Compliance Framework Alignment

Compliance Framework Alignment Skill

Purpose

This skill provides a unified cross-framework compliance alignment for the CIA platform, mapping controls between ISO 27001:2022, NIST CSF 2.0, CIS Controls v8, and GDPR. It enables developers and security teams to understand how a single implementation satisfies multiple compliance requirements simultaneously.

When to Use This Skill

Apply this skill when:

• ✅ Implementing security controls that must satisfy multiple frameworks
• ✅ Preparing for compliance audits
• ✅ Documenting control implementations
• ✅ Assessing compliance gaps
• ✅ Justifying security investments to stakeholders
• ✅ Reviewing architecture changes for compliance impact
• ✅ Updating ISMS documentation

Do NOT use for:

• ❌ Detailed control implementation (use framework-specific skills)
• ❌ Risk assessment methodology (use risk-assessment-methodology)
• ❌ Incident response procedures (use incident-response)

Framework Overview

Frameworks in Scope

Framework Function Mapping

ISO 27001 Domains    ←→    NIST CSF Functions    ←→    CIS Controls IG
────────────────           ──────────────────           ──────────────
Organizational (5)   ←→    Govern (GV)            ←→    IG1: Essential
People (6)           ←→    Identify (ID)          ←→    IG2: Foundational
Physical (7)         ←→    Protect (PR)           ←→    IG3: Organizational
Technological (8)    ←→    Detect (DE)
                     ←→    Respond (RS)
                     ←→    Recover (RC)

Cross-Framework Control Mapping

Access Control

Data Protection

Secure Development

Logging & Monitoring

Incident Management

Compliance Gap Analysis Template

Per-Control Assessment

## Control: [Name]

### Framework References
- ISO 27001: [Control ID]
- NIST CSF: [Function.Category-Subcategory]
- CIS Controls: [Control ID]
- GDPR: [Article]

### Current Implementation
- **Status:** Implemented / Partial / Not Implemented
- **Implementation:** [Description]
- **Evidence:** [Where to find proof]

### Gap Assessment
- **Gap:** [What's missing]
- **Risk:** Critical / High / Medium / Low
- **Remediation:** [What needs to be done]
- **Timeline:** [When]
- **Owner:** [Who]

Audit Preparation

Evidence Collection Matrix

Audit Readiness Checklist

□ ISMS documentation current and approved
□ Risk assessment completed within last year
□ Security controls implemented and documented
□ Evidence artifacts collected and organized
□ Training records available
□ Incident response plan tested
□ Business continuity plan reviewed
□ Third-party security assessments completed
□ Corrective actions from previous audit closed
□ Management review conducted

GDPR-Specific Requirements

CIA Platform GDPR Obligations

Decision Framework

Implementing a New Security Control
    │
    ├─→ Identify all applicable framework requirements
    │   └─→ Check ISO 27001, NIST CSF, CIS, GDPR mappings above
    │
    ├─→ Design control to satisfy ALL applicable frameworks
    │   └─→ One implementation, multiple compliance benefits
    │
    ├─→ Document control implementation
    │   └─→ Map to specific control IDs in each framework
    │
    ├─→ Collect evidence of implementation
    │   └─→ Automated where possible (CI/CD, logs, configs)
    │
    └─→ Verify control effectiveness
        └─→ Test, review, and audit periodically

References

• ISO 27001:2022
• NIST CSF 2.0
• CIS Controls v8
• GDPR Full Text
• Hack23 ISMS Compliance Mapping