FinancialSecurityPlan.md
May 30, 2026 · View on GitHub
💰 Riksdagsmonitor — Financial & Security Plan
📊 Infrastructure Cost Analysis & Security Investment
🔗 Secure Development Policy · Classification Framework
📋 Document Owner: CEO | 📄 Version: 1.3 | 📅 Last Updated: 2026-05-28 (UTC)
🔄 Review Cycle: Annual | ⏰ Next Review: 2027-05-28
📋 Purpose
This document outlines the financial and security implementation plan for the Riksdagsmonitor platform — a static HTML5/CSS3 website providing Swedish Parliament transparency across 14 languages.
Riksdagsmonitor uses a dual-deployment architecture with AWS CloudFront + S3 as the primary delivery mechanism and GitHub Pages as the disaster recovery standby, as detailed in the Business Continuity Plan. For architectural context, see the Architecture Documentation and End-of-Life Strategy.
💵 Cost Summary — Dual Deployment Architecture
Cash Flow Overview
| Time Frame | Monthly (USD) | Annual (USD) |
|---|---|---|
| Primary Infrastructure (AWS) | $7.50 | $90.00 |
| DR Infrastructure (GitHub Pages) | $0.00 | $0.00 |
| Domain Registration | $1.00 | $12.00 |
| Security Tooling | $0.00 | $0.00 |
| Development CI/CD | $0.00 | $0.00 |
| Grand Total | $8.50 | $102.00 |
Note: Riksdagsmonitor leverages free-tier and open-source services extensively. The primary recurring costs are AWS S3/CloudFront hosting (including Route 53 DNS) and domain registration. All security tooling is free for open-source projects.
🏗️ Infrastructure Cost Breakdown
Primary Deployment: AWS CloudFront + S3
| Component | AWS Service | Monthly (USD) | Annual (USD) | Notes |
|---|---|---|---|---|
| Static Hosting | S3 Standard | $0.50 | $6.00 | ~5 GB storage, static HTML/CSS/JS/data |
| CDN | CloudFront | $5.00 | $60.00 | Global edge caching, ~50 GB/month transfer |
| SSL/TLS | ACM (Certificate Manager) | $0.00 | $0.00 | Free public certificates |
| DNS | Route 53 | $1.00 | $12.00 | Hosted zone + health checks |
| Monitoring | CloudWatch (basic) | $0.00 | $0.00 | Basic metrics included |
| Failover | Route 53 Health Checks | $1.00 | $12.00 | 2 health checks for failover |
| Subtotal (AWS) | $7.50 | $90.00 |
Disaster Recovery: GitHub Pages (Standby)
| Component | Service | Monthly (USD) | Annual (USD) | Notes |
|---|---|---|---|---|
| Hosting | GitHub Pages | $0.00 | $0.00 | Free for public repos |
| CDN | GitHub Pages CDN (Fastly) | $0.00 | $0.00 | Included with GitHub Pages |
| SSL/TLS | Let's Encrypt (via GitHub) | $0.00 | $0.00 | Automatic HTTPS |
| Subtotal (DR) | $0.00 | $0.00 |
Domain & Registration
| Component | Service | Monthly (USD) | Annual (USD) | Notes |
|---|---|---|---|---|
| Domain | riksdagsmonitor.com | $1.00 | $12.00 | Annual domain renewal |
| DNS | Route 53 Hosted Zone | $0.00 | $0.00 | Included in AWS section above (Route 53 line) |
| SSL Certificate | ACM | $0.00 | $0.00 | Free for AWS services |
| Subtotal (Domain) | $1.00 | $12.00 | Domain registration only; DNS cost in AWS section |
🔐 Security Investment Analysis
Current Security Services (All Free Tier / Open Source)
| Security Service | Provider | Annual Cost | ISMS Policy Alignment |
|---|---|---|---|
| SAST Scanning | CodeQL | $0.00 | Secure Development Policy |
| Dependency Scanning | Dependabot + npm audit | $0.00 | Vulnerability Management |
| Secret Scanning | GitHub Secret Scanning | $0.00 | Cryptography Policy |
| Supply Chain Security | SLSA Build Provenance + OpenSSF Scorecard | $0.00 | Secure Development Policy |
| SBOM Generation | GitHub SBOM (SPDX format) | $0.00 | Secure Development Policy |
| CI/CD Hardening | step-security/harden-runner | $0.00 | Secure Development Policy |
| HTML Validation | HTMLHint | $0.00 | Secure Development Policy |
| Dead Code Detection | knip | $0.00 | Secure Development Policy |
| Unit Testing | Vitest | $0.00 | Secure Development Policy |
| E2E Testing | Cypress (OSS) | $0.00 | Secure Development Policy |
| Performance Monitoring | Lighthouse CI | $0.00 | Quality gates |
| Total Security Tooling | $0.00 |
Security ROI Metrics
| Metric | Value | Source |
