Information_Security_Policy.md

June 28, 2026 · View on GitHub

Hack23 Logo

🔐 Hack23 AB — Information Security Policy

🛡️ Security Through Transparency and Excellence
🎯 Enterprise-grade Security for Innovation-driven Consulting

Owner Version Effective Date Review Cycle

📋 Document Owner: CEO | 📄 Version: 2.1 | 📅 Last Updated: 2026-06-28 (UTC)
🔄 Review Cycle: Annual | ⏰ Next Review: 2027-06-28

🎯 Purpose Statement

Hack23 AB represents a new paradigm in technology companies - where enterprise-grade security expertise directly enables innovation rather than constraining it. This Information Security Policy embodies our fundamental principle: our ISMS is not separate from our business - it IS our business model.

As a cybersecurity consulting company, our own security posture serves as both our operational foundation and our marketing demonstration. Every security control we implement, every process we document, and every risk we mitigate showcases our expertise to potential clients while protecting our own valuable assets.

Our commitment to transparency extends to this policy itself - demonstrating that true security comes from robust processes, continuous improvement, and a culture where security considerations are integral to every business decision.

— James Pether Sörling, CEO/Founder

🔍 Purpose & Scope

Purpose

This policy establishes the information security framework for Hack23 AB, ensuring the confidentiality, integrity, and availability of all information assets while supporting our mission of secure product development, AI-augmented political intelligence, and cybersecurity consulting excellence.

Scope

This policy applies to:

🏢 Organizational Context

Hack23 AB is a Swedish innovation hub operating five integrated business lines across nine public repositories, each classified per the Classification Framework:

  • 🔐 Cybersecurity Consulting: Enterprise-grade security advisory and ISMS implementation services
  • 📊 CIA Compliance Manager: Automated compliance assessment and evidence-generation platform, also published as a reusable npm library
  • 🏛️ Citizen Intelligence Agency: Open-source political transparency and democratic accountability platform
  • 🎮 Black Trigram: Immersive Korean martial arts educational gaming experience
  • 📡 Political Intelligence & AI News Media: AI-disrupted political intelligence and autonomous news generation — Riksdagsmonitor, EU Parliament Monitor, and the European Parliament MCP Server

Hack23 operates as an AI-augmented company, where a curated ecosystem of specialist AI agents operates under CEO oversight per the 🤖 AI-First Operations Governance section below. Our security approach reflects our business model: demonstrating security excellence through transparent implementation.

🔒 Information Security Principles

Core Principles

  1. 🔐 Security by Design: Security considerations integrated from conception, delivering 🏆 competitive advantage through protected innovations and 🤝 customer trust via demonstrable privacy controls

  2. 🌟 Transparency: Open documentation enhances security posture while demonstrating expertise, creating 💼 partnership value through reputation as a secure business partner and enabling 💡 innovation enablement for new digital initiatives

  3. 🔄 Continuous Improvement: Regular assessment and enhancement of controls drives ⚙️ operational efficiency and 🔄 operational excellence, ensuring near-continuous operations that maintain revenue streams

  4. ⚖️ Business Value Focus: Security measures proportional to business impact, maximizing 💰 cost efficiency through reduced data errors, 💰 cost avoidance via breach prevention, and 💰 revenue protection through minimal service interruptions

  5. 🤝 Stakeholder Engagement: Security as a business enabler creating 🤝 trust enhancement with customers and partners, 📊 decision quality through trustworthy data, and 📋 compliance posture supporting regulatory requirements

  6. 🛡️ Risk Reduction: Comprehensive risk management reducing likelihood of business disruptions while maintaining 🏆 service reliability for superior uptime and 🤝 trust maintenance through consistent delivery

👥 Roles and Responsibilities

CEO/Founder (James Pether Sörling)

As the sole employee and decision-maker, the CEO maintains comprehensive responsibility for all aspects of information security:

