---

📋 Purpose Statement

"At Hack23 AB, we believe that true security comes through transparency and demonstrable practices. This document maps all Black Trigram project references to our publicly available Information Security Management System (ISMS), ensuring complete traceability, audit readiness, and transparent security governance."

— James Pether Sörling, CEO, Hack23 AB

This mapping document serves as the single source of truth for ISMS policy references within the Black Trigram project, consolidating work from multiple tracking efforts to provide:

• 🔍 Complete Coverage Mapping: Every Black Trigram security reference mapped to ISMS-PUBLIC policies
• ✅ Link Validation: Verification that all policy links are current and functional
• 📊 Gap Analysis: Identification of areas requiring additional ISMS documentation
• 🎯 Developer Guidance: Clear reference for implementing security requirements
• 🌐 Public Transparency: Demonstrable security practices for users and regulators

---

🎯 Document Scope

In Scope

This document covers all ISMS policy references across:

• ✅ Project Documentation (README.md, SECURITY.md, architecture docs)
• ✅ Security Assessments (THREAT_MODEL.md, CRA-ASSESSMENT.md)
• ✅ Development Guidelines (CONTRIBUTING.md, code comments)
• ✅ User-Facing Content (In-game disclaimers, privacy notices)
• ✅ CI/CD Workflows (GitHub Actions, security scanning configurations)

Out of Scope

• ❌ Internal Hack23 AB operational ISMS documentation (non-public)
• ❌ Third-party vendor ISMS documentation
• ❌ Project-specific implementation details (covered in project architecture docs)

---

🏗️ ISMS-PUBLIC Repository Structure

The public ISMS repository is located at: https://github.com/Hack23/ISMS-PUBLIC

📚 Available ISMS Documents

Category	Document	Relevance to Black Trigram	Primary References
🔐 Core Policies	Information Security Policy	⚡ Critical	README.md, SECURITY.md
🔐 Core Policies	Acceptable Use Policy	🟡 Medium	In-game disclaimers
🔐 Core Policies	Privacy Policy	🟠 High	Privacy notices, data handling
🔑 Access & Identity	Access Control Policy	🟢 Low	Development access only
🌐 Network & Infrastructure	Network Security Policy	🟡 Medium	Hosting, CDN configuration
🔒 Data Protection	Data Classification Policy	⚡ Critical	README.md classification badges
🔒 Data Protection	Cryptography Policy	🟢 Low	HTTPS/TLS only
🛠️ Development	Secure Development Policy	⚡ Critical	SECURITY_ARCHITECTURE.md, CRA-ASSESSMENT.md
🛠️ Development	Open Source Policy	⚡ Critical	LICENSE, dependency management
🛠️ Development	AI Policy	🟢 Low	Future AI-assisted gameplay
⚙️ Operations	Change Management	🟡 Medium	CI/CD workflows
⚙️ Operations	Vulnerability Management	🟠 High	Security scanning, Dependabot
⚙️ Operations	Incident Response Plan	🟡 Medium	Security issue handling
💾 Continuity	Business Continuity Plan	🟢 Low	Service availability
💾 Continuity	Disaster Recovery Plan	🟢 Low	Backup and recovery
💾 Continuity	Backup Recovery Policy	🟢 Low	Repository backups
🤝 Third Party	Third Party Management	🟡 Medium	CDN, GitHub, npm dependencies
🤝 Third Party	SUPPLIER.md	🟡 Medium	Vendor risk assessment
📊 Governance	Risk Assessment Methodology	🟠 High	THREAT_MODEL.md
📊 Governance	Risk Register	🟠 High	Risk tracking
📊 Governance	Asset Register	🟡 Medium	Asset inventory
📊 Governance	Security Metrics	🟡 Medium	Security KPIs
📊 Governance	Compliance Checklist	🟠 High	Regulatory compliance
🏷️ Frameworks	CLASSIFICATION.md	⚡ Critical	README.md badges, risk levels
🏷️ Frameworks	Threat Modeling	⚡ Critical	THREAT_MODEL.md methodology
🏷️ Frameworks	ISMS Transparency Plan	🟠 High	Public disclosure strategy
🔐 Specialized	Physical Security Policy	🟢 Low	Development workstation security
🔐 Specialized	Mobile Device Management Policy	🟢 Low	Mobile gameplay considerations
🔐 Specialized	OWASP LLM Security Policy	🟢 Low	Future AI integration
🏛️ Regulatory	CRA Conformity Assessment Process	⚡ Critical	CRA-ASSESSMENT.md
📋 Registry	External Stakeholder Registry	🟡 Medium	Community stakeholders
📖 Style	STYLE_GUIDE.md	🟡 Medium	Documentation standards

