BLOCKCHAIN-ORIENTED APPROACH TO ENSURING TRACEABILITY AND VERIFIABILITY OF ISMS POLICY ENFORCEMENT

Abstract

This paper proposes a blockchain-oriented approach to ensuring the traceability and verifiability of information security policy enforcement within integrated information security management systems (ISMS). The relevance of the study is driven by the fact that, in practical ISMS deployments, compliance with security policies is commonly confirmed through event logs and reports that may be altered or deleted, thereby reducing the evidentiary value of audits and complicating independent verification. The proposed approach is based on recording only cryptographic “anchors” (hash values) of policy enforcement events in a permissioned blockchain, rather than storing complete logs in a distributed ledger. This design minimizes system overhead and mitigates the risk of sensitive data disclosure. An architecture is introduced that comprises an event collection and normalization module, a hash aggregator with batch packaging, a smart contract for anchor registration, and an audit verification module. A practical prototype was implemented as an application-level service integrated with an existing logging system and interacting with the smart contract via an API. Experimental evaluation was conducted using modeled scenarios, including access control enforcement, role changes, unauthorized action attempts, and incident handling, followed by simulated log tampering through deletion, substitution, and reordering of events in local logs. The evaluation considered anchor registration latency, batching throughput, successful transaction ratio, and auditor verification time for varying log volumes. The results demonstrate that the proposed mechanism reliably detects log manipulation through inconsistencies between locally computed hashes and on-chain records, supports a reproducible chain of evidence for critical ISMS policies, and enhances audit transparency without relying on a trusted third party. The paper also discusses limitations of the approach, including the selection of critical events, key management, and data retention policies, and provides recommendations for integration with SIEM platforms and alignment with ISO/IEC 27001 requirements. The obtained results can be applied in the design and modernization of ISMS for government information systems and critical infrastructure facilities. The proposed approach may serve as a foundation for automated generation of audit reports and immutable evidence of compliance with organizational ISMS regulations.