# Cis Controls

> CIS Controls v8.1 critical security controls for static HTML/CSS websites on GitHub Pages

- Skill: `hack23/cis-controls` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hack23/cis-controls`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hack23/cis-controls/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend, Security
- License: Apache-2.0
- Author: Hack23 (https://skillmd.com/u/hack23)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hack23/cis-controls

---


# CIS Controls v8.1 Implementation Skill (Static Site)


## 🔴 AI FIRST Quality Principle

> **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.**

## Purpose

Implement prioritized CIS Controls for Riksdagsmonitor's static HTML/CSS website, focusing on controls applicable to static site hosting on GitHub Pages.

## When to Use

- ✅ Security hardening activities
- ✅ Compliance assessments
- ✅ Security baseline establishment
- ✅ GitHub Pages security configuration

## Applicable CIS Controls for Static Sites

### Control 1: Inventory and Control of Enterprise Assets

**Static Site Context:**
- GitHub repository (version control)
- GitHub Pages hosting infrastructure
- DNS records (riksdagsmonitor.com)
- CDN endpoints

**Implementation:**
```yaml
# Document in ARCHITECTURE.md
Assets:
  - Repository: Hack23/riksdagsmonitor (GitHub)
  - Hosting: GitHub Pages CDN
  - Domain: riksdagsmonitor.com
  - DNS: GitHub Pages DNS
  - Languages: 14 HTML files (index.html, index_sv.html, etc.)
  - Styles: styles.css (107KB)
```

### Control 2: Inventory and Control of Software Assets

**Static Site Context:**
- HTML5, CSS3 (no backend dependencies)
- GitHub Actions workflows
- MCP servers (local Node.js packages)

**Implementation:**
```json
// package.json - Track all MCP dependencies
{
  "dependencies": {
    "riksdag-regering-mcp": "^1.0.0",
    "@modelcontextprotocol/server-filesystem": "latest",
    "@modelcontextprotocol/server-memory": "latest",
    "@playwright/mcp": "latest"
  }
}
```

### Control 3: Data Protection

**Static Site Context:**
- No server-side data storage
- No cookies or tracking
- External links to CIA platform (HTTPS)

**Implementation:**
```html
<!-- All links use HTTPS -->
<a href="https://www.hack23.com/cia/" rel="noopener noreferrer">CIA Platform</a>

<!-- No data collection -->
<!-- No cookies, no analytics, no user tracking -->

<!-- Security headers configured in GitHub Pages -->
```

### Control 4: Secure Configuration

**Static Site Context:**
- GitHub Pages configuration
- Security headers
- CSP (Content Security Policy)

**Implementation:**
```yaml
# .github/workflows/deploy.yml
name: Deploy

# Minimal permissions
permissions:
  contents: read
  pages: write
  id-token: write

# Security headers enforced via GitHub Pages
# Additional headers via _headers file (if supported)
```

**Security Headers:**
```text
# _headers (Netlify-style, adapt for GitHub Pages alternatives)
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none';
```

### Control 5: Account Management

**Static Site Context:**
- GitHub organization members
- Repository contributors
- No end-user accounts (static site)

**Implementation:**
```bash
# Review GitHub organization members
gh api orgs/Hack23/members --jq '.[] | {login, role}'

# Review repository collaborators
gh api repos/Hack23/riksdagsmonitor/collaborators --jq '.[] | {login, permissions}'

# Audit access logs
gh api orgs/Hack23/audit-log --jq '.[] | select(.action == "repo.access")'
```

### Control 6: Access Control Management

**Static Site Context:**
- GitHub branch protection
- Required reviews
- Signed commits

**Implementation:**
```yaml
# Branch protection rules for main branch
protections:
  - required_pull_request_reviews:
      required_approving_review_count: 1
  - required_signatures: true
  - enforce_admins: true
  - restrictions:
      users: []
      teams: ["security-team"]
```

### Control 8: Audit Log Management

**Static Site Context:**
- GitHub audit logs
- GitHub Actions logs
- Deployment logs

**Implementation:**
```bash
# Query GitHub audit logs
gh api /orgs/Hack23/audit-log \
  --jq '.[] | select(.repo == "Hack23/riksdagsmonitor") | {created_at, action, actor}'

# Review workflow runs
gh run list --repo Hack23/riksdagsmonitor --limit 100

# Download workflow logs
gh run view <run-id> --log --repo Hack23/riksdagsmonitor
```

### Control 10: Malware Defenses

**Static Site Context:**
- No server-side code execution
- GitHub's malware scanning
- Dependency scanning

**Implementation:**
```yaml
# .github/workflows/security-scanning.yml
name: Security Scanning

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      
      # Scan for malware in committed files
      - name: Malware Scanner
        uses: dell/common-github-actions/malware-scanner@main
      
      # CodeQL for any JavaScript
      - name: CodeQL Analysis
        uses: github/codeql-action/init@v3
        with:
          languages: javascript
      
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
```

