ISO Compliance

Overview

Centralize Management System mengimplementasikan 3 standar ISO untuk kepatuhan perbankan.

Standards

Standard	Description	Status
ISO 27001	Information Security Management	✅ Implemented
ISO 20022	Financial Messaging	✅ Implemented
ISO 22301	Business Continuity Management	✅ Implemented

ISO 27001

Controls Implemented

Control	Category	Implementation
A.9.1	Access control	JWT + RBAC
A.9.2	User access management	Role-based permissions
A.9.4	System access control	API authentication
A.12.4	Logging and monitoring	Audit trail + alerts
A.12.6	Vulnerability management	Security updates
A.18.1	Compliance	Audit logging

Dashboard

{
  "iso27001": {
    "status": "COMPLIANT",
    "controls": {
      "accessControl": "IMPLEMENTED",
      "auditLogging": "IMPLEMENTED",
      "encryption": "IMPLEMENTED"
    },
    "lastAudit": "2026-06-15T00:00:00Z",
    "findings": 0
  }
}

ISO 20022

Message Types

Code	Description	Status
pacs.008	Customer Credit Transfer	✅
pacs.002	Payment Status Report	✅
pacs.009	FI Credit Transfer	✅
pain.008	Customer Direct Debit	✅

Implementation

@Service
public class Iso20022Service {
    
    public Pacs008 createCreditTransfer(Transaction txn) {
        Pacs008 pacs = new Pacs008();
        
        pacs.setCreDtTm(LocalDateTime.now());
        pacs.setMsgId(generateMessageId());
        pacs.setNbOfTxs(1);
        
        // Payment Information
        PaymentInformation pi = new PaymentInformation();
        pi.setPmtInfId(generatePaymentInfoId());
        pi.setPmtMtd("TRF");
        
        pacs.setPaymentInformation(pi);
        return pacs;
    }
}

Dashboard

{
  "iso20022": {
    "status": "COMPLIANT",
    "messageFormats": {
      "pacs.008": "IMPLEMENTED",
      "pacs.002": "IMPLEMENTED"
    },
    "lastValidation": "2026-07-06T00:00:00Z"
  }
}

ISO 22301

Requirements

Requirement	Target	Status
RTO	4 hours	✅ Met
RPO	1 hour	✅ Met
Health Checks	Every 30s	✅ Active
Circuit Breakers	Automatic	✅ Active

Implementation

@Configuration
public class BusinessContinuityConfig {
    
    @Bean
    public CircuitBreaker circuitBreaker() {
        return CircuitBreaker.ofDefaults("coreBanking");
    }
    
    @Bean
    public Retry retry() {
        return Retry.of("coreBanking", RetryConfig.custom()
            .maxAttempts(3)
            .waitDuration(Duration.ofSeconds(1))
            .build());
    }
}

Dashboard

{
  "iso22301": {
    "status": "COMPLIANT",
    "targets": {
      "rto": "4 hours",
      "rpo": "1 hour"
    },
    "lastTest": "2026-06-01T00:00:00Z",
    "circuitBreakers": "ACTIVE"
  }
}

Compliance Dashboard API

GET /iso/compliance/status

curl -H "Authorization: Bearer <token>" \
  http://localhost:8080/iso/compliance/status

Response

{
  "iso27001": {
    "status": "COMPLIANT",
    "lastAudit": "2026-06-15T00:00:00Z",
    "findings": 0
  },
  "iso20022": {
    "status": "COMPLIANT",
    "messageFormat": "pacs.008",
    "lastValidation": "2026-07-06T00:00:00Z"
  },
  "iso22301": {
    "status": "COMPLIANT",
    "rto": "4 hours",
    "rpo": "1 hour",
    "lastTest": "2026-06-01T00:00:00Z"
  }
}

Next Steps

• Audit Trail - Audit logging
• RBAC - Role-Based Access Control
• Core Banking - Core Banking ISO