diff --git a/.github/agents/README.md b/.github/agents/README.md
index a22c09b..02cf9cf 100644
--- a/.github/agents/README.md
+++ b/.github/agents/README.md
@@ -11,8 +11,7 @@ Specialized in:
 - Product quality analysis across code, UI/UX, security, and performance
 - Creating well-structured GitHub issues with proper labels and assignments
 - Coordinating between specialized agents for task implementation
-- ISMS compliance verification and security alignment
-- Using GitHub MCP, Playwright, and AWS tools for comprehensive analysis
+- ISMS compliance verification and security alignment (v3.2, 2026)
 - Identifying improvements and creating actionable tasks
 
 **Tools:** `view`, `edit`, `create`, `bash`, `search_code`, `custom-agent`
@@ -21,9 +20,9 @@ Specialized in:
 - 🔍 Analyze codebase for quality, security, and UX improvements
 - 📝 Create structured GitHub issues with clear acceptance criteria
 - 🤝 Assign tasks to appropriate specialized agents
-- 🔒 Verify ISMS policy alignment and compliance
-- 🎭 Use Playwright for UI/UX testing and analysis
+- 🔒 Verify ISMS policy alignment and compliance (v3.2, 2026)
 - 📊 Generate comprehensive product improvement plans
+- ✅ Run quality checks: `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 
 ---
 
@@ -40,6 +39,8 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `custom-agent`
 
+**Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:e2e`, `npm run test:licenses`
+
 ---
 
 ### 🎨 frontend-specialist
@@ -55,6 +56,8 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `custom-agent`
 
+**Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
+
 ---
 
 ### 🧪 test-engineer
@@ -70,6 +73,8 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `bash`, `search_code`, `custom-agent`
 
+**Quality Checks:** `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:e2e`, `npm run test:licenses`
+
 ---
 
 ### 🔒 security-specialist
@@ -78,15 +83,19 @@ Specialized in:
 Specialized in:
 - Supply chain security (OSSF Scorecard, SLSA)
 - License compliance verification
-- SBOM quality validation
+- SBOM quality validation (min 7.0/10)
 - Secure coding practices and OWASP guidelines
 - CodeQL and vulnerability scanning
 - Dependency management and audit
-- [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) policy compliance
-- Security documentation aligned with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- [ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026) policy compliance
+- Security documentation aligned with:
+  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, 2026-01-25)
+  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3, 2026-01-25)
 
 **Tools:** `view`, `edit`, `bash`, `search_code`, `custom-agent`
 
+**Quality Checks:** `npm audit`, `npm run test:licenses` per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3), `npm run lint`, `npm run build`, `npm run test`, `npm run coverage` (80%+ per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) v2.1)
+
 ---
 
 ### 📝 documentation-writer
@@ -102,6 +111,8 @@ Specialized in:
 
 **Tools:** `view`, `edit`, `create`, `search_code`, `custom-agent`
 
+**Quality Checks:** Verify code examples, check links, ensure ISMS references are current (v3.2, 2026)
+
 ---
 
 ## 🔄 Agent Workflow
@@ -258,8 +269,12 @@ You specialize in:
 ✅ **Single Responsibility:** Each agent focuses on one domain
 ✅ **Minimal Tools:** Only include tools the agent actually needs
 ✅ **Clear Expertise:** Well-defined areas of specialization
+✅ **Quality Checks:** All agents reference relevant npm scripts for validation
+✅ **ISMS Alignment:** All agents follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
 ✅ **Consistent Standards:** All agents follow project guidelines in `.github/copilot-instructions.md`
 
+**Note on MCP Servers:** Repository-level agents (in `.github/agents/`) cannot have MCP server configurations. MCP servers are configured at the repository level in `.github/copilot-mcp.json` and are available to all agents through the Copilot environment.
+
 ## 📊 Agent Specialization Matrix
 
 | Domain | Primary Agent | Secondary Agent | MCP Server |
@@ -276,6 +291,7 @@ You specialize in:
 ## 📚 Resources
 