🔐 Information Security Leadership

  • ISMS Owner: Overall responsibility for ISMS design, implementation, and effectiveness
  • Risk Owner: Accountable for all identified risks in the Risk Register
  • Policy Authority: Approve all security policies and procedures
  • Incident Commander: Lead response to all security incidents per Incident Response Plan

🛡️ Technical Security Management

  • Security Architecture: Design and maintain security controls across all systems
  • Access Control: Manage all user accounts and permissions per Access Control Policy
  • Vulnerability Management: Execute scanning, assessment, and remediation per Vulnerability Management
  • Cryptography Management: Implement encryption standards per Cryptography Policy

📋 Compliance and Governance

🔄 Business Continuity

🚀 Development Security

📊 Monitoring and Measurement

External Responsibilities

While Hack23 AB operates as a single-person company, certain specialized responsibilities may be delegated to external parties:

  • Review and advise on compliance requirements
  • Support contract negotiations with critical suppliers
  • Provide guidance on regulatory changes

Insurance Provider

  • Assess cyber liability coverage adequacy
  • Support incident response when claims are involved
  • Provide risk management guidance

External Auditors (When Required)

  • Conduct independent ISMS assessments
  • Validate compliance with ISO 27001 requirements
  • Provide recommendations for improvement

🤖 AI-First Operations Governance

Hack23 AB operates an AI-first operating model where GitHub Copilot custom agents are core strategic enablers for enterprise-grade delivery. This section establishes governance requirements; detailed architecture and workflows are documented in Information Security Strategy.

Governance Principles

Human Oversight: CEO maintains ultimate authority over all agent activities. All agent-created pull requests require CEO approval before merge.

ISMS Integration: All agents load ISMS-PUBLIC policies as mandatory context, ensuring compliance with AI Policy, Secure Development Policy, and Open Source Policy.

Least Privilege: Agents operate with minimal tool sets and permissions required for their designated functions.

Audit Trail: All agent activities are logged through GitHub's audit mechanisms, enabling complete traceability.

Agent Tiers

  1. Curator-Agent — Maintains agent fleet configuration (profiles, MCP configs, workflows)
  2. Task Agents — Product-specific analysis and issue creation with ISMS policy mappings
  3. Specialist Agents — Domain-specific implementation (security, development, testing, documentation)

CEO Control Points

  • Sets strategic direction for agent analysis priorities
  • Approves all agent-created pull requests
  • Approves all workflow and configuration changes
  • Retains responsibility for production changes and policy evolution

🚫 Segregation of Duties

ISO 27001:2022 Control A.5.3 requires segregation of duties to reduce opportunities for unauthorized or unintentional modification or misuse of organizational assets. As a single-person organization, Hack23 AB implements comprehensive compensating controls documented in the dedicated 🚫 Segregation of Duties Policy.

The policy defines:

  • 15 Incompatible Role Pairs: System Admin/Auditor, Developer/Deployer, Financial Approver/Processor, and 12 additional critical separations
  • Compensating Controls: Temporal separation, tool-based enforcement, audit trails, external validation, automated anomaly detection
  • Risk-Based Workflow: Differentiated approval processes for high/medium/low risk changes
  • Monitoring Framework: Continuous, quarterly, and annual audit procedures
  • Break-Glass Procedures: Emergency response protocols with enhanced logging

See 🚫 Segregation of Duties Policy for complete matrix, workflows, and control details.