### Control 11: Data Recovery

**Static Site Context:**
- Git version history
- GitHub repository backups
- No dynamic data to backup

**Implementation:**
```bash
# Backup repository (automated via git)
git clone --mirror https://github.com/Hack23/riksdagsmonitor.git
tar -czf riksdagsmonitor-backup-$(date +%Y%m%d).tar.gz riksdagsmonitor.git

# Restore from backup
git clone riksdagsmonitor.git riksdagsmonitor-restored
cd riksdagsmonitor-restored
git remote set-url origin https://github.com/Hack23/riksdagsmonitor.git
```

### Control 12: Network Infrastructure Management

**Static Site Context:**
- GitHub Pages CDN
- TLS 1.3 enforced
- HTTPS-only

**Implementation:**
- ✅ GitHub Pages CDN (global distribution)
- ✅ Automatic TLS 1.3 via GitHub
- ✅ HTTPS enforced (redirect HTTP → HTTPS)
- ✅ Custom domain: riksdagsmonitor.com
- ✅ DNSSEC enabled (if DNS provider supports)

### Control 13: Network Monitoring and Defense

**Static Site Context:**
- GitHub's DDoS protection
- Rate limiting via CDN
- No application-level monitoring needed

**Implementation:**
- ✅ GitHub Pages CDN with built-in DDoS protection
- ✅ Rate limiting handled by GitHub infrastructure
- ✅ Monitor via GitHub Status: https://www.githubstatus.com/

### Control 16: Application Software Security

**Static Site Context:**
- HTML5/CSS3 validation
- Link checking
- Dependency scanning

**Implementation:**
```yaml
# .github/workflows/quality-checks.yml
name: Quality Checks

on: [push, pull_request]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # HTML validation
      - name: Validate HTML
        run: |
          npm install -g htmlhint
          htmlhint *.html
      
      # CSS validation
      - name: Validate CSS
        run: |
          npm install -g csslint
          csslint styles.css
      
      # Link checking
      - name: Check Links
        run: |
          npm install -g linkinator
          python3 -m http.server 8080 &
          sleep 5
          linkinator http://localhost:8080/ --recurse
      
      # Dependency scanning
      - name: Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'riksdagsmonitor'
          path: '.'
          format: 'HTML'
```

### Control 17: Incident Response Management

**Static Site Context:**
- GitHub Security Advisories
- Incident response procedures
- Security contact

**Implementation:**
```markdown
# SECURITY.md
## Security Policy

### Reporting a Vulnerability

Contact: security@hack23.com

Response time: Within 48 hours

### Incident Response Process
1. Assessment (4 hours)
2. Containment (8 hours)
3. Eradication (24 hours)
4. Recovery (48 hours)
5. Post-incident review (7 days)
```

### Control 18: Penetration Testing

**Static Site Context:**
- OWASP ZAP baseline scan
- Security header testing
- SSL/TLS configuration testing

**Implementation:**
```bash
# SSL Labs scan
curl -X GET "https://api.ssllabs.com/api/v3/analyze?host=riksdagsmonitor.com"

# Security Headers scan
curl -I https://riksdagsmonitor.com | grep -E "X-Frame-Options|X-Content-Type-Options|Strict-Transport-Security"

# OWASP ZAP baseline scan
docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-baseline.py \
  -t https://riksdagsmonitor.com \
  -r zap-report.html
```

## Implementation Priority (Static Site Focus)

**IG1 (Implementation Group 1)** - Essential
- ✅ Control 1: Asset inventory (repository, domain)
- ✅ Control 2: Software inventory (HTML/CSS, workflows)
- ✅ Control 4: Secure configuration (GitHub Pages)
- ✅ Control 5: Account management (GitHub org)
- ✅ Control 6: Access control (branch protection)

**IG2** - Enhanced
- ✅ Control 8: Audit logging (GitHub audit logs)
- ✅ Control 11: Data recovery (Git history)
- ✅ Control 12: Network infrastructure (CDN, TLS)

**IG3** - Advanced
- ✅ Control 16: Application security (validation, scanning)
- ✅ Control 17: Incident response (procedures)
- ✅ Control 18: Penetration testing (security scans)

## ISMS Compliance

### ISO 27001:2022 Mapping
- **A.5.10**: Asset inventory and classification
- **A.8.3**: Access restrictions via GitHub permissions
- **A.8.8**: Vulnerability management via Dependabot

### NIST CSF 2.0 Mapping
- **ID.AM**: Asset management (repository inventory)
- **PR.AC**: Access control (GitHub permissions)
- **PR.DS**: Data security (HTTPS, no cookies)
- **DE.CM**: Continuous monitoring (GitHub audit logs)

## References

- **CIS Controls v8**: https://www.cisecurity.org/controls/v8
- **GitHub Pages Security**: https://docs.github.com/en/pages/getting-started-with-github-pages/securing-your-github-pages-site-with-https
- **ISMS**: https://github.com/Hack23/ISMS-PUBLIC
- **ARCHITECTURE.md**: System architecture and components
- **SECURITY_ARCHITECTURE.md**: Security controls documentation