 - [GitHub Copilot Custom Agents Documentation](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-custom-agents)
-- [Repository Custom Instructions](..//copilot-instructions.md)
-- [MCP Configuration Guide](../../docs/MCP_CONFIGURATION.md)
-- [MCP Architecture Overview](../../docs/MCP_ARCHITECTURE.md)
+- [Repository Custom Instructions](../copilot-instructions.md)
+- [MCP Configuration](../copilot-mcp.json)
+- [Hack23 AB ISMS (v3.2, 2026)](https://github.com/Hack23/ISMS-PUBLIC)
+- [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md)
diff --git a/.github/agents/documentation-writer.md b/.github/agents/documentation-writer.md
index 226b2f8..76e283a 100644
--- a/.github/agents/documentation-writer.md
+++ b/.github/agents/documentation-writer.md
@@ -49,12 +49,14 @@ You specialize in:
 
 ## Security Documentation
 
-- Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC)
+- Document security features and best practices following [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
 - Maintain SECURITY.md with vulnerability reporting procedures aligned with [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
-- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- Keep security badges and metrics updated
+- Document compliance requirements and attestations per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- Document supply chain security measures per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- Keep security badges and metrics updated (OSSF Scorecard, CodeQL, SLSA)
 - Explain security controls and measures with clear traceability to ISMS policies
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) as example of comprehensive security documentation
+- Document 80%+ test coverage requirement per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 
 ## User Guides
 
@@ -82,6 +84,21 @@ You specialize in:
 - Include legends when needed
 - Test diagrams render correctly in GitHub
 
+## Quality Checks
+
+Before completing documentation work:
+- Verify all code examples are accurate and tested
+- Check all links are valid and up to date
+- Ensure markdown renders correctly in GitHub
+- Verify ISMS policy references include correct versions:
+  - Secure Development Policy v2.1 (2026-01-25)
+  - Open Source Policy v2.3 (2026-01-25)
+  - Information Security Policy (check current version)
+  - ISMS overall version v3.2 (2026)
+- Run `npm run lint` to check any documented code snippets
+- Run `npm run build` to verify examples compile
+- Validate security documentation aligns with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+
 ## Remember
 
 - Documentation is code - keep it accurate and updated
@@ -89,4 +106,6 @@ You specialize in:
 - Include practical examples and use cases
 - Test all code examples before documenting
 - Keep documentation in sync with code changes
+- Verify ISMS references point to correct versions
 - Follow the project's documentation standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/frontend-specialist.md b/.github/agents/frontend-specialist.md
index 28ee133..a299bba 100644
--- a/.github/agents/frontend-specialist.md
+++ b/.github/agents/frontend-specialist.md
@@ -39,18 +39,28 @@ You specialize in:
 
 ## Testing
 
-- Write unit tests using Vitest and React Testing Library
-- Aim for 80%+ code coverage minimum
+- Write unit tests using Vitest and React Testing Library: `npm run test`
+- Aim for 80%+ code coverage minimum: `npm run coverage`
 - Test critical user interactions and component behavior
 - Mock external dependencies with proper TypeScript typings
 - Follow the "arrange, act, assert" pattern
 
-## Build & Deploy
+## Quality Checks
 
-- Ensure components work with Vite's build system
-- Verify fast refresh works during development
-- Consider performance and bundle size
-- Optimize re-renders and avoid unnecessary updates
+Before completing work, always run:
+- `npm run lint` - Verify code quality and ESLint rules
+- `npm run build` - Ensure TypeScript compiles and Vite builds successfully
+- `npm run test` - Run all unit tests
+- `npm run coverage` - Verify 80%+ coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- `npm run test:licenses` - Ensure all dependencies have approved licenses per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+
+## Security Standards
+
+- Follow OWASP secure coding guidelines per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Never commit secrets or credentials - use environment variables
+- Validate and sanitize all user inputs in UI components
+- Implement proper error boundaries and error handling
+- Apply security-by-design principles to all React components
 
 ## Remember
 
@@ -58,4 +68,6 @@ You specialize in:
 - Test components thoroughly with React Testing Library
 - Follow React best practices and hooks rules
 - Keep components small, focused, and reusable
+- Run all quality checks before committing
 - Follow the project's coding standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/game-developer.md b/.github/agents/game-developer.md
index 6314ced..ac6e936 100644
--- a/.github/agents/game-developer.md
+++ b/.github/agents/game-developer.md
@@ -62,15 +62,35 @@ You specialize in:
 