👔 Management Commitment and Responsibilities

🎯 CEO/Founder Accountability

As a single-person company, James Pether Sörling (CEO/Founder) holds direct responsibility for all ISMS activities:

  • Approves and follows all information security policies defined in this ISMS
  • Allocates time and resources for security implementation and maintenance
  • Reviews ISMS effectiveness quarterly through documented self-assessments
  • Manages all risks documented in the Risk Register
  • Ensures compliance with ISO 27001:2022, NIST CSF 2.0, and CIS Controls v8.1
  • Continuously improves security processes based on lessons learned and industry best practices

💰 Resource Management

The CEO/Founder commits resources appropriate for a single-person operation:

  • Budget: Security tools, cloud services (AWS), and external auditors as needed
  • Time: Quarterly ISMS reviews and ongoing security maintenance activities
  • Expertise: Leverages cybersecurity consulting background and engages external specialists when required

📋 Policy Approval and Maintenance

As the sole decision-maker:

  • The CEO/Founder approves all ISMS policies and major security changes
  • Policy reviews occur at least annually, with updates as needed
  • All approvals are documented through version control and dated signatures in policy documents
  • No delegation is required in a single-person organization

📊 Performance Monitoring

The CEO/Founder monitors ISMS effectiveness through:

  • Quarterly Reviews: Assessment of security metrics, incidents, risks, and compliance status
  • Key Metrics: OpenSSF Scorecard scores, vulnerability remediation times, backup success rates
  • Documentation: Review findings documented in quarterly management review records

Detailed metrics are maintained in Security Metrics Dashboard.

⚖️ Risk Management

The CEO/Founder manages all information security risks:

  • Reviews and updates the Risk Register quarterly
  • Evaluates treatment options and accepts residual risks with documented rationale
  • High and critical risks require explicit acceptance documentation
  • All risk decisions are recorded in the Risk Register

🚨 Incident Management

The CEO/Founder handles all security incidents:

  • Follows procedures defined in the Incident Response Plan
  • Responds to all incidents according to severity (immediate action for high/critical incidents)
  • Documents incidents and lessons learned
  • Implements corrective actions to prevent recurrence

✅ Compliance and Audits

The CEO/Founder maintains compliance through:

  • Quarterly self-assessment against Compliance Checklist
  • Annual external audits when pursuing ISO 27001 certification
  • Prompt review and remediation of any audit findings
  • Documentation of compliance status and improvement actions

🔄 Continuous Improvement

The CEO/Founder continuously improves the ISMS through:

  • Plan: Set security objectives, identify improvements (quarterly planning)
  • Do: Implement security controls and procedures as defined in ISMS policies
  • Check: Review effectiveness through quarterly assessments and metrics
  • Act: Update policies and controls based on lessons learned and audit findings

Improvement objectives include increasing OpenSSF Scorecard scores, reducing incident response times, and advancing ISO 27001 certification readiness.

📅 Quarterly Management Review

The CEO/Founder conducts a quarterly ISMS self-assessment covering:

  1. Incidents: Review any security incidents and lessons learned
  2. Metrics: Check security metrics (OpenSSF scores, vulnerabilities, backups)
  3. Risks: Update Risk Register with new or changed risks
  4. Compliance: Review Compliance Checklist status
  5. Improvements: Identify and document improvement opportunities

Documentation: Each review is documented with date, findings, decisions, and action items. Reviews are scheduled quarterly (March, June, September, December) with ad-hoc reviews as needed for major incidents or changes.

Simple Review Template

# Quarterly ISMS Review - Q[X] [YYYY]

**Date**: [YYYY-MM-DD]
**Reviewer**: James Pether Sörling, CEO

## Review Areas

1. **Incidents**: [Any incidents? Lessons learned?]
2. **Metrics**: [OpenSSF scores, vulnerabilities, backup status]
3. **Risks**: [New/changed risks? Updates to Risk Register?]
4. **Compliance**: [Compliance Checklist status, any gaps?]
5. **Improvements**: [What can be improved? Action items?]

## Decisions & Actions

- **Risk Decisions**: [Any risks accepted/mitigated?]
- **Policy Updates**: [Any policies need updating?]
- **Action Items**: 
  - [ ] [Action 1] - Due: [Date]
  - [ ] [Action 2] - Due: [Date]

## Next Review

**Date**: [YYYY-MM-DD] (Q[X] [YYYY])

---
**Completed by**: James Pether Sörling, CEO | **Date**: [YYYY-MM-DD]

This lightweight template provides the essential documentation required for ISO 27001:2022 Clause 9.3 compliance.

