Weekly ISMS sync — 2026-07-24¶
Attendees: Olaf Jacobson, Andrea Cardinali (CyberSquad) — TODO(owner): confirm attendance (Thomas/Melvin for the backup and tooling items?) Status: agenda prepared 2026-07-20; decisions and outcomes to be recorded during/after the session.
Register at time of prep: 74 documents · 57 draft · 2 template · 15 superseded · 0 approved (0%) · no reviews overdue.
1. Since the last sync (2026-07-02) — 5 min¶
- Lean overhaul merged (PR #24): entire corpus rewritten Soon-specific, −67% volume, 16 documents merged into anchors with traceable superseded stubs; MD5 password hashing corrected to bcrypt/argon2.
- Q&A round applied (PR #22): backup reality now honestly documented — PITR is off, retention 7d (prod) / 30d (Knab), no off-account isolation, restore never tested (risk R-15).
- Evidence system + GRC design (PR #23); Supabase removed from all stack references (owner-confirmed not used).
- Gap analysis run against ISO 27001: SoA covers all 93 Annex A controls with justified exclusions; the mandatory document set is nearly complete — see focus.
2. Focus this week — 10 min¶
| # | Action | Owner |
|---|---|---|
| 1 | Approval batch 1: review & approve Context & Scope, Information Security Policy, Roles (05-2), Risk Assessment & Treatment Process (06-2); sign the Executive Support Letter | Olaf |
| 2 | Risk Treatment Plan (06-4) — generate from the Risk Assessment Report; the last mandatory ISO document still at template status | Andrea |
| 3 | SoA v0.2 — update rows to the post-overhaul document structure; close "to create" items that now exist | Andrea |
| 4 | Process Interaction Overview (08-1) — one page, clause 8.1 | Andrea |
| 5 | Schedule the first restore test — biggest open finding (R-15); Melvin owns backups | Olaf → Melvin |
3. Decisions needed (top open TODO(owner) items) — 10 min¶
- Backup retention: is 7 days (RDS default) sufficient for the main production DB, or align upward? Set a date for the first restore test.
- Assign owners: ~25 documents still have
owner: TBD— split across Olaf/Thomas/Melvin/Alessandro. - Tooling questions (Thomas): MDM/EDR on laptops yes/no; IaC tooling; WorkOS non-SSO system list; staging data question (Q6: does staging touch real customer data?).
- Patch SLAs: confirm proposal (critical 7d / high 30d) and pentest cadence/vendor.
- Intercom EU migration (Linear S-303): status and target date.
4. Blockers — 5 min¶
No hard blockers; progress depends on the decisions above. The Business/ICT Continuity Plan (A.5.29/A.5.30) is the only genuinely missing document — involve Thomas.
5. Outcomes & decisions (fill in during the meeting)¶
- TODO(owner): record decisions, assignments and dates here after the session.