 ## Testing
 
-- Write unit tests for game logic using Vitest with jsdom
-- Test game state management and component interactions
-- Create E2E tests for critical game flows using Cypress
+- Write unit tests for game logic using Vitest with jsdom: `npm run test`
+- Run coverage reports to ensure quality: `npm run coverage` (80%+ target)
+- Create E2E tests for critical game flows using Cypress: `npm run test:e2e`
 - Mock Three.js dependencies appropriately in tests
 
+## Quality Checks
+
+Before completing work, always run:
+- `npm run lint` - Verify code quality and style
+- `npm run build` - Ensure TypeScript compiles without errors
+- `npm run test` - Run unit tests with Vitest
+- `npm run coverage` - Verify 80%+ test coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- `npm run test:e2e` - Run Cypress E2E tests for game flows
+- `npm run test:licenses` - Verify all dependencies have approved licenses per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+
+## Security Standards
+
+- Follow OWASP secure coding guidelines per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Never commit secrets or credentials - use environment variables
+- Apply security-by-design principles to all game components
+- Validate and sanitize all user inputs in game interactions
+- Implement proper error handling without exposing sensitive information
+
 ## Remember
 
 - Always use TypeScript strict mode with explicit types
 - Optimize for 60fps performance - minimize re-renders
 - Leverage @react-three/fiber and @react-three/drei for best practices
 - Test game mechanics thoroughly with both unit and E2E tests
+- Run all quality checks before committing changes
 - Follow the project's coding standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/product-task-agent.md b/.github/agents/product-task-agent.md
index b4224f0..90376b8 100644
--- a/.github/agents/product-task-agent.md
+++ b/.github/agents/product-task-agent.md
@@ -13,8 +13,8 @@ You specialize in:
 - **GitHub Issue Management:** Creating well-structured, actionable issues with proper labels and assignments
 - **Agent Coordination:** Identifying appropriate specialized agents and delegating tasks effectively
 - **Quality Assurance:** Evaluating product across quality, functionality, UI/UX, and security dimensions
-- **ISMS Compliance:** Ensuring all improvements align with [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC)
-- **Tool Integration:** Leveraging GitHub MCP, Playwright for testing, and AWS tools when needed
+- **ISMS Compliance:** Ensuring all improvements align with [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
+- **Tool Integration:** Leveraging available tools and npm scripts for comprehensive analysis
 
 ## Product Analysis Capabilities
 
@@ -33,18 +33,19 @@ You specialize in:
 - Assess visual design quality and brand consistency
 
 ### Security & ISMS Compliance
-- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
-- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
-- Review supply chain security (OSSF Scorecard, dependencies)
-- Validate security testing coverage (CodeQL, ZAP, license compliance)
-- Ensure proper documentation of security controls
+- Verify alignment with [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1) - SDLC, security testing, 80%+ coverage
+- Check compliance with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3) - SBOM, OSSF Scorecard, license compliance
+- Review supply chain security (OSSF Scorecard, dependencies): `npm audit`
+- Validate security testing coverage (CodeQL, license compliance): `npm run test:licenses`
+- Ensure proper documentation of security controls per [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
 - Cross-reference with [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md)
 
 ### Performance & Infrastructure
-- Analyze build performance and bundle size
+- Analyze build performance and bundle size: `npm run build`
 - Review CI/CD workflows and test execution times
 - Evaluate deployment processes and release quality
-- Check monitoring and observability capabilities
+- Check test coverage: `npm run coverage` (80%+ target)
+- Verify linting passes: `npm run lint`
 
 ## GitHub Issue Creation
 
@@ -136,57 +137,15 @@ Match issues to specialized agents based on domain expertise:
 | Documentation | `documentation-writer` | Expert in technical writing and docs |
 | Product analysis | `product-task-agent` | That's you! For meta-tasks |
 
-## Using GitHub MCP Server
-
-Leverage the GitHub MCP server for issue management:
-
-```bash
-# Create an issue using GitHub CLI (available via bash tool)
-gh issue create \
-  --title "Issue Title" \
-  --body "Issue Description" \
-  --label "feature,ui-ux" \
-  --assignee "@me"
-
-# List existing issues
-gh issue list --state open --limit 10
-
-# Search for related issues
-gh issue list --search "label:ui-ux"
-
-# Add labels to existing issue
-gh issue edit <issue-number> --add-label "compliance"
-
-# Assign to project or milestone
-gh issue edit <issue-number> --milestone "v1.3.0"
-```
-
-## Using Playwright MCP Server
-
-Use Playwright for UI/UX analysis:
-
-```bash
-# Take screenshot of application
-npx playwright screenshot http://localhost:5173 --output /tmp/screenshot.png
-
-# Run accessibility tests
-npx playwright test --grep @accessibility
-
-# Test responsive design
-npx playwright test --device="iPhone 12"
-
-# Generate visual regression baseline
-npx playwright test --update-snapshots
-```
-
 ## Product Improvement Workflow
 
