ISMS_REFERENCE_GUIDE.md

January 12, 2026 · View on GitHub

Hack23 AB Logo

🔐 Hack23 AB — ISMS Reference Guide

📘 Quick Reference: Homepage Blog → ISMS Policy Mapping

Transparency through precise documentation

Document owner: James Pether Sörling Version 1.0 Effective date: 2025-11-10 Review cycle: Quarterly

📄 Document | 🔐 Security Policy | 🌐 Public | ⚡ Living Document

🎯 Purpose Statement

"This reference guide maps Hack23's public-facing blog content to our Information Security Management System (ISMS) policies in the ISMS-PUBLIC repository. It ensures accurate, verifiable references from marketing content to operational security documentation—demonstrating that our cybersecurity consulting expertise is backed by auditable implementation, not marketing claims."

— James Pether Sörling, CEO / Cybersecurity Expert, Hack23 AB

📋 Blog Post to ISMS Policy Mapping

This guide documents the precise mapping between blog posts on hack23.com and the corresponding ISMS policies in our public ISMS-PUBLIC repository.

📧 Email Security

Blog Page: discordian-email-security.html

TopicPrimary PolicySection/AnchorStatusNotes
Email Authentication (SPF/DKIM/DMARC)Network_Security_Policy.md§ Email Security Architecture✅ VerifiedComprehensive email security controls including SPF, DKIM, DMARC, MTA-STS, TLS-RPT
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy
ISMS Repository RootISMS-PUBLICRepository home✅ VerifiedPublic ISMS documentation

Coverage Summary: Email security is comprehensively documented in the Network Security Policy's dedicated email section, covering all aspects of email authentication, transport security, and monitoring.

☁️ Cloud Security

Blog Page: discordian-cloud-security.html

TopicPrimary PolicySection/AnchorStatusNotes
AWS Cloud ArchitectureNetwork_Security_Policy.mdFull document✅ VerifiedVPC architecture, security groups, CloudFront, WAF
Cloud Access ControlAccess_Control_Policy.mdFull document✅ VerifiedIAM, MFA, least privilege
AWS Supplier DetailsSUPPLIER.md§ AWS Section✅ VerifiedAWS supplier risk assessment and controls
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy

Coverage Summary: Cloud security is distributed across Network Security Policy (technical controls), Access Control Policy (identity and permissions), and SUPPLIER.md (third-party risk management for AWS).

🏢 Physical Security

Blog Page: discordian-physical-security.html

TopicPrimary PolicySection/AnchorStatusNotes
Physical Security ControlsPhysical_Security_Policy.mdFull document✅ VerifiedStandalone policy covering office access, device protection, home office security
Device EncryptionCryptography_Policy.md§ Full Disk Encryption✅ VerifiedAES-256 FDE requirements
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy

Coverage Summary: Physical security has a dedicated standalone policy, with device encryption requirements cross-referenced in the Cryptography Policy.

📜 Acceptable Use

Blog Page: discordian-acceptable-use.html

TopicPrimary PolicySection/AnchorStatusNotes
Acceptable Use PolicyAcceptable_Use_Policy.mdFull document✅ VerifiedStandalone policy covering resource usage, prohibited activities, enforcement
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy

Coverage Summary: Acceptable Use has a comprehensive standalone policy document.

📊 Monitoring and Logging

Blog Page: discordian-monitoring-logging.html

TopicPrimary PolicySection/AnchorStatusNotes
Development LoggingSecure_Development_Policy.md§ Security Monitoring✅ VerifiedApplication-level security logging, audit trails
Network MonitoringNetwork_Security_Policy.md§ Monitoring sections✅ VerifiedCloudWatch, GuardDuty, Security Hub
Security MetricsSecurity_Metrics.mdFull document✅ VerifiedMonitoring dashboards, KPIs, metrics framework
Incident ResponseIncident_Response_Plan.md§ Detection & Monitoring✅ VerifiedIncident detection and response procedures
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy

Coverage Summary: Monitoring and logging coverage is distributed across multiple policies: Secure Development Policy (application logging), Network Security Policy (infrastructure monitoring), Security Metrics (measurement framework), and Incident Response Plan (detection procedures).