🏗️ Management Governance (Single-Person Organization)

In a single-person company, the CEO/Founder handles all management responsibilities:

flowchart LR
    CEO["👤 CEO/Founder<br/>James Pether Sörling"]
    
    CEO --> Approve["📋 Approves<br/>Policies & Changes"]
    CEO --> Follow["✅ Follows<br/>ISMS Procedures"]
    CEO --> Review["🔄 Reviews<br/>Quarterly"]
    CEO --> Improve["🚀 Improves<br/>Continuously"]
    
    Auditors["👨‍💼 External Auditors"] -.->|Validate| CEO
    
    style CEO fill:#2E7D32,stroke:#2E7D32,stroke-width:3px,color:#fff
    style Approve fill:#1565C0,stroke:#0D47A1,stroke-width:2px,color:#fff
    style Follow fill:#1565C0,stroke:#0D47A1,stroke-width:2px,color:#fff
    style Review fill:#FF9800,stroke:#F57C00,stroke-width:2px,color:#fff
    style Improve fill:#FF9800,stroke:#F57C00,stroke-width:2px,color:#fff
    style Auditors fill:#7B1FA2,stroke:#4A148C,stroke-width:2px,color:#fff

The CEO/Founder maintains accountability through documented decisions, quarterly self-assessments, and external validation when needed.

📊 Document Integration Matrix

Security DomainPrimary PolicySupporting DocumentsRegistersProcedures
🔑 Identity & Access🔑 Access Control Policy✅ Acceptable Use Policy, 📱 Mobile Device Management Policy, 💻 Asset Register, 📉 Risk Register💻 Asset Register🚨 Incident Response Plan
🏠 Physical Security🏠 Physical Security Policy✅ Acceptable Use Policy, 📱 Mobile Device Management Policy, 💻 Asset Register💻 Asset Register🚨 Incident Response Plan
📱 Endpoint Security📱 Mobile Device Management Policy🏠 Physical Security Policy, 🔑 Access Control Policy, 🔒 Cryptography Policy💻 Asset Register🚨 Incident Response Plan
🏷️ Data Protection🏷️ Data Classification Policy🔒 Cryptography Policy, 💾 Backup Recovery Policy💻 Asset Register🚨 Incident Response Plan
🌐 Network Security🌐 Network Security Policy🔑 Access Control Policy💻 Asset Register📝 Change Management
🤝 Third-Party Risk🤝 Third Party Management🔗 Supplier Security Posture💻 Asset Register, 📉 Risk Register🚨 Incident Response Plan
🔄 Business Continuity🔄 Business Continuity Plan🆘 Disaster Recovery Plan, 💾 Backup Recovery Policy💻 Asset Register🚨 Incident Response Plan
🛠️ Development Security🛠️ Secure Development Policy🔓 Open Source Policy, 📝 Change Management, 🎯 Threat Modeling💻 Asset Register🔍 Vulnerability Management
🤖 AI Governance🤖 AI Governance Policy🔐 Information Security Policy, 📊 Risk Assessment Methodology💻 Asset Register, 📉 Risk Register🤝 Third Party Management
✅ Compliance✅ Compliance ChecklistAll policies📉 Risk Register🚨 Incident Response Plan

This Information Security Policy integrates with and references the complete ISMS documentation suite:

🏛️ Primary ISMS Framework

🔐 Core Security Policies

🚨 Operational Plans and Procedures

📊 Asset and Risk Management

🤝 Third Party & Supply Chain

✅ Compliance and Governance

📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification: Confidentiality: Public
📅 Effective Date: 2026-06-28
⏰ Next Review: 2027-06-28
🎯 Framework Compliance: ISO 27001 NIST CSF 2.0 CIS Controls