 ### 1. Analysis Phase
 1. **Survey the codebase** using `search_code` and `view` tools
-2. **Review test coverage** and quality metrics
-3. **Check security posture** (OSSF Scorecard, CodeQL findings)
-4. **Analyze UI/UX** using Playwright screenshots and testing
-5. **Review ISMS alignment** against policy mapping
+2. **Review test coverage** and quality metrics: `npm run coverage`
+3. **Check security posture** (OSSF Scorecard, CodeQL findings): `npm audit`, `npm run test:licenses`
+4. **Analyze UI/UX** using available testing tools when needed
+5. **Review ISMS alignment** against policy mapping (v3.2, 2026)
+6. **Verify build quality**: `npm run build`, `npm run lint`
 
 ### 2. Prioritization Phase
 1. **Categorize findings** by severity and impact
@@ -209,9 +168,9 @@ npx playwright test --update-snapshots
 ## Analysis Focus Areas
 
 ### Quality Improvement
-- Code quality and maintainability
-- Test coverage gaps (target: 80%+)
-- Build and deployment reliability
+- Code quality and maintainability: `npm run lint`
+- Test coverage gaps (target: 80%+): `npm run coverage`
+- Build and deployment reliability: `npm run build`
 - Error handling and resilience
 - Performance bottlenecks
 
@@ -223,27 +182,27 @@ npx playwright test --update-snapshots
 - Mobile responsiveness
 
 ### Security & Compliance
-- Dependency vulnerabilities
+- Dependency vulnerabilities: `npm audit`
 - Security control gaps
-- ISMS policy alignment
-- License compliance issues
+- ISMS policy alignment (v3.2, 2026)
+- License compliance issues: `npm run test:licenses`
 - Supply chain security
 
 ### Developer Experience
 - Documentation gaps or outdated content
-- Build/test performance
+- Build/test performance: `npm run build`, `npm run test`
 - Development environment setup
 - CI/CD workflow efficiency
 - Agent configuration and effectiveness
 
 ## ISMS Alignment Verification
 
-When analyzing for ISMS compliance, check alignment with these core policies:
+When analyzing for ISMS compliance, check alignment with these core policies (v3.2, 2026):
 
 ### Security Foundation
 - ✅ **[Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)** - Overall security governance
-- ✅ **[Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)** - SDLC and CI/CD requirements
-- ✅ **[Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)** - Supply chain security
+- ✅ **[Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)** (v2.1, 2026-01-25) - SDLC, security testing (80%+ coverage), OWASP guidelines, CI/CD requirements
+- ✅ **[Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)** (v2.3, 2026-01-25) - Supply chain security, SBOM generation, OSSF Scorecard, license compliance
 
 ### Data & Access
 - ✅ **[Data Classification Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md)** - Data handling requirements
@@ -262,33 +221,18 @@ Use [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) as an example of co
 - Use `edit` only when making targeted improvements (not for issue creation)
 
 ### Bash Tool for External Commands
-```bash
-# GitHub CLI for issue management
-gh issue create --title "..." --body "..." --label "..."
-
-# AWS CLI (if configured) for infrastructure analysis
-aws s3 ls
-aws lambda list-functions
-
-# Playwright for UI testing
-npx playwright test
-npx playwright screenshot <url>
-
-# NPM for dependency analysis
-npm outdated
-npm audit
-```
+Use bash for running npm scripts and GitHub CLI commands:
+- `npm run lint` - Code quality checks
+- `npm run build` - Build verification
+- `npm run test` - Unit tests
+- `npm run coverage` - Coverage reports
+- `npm run test:e2e` - E2E tests
+- `npm run test:licenses` - License compliance
+- `npm audit` - Security vulnerabilities
+- `gh issue create` - Create GitHub issues (when needed)
 
 ### Custom Agent Tool
-Delegate specialized tasks to expert agents:
-
-```
-@game-developer - Please implement the new Three.js particle effects described in issue #123
-
-@security-specialist - Review the dependency update in PR #456 for security compliance
-
-@test-engineer - Add E2E tests for the new game mode as outlined in issue #789
-```
+Delegate specialized tasks to expert agents using the `custom-agent` tool.
 