|---|---|---|
| Total Annual Security Investment | $0/year | Free OSS tooling |
| Total Annual Infrastructure | $102/year | AWS + domain costs |
| Security-to-Infrastructure Ratio | Included | Security is built-in, not bolt-on |
| Vulnerability Detection Rate | >95% | Automated scanning pipeline (CodeQL + Dependabot + npm audit) |
| Mean Time to Detect (MTTD) | <24 hours | Automated CI/CD scanning on every push |
| Mean Time to Remediate (MTTR) | <48 hours critical, <7 days high | Dependabot auto-merge + manual review |
| Supply Chain Score | OpenSSF Scorecard | Automated weekly assessment |
| Build Attestation | SLSA Level 3 | Provenance attached to every release |
🛡️ ISMS Policy Alignment
Security Investment by ISMS Policy
| 🛡️ ISMS Policy | 💰 Annual Investment | 🔧 Services | 📊 Business Value |
|---|---|---|---|
| Incident Response Plan | $12.00 | Route 53 Health Checks | Automated failover detection DR activation capability |
| Vulnerability Management | $0.00 | Dependabot + CodeQL + npm audit | Continuous vulnerability scanning Automated patch PRs |
| Cryptography Policy | $0.00 | ACM + SRI + GitHub Secret Scanning | TLS 1.3 certificates Subresource integrity Secret leak prevention |
| Network Security Policy | $60.00 | CloudFront | DDoS protection (AWS Shield Standard) Edge caching reduces origin exposure |
| Information Security Policy | $0.00 | CloudWatch (basic) + GitHub Audit Log | Infrastructure monitoring Repository access auditing |
| Business Continuity Plan | $30.00 | S3 ($6) + Route 53 DNS ($12) + Domain ($12) | Dual-deployment resilience GitHub Pages DR at $0 additional |
| Secure Development Policy | $0.00 | SLSA + SBOM + harden-runner | Supply chain security Build provenance attestation |
| Total | $102.00 |
Cost Efficiency Analysis
┌─────────────────────────────────────────────────────────────────┐
│ Annual Cost Distribution │
├─────────────────────────────────────────────────────────────────┤
│ │
│ CloudFront CDN █████████████████████████████████ \$60 (59%)│
│ Route 53 DNS ██████ \$12 (12%) │
│ Route 53 Health ██████ \$12 (12%) │
│ Domain Registration ██████ \$12 (12%) │
│ S3 Storage ███ \$6 (6%) │
│ Security Tooling (included in free tier) \$0 (0%) │
│ │
│ Total: \$102/year (\$8.50/month) │
└─────────────────────────────────────────────────────────────────┘
Key Insight: By leveraging open-source security tooling and GitHub's free tier for public repositories, Riksdagsmonitor achieves enterprise-grade security posture at near-zero security cost. The entire annual budget of $102 is spent on infrastructure availability, not security tooling.
💡 Included Security Features (Zero Additional Cost)
AWS Shield Standard (Included with CloudFront)
- DDoS Protection: Automatic layer 3/4 DDoS mitigation
- Always-On Detection: Network flow monitoring for volumetric attacks
- No Additional Cost: Included with every CloudFront distribution
GitHub Advanced Security (Free for Public Repos)
- CodeQL Analysis: Semantic code analysis for JavaScript/TypeScript vulnerabilities
- Dependabot Alerts: Real-time vulnerability notifications for all dependencies
- Secret Scanning: Detection of leaked credentials in commits
- Security Advisories: Coordinated vulnerability disclosure workflow
Build Integrity (Free)
- SLSA Build Provenance: Cryptographic attestation of build process
- SBOM (SPDX): Software Bill of Materials for supply chain transparency
- SRI Hashes: Subresource Integrity for all CDN-loaded assets
- SHA-Pinned Actions: Supply chain protection for CI/CD pipeline
📈 Future Cost Projection
Potential Cost Increases
| Scenario | Trigger | Additional Monthly Cost | Additional Annual Cost |
|---|---|---|---|
| Traffic Growth (10x) | Viral content / election period | +$20.00 | +$240.00 |
| AWS WAF Addition | Targeted attack mitigation | +$10.00 | +$120.00 |
| CloudFront Functions | Edge-side language routing | +$2.00 | +$24.00 |
| AWS GuardDuty | Enhanced threat detection | +$15.00 | +$180.00 |
| Worst-Case Total | All scenarios combined | $59.00 | $708.00 |
Cost Optimisation Opportunities
