🌐 Hack23 AB — ISMS Transparency Plan

Security Through Transparency and Open Documentation
Demonstrating Security Excellence Through Public ISMS Disclosure

📋 Document Owner: CEO | 📄 Version: 2.1 | 📅 Last Updated: 2025-11-10 (UTC)
🔄 Review Cycle: Annual | ⏰ Next Review: 2026-11-10

---

🎯 Purpose Statement

Hack23 AB's core philosophy is that transparency enhances security rather than diminishing it. This document outlines our strategy for making our Information Security Management System (ISMS) public, demonstrating our expertise and building trust, while carefully protecting sensitive information that could introduce risk.

This plan defines what is considered public, what is confidential, and the processes for maintaining our commitment to security through transparency.

— James Pether Sörling, CEO/Founder

---

📜 Guiding Principles

1. Default to Public: Policies, frameworks, and high-level procedures will be public unless a specific, documented risk is identified.
2. Demonstrate, Don't Expose: The goal is to showcase our security maturity and processes, not to reveal secrets that could be exploited.
3. Redact, Don't Hide: When a document contains a mix of public and sensitive information, we will redact the sensitive parts and publish the rest.
4. Clarity and Rationale: The reason for keeping any information confidential will be clearly documented internally.

---

📊 Information Classification for Publication

This table defines the publication status of ISMS documents and the rationale.

Document / Information Type	Publication Status	Rationale & Redaction Rules
🔐 Core Policies & Frameworks
🔐 Information Security Policy	✅ Public	Demonstrates overall security posture. No sensitive details.
🏷️ Classification Framework	✅ Public	Core to our methodology; showcases our approach to risk.
🔓 Open Source Policy	✅ Public	Aligns with our open-source philosophy.
📐 Style Guide	✅ Public	Shows our commitment to quality and consistency.
🛠️ Operational Policies
🔑 Access Control Policy	✅ Public	High-level policy is public. Specific roles and access lists are confidential.
✅ Acceptable Use Policy	✅ Public	Behavioral expectations and usage standards public. Demonstrates security culture and professional conduct.
🏠 Physical Security Policy	✅ Public	Home office security framework and device protection standards public. Specific home addresses confidential.
🔒 Cryptography Policy	✅ Public	Approved algorithms and standards are public. Key management procedures are confidential.
🛠️ Secure Development Policy	✅ Public	The framework is public. Specific tool configurations are confidential.
🌐 Network Security Policy	✅ Public	Network architecture principles public. Specific configurations confidential.
📝 Change Management	✅ Public	Process framework public. Specific change details confidential.
🔍 Vulnerability Management	✅ Public	Process public. Active vulnerabilities confidential.
💾 Backup & Recovery Policy	✅ Public	Policy framework public. Specific procedures confidential.
🤖 AI Governance Policy	✅ Public	AI governance framework and EU AI Act compliance public. AI vendor assessments confidential.
🛡️ OWASP LLM Security Policy	✅ Public	Comprehensive LLM security framework demonstrating OWASP Top 10 alignment and implementation transparency. Shows foundation strength while clearly identifying future development areas.
🎯 Threat Modeling Policy	✅ Public	STRIDE methodology and threat assessment framework public. Specific threat intelligence confidential.
📋 Management & Governance
💻 Asset Register	⚠️ Redacted	Complete asset inventory public including all systems, services, and configurations. Only specific credentials, API keys, and account numbers replaced with [REDACTED].
📉 Risk Register	⚠️ Redacted	Complete risk framework and all risks public. Only specific financial impact values replaced with [REDACTED].
🔗 Third-Party Management	✅ Public	Complete policy framework and all procedures public.
🏢 Supplier Security Posture	⚠️ Redacted	Complete supplier assessments public including all details. Only specific contract pricing and sensitive commercial terms replaced with [REDACTED].
🤝 External Stakeholder Registry	✅ Public	Professional network and regulatory contacts demonstrate stakeholder engagement and compliance readiness.
🚨 Response & Recovery Plans
🚨 Incident Response Plan	✅ Public	Complete process framework and all procedures public.
🔄 Business Continuity Plan	✅ Public	Complete strategies and all recovery procedures public.
🆘 Disaster Recovery Plan	✅ Public	Complete architecture and all technical procedures public.
📊 Compliance & Legal
✅ Compliance Checklist	✅ Public	Demonstrates our commitment to transparency and provides a clear, auditable trail of our compliance posture against key frameworks.
🏷️ Data Classification Policy	✅ Public	The classification levels and handling rules are public. The classification of specific datasets is confidential.
🏢 Company Documentation
📊 Aktiebok	❌ Confidential	Share register details confidential.
📊 Annual Accounts	✅ Public	Filed annual reports are public record.
📑 Articles of Association	✅ Public	Corporate governance structure public.
📋 Business Plan	❌ Confidential	Financial projections, strategic roadmap, and revenue models confidential.
📊 Business Strategy	❌ Confidential	Strategic plans and business tactics confidential.
🏢 Company Information	❌ Confidential	Corporate structure and internal operations.
📄 Copyright Assignment Agreement	❌ Confidential	Legal agreements and IP management confidential.
🔐 Information Security Strategy	✅ Public	Strategic security initiatives and competitive security positioning differentiation through radical transparency.
📅 Marketing Plan	❌ Confidential	Tactical marketing implementation, campaigns, and operational details confidential.
📈 Marketing Strategy	❌ Confidential	Marketing strategies and competitive analysis confidential.
🤝 Stakeholders Overview	❌ Confidential	Internal stakeholder alignment and strategic mapping confidential.
❌ Sensitive Information
Personal Data (CEO, future employees)	❌ Confidential	Per GDPR and privacy best practices.
Financial Records & Bank Details	❌ Confidential	Per Swedish Bookkeeping Act and security best practices.
Customer Data	❌ Confidential	Absolute confidentiality is paramount for client trust and GDPR.
Active Security Vulnerabilities	❌ Confidential	Public disclosure would be irresponsible.
Credentials, API Keys, Tokens	❌ Confidential	Extreme-level confidential data.
Risk Exposure Values	❌ Confidential	Specific financial impacts could enable targeted attacks.
Supplier Contract Details	❌ Confidential	Commercial terms, costs, and performance details.

