Information Security Strategy Skill
🔴 AI FIRST Quality Principle
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
Purpose
Defines the information security strategy framework for Hack23 projects, integrating risk management with compliance requirements.
Security Strategy Pillars
- Governance — Policies, procedures, roles
- Risk Management — Identify, assess, treat risks
- Compliance — ISO 27001, NIST CSF, CIS Controls
- Operations — Monitoring, incident response
- Assurance — Audits, testing, continuous improvement
Risk Management Process
- Context — Scope, stakeholders, criteria
- Assessment — Identify, analyze, evaluate risks
- Treatment — Accept, mitigate, transfer, avoid
- Monitoring — Continuous risk review
- Communication — Stakeholder reporting
Compliance Framework Integration
| Framework |
Focus |
Key Controls |
| ISO 27001:2022 |
ISMS |
93 controls in 4 themes |
| NIST CSF 2.0 |
Cybersecurity |
Govern, Identify, Protect, Detect, Respond, Recover |
| CIS Controls v8.1 |
Implementation |
18 control groups |
| GDPR |
Privacy |
Data protection, rights |
| NIS2 |
Critical infra |
Supply chain, incident reporting |
Security Metrics
- Mean Time to Detect (MTTD)
- Mean Time to Respond (MTTR)
- Vulnerability remediation SLA compliance
- Security training completion rate
- Audit finding closure rate
Continuous Improvement
- Regular policy reviews (annual minimum)
- Lessons learned from incidents
- Benchmark against industry standards
- Security awareness program updates
- Technology evolution tracking
Related Hack23 ISMS Policies
Strategy execution requires cross-policy alignment across the ISMS-PUBLIC suite:
Governance & Classification
Operational
Strategic Alignment Principle
Every strategic initiative MUST map to: (a) one or more ISMS policies, (b) measurable KPI in Security_Metrics.md, (c) at least one compliance framework (ISO 27001 / NIST CSF 2.0 / CIS Controls v8.1 / GDPR / NIS2 / EU CRA), and (d) risk-treatment action in the risk register.
1---2name: information-security-strategy3description: Information security strategy, risk management, security program governance, and compliance framework integration4license: Apache-2.05---67# Information Security Strategy Skill8910## 🔴 AI FIRST Quality Principle1112> **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.**1314## Purpose15Defines the information security strategy framework for Hack23 projects, integrating risk management with compliance requirements.1617## Security Strategy Pillars181. **Governance** — Policies, procedures, roles192. **Risk Management** — Identify, assess, treat risks203. **Compliance** — ISO 27001, NIST CSF, CIS Controls214. **Operations** — Monitoring, incident response225. **Assurance** — Audits, testing, continuous improvement2324## Risk Management Process251. **Context** — Scope, stakeholders, criteria262. **Assessment** — Identify, analyze, evaluate risks273. **Treatment** — Accept, mitigate, transfer, avoid284. **Monitoring** — Continuous risk review295. **Communication** — Stakeholder reporting3031## Compliance Framework Integration32| Framework | Focus | Key Controls |33|-----------|-------|-------------|34| ISO 27001:2022 | ISMS | 93 controls in 4 themes |35| NIST CSF 2.0 | Cybersecurity | Govern, Identify, Protect, Detect, Respond, Recover |36| CIS Controls v8.1 | Implementation | 18 control groups |37| GDPR | Privacy | Data protection, rights |38| NIS2 | Critical infra | Supply chain, incident reporting |3940## Security Metrics41- Mean Time to Detect (MTTD)42- Mean Time to Respond (MTTR)43- Vulnerability remediation SLA compliance44- Security training completion rate45- Audit finding closure rate4647## Continuous Improvement48- Regular policy reviews (annual minimum)49- Lessons learned from incidents50- Benchmark against industry standards51- Security awareness program updates52- Technology evolution tracking5354## Related Hack23 ISMS Policies5556Strategy execution requires cross-policy alignment across the [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) suite:5758### Governance & Classification59- [Information_Security_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) — **master policy**: scope, roles, risk management, continuous improvement (master strategy document)60- [CLASSIFICATION.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) — CIA triad ratings + RTO/RPO drive control selection61- [AI_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) — AI governance, human-in-the-loop, agent-activity logging6263### Operational64- [Secure_Development_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) — SDLC security65- [Open_Source_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) — supply chain, SBOM, licence approvals66- [Access_Control_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md) · [Cryptography_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md) · [Change_Management.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Change_Management.md)67- [Threat_Modeling.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md) · [Vulnerability_Management.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md)68- [Incident_Response_Plan.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md) · [Security_Metrics.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Security_Metrics.md)6970### Strategic Alignment Principle71Every strategic initiative MUST map to: (a) one or more ISMS policies, (b) measurable KPI in `Security_Metrics.md`, (c) at least one compliance framework (ISO 27001 / NIST CSF 2.0 / CIS Controls v8.1 / GDPR / NIS2 / EU CRA), and (d) risk-treatment action in the risk register.
Hack23