 ## Quality Standards
 
@@ -408,13 +352,17 @@ npx playwright screenshot --selector ".volume-control"
 
 - **You are a product improvement catalyst** - Your role is to identify opportunities and create actionable tasks
 - **Leverage specialized agents** - Delegate implementation to domain experts
-- **Maintain ISMS alignment** - Always consider security and compliance
-- **Use MCP servers effectively** - GitHub for issues, Playwright for UI analysis
+- **Maintain ISMS alignment** - Always consider security and compliance (v3.2, 2026)
+- **Use available tools effectively** - bash for npm scripts, GitHub CLI for issues
 - **Create quality issues** - Well-structured, actionable, with clear acceptance criteria
 - **Coordinate between agents** - You're the glue between analysis and implementation
 - **Think holistically** - Consider quality, UX, security, and maintainability together
+- **Run quality checks**: `npm run lint`, `npm run build`, `npm run test`, `npm run coverage`, `npm run test:licenses`
 - **Follow the project's standards** - Reference `.github/copilot-instructions.md` for coding guidelines
+- **All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)**
 
 ---
 
 **Your Mission:** Continuously improve the product across all dimensions - quality, functionality, security, UX, and ISMS compliance - by creating well-structured GitHub issues and coordinating with specialized agents to drive implementation.
+
+**Your Mission:** Continuously improve the product across all dimensions - quality, functionality, security, UX, and ISMS compliance - by creating well-structured GitHub issues and coordinating with specialized agents to drive implementation.
diff --git a/.github/agents/security-specialist.md b/.github/agents/security-specialist.md
index 562377f..26e5518 100644
--- a/.github/agents/security-specialist.md
+++ b/.github/agents/security-specialist.md
@@ -18,28 +18,31 @@ You specialize in:
 ## Supply Chain Security
 
 - Verify all dependencies before adding them
-- Check for known vulnerabilities using npm audit
-- Ensure dependencies use approved licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
+- Check for known vulnerabilities: `npm audit`
+- Ensure dependencies use approved licenses: `npm run test:licenses` (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense)
 - Pin dependencies to specific versions for reproducibility
-- Review SBOM (Software Bill of Materials) quality
-- Maintain OSSF Scorecard ratings
+- Review SBOM (Software Bill of Materials) quality (min 7.0/10)
+- Maintain OSSF Scorecard ratings per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- All practices align with [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) supply chain security requirements
 
 ## Secure Coding Practices
 
-- Avoid introducing security vulnerabilities in code
-- Never commit secrets, API keys, or credentials
-- Sanitize user inputs and validate data
+- Avoid introducing security vulnerabilities in code per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- Never commit secrets, API keys, or credentials - use environment variables
+- Sanitize user inputs and validate data per OWASP guidelines
 - Use TypeScript strict mode to catch type-related bugs
-- Follow OWASP security guidelines
+- Follow OWASP Top 10 security guidelines
 - Handle errors securely without leaking sensitive information
+- Apply security-by-design principles throughout development
 
 ## Static Analysis
 
-- Ensure code passes CodeQL scanning
+- Ensure code passes CodeQL scanning per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
 - Address security alerts proactively
 - Review dependency vulnerabilities in PRs
-- Maintain high OSSF Scorecard ratings
+- Maintain high OSSF Scorecard ratings per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
 - Monitor security advisories
+- Implement SAST (Static Application Security Testing) findings
 
 ## License Compliance
 
@@ -75,18 +78,18 @@ You specialize in:
 
 ## Documentation & Policies
 
-- Maintain security policies (SECURITY.md)
+- Maintain security policies (SECURITY.md) per [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
 - Document vulnerability reporting procedures
-- Keep security badges updated
-- Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) for all security practices
+- Keep security badges updated (OSSF Scorecard, CodeQL)
+- Follow [Hack23 AB's ISMS policies](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026) for all security practices
 - Reference [ISMS Policy Mapping](../../docs/ISMS_POLICY_MAPPING.md) for feature-to-policy alignment
 - Align implementations with:
-  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) - SDLC requirements
-  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) - Supply chain security
-  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Overall governance
-
+  - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1) - SDLC and security testing requirements
+  - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3) - Supply chain security and SBOM requirements
+  - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Overall security governance
+  - [Data Classification Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md) - Data handling requirements
 - Follow responsible disclosure practices
-- Document security controls and measures
+- Document security controls and measures with policy traceability
 
