRA_Conformity_Assessment_Process.md46 KB🔴 OversizedSplit into focused sub-documents
SECURITY_ARCHITECTURE.md45 KB🔴 OversizedSplit into focused sub-documents
External_Stakeholder_Registry.md42 KB🔴 OversizedSplit into focused sub-documents

🎯 Size Optimization Target: Reduce all documents to <35KB for improved maintainability and navigability.

📋 Consolidation Guidelines:

  • Identify duplicate content across related policies
  • Extract implementation details to operational documents
  • Move detailed specifications to technical architecture documents
  • Consolidate repetitive sections while preserving unique guidance
  • Add cross-references instead of repeating content

📅 Upcoming Reviews (Next 90 Days)

Review DateDocumentReview CycleDays Until DueStatus
2026-07-25Backup_Recovery_Policy.mdSemi-Annual7🟡 Due Soon
2026-07-25Disaster_Recovery_Plan.mdSemi-Annual7🟡 Due Soon
2026-07-25Mobile_Device_Management_Policy.mdSemi-Annual7🟡 Due Soon
2026-07-25Access_Control_Policy.mdSemi-Annual7🟡 Due Soon
2026-07-25External_Stakeholder_Registry.mdSemi-Annual7🟡 Due Soon
2026-08-01Security_Metrics.mdMonthly14🟡 Due Soon
2026-09-05SWOT.mdSemi-Annual49🟢 Current
2026-09-05Business_Continuity_Plan.mdSemi-Annual49🟢 Current
2026-09-13Vulnerability_Management.mdQuarterly57🟢 Current
2026-09-20OWASP_LLM_Security_Policy.mdQuarterly64🟢 Current
2026-09-20AI_Policy.mdQuarterly64🟢 Current
2026-09-28Risk_Register.mdQuarterly72🟢 Current

📋 Document Health Matrix

Complete status of all ISMS documentation:

DocumentVersionLast UpdatedNext ReviewReview CycleStatusCompliance
FUTURE_WORKFLOWS.md1.22026-03-052026-06-05Quarterly🔴 OverdueISO NIST CIS
Backup_Recovery_Policy.md1.22026-01-252026-07-25Semi-Annual🟡 Due SoonISO NIST CIS
Disaster_Recovery_Plan.md2.32026-01-252026-07-25Semi-Annual🟡 Due SoonISO NIST CIS
Mobile_Device_Management_Policy.md1.12026-01-252026-07-25Semi-Annual🟡 Due SoonISO NIST CIS
Access_Control_Policy.md2.62026-01-252026-07-25Semi-Annual🟡 Due SoonISO NIST CIS
External_Stakeholder_Registry.md1.52026-01-252026-07-25Semi-Annual🟡 Due SoonISO NIST CIS
Security_Metrics.md3.82026-07-012026-08-01Monthly🟡 Due SoonISO NIST CIS
SWOT.md1.32026-03-052026-09-05Semi-Annual🟢 CurrentISO NIST CIS
Business_Continuity_Plan.md1.42026-03-052026-09-05Semi-Annual🟢 CurrentISO NIST CIS
Vulnerability_Management.md3.12026-06-132026-09-13Quarterly🟢 CurrentISO NIST CIS
OWASP_LLM_Security_Policy.md1.52026-06-202026-09-20Quarterly🟢 CurrentISO
AI_Policy.md2.32026-06-202026-09-20Quarterly🟢 CurrentISO NIST CIS
Risk_Register.md3.92026-06-282026-09-28Quarterly🟢 CurrentISO NIST CIS
SUPPLIER.md1.52026-05-102026-11-10Semi-Annual🟢 CurrentISO NIST CIS
Compliance_Checklist.md2.62026-05-102026-11-10Semi-Annual🟢 CurrentISO NIST CIS
NIS2_Compliance_Service.md1.32026-05-102026-11-10Semi-Annual🟢 CurrentISO NIST CIS
SECURITY_ARCHITECTURE.md1.32026-05-102026-11-10Semi-Annual🟢 CurrentISO NIST CIS
Third_Party_Management.md2.42026-05-102026-11-10Semi-Annual🟢 CurrentISO NIST CIS
Incident_Response_Plan.md1.72026-05-102026-11-10Semi-Annual🟢 CurrentISO NIST CIS
Privacy_Policy.md1.12026-01-252027-01-25Annual🟢 CurrentISO NIST
ISMS_Transparency_Plan.md2.22026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Acceptable_Use_Policy.md1.12026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Cryptography_Policy.md1.22026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Physical_Security_Policy.md1.12026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Change_Management.md3.12026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Segregation_of_Duties_Policy.md2.12026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Network_Security_Policy.md2.32026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
Data_Classification_Policy.md2.32026-01-252027-01-25Annual🟢 CurrentISO NIST CIS
ISO_5230_Self_Certification.md1.02026-04-102027-04-10Annual🟢 CurrentISO NIST CIS
ISMS_QA_CHECKLIST.md1.32026-05-102027-05-10Annual🟢 CurrentISO NIST CIS
Risk_Assessment_Methodology.md2.32026-05-102027-05-10Annual🟢 CurrentISO NIST CIS
Partnership_Framework.md1.32026-05-102027-05-10Annual🟢 CurrentISO NIST CIS
CLASSIFICATION.md1.52026-05-102027-05-10Annual🟢 CurrentISO NIST CIS
Information_Security_Strategy.md4.72026-06-282027-06-02Annual🟢 CurrentISO NIST CIS
Asset_Register.md2.42026-06-022027-06-02Annual🟢 CurrentISO NIST CIS
WORKFLOWS.md1.22026-06-132027-06-13Annual🟢 CurrentISO NIST CIS
End-of-Life-Strategy.md1.02026-06-132027-06-13Annual🟢 CurrentISO NIST CIS
Information_Security_Policy.md2.12026-06-282027-06-28Annual🟢 CurrentISO NIST CIS
CRA_Conformity_Assessment_Process.md1.52026-06-282027-06-28Annual🟢 CurrentISO NIST CIS
Threat_Modeling.md1.62026-06-282027-06-28Annual🟢 CurrentISO NIST CIS
Secure_Development_Policy.md2.52026-07-122027-07-12Annual🟢 CurrentISO NIST CIS
Open_Source_Policy.md2.72026-07-122027-07-12Annual🟢 CurrentISO NIST CIS