Legend:

• ⚡ Critical: Core dependency, referenced extensively
• 🟠 High: Important for security compliance
• 🟡 Medium: Referenced for specific features
• 🟢 Low: Minimal current relevance, future consideration

---

🗺️ Reference Mapping by Black Trigram Document

📄 README.md (Primary Project Documentation)

Total ISMS-PUBLIC References: 65

Section	ISMS Policy Referenced	Link Type	Purpose
Header - Public ISMS Repository	ISMS-PUBLIC Root	Direct link	Repository access
Header - Security Policy Link	Information Security Policy	Direct link	Policy overview
Badges - Project Type	CLASSIFICATION.md#project-type-classifications	Badge link	Frontend Apps classification
Badges - Process Type	CLASSIFICATION.md#project-type-classifications	Badge link	Marketing process
Badges - Confidentiality	CLASSIFICATION.md#confidentiality-levels	Badge link	Public classification
Badges - Integrity	CLASSIFICATION.md#integrity-levels	Badge link	Moderate integrity
Badges - Availability	CLASSIFICATION.md#availability-levels	Badge link	Standard availability
Badges - RTO	CLASSIFICATION.md#rto-classifications	Badge link	Recovery Time Objective
Badges - RPO	CLASSIFICATION.md#rpo-classifications	Badge link	Recovery Point Objective
Impact Assessment Table	CLASSIFICATION.md (Financial, Operational, Reputational, Regulatory)	Multiple badge links	CIA impact levels
Security Investment ROI	CLASSIFICATION.md#security-investment-returns	Badge links	ROI metrics
Competitive Differentiation	CLASSIFICATION.md#competitive-differentiation	Badge links	Market positioning
Porter's Five Forces	CLASSIFICATION.md#porters-five-forces	Badge links	Strategic analysis

Status: ✅ All links verified and functional

---

🛡️ THREAT_MODEL.md (Security Threat Analysis)

Total ISMS-PUBLIC References: 30

Section	ISMS Policy Referenced	Link Type	Purpose
Business Value Metrics	CLASSIFICATION.md	Badge links	Risk and value alignment
Threat Modeling Methodology	Threat_Modeling.md#architecture-centric-threat-modeling	Direct link	STRIDE methodology
MITRE ATT&CK Analysis	Threat_Modeling.md#mitre-attck-driven-analysis	Direct link	Attack framework
Risk-Centric Modeling	Threat_Modeling.md#risk-centric-threat-modeling	Direct link	Risk methodology
Top Risks Table	CLASSIFICATION.md	Badge links	Risk severity levels

Distributed Coverage Notes:

• Supply chain security: Covered across Secure_Development_Policy.md, Third_Party_Management.md, Open_Source_Policy.md
• Cultural content validation: Unique to Black Trigram, no specific ISMS policy (documented in project-specific THREAT_MODEL.md)
• Domain security: Covered in Network_Security_Policy.md

Status: ✅ All links verified and functional

---

📋 CRA-ASSESSMENT.md (EU Cyber Resilience Act Compliance)

Total ISMS-PUBLIC References: 21

Section	ISMS Policy Referenced	Link Type	Purpose
Related ISMS Documents	Cryptography Policy	Direct link	Encryption standards
Related ISMS Documents	Access Control Policy	Direct link	Identity management
Related ISMS Documents	Network Security Policy	Direct link	Network controls
Related ISMS Documents	Data Classification Policy	Direct link	Data protection
Related ISMS Documents	Secure Development Policy	Direct link	SDLC security
Related ISMS Documents	Change Management	Direct link	Release management
Related ISMS Documents	Vulnerability Management	Direct link	Security testing
Related ISMS Documents	Third Party Management	Direct link	Supplier risk
Related ISMS Documents	Open Source Policy	Direct link	OSS governance
Related ISMS Documents	Incident Response Plan	Direct link	Security events
Related ISMS Documents	Business Continuity Plan	Direct link	Resilience
Related ISMS Documents	Disaster Recovery Plan	Direct link	Recovery procedures
Related ISMS Documents	Backup Recovery Policy	Direct link	Data protection
Related ISMS Documents	Security Metrics	Direct link	KPI tracking
Related ISMS Documents	Asset Register	Direct link	Asset inventory
Related ISMS Documents	Risk Register	Direct link	Risk tracking
Related ISMS Documents	Risk Assessment Methodology	Direct link	Risk framework
Related ISMS Documents	Compliance Checklist	Direct link	Compliance tracking
Document Footer	CLASSIFICATION.md#confidentiality-levels	Badge link	Public classification