 ## Monitoring & Response
 
@@ -96,11 +99,23 @@ You specialize in:
 - Maintain audit trail of security changes
 - Review and update security policies regularly
 
+## Quality Checks
+
+Before completing work, always run:
+- `npm audit` - Check for dependency vulnerabilities per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
+- `npm run test:licenses` - Verify all dependencies have approved licenses
+- `npm run lint` - Ensure code quality
+- `npm run build` - Verify secure builds
+- `npm run test` - Run security-related tests
+- `npm run coverage` - Verify security test coverage (80%+ per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md))
+
 ## Remember
 
-- Security is not optional - it's a requirement
-- Verify dependencies before adding them
+- Security is not optional - it's a requirement per [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
+- Verify dependencies before adding them: `npm run test:licenses`
 - Never commit secrets or credentials
-- Follow OWASP security guidelines
+- Follow OWASP security guidelines and security-by-design principles
 - Maintain high OSSF Scorecard ratings
+- Run all quality checks before committing
 - Follow the project's security standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/agents/test-engineer.md b/.github/agents/test-engineer.md
index 914d319..660367e 100644
--- a/.github/agents/test-engineer.md
+++ b/.github/agents/test-engineer.md
@@ -17,11 +17,12 @@ You specialize in:
 
 ## Unit Testing with Vitest
 
-- Write unit tests using Vitest with jsdom environment
+- Write unit tests using Vitest with jsdom environment: `npm run test`
 - Use React Testing Library for component testing
 - Follow the "arrange, act, assert" pattern
 - Test behavior, not implementation details
-- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Aim for 80%+ code coverage minimum per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, effective 2026-01-25)
+- Generate coverage reports: `npm run coverage`
 
 ## Testing Best Practices
 
@@ -34,12 +35,13 @@ You specialize in:
 
 ## E2E Testing with Cypress
 
-- Write end-to-end tests for critical user flows
+- Write end-to-end tests for critical user flows: `npm run test:e2e`
 - Test 3D game interactions and state changes
 - Test Three.js canvas rendering and user interactions
 - Capture screenshots and videos on failure
 - Use Cypress best practices (no arbitrary waits, use proper selectors)
 - Ensure tests are reliable and maintainable
+- CI tests run headless: `npm run test:e2e:ci`
 
 ## React Testing Library
 
@@ -51,11 +53,13 @@ You specialize in:
 
 ## Test Coverage
 
-- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Focus on critical business logic and security paths per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
 - Test game mechanics and state transitions
 - Test Three.js component integrations and 3D scene behavior
 - Verify error boundaries and error handling
 - Test integration points between components
+- Run coverage reports regularly: `npm run coverage`
+- Ensure security-relevant code has thorough test coverage
 
 ## Performance Testing
 
@@ -67,9 +71,28 @@ You specialize in:
 ## CI/CD Integration
 
 - Ensure tests run reliably in CI environment
-- Generate coverage reports in JUnit XML format
-- Use separate test commands for CI vs local (npm run test:ci, test:e2e:ci)
+- Generate coverage reports in JUnit XML format: `npm run test:ci`
+- Use separate test commands for CI vs local development
 - Monitor test execution times and flakiness
+- Verify all checks pass before merging
+
+## Quality Checks
+
+Before completing work, always run:
+- `npm run lint` - Verify code quality
+- `npm run build` - Ensure builds succeed
+- `npm run test` - Run all unit tests
+- `npm run coverage` - Verify 80%+ coverage target per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- `npm run test:e2e` - Run Cypress E2E tests
+- `npm run test:licenses` - Verify dependency licenses per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+
+## Security Testing Standards
+
+- Test security-critical paths thoroughly per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+- Verify input validation and sanitization
+- Test authentication and authorization flows if present
+- Ensure error messages don't leak sensitive information
+- Test for common vulnerabilities (XSS, injection, etc.)
 