📊 Compliance Framework Coverage

Our ISMS documentation alignment with major security frameworks:

FrameworkCoverageDocumentsPercentage
ISO 27001:202242/42Information Security Management100%
NIST CSF 2.041/42Cybersecurity Framework97%
CIS Controls v8.140/42Center for Internet Security95%

Note: All ISMS documents are designed to align with ISO 27001:2022, NIST CSF 2.0, and CIS Controls v8.1 requirements. Framework badges in individual documents indicate explicit alignment.

📏 Document Size Analysis

Monitor document sizes to identify consolidation opportunities and maintain optimal document length for readability and maintainability.

📊 Size Distribution

Size RangeCountPercentageStatus
🔴 Oversized (>40KB)2457%❌ Requires consolidation
🟡 Large (30-40KB)716%⚠️ Monitor for growth
🟢 Normal (<30KB)1126%✅ Optimal size

Target Metrics:

  • Average Document Size: 57 KB (Target: <25 KB)
  • Maximum Document Size: 243 KB (Target: <35 KB)
  • Oversized Documents: 24 (Target: 0)

📋 Detailed Size Listing

DocumentSize (KB)Size StatusReview StatusLast Updated
Compliance_Checklist.md243🔴 Oversized🟢 Current2026-05-10
Secure_Development_Policy.md142🔴 Oversized🟢 Current2026-07-12
Information_Security_Strategy.md122🔴 Oversized🟢 Current2026-06-28
Risk_Register.md107🔴 Oversized🟢 Current2026-06-28
SUPPLIER.md100🔴 Oversized🟢 Current2026-05-10
Security_Metrics.md96🔴 Oversized🟡 Due Soon2026-07-01
Vulnerability_Management.md82🔴 Oversized🟢 Current2026-06-13
Threat_Modeling.md79🔴 Oversized🟢 Current2026-06-28
OWASP_LLM_Security_Policy.md79🔴 Oversized🟢 Current2026-06-20
Incident_Response_Plan.md77🔴 Oversized🟢 Current2026-05-10
ISO_5230_Self_Certification.md69🔴 Oversized🟢 Current2026-04-10
Open_Source_Policy.md68🔴 Oversized🟢 Current2026-07-12
Asset_Register.md68🔴 Oversized🟢 Current2026-06-02
CLASSIFICATION.md62🔴 Oversized🟢 Current2026-05-10
Data_Classification_Policy.md61🔴 Oversized🟢 Current2026-01-25
Partnership_Framework.md60🔴 Oversized🟢 Current2026-05-10
Business_Continuity_Plan.md53🔴 Oversized🟢 Current2026-03-05
Risk_Assessment_Methodology.md52🔴 Oversized🟢 Current2026-05-10
Network_Security_Policy.md51🔴 Oversized🟢 Current2026-01-25
Third_Party_Management.md50🔴 Oversized🟢 Current2026-05-10
SWOT.md50🔴 Oversized🟢 Current2026-03-05
CRA_Conformity_Assessment_Process.md46🔴 Oversized🟢 Current2026-06-28
SECURITY_ARCHITECTURE.md45🔴 Oversized🟢 Current2026-05-10
External_Stakeholder_Registry.md42🔴 Oversized🟡 Due Soon2026-01-25
FUTURE_WORKFLOWS.md39🟡 Large🔴 Overdue2026-03-05
AI_Policy.md38🟡 Large🟢 Current2026-06-20
Segregation_of_Duties_Policy.md37🟡 Large🟢 Current2026-01-25
Change_Management.md37🟡 Large🟢 Current2026-01-25
Physical_Security_Policy.md36🟡 Large🟢 Current2026-01-25
Access_Control_Policy.md36🟡 Large🟡 Due Soon2026-01-25
Privacy_Policy.md31🟡 Large🟢 Current2026-01-25
NIS2_Compliance_Service.md29🟢 Normal🟢 Current2026-05-10
ISMS_QA_CHECKLIST.md29🟢 Normal🟢 Current2026-05-10
Cryptography_Policy.md29🟢 Normal🟢 Current2026-01-25
WORKFLOWS.md28🟢 Normal🟢 Current2026-06-13
Mobile_Device_Management_Policy.md28🟢 Normal🟡 Due Soon2026-01-25
Disaster_Recovery_Plan.md28🟢 Normal🟡 Due Soon2026-01-25
Acceptable_Use_Policy.md27🟢 Normal🟢 Current2026-01-25
Information_Security_Policy.md26🟢 Normal🟢 Current2026-06-28
Backup_Recovery_Policy.md21🟢 Normal🟡 Due Soon2026-01-25
ISMS_Transparency_Plan.md18🟢 Normal🟢 Current2026-01-25
End-of-Life-Strategy.md7🟢 Normal🟢 Current2026-06-13