Status: ✅ All links verified and functional

---

🔚 End-of-Life-Strategy.md (Product Lifecycle Management)

Total ISMS-PUBLIC References: 3

Section	ISMS Policy Referenced	Link Type	Purpose
Asset Management	Asset Register	Direct link	Asset lifecycle tracking
Data Retention	Data Classification Policy	Direct link	Retention requirements
Classification Framework	CLASSIFICATION.md	Direct link	Decommissioning criteria

Status: ✅ All links verified and functional

---

🛡️ SECURITY_ARCHITECTURE.md (Security Architecture Documentation)

Total ISMS-PUBLIC References: 18

Section	ISMS Policy Referenced	Link Type	Purpose
Security Documentation Map	Information Security Policy	Direct link	Top-level policy alignment
Defense-in-Depth Strategy	Secure Development Policy	Direct link	SDLC security controls
Network Security & Perimeter	Network Security Policy	Direct link	CDN, TLS, DNSSEC controls
Data Protection & Key Management	Cryptography Policy	Direct link	Encryption and key management
Data Protection & Key Management	Data Classification Policy	Direct link	Data handling requirements
Authentication & Authorization	Access Control Policy	Direct link	Access management model
Vulnerability Management	Vulnerability Management	Direct link	Scanning and remediation
Threat Detection & Investigation	Threat Modeling	Direct link	Threat identification methodology
Application Security Controls	Open Source Policy	Direct link	SBOM, dependency governance
Application Security Controls	CRA Conformity Assessment Process	Direct link	EU CRA technical compliance
High Availability & Resilience	Backup Recovery Policy	Direct link	Recovery and resilience
Security Operations	Incident Response Plan	Direct link	Incident handling procedures
Compliance Framework Mapping	Compliance Checklist	Direct link	ISO 27001, NIST CSF, CIS mapping
Compliance Framework Mapping	CLASSIFICATION.md	Badge links	CIA classification levels
Security Investment	Security Metrics	Direct link	Security KPI tracking
Automated Security Operations	Change Management	Direct link	CI/CD pipeline security
Supply Chain Security	Third Party Management	Direct link	Vendor and dependency risk
Supply Chain Security	Risk Register	Direct link	Risk tracking and assessment

Status: ✅ All links verified and functional

---

🏗️ ARCHITECTURE.md (Technical Architecture Documentation)

Total ISMS-PUBLIC References: 8

Section	ISMS Policy Referenced	Link Type	Purpose
System Context	CLASSIFICATION.md	Reference	System classification context
Container View - CDN/Hosting	Network Security Policy	Reference	Infrastructure security alignment
Performance Architecture	Secure Development Policy	Reference	Secure coding practices
File Structure	Open Source Policy	Reference	Dependency structure governance
SWOT Analysis	Risk Assessment Methodology	Reference	Strategic risk alignment
Architecture Documentation Map	Information Security Policy	Reference	Documentation completeness
High Availability	Backup Recovery Policy	Reference	DR architecture alignment
Third-Party Dependencies	Third Party Management	Reference	CDN and hosting vendor governance

Status: ✅ All links verified and functional

---

🔍 Coverage Gap Analysis

✅ Well-Covered Areas

These Black Trigram aspects have strong ISMS policy coverage:

1. Data Classification & Protection ✅

   • README.md extensively references CLASSIFICATION.md
   • All CIA dimensions properly documented
   • Impact assessment tables complete

2. Secure Development Lifecycle ✅

   • CRA-ASSESSMENT.md maps to Secure_Development_Policy.md
   • CI/CD security covered by Change_Management.md
   • Vulnerability scanning aligned with Vulnerability_Management.md

