What

Coordinate ISO standard compliance work across the kcenon ecosystem so that each Tier-1 and higher system can document concrete mapping to the relevant ISO standards.

• Current: ISO compliance is implemented in places (DICOM in pacs, audit HMAC in logger audit_logger) but not documented or applied consistently
• Expected: Each system has a docs/compliance/ page with control-by-control mapping
• Scope: logger, monitoring, database, pacs (common and network already align)

Why

• Enterprise adopters request ISO evidence at procurement
• Regulated domains (medical, financial) need demonstrable compliance, not just "we use TLS"
• Consistent posture across the ecosystem simplifies the story for anyone evaluating kcenon as a foundation

Where

How

Sub-issues (implementation work)

• security: extend HMAC integrity protection to all writers (ISO 27001) logger_system#612 — Extend HMAC integrity to all writers (ISO 27001 A.12.4)
• docs: document ISO/IEC 27001 and 20000 compliance mapping monitoring_system#671 — Document ISO/IEC 27001 + 20000 mapping
• security: document ISO/IEC 27001 compliance and enable TLS by default database_system#569 — Document ISO/IEC 27001 + enable TLS by default
• security: encrypt audit log storage per ISO 27799 pacs_system#1102 — Encrypt audit log storage per ISO 27799

Sub-issues (documentation gap, opened 2026-04-21)

• docs(compliance): create docs/compliance/iso-27001.md and README link logger_system#622 — Create docs/compliance/iso-27001.md and README link
• docs(compliance): create docs/compliance/iso-27799.md and README link pacs_system#1126 — Create docs/compliance/iso-27799.md and README link
• docs(compliance): create ISO_OVERVIEW.md ecosystem summary #651 — Create docs/compliance/ISO_OVERVIEW.md ecosystem summary

Acceptance Criteria

• Each implementation sub-issue closed
• Each target system has docs/compliance/ section linked from its README (2/4 done — monitoring, database)
• Ecosystem-level compliance summary added to common_system/docs/compliance/ISO_OVERVIEW.md

Verification 2026-04-21: monitoring_system and database_system meet the per-system criterion. logger and pacs lack docs/compliance/ directories on develop. ISO_OVERVIEW.md is absent. Three gap sub-issues opened to close the remaining work — see verification comment.