🔐 Remote Access

Blog Page: discordian-remote-access.html

TopicPrimary PolicySection/AnchorStatusNotes
Remote Access ControlsAccess_Control_Policy.mdFull document✅ VerifiedRemote access integrated into general access control (MFA, session management, least privilege)
Mobile Device ManagementMobile_Device_Management_Policy.mdFull document✅ VerifiedBYOD policy, mobile device security, remote work endpoints
Data Classification for Remote AccessCLASSIFICATION.md§ CIA Classification✅ VerifiedData classification framework guiding remote access controls
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy

Coverage Summary: Remote access is treated as a subset of general access control rather than having a standalone policy. Coverage spans Access Control Policy (authentication, authorization), Mobile Device Management Policy (endpoint security), and CLASSIFICATION.md (data handling requirements).

🎓 Security Training

Blog Page: discordian-security-training.html

TopicPrimary PolicySection/AnchorStatusNotes
Security Awareness TrainingInformation_Security_Policy.md§ Training & Awareness✅ VerifiedTraining requirements integrated into main security policy
Classification TrainingCLASSIFICATION.mdFull document✅ VerifiedData classification framework training requirements
Incident Response TrainingIncident_Response_Plan.md§ Training & Exercises✅ VerifiedIncident response drills and training

Coverage Summary: Security training is documented within the Information Security Policy rather than as a standalone document, with specialized training requirements in Classification and Incident Response documents.

🔒 Data Protection

Blog Page: discordian-data-protection.html

TopicPrimary PolicySection/AnchorStatusNotes
Privacy PolicyPrivacy_Policy.mdFull document✅ VerifiedGDPR compliance, data subject rights, retention policies
Data ClassificationData_Classification_Policy.mdFull document✅ VerifiedClassification framework for data protection requirements
Privacy LevelsCLASSIFICATION.md§ Privacy Levels✅ VerifiedPrivacy classification tiers
Encryption ControlsCryptography_Policy.mdFull document✅ VerifiedEncryption requirements for data protection
Access ControlsAccess_Control_Policy.mdFull document✅ VerifiedData access control requirements
Backup & RecoveryBackup_Recovery_Policy.mdFull document✅ VerifiedData backup and retention
Third-Party Data HandlingThird_Party_Management.md§ Data Processing✅ VerifiedSupplier data protection requirements
Incident ResponseIncident_Response_Plan.md§ Data Breach Response✅ VerifiedData breach notification procedures
General Security FrameworkInformation_Security_Policy.mdFull document✅ VerifiedOverarching security policy

Coverage Summary: Data protection has comprehensive coverage split between Privacy Policy (legal/regulatory requirements) and Data Classification Policy (technical controls), with supporting controls across multiple policies.

🏗️ ISMS Policy Architecture

Policy Organization Philosophy

Hack23's ISMS follows a modular, topic-focused architecture rather than creating redundant standalone policies for every blog topic. This approach:

✅ Reduces Redundancy: Avoids duplicating common controls across multiple documents
✅ Maintains Single Source of Truth: Each control defined once, referenced everywhere
✅ Improves Maintainability: Changes propagate automatically through cross-references
✅ Demonstrates Real Implementation: Structure reflects actual operational integration

Primary Policy Categories

📜 Policies (Requirements & Standards)

  • 🔐 Information_Security_Policy.md (master policy)
  • 🔐 Acceptable_Use_Policy.md
  • 🔐 Access_Control_Policy.md
  • 🔐 Network_Security_Policy.md
  • 🔐 Physical_Security_Policy.md
  • 🔐 Privacy_Policy.md
  • 🔐 Cryptography_Policy.md
  • 🔐 Data_Classification_Policy.md
  • 🔐 Mobile_Device_Management_Policy.md
  • 🔐 Secure_Development_Policy.md
  • 🔐 AI_Policy.md
  • 🔐 OWASP_LLM_Security_Policy.md
  • 🔐 Open_Source_Policy.md

📋 Plans (Procedures & Responses)

  • 📋 Incident_Response_Plan.md
  • 📋 Business_Continuity_Plan.md
  • 📋 Disaster_Recovery_Plan.md
  • 📋 Backup_Recovery_Policy.md

📊 Registers (Asset & Risk Management)

  • 📊 Asset_Register.md
  • 📊 Risk_Register.md
  • 📊 External_Stakeholder_Registry.md

🏷️ Frameworks (Standards & Methodologies)