3. Threat Modeling ✅

   • THREAT_MODEL.md follows ISMS Threat_Modeling.md methodology
   • STRIDE, MITRE ATT&CK, and risk-centric approaches documented
   • Risk severity properly classified

4. Supply Chain Security ✅

   • Distributed coverage across multiple policies
   • SBOM generation and dependency scanning documented
   • Third-party risk assessment processes defined

5. Security Architecture ✅ (NEW in v2.0)

   • SECURITY_ARCHITECTURE.md maps 18 ISMS policy references
   • Defense-in-depth strategy aligned with Information_Security_Policy.md
   • CRA conformity traceable via CRA_Conformity_Assessment_Process.md

6. Open Source Governance ✅ (NEW in v2.0)

   • Open_Source_Policy.md referenced in SECURITY_ARCHITECTURE.md, CRA-ASSESSMENT.md, THREAT_MODEL.md
   • Dependency management aligned with Third_Party_Management.md
   • SBOM and license compliance documented

🟡 Areas with Distributed Coverage

These topics span multiple ISMS policies (requires cross-referencing):

1. Cloud Infrastructure Security 🟡

   • Covered by: Network_Security_Policy.md, Access_Control_Policy.md, Third_Party_Management.md
   • Improvement in v2.0: SECURITY_ARCHITECTURE.md now provides consolidated infrastructure security mapping
   • Recommendation: Add explicit CDN and GitHub Pages references to ISMS-PUBLIC

2. Open Source Dependency Management 🟡 → ✅ (Improved in v2.0)

   • Covered by: Open_Source_Policy.md, Third_Party_Management.md, Vulnerability_Management.md
   • Improvement in v2.0: SECURITY_ARCHITECTURE.md and ARCHITECTURE.md now reference Open_Source_Policy.md directly
   • SBOM generation and license compliance documented in CRA-ASSESSMENT.md

3. User Privacy & GDPR Compliance 🟡

   • Covered by: Privacy_Policy.md, Data_Classification_Policy.md
   • Recommendation: Add Black Trigram-specific privacy examples to ISMS-PUBLIC

🔴 Coverage Gaps Requiring Action

1. Cultural Content Validation 🔴

   • Current State: Unique threat to Black Trigram (Korean cultural authenticity)
   • ISMS Coverage: No specific policy exists
   • Recommendation: Create "Cultural_Content_Policy.md" in ISMS-PUBLIC or document in project-specific guidelines
   • Priority: Medium (project-specific, not applicable to other Hack23 products)

2. Three.js/WebGL Security Best Practices 🟡 (Reduced from 🔴 in v2.0)

   • Current State: THREAT_MODEL.md identifies WebGL exploitation risks; project migrated from PixiJS to Three.js
   • ISMS Coverage: General Secure_Development_Policy.md; SECURITY_ARCHITECTURE.md now covers application security controls
   • Recommendation: Add "Frontend Graphics Security" section to Secure_Development_Policy.md
   • Priority: Medium (applies to all Hack23 games using Three.js/@react-three/fiber)

3. In-Game ISMS Reference Display 🟢

   • Current State: No in-game UI currently links to ISMS-PUBLIC
   • ISMS Coverage: ISMS_Transparency_Plan.md encourages public disclosure
   • Recommendation: Add "About" or "Security" menu option linking to ISMS-PUBLIC
   • Priority: Low (nice-to-have for transparency)

---

🎮 In-Game ISMS References

Current Implementation

Location: src/components/intro/IntroScreen.tsx

Existing References:

• Line 649: GitHub repository link (https://github.com/Hack23/blacktrigram)
• Line 682-686: Release version link

Status: ⚠️ No current in-game ISMS-PUBLIC links

Recommended Implementation

Add ISMS reference to Philosophy screen or About dialog:

// Recommended addition to Philosophy or Settings screen
<pixiText
  text="🔐 View Our Public Security Policies"
  style={{
    fontSize: 14,
    fill: KOREAN_COLORS.ACCENT_GOLD,
    align: "center",
    fontWeight: "bold",
  }}
  interactive={true}
  onPointerTap={() =>
    window.open("https://github.com/Hack23/ISMS-PUBLIC", "_blank")
  }
  anchor={0.5}
  data-testid="isms-link"
/>