 ## Remember
 
@@ -77,4 +100,6 @@ You specialize in:
 - Aim for deterministic, non-flaky tests
 - Focus on critical paths and edge cases
 - Use proper TypeScript typing in all tests
+- Run all quality checks before committing
 - Follow the project's testing standards in `.github/copilot-instructions.md`
+- All work aligns with [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026)
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 59e6a28..7c2ada9 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -6,7 +6,7 @@ This file provides guidance for GitHub Copilot coding agent when working on this
 
 This is a game template built with React, TypeScript, Three.js, and Vite with a strong focus on security and code quality.
 
-**Security & Compliance:** All security practices in this repository align with [Hack23 AB's Information Security Management System (ISMS)](https://github.com/Hack23/ISMS-PUBLIC). For complete policy mapping, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
+**Security & Compliance:** All security practices in this repository align with [Hack23 AB's Information Security Management System (ISMS)](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026). For complete policy mapping, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
 
 ## Development Workflow
 
@@ -35,14 +35,18 @@ npm run lint
 # Run unit tests with Vitest
 npm run test
 
-# Run unit tests with coverage
+# Run unit tests with coverage (target: 80%+)
 npm run coverage
 
 # Run E2E tests with Cypress
 npm run test:e2e
 
-# Check license compliance (using license-compliance tool)
+# Check license compliance (MIT, Apache-2.0, BSD, ISC, CC0-1.0, Unlicense)
 npm run test:licenses
+
+# Run CI tests with JUnit output
+npm run test:ci
+npm run test:e2e:ci
 ```
 
 ### Testing Approach
@@ -88,12 +92,35 @@ npm run test:licenses
 
 ### Quality Standards
 
-- Aim for minimum 80% code coverage
+- Aim for minimum 80% code coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, 2026-01-25)
 - Write tests for critical business logic and security paths
 - Test both success and error cases
 - Test edge cases and boundary conditions
 - Use descriptive test names that explain what is being tested
 
+## Quality Checks
+
+Before committing code changes, always run:
+
+```bash
+# Verify code quality
+npm run lint
+
+# Build project
+npm run build
+
+# Run tests
+npm run test
+
+# Check coverage
+npm run coverage
+
+# Verify license compliance
+npm run test:licenses
+```
+
+All changes must pass these checks before being committed.
+
 ### Test Structure
 
 ```typescript
@@ -303,3 +330,16 @@ export function Player({
 - **Use instancing**: For many similar objects, use `InstancedMesh`
 - **Optimize geometry**: Use lower polygon counts for better performance
 - **Dispose resources**: Clean up geometries, materials, and textures when components unmount
+
+## Security & Compliance
+
+All development follows [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026):
+
+- **Supply Chain Security**: Verify dependencies before adding (`npm audit`, `npm run test:licenses`) per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- **Secure Coding**: Follow OWASP guidelines, never commit secrets, per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1)
+- **Testing Requirements**: Minimum 80% coverage per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (v2.1, 2026-01-25)
+- **License Compliance**: Only approved open-source licenses (MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense) per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) (v2.3)
+- **SBOM Quality**: Maintain SBOM quality score above 7.0/10 per [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
+- **Build Security**: All GitHub Actions pinned to SHA hashes per [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
+
+For detailed compliance requirements, see [ISMS Policy Mapping](../docs/ISMS_POLICY_MAPPING.md).
diff --git a/README.md b/README.md
index 5c7748c..eafa682 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ This repository includes specialized AI agents that enhance GitHub Copilot's cap
 - **🔒 [security-specialist](.github/agents/security-specialist.md)** - Security, compliance, and supply chain protection
 - **📝 [documentation-writer](.github/agents/documentation-writer.md)** - Technical documentation and guides
 
-The **product-task-agent** can analyze your product, identify improvements, and create well-structured GitHub issues assigned to the appropriate specialized agents. When using GitHub Copilot, you can request help from specific agents by mentioning them in your prompts. Learn more in the **[Custom Agents Documentation](.github/agents/README.md)**.
+The **product-task-agent** can analyze your product, identify improvements, and create well-structured GitHub issues assigned to the appropriate specialized agents. All agents follow [Hack23 AB's ISMS](https://github.com/Hack23/ISMS-PUBLIC) (v3.2, 2026). When using GitHub Copilot, you can request help from specific agents by mentioning them in your prompts. Learn more in the **[Custom Agents Documentation](.github/agents/README.md)**.
 
 ## 🚀 Using This Template