💰 Riksdagsmonitor — Financial & Security Plan

📊 Infrastructure Cost Analysis & Security Investment
🔗 Secure Development Policy · Classification Framework

📋 Document Owner: CEO | 📄 Version: 1.3 | 📅 Last Updated: 2026-05-28 (UTC)
🔄 Review Cycle: Annual | ⏰ Next Review: 2027-05-28

📋 Purpose

This document outlines the financial and security implementation plan for the Riksdagsmonitor platform — a static HTML5/CSS3 website providing Swedish Parliament transparency across 14 languages.

Riksdagsmonitor uses a dual-deployment architecture with AWS CloudFront + S3 as the primary delivery mechanism and GitHub Pages as the disaster recovery standby, as detailed in the Business Continuity Plan. For architectural context, see the Architecture Documentation and End-of-Life Strategy.

💵 Cost Summary — Dual Deployment Architecture

Cash Flow Overview

Note: Riksdagsmonitor leverages free-tier and open-source services extensively. The primary recurring costs are AWS S3/CloudFront hosting (including Route 53 DNS) and domain registration. All security tooling is free for open-source projects.

🏗️ Infrastructure Cost Breakdown

Primary Deployment: AWS CloudFront + S3

Disaster Recovery: GitHub Pages (Standby)

Domain & Registration

🔐 Security Investment Analysis

Current Security Services (All Free Tier / Open Source)

Security ROI Metrics

🛡️ ISMS Policy Alignment

Security Investment by ISMS Policy

Cost Efficiency Analysis

┌─────────────────────────────────────────────────────────────────┐
│                    Annual Cost Distribution                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  CloudFront CDN      █████████████████████████████████  $60 (59%)│
│  Route 53 DNS        ██████                            $12 (12%) │
│  Route 53 Health     ██████                            $12 (12%) │
│  Domain Registration ██████                            $12 (12%) │
│  S3 Storage          ███                               $6  (6%)  │
│  Security Tooling    (included in free tier)            $0  (0%) │
│                                                                  │
│  Total: $102/year ($8.50/month)                                  │
└─────────────────────────────────────────────────────────────────┘
Copy

Key Insight: By leveraging open-source security tooling and GitHub's free tier for public repositories, Riksdagsmonitor achieves enterprise-grade security posture at near-zero security cost. The entire annual budget of $102 is spent on infrastructure availability, not security tooling.

💡 Included Security Features (Zero Additional Cost)

AWS Shield Standard (Included with CloudFront)

• DDoS Protection: Automatic layer 3/4 DDoS mitigation
• Always-On Detection: Network flow monitoring for volumetric attacks
• No Additional Cost: Included with every CloudFront distribution

GitHub Advanced Security (Free for Public Repos)

• CodeQL Analysis: Semantic code analysis for JavaScript/TypeScript vulnerabilities
• Dependabot Alerts: Real-time vulnerability notifications for all dependencies
• Secret Scanning: Detection of leaked credentials in commits
• Security Advisories: Coordinated vulnerability disclosure workflow

Build Integrity (Free)

• SLSA Build Provenance: Cryptographic attestation of build process
• SBOM (SPDX): Software Bill of Materials for supply chain transparency
• SRI Hashes: Subresource Integrity for all CDN-loaded assets
• SHA-Pinned Actions: Supply chain protection for CI/CD pipeline

📈 Future Cost Projection

Potential Cost Increases

Cost Optimisation Opportunities

📚 Related Documents

🏗️ Architecture & Planning

• 🏛️ Architecture — System architecture overview
• 🚀 Future Architecture — Long-term architectural vision
• 📅 End-of-Life Strategy — Technology lifecycle management
• 📋 README — Project overview and quick links

🛡️ Security & Compliance

• 🛡️ Security Architecture — Security model details
• 🎯 Threat Model — Risk-driven justification for security services
• 📋 CRA Assessment — EU Cyber Resilience Act compliance
• 🔒 Security Policy — Vulnerability disclosure and management

🔄 Operations & Lifecycle

• 📋 BCP Plan — Business continuity and disaster recovery
• 🚀 Release Process — Release procedures with attestations
• 🔄 CI/CD Workflows — Security-hardened CI/CD pipelines
• 🔮 Future Workflows — Enhanced CI/CD roadmap

🔐 ISMS Policies

• 🔐 Information Security Policy — Overall security governance
• 🔍 Vulnerability Management — Security testing and remediation
• 🚨 Incident Response Plan — Security incident management
• 🏷️ Classification Framework — Business impact and risk assessment

📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification:
📅 Effective Date: 2026-05-28
⏰ Next Review: 2027-05-28
🎯 Framework Compliance:

🌐 IMF Integration — Financial Risk Note

Effective: 2026-04-24 · Authoritative hub: analysis/imf/README.md · analysis/imf/agentic-integration.md · analysis/imf/indicators-inventory.json · analysis/imf/data-dictionary.md · .github/aw/ECONOMIC_DATA_CONTRACT.md

IMF cost surface

IMF financial risks

IMF financial benefit

The IMF-primary, WB-residue, SCB-Sweden split avoids any commercial economic-data subscription that the platform might otherwise need (Bloomberg Terminal Data Feed ~€20K/seat/year, Refinitiv ~€15K/seat/year). Free-tier IMF coverage is the deliberate financial-resilience choice.

Canonical rule. Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See ECONOMIC_DATA_CONTRACT.md v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).

🔗 Hack23 Ecosystem

🗳️ Empower citizens · 🔍 Strengthen democratic accountability · 🕵️ Illuminate the political process

_{© 2008–2026 Hack23 AB (Org.nr 559534-7807) · Maintainer: James Pether Sörling, CISSP CISM}