  • 🏷️ CLASSIFICATION.md
  • 🏷️ Security_Metrics.md
  • 🏷️ Risk_Assessment_Methodology.md
  • 🏷️ Threat_Modeling.md

📄 Supporting Documents

  • 📄 SUPPLIER.md (third-party risk assessment)
  • 📄 Third_Party_Management.md
  • 📄 Change_Management.md
  • 📄 Vulnerability_Management.md
  • 📄 CRA_Conformity_Assessment_Process.md
  • 📄 Compliance_Checklist.md
  • 📄 ISMS_Transparency_Plan.md
  • 📄 STYLE_GUIDE.md

🔍 Verification & Testing

All ISMS policy links are verified through:

Automated Verification

  • ✅ GitHub Actions link checker (weekly)
  • ✅ Pre-deployment link validation
  • ✅ Broken link detection in CI/CD

Manual Verification

  • ✅ Quarterly ISMS review (per review cycle)
  • ✅ Blog content audit during ISMS updates
  • ✅ Cross-reference validation during policy changes

Testing Commands

# Verify all ISMS-PUBLIC links in blog files
grep -r "github.com/Hack23/ISMS-PUBLIC" *.html | wc -l

# Check for anchor existence by searching for the heading in the raw Markdown file
curl -s "https://raw.githubusercontent.com/Hack23/ISMS-PUBLIC/main/Network_Security_Policy.md" | grep -i "^##.*Email Security Architecture"

# Validate policy file existence
curl -I "https://raw.githubusercontent.com/Hack23/ISMS-PUBLIC/main/Acceptable_Use_Policy.md"
DocumentPurposeLink
🔐 ISMS-PUBLIC RepositoryComplete ISMS documentationGitHub
📘 ISMS Style GuideDocumentation standardsSTYLE_GUIDE.md
🏷️ Classification FrameworkCIA classification levelsCLASSIFICATION.md
📋 Compliance ChecklistISO 27001, NIST CSF, CIS ControlsCompliance_Checklist.md
🌐 Homepage RepositoryWebsite source codeGitHub

🔄 Maintenance Procedures

When Adding New Blog Posts

  1. Identify Topic Coverage: Determine which ISMS policies cover the blog topic
  2. Check for Existing Sections: Review policies for relevant section anchors
  3. Update This Guide: Add new blog post mapping to this reference guide
  4. Verify Links: Test all links before publication
  5. Cross-Reference: Ensure bidirectional references (blog ↔ ISMS)

When Updating ISMS Policies

  1. Check Blog References: Search homepage repository for references to updated policy
  2. Update Section Anchors: If section headings change, update blog anchor links
  3. Update This Guide: Reflect any policy reorganization
  4. Communication: Notify stakeholders of significant policy changes
  5. Version Control: Update policy version badges and dates

When Reorganizing ISMS Structure

  1. Impact Assessment: Identify all homepage references affected
  2. Redirect Strategy: Plan for deprecated policy redirects/mergers
  3. Batch Update: Update all homepage references simultaneously
  4. This Guide Update: Complete revision of mapping table
  5. Verification: Full link validation across entire homepage

📊 Current Status Summary

Last Verified: 2025-11-10
Total Blog Posts Mapped: 8 primary discordian-* blog posts
Total ISMS Policies Referenced: 30+ policies, plans, and frameworks
Broken Links: 0 ✅
Verification Status: All links verified and working

Blog PostISMS LinksStatusLast Verified
discordian-email-security.html3 references✅ Verified2025-11-10
discordian-cloud-security.html3 policies✅ Verified2025-11-10
discordian-physical-security.html3 policies✅ Verified2025-11-10
discordian-acceptable-use.html2 policies✅ Verified2025-11-10
discordian-monitoring-logging.html5 policies✅ Verified2025-11-10
discordian-remote-access.html3 policies✅ Verified2025-11-10
discordian-security-training.html3 policies✅ Verified2025-11-10
discordian-data-protection.html9 policies✅ Verified2025-11-10

📋 Document Control

✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification: Confidentiality: Public

📅 Effective Date: 2025-11-10
⏰ Next Review: 2026-02-10 (Quarterly)

🎯 Framework Compliance:
ISO 27001 NIST CSF 2.0 CIS Controls

🔗 Related Documents: ISMS Transparency Plan, Information Security Policy, Style Guide

Living documentation maintained through continuous improvement. Report discrepancies via GitHub Issues.