📐 Size Optimization Recommendations

For documents >40KB:

  1. Identify duplicate content across related policies
  2. Extract implementation details to operational policy documents
  3. Move detailed specifications to technical architecture documents
  4. Consolidate repetitive sections while preserving unique guidance
  5. Add cross-references instead of repeating content

Best Practices:

  • Keep policy documents focused on "what" and "why" (strategic level)
  • Move "how" details to procedure documents or technical guides
  • Use tables and diagrams to convey complex information concisely
  • Link to related documents rather than duplicating content
  • Review quarterly for opportunities to streamline

Note: Size growth >10% per quarter triggers consolidation review.

🔍 Quality Metrics

MetricStatusDescription
📝 Document Completeness✅ 42/42All ISMS documents have complete metadata
🔄 Review Cycle Defined✅ 100%All documents have defined review frequencies
📅 Review Dates Set✅ 100%All documents have scheduled next review dates
🏷️ Version Control✅ ActiveAll documents maintain version numbers
📊 Dashboard Automation✅ ActiveWeekly automated updates via GitHub Actions
📏 Size Monitoring⚠️ 24 oversizedAutomated document size tracking and alerts

Quality Standards:

  • ✅ All documents follow STYLE_GUIDE.md formatting
  • ✅ All documents include document control footers
  • ✅ All documents reference relevant compliance frameworks
  • ✅ All documents maintained in version control (Git)

📈 Using This Dashboard

For Policy Owners (CEO)

  • Weekly Review: Check 🔴 Overdue and 🟡 Due Soon sections every Monday
  • Size Monitoring: Review 🔴 Oversized documents for consolidation opportunities
  • Quarterly Planning: Use "Upcoming Reviews (Next 90 Days)" to schedule review activities
  • Compliance Audits: Reference "Document Health Matrix" for audit evidence

For Stakeholders (Clients, Auditors, Partners)

  • ISMS Health: Review Status Summary for overall governance maturity
  • Compliance Coverage: Verify framework alignment for regulatory requirements
  • Transparency Validation: Compare dashboard dates with individual policy documents

Automation Details

  • Update Frequency: Automated weekly (every Monday 08:00 UTC)
  • Data Source: Metadata extracted from all *.md files in repository root
  • Size Monitoring: Document sizes calculated using wc -c command
  • Status Calculation:
    • 🔴 Overdue: Review date has passed
    • 🟡 Due Soon: Review date within 30 days
    • 🟢 Current: Review date more than 30 days away
  • Size Thresholds:
    • 🔴 Oversized: >40KB (requires consolidation)
    • 🟡 Large: 30-40KB (monitor for growth)
    • 🟢 Normal: <30KB (optimal size)
  • Generation Script: .github/scripts/generate-metrics.sh
  • Workflow: .github/workflows/update-metrics.yml

📋 Document Control:
✅ Generated by: Automated GitHub Actions Workflow
📤 Distribution: Public (GitHub Repository)
🏷️ Classification: Confidentiality: Public
📅 Last Generated: 2026-07-17 07:52 UTC
⏰ Next Update: Weekly (Automated)
🎯 Framework Compliance: ISO 27001 NIST CSF 2.0 CIS Controls