| Opportunity | Potential Savings | Implementation |
|---|---|---|
| CloudFront Reserved Capacity | 10–20% on data transfer | Commit to 12-month pricing |
| S3 Intelligent Tiering | 5–10% on storage | Enable for data archives |
| Consolidated billing | Shared across Hack23 repos | AWS Organizations |
📚 Related Documents
🏗️ Architecture & Planning
- 🏛️ Architecture — System architecture overview
- 🚀 Future Architecture — Long-term architectural vision
- 📅 End-of-Life Strategy — Technology lifecycle management
- 📋 README — Project overview and quick links
🛡️ Security & Compliance
- 🛡️ Security Architecture — Security model details
- 🎯 Threat Model — Risk-driven justification for security services
- 📋 CRA Assessment — EU Cyber Resilience Act compliance
- 🔒 Security Policy — Vulnerability disclosure and management
🔄 Operations & Lifecycle
- 📋 BCP Plan — Business continuity and disaster recovery
- 🚀 Release Process — Release procedures with attestations
- 🔄 CI/CD Workflows — Security-hardened CI/CD pipelines
- 🔮 Future Workflows — Enhanced CI/CD roadmap
🔐 ISMS Policies
- 🔐 Information Security Policy — Overall security governance
- 🔍 Vulnerability Management — Security testing and remediation
- 🚨 Incident Response Plan — Security incident management
- 🏷️ Classification Framework — Business impact and risk assessment
📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification: 
📅 Effective Date: 2026-05-28
⏰ Next Review: 2027-05-28
🎯 Framework Compliance: 
🌐 IMF Integration — Financial Risk Note
Effective: 2026-04-24 · Authoritative hub:
analysis/imf/README.md·analysis/imf/agentic-integration.md·analysis/imf/indicators-inventory.json·analysis/imf/data-dictionary.md·.github/aw/ECONOMIC_DATA_CONTRACT.md
IMF cost surface
| Item | Cost | Notes |
|---|---|---|
| IMF Datamapper REST API | €0 | Free, public, anonymous; no paid tier |
| IMF SDMX 3.0 endpoint | €0 | Free, public, anonymous; no paid tier |
| IMF data redistribution licence | €0 | Attribution required — no licence fee |
| Egress bandwidth (IMF responses) | Negligible | <50 MB/month per workflow on cache-first strategy |
IMF financial risks
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| IMF introduces a paid tier for high-volume access | LOW | LOW | Cache-first design keeps us under any plausible free-tier ceiling |
| IMF Datamapper deprecation forces migration to commercial provider (e.g., Refinitiv, Bloomberg) | LOW | HIGH | SDMX 3.0 is the open standard fallback; no commercial provider needed for the open IMF data we use |
| IMF data licence change requires paid attribution scheme | LOW | LOW | Attribution is current free requirement; downside is operational not financial |
IMF financial benefit
The IMF-primary, WB-residue, SCB-Sweden split avoids any commercial economic-data subscription that the platform might otherwise need (Bloomberg Terminal Data Feed ~€20K/seat/year, Refinitiv ~€15K/seat/year). Free-tier IMF coverage is the deliberate financial-resilience choice.
Canonical rule. Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See ECONOMIC_DATA_CONTRACT.md v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).
🔗 Hack23 Ecosystem
| 🌐 Platforms | 📦 Open-Source Projects | 🛡️ Governance & Standards |
|---|---|---|
|
🗳️ Riksdagsmonitor — Swedish Parliament intelligence 🇪🇺 EU Parliament Monitor — European coverage 🕵️ Citizen Intelligence Agency — political-data engine 🌐 Hack23 AB — corporate site 📰 Hack23 Blog — engineering & policy 💼 Hack23 on LinkedIn |
🗳️ Hack23/riksdagsmonitor 🕵️ Hack23/cia 🇪🇺 Hack23/euparliamentmonitor 🔌 Hack23/european-parliament-mcp ✅ Hack23/cia-compliance-manager 🥋 Hack23/black-trigram 🏠 Hack23/homepage |
🛡️ Hack23 ISMS-PUBLIC — public ISMS 🔒 Information Security Policy 🤖 AI Policy 🧪 Secure Development Policy 🎯 Threat Modeling Policy ⚠️ Vulnerability Management 🏷️ Classification Framework |
🗳️ Empower citizens · 🔍 Strengthen democratic accountability · 🕵️ Illuminate the political process
© 2008–2026 Hack23 AB (Org.nr 559534-7807) · Maintainer: James Pether Sörling, CISSP CISM