Korean Translation: "공개 보안 정책 보기" (Gong-gae Bo-an Jeong-chaek Bo-gi)

---

📊 Link Validation Summary

Validation Methodology

All ISMS-PUBLIC links validated on 2026-03-19 using:

1. Automated link checker against live GitHub repository
2. Manual verification of anchor links and sections
3. HTTPS certificate validation
4. Response time monitoring

Results

Document	Total Links	Valid	Broken	Status
README.md	65	65	0	✅ Pass
THREAT_MODEL.md	30	30	0	✅ Pass
CRA-ASSESSMENT.md	21	21	0	✅ Pass
SECURITY_ARCHITECTURE.md	18	18	0	✅ Pass
ARCHITECTURE.md	8	8	0	✅ Pass
End-of-Life-Strategy.md	3	3	0	✅ Pass
TOTAL	145	145	0	✅ 100% Valid

Validation Date: 2026-03-19
Next Validation: 2026-06-19 (Quarterly)

---

🛠️ Developer Quick Reference

How to Reference ISMS Policies

When adding new security features or documentation:

1. Identify the Security Domain

   • Access Control? → Access_Control_Policy.md
   • Data Protection? → Data_Classification_Policy.md
   • Development? → Secure_Development_Policy.md
   • Third-Party? → Third_Party_Management.md

2. Use the Standard Link Format

   [Policy Name](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Policy_Name.md)
   

3. For Section Anchors

   [Specific Section](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Policy_Name.md#section-anchor)
   

4. For Classification Badges

   [![Badge Label](https://img.shields.io/badge/Label-Value-color?style=for-the-badge&logo=icon&logoColor=white)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#anchor)
   

Quick Policy Lookup

Need	Policy	Link
Add new dependency	Open Source Policy	Link
Handle security issue	Incident Response Plan	Link
Classify new data	Data Classification Policy	Link
Add CI/CD step	Change Management	Link
Third-party service	Third Party Management	Link
Model threats	Threat Modeling	Link
Assess vulnerabilities	Vulnerability Management	Link
EU CRA compliance	CRA Conformity Assessment	Link
Evaluate risk	Risk Assessment Methodology	Link

---

📋 Related Documents

Icon	Document	Relationship
📖	ISMS-PUBLIC README	Master ISMS documentation index
🏷️	CLASSIFICATION.md	Classification framework (heavily referenced)
🛡️	THREAT_MODEL.md	Black Trigram threat analysis
📋	CRA-ASSESSMENT.md	EU CRA compliance assessment
🔐	SECURITY_ARCHITECTURE.md	Current security implementation
🏗️	ARCHITECTURE.md	Technical architecture documentation
🔮	FUTURE_SECURITY_ARCHITECTURE.md	Planned security enhancements
📊	README.md	Project overview with ISMS badges
🔚	End-of-Life-Strategy.md	Product lifecycle management

---

📝 Maintenance & Updates

Review Schedule

• Quarterly Review: Validate all 145 links, check for new ISMS policies
• Post-ISMS Update: Update mappings within 5 business days of ISMS-PUBLIC changes
• Major Feature Addition: Update this document when adding significant Black Trigram features
• Regulatory Changes: Immediate review if CRA or GDPR requirements evolve

Change Log

Version	Date	Changes	Author
1.0	2025-11-10	Initial ISMS reference mapping, consolidation of issues #560 and #561	ISMS Ninja
2.0	2026-03-19	Major update: Added SECURITY_ARCHITECTURE.md (18 refs) and ARCHITECTURE.md (8 refs) mappings; expanded Quick Policy Lookup; updated gap analysis; total links 119→145	Documentation Writer

Document Ownership

• Primary Owner: Security Team (security@hack23.com)
• Technical Owner: Development Lead
• Review Authority: CEO (James Pether Sörling)

---

🎯 Success Metrics

This document is successful when:

• ✅ 100% Link Validation: All ISMS-PUBLIC references functional
• ✅ Zero Broken References: No dead links in any Black Trigram documentation
• ✅ Developer Adoption: Team uses this as primary ISMS reference guide
• ✅ Audit Readiness: Regulators can trace all security claims to ISMS policies
• ✅ Public Transparency: External stakeholders can verify our security practices

---