---

🔧 Redaction and Publication Process

Radical Transparency Approach

Hack23 AB practices radical transparency - we publish complete ISMS documents with only specific sensitive values redacted. This demonstrates our security maturity and operational excellence while protecting only the most sensitive information.

What We Publish (Everything):

• ✅ Complete processes, procedures, and technical details
• ✅ All system configurations, architectures, and operational procedures
• ✅ All contact information (roles, escalation paths, response procedures)
• ✅ All supplier names, assessments, and security postures
• ✅ All risk assessments, risk details, and mitigation strategies
• ✅ Complete asset inventories with all systems and services

What We Redact (Minimal):

• 🔒 Specific credentials, API keys, passwords, tokens
• 🔒 Specific account numbers, account IDs (replaced with [REDACTED])
• 🔒 Specific financial impact amounts in risks (e.g., "$1.8M" → [REDACTED])
• 🔒 Specific contract pricing and commercial terms
• 🔒 Personal phone numbers and personal email addresses

Publication Process

1. Create Internal Version: The complete document is created as the "source of truth."
2. Create Public Version: An identical copy is made for public release.
3. Apply Minimal Redactions: Only specific sensitive VALUES are replaced with [REDACTED] - structure and content remain intact.
4. Review: The CEO reviews to ensure only appropriate values are redacted.
5. Publish: The document is published to the public GitHub repository.

Redaction Examples

• Credentials: password: "abc123" becomes password: [REDACTED]
• Account Numbers: Account: 172017021075 becomes Account: [REDACTED]
• Financial Risk Values: ALE: €65,700 becomes ALE: [REDACTED]
• Personal Contact: CEO: +46-XXX-XXX becomes CEO: [REDACTED]
• Contract Pricing: $50/month becomes [REDACTED]/month

Everything else remains public and unredacted.

---

🌐 Publication Channels

Primary Documentation Repository

• GitHub Public: hack23/ISMS-PUBLIC - Complete public ISMS documentation
• Corporate Website: Links to documentation for client access

Documentation Mirrors

• Product Documentation: Specific security architectures for each project
  • Citizen Intelligence Agency: https://www.hack23.com/cia-docs.html
  • CIA Compliance Manager: https://www.hack23.com/cia-compliance-manager-docs.html
  • Black Trigram: https://www.hack23.com/black-trigram-docs.html

---

📊 Metrics & Review

Publication Metrics

• Documents Published: Framework complete with ongoing updates
• Public/Confidential Ratio: Approximately 70% public framework, 30% redacted operational details
• Client Engagement: Documentation views, security inquiries generated

Key Dependencies

From our comprehensive supplier management approach:

• Cloud Infrastructure: Critical dependency with robust continuity planning
• Development Platforms: High-impact services with documented alternatives
• Financial Services: Regulatory-compliant banking and payment processing
• Supporting Services: Managed risk profile across operational tools

Risk Management Overview

Our systematic approach includes:

• Comprehensive Risk Assessment: Full spectrum risk identification and classification
• Regular Risk Reviews: Ongoing monitoring and reassessment cycles
• Risk Treatment Planning: Appropriate mitigation strategies based on impact analysis
• Continuous Improvement: Regular updates to risk management processes

Review Schedule

• Monthly: Review redaction effectiveness and update metrics
• Quarterly: Update publication classifications and risk assessments
• Annually: Complete transparency strategy review
• Ad-hoc: Following security incidents or significant business changes

---

📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification:
📅 Effective Date: 2025-09-22
⏰ Next Review: 2026-09-22
🎯 Framework Compliance: