Information Security Manager Iso27001

Information Security Manager - ISO 27001

Implement and manage Information Security Management Systems (ISMS) aligned with ISO 27001:2022 and healthcare regulatory requirements. Covers the full lifecycle: scoping, risk assessment per Clause 6.1.2, selection and implementation of the 93 Annex A controls across four themes, certification readiness, incident response, and cross-framework mapping to SOC 2, NIST CSF 2.0, and NIS2 — with cloud-specific (AWS/Azure/GCP) and Zero Trust guidance.

Core Capabilities

• ISMS implementation — scope/context definition, risk treatment, Statement of Applicability (SoA), monitoring metrics, certification readiness (Stage 1/2)
• Risk assessment — Clause 6.1.2 methodology, asset classification, threat/vulnerability modeling, Likelihood × Impact scoring, treatment planning
• Control implementation — all 93 Annex A:2022 controls (Organizational, People, Physical, Technological) with cloud-provider mappings and Zero Trust integration
• Incident response — detection, triage/classification, containment, recovery, and lessons learned
• Cross-framework alignment — ISO 27001 ↔ SOC 2 TSC ↔ NIST CSF 2.0 ↔ NIS2, plus supply chain and hardware-key (FIDO2) requirements

When to Use

Use this skill when you hear: "implement ISO 27001", "ISMS implementation", "security risk assessment", "information security policy", "ISO 27001 certification", "security controls implementation", "incident response plan", "healthcare data security", "medical device cybersecurity", or "security compliance audit".

Clarify First

Before running the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• [ ] ISMS scope — which systems, locations, and data are inside the boundary (drives the Statement of Applicability and risk assessment)
• [ ] Task — ISMS implementation, risk assessment, gap analysis, or incident response (picks the workflow and script)
• [ ] Threat context — general, healthcare, or cloud (selects the threat catalog and changes the risk register inputs)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the report.

Quick Start

# Run a security risk assessment
python scripts/risk_assessment.py --scope "patient-data-system" --output risk_register.json

# Check ISO 27001 compliance status
python scripts/compliance_checker.py --standard iso27001 --controls-file controls.csv

# Generate a gap analysis report
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output gaps.md

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• [references/workflows-and-tools.md](references/workflows-and-tools.md) — step-by-step ISMS implementation, risk assessment, and incident-response workflows; validation checkpoints; certification-readiness checklists; worked healthcare example; troubleshooting; success criteria; and full risk_assessment.py / compliance_checker.py flag tables. Read when executing any end-to-end workflow or looking up a script flag.
• [references/annex-a-controls.md](references/annex-a-controls.md) — complete enumeration of all 93 Annex A:2022 controls across the four themes plus the 11 controls new in 2022. Read when building/updating a Statement of Applicability or mapping a 2013 SoA to 2022.
• [references/cloud-and-cross-framework.md](references/cloud-and-cross-framework.md) — AWS/Azure/GCP control mappings, Zero Trust architecture integration, hardware security key (FIDO2/WebAuthn) requirements, supply chain security, and ISO 27001 ↔ SOC 2 / NIST CSF / NIS2 mappings. Read when implementing in a specific cloud, designing Zero Trust, or pursuing multiple certifications.
• [references/iso27001-controls.md](references/iso27001-controls.md) — Annex A control implementation guidance with evidence requirements and audit preparation. Read for control selection for the SoA and audit prep.
• [references/risk-assessment-guide.md](references/risk-assessment-guide.md) — risk methodology selection, asset classification criteria, threat modeling approaches, and risk calculation methods. Read before designing the risk assessment process.
• [references/incident-response.md](references/incident-response.md) — detailed response procedures, escalation matrices, communication templates, and recovery checklists. Read when building or running the incident response plan.

Scope & Limitations

In Scope: ISO 27001:2022 ISMS implementation (all 93 Annex A controls across 4 themes); risk assessment per Clause 6.1.2 with configurable threat catalogs (general, healthcare, cloud); compliance checking and gap analysis against ISO 27001/27002; cross-framework mapping to SOC 2 TSC, NIST CSF 2.0, and NIS2; cloud-specific controls for AWS/Azure/GCP; Zero Trust integration with phased roadmap; hardware security key (FIDO2/WebAuthn) requirements; supply chain controls including SBOM and vendor risk tiering.

Out of Scope: ISO 27001 certification audit execution (preparation guidance only, not audit services); implementation of specific security tools (SIEM, EDR, DLP, WAF — mapped to categories only); penetration testing or vulnerability scanning execution (use infrastructure-compliance-auditor); ISO 27701/27017/27018 implementation beyond cross-reference; physical security system design beyond control requirements.

Important Notes:

• The ISO 27001:2013 to 2022 transition deadline was October 2025; all certifications must now conform to the 2022 edition.
• The 2022 revision introduced 11 entirely new controls, notably A.5.7 (Threat intelligence), A.5.23 (Cloud services), A.8.9 (Configuration management), A.8.16 (Monitoring activities), and A.8.28 (Secure coding).
• Integration with other standards (ISO 27701, ISO 42001, ISO 9001) via the harmonized Annex SL structure is becoming standard practice.

Integration Points

ISO 27001:2022 Annex A Controls — Complete Reference

The full enumeration of all 93 Annex A controls across the four 2022 themes, plus the 11 controls new in the 2022 revision. Read this when building or updating a Statement of Applicability (SoA), selecting controls for a risk treatment plan, or mapping a 2013 SoA to the 2022 structure.

The 2022 revision restructured controls from 14 domains (114 controls) to 4 themes (93 controls). All organizations must update their Statement of Applicability (SoA) accordingly.

Theme 1: Organizational Controls (37 controls)

Theme 2: People Controls (8 controls)

Theme 3: Physical Controls (14 controls)

Theme 4: Technological Controls (34 controls)

New Controls in ISO 27001:2022

11 controls are entirely new in the 2022 revision:

Cloud Security, Zero Trust & Cross-Framework Mapping

Cloud-provider control mappings (AWS/Azure/GCP), Zero Trust architecture integration, hardware security key (FIDO2/WebAuthn) requirements, supply chain security controls, and mappings from ISO 27001:2022 to SOC 2, NIST CSF 2.0, and NIS2. Read this when implementing controls in a specific cloud, designing Zero Trust, hardening authentication, managing vendor/supply-chain risk, or pursuing multiple certifications at once.

Cross-Reference: SOC 2 Control Mapping

Map ISO 27001:2022 controls to SOC 2 Trust Services Criteria for organizations requiring both certifications:

See also: ../soc2-compliance-specialist/SKILL.md for full SOC 2 compliance workflows.

---

Cross-Reference: NIS2 Directive Alignment

The NIS2 Directive (EU 2022/2555) mandates cybersecurity measures for essential and important entities, including healthcare organizations. ISO 27001 provides a strong foundation for NIS2 compliance:

NIS2-specific additions beyond ISO 27001:

• Incident reporting: 24-hour early warning to CSIRT, 72-hour incident notification, 1-month final report
• Management accountability: Senior management must approve cybersecurity measures and undergo training
• Penalties: Up to EUR 10M or 2% of global turnover for essential entities
• Supply chain: Must assess each direct supplier's cybersecurity practices

See also: ../nis2-compliance-specialist/SKILL.md for complete NIS2 implementation workflows.

---

Cloud Security Controls

AWS-Specific Controls

Azure-Specific Controls

GCP-Specific Controls

---

Zero Trust Architecture Integration

Align ISO 27001 controls with Zero Trust principles (NIST SP 800-207):

Zero Trust Pillars Mapped to ISO 27001

Zero Trust Implementation Roadmap

Phase 1: Foundation (0-6 months)
├── Implement identity provider with MFA for all users
├── Deploy EDR on all endpoints
├── Enable centralized logging and SIEM
└── Classify critical data assets

Phase 2: Enhancement (6-12 months)
├── Implement network microsegmentation
├── Deploy conditional access policies
├── Enable continuous device compliance monitoring
└── Implement DLP for classified data

Phase 3: Maturation (12-18 months)
├── Deploy zero-trust network access (ZTNA) replacing VPN
├── Implement just-in-time (JIT) privileged access
├── Enable automated threat response (SOAR)
└── Continuous verification with behavioral analytics

---

Hardware Security Key Requirements

FIDO2/WebAuthn Implementation

For high-assurance authentication per A.5.17 and A.8.5:

Supported standards:

• FIDO2 / WebAuthn (passwordless primary authentication)
• FIDO U2F (second-factor authentication)
• PIV/Smart Card (legacy enterprise systems)
• TOTP (fallback only — hardware keys preferred)

Deployment checklist:

• [ ] Procure minimum 2 hardware keys per critical user (primary + backup)
• [ ] Register keys with identity provider (Entra ID, Okta, Google Workspace)
• [ ] Enforce phishing-resistant MFA policy for privileged access
• [ ] Disable SMS/voice MFA for admin accounts
• [ ] Document key recovery procedures
• [ ] Test break-glass procedures with backup keys

---

Supply Chain Security Controls

ICT Supply Chain Risk Management (A.5.19-A.5.22)

Software Bill of Materials (SBOM) Requirements

Third-Party Risk Tiers

---

Cross-Framework Mapping Table

Cross-references: See ../gdpr-dsgvo-expert/SKILL.md for GDPR privacy controls mapping, and ../risk-management-specialist/SKILL.md for ISO 14971 risk management integration with ISO 27001.

---

ISO 27001:2022 Enhanced Controls & Cross-Framework Integration

Annex A Control Themes (93 Controls)

Hardware Security Key Requirements

• YubiKey 5 Series: Required for admin accounts, cloud console access, VPN, code signing
• FIDO2/WebAuthn: Phishing-resistant MFA for all users within 90 days of ISMS deployment
• Policy: SMS/voice MFA PROHIBITED (SIM swapping risk). TOTP acceptable as interim for non-admin
• Backup Keys: Minimum 2 hardware keys per user (primary + backup stored securely)
• Recovery: Manager approval + identity verification required for key replacement

Zero Trust Architecture Integration

• Never Trust, Always Verify: All access decisions based on identity, device, and context
• Microsegmentation: Network segmentation at workload level, not just network perimeter
• Least Privilege: Just-in-time access, time-bounded permissions, automated deprovisioning
• Continuous Verification: Session-level authentication, device health checks, behavioral analytics

Cross-Framework Mapping (ISO 27001 ↔ SOC 2 ↔ NIST CSF ↔ NIS2)

Supply Chain Security Controls

• Supplier Risk Assessment: Due diligence before onboarding, annual reassessment
• Contractual Security Clauses: Data protection, incident reporting, audit rights, exit terms
• Continuous Monitoring: Vendor security ratings, certificate expiry alerts, breach notifications
• SBOM Requirements: Software Bill of Materials for all third-party software components

Incident Response Procedures

Security incident detection, response, and recovery procedures per ISO 27001 requirements.

---

Table of Contents

• Incident Classification
• Response Procedures
• Escalation Matrix
• Communication Templates
• Recovery Checklists
• Post-Incident Activities

---

Incident Classification

Incident Categories

Severity Levels

Severity Decision Tree

Is there active data loss or system compromise?
├── Yes → CRITICAL (P1)
└── No → Is there an active uncontained threat?
          ├── Yes → HIGH (P2)
          └── No → Is there potential for data exposure?
                    ├── Yes → MEDIUM (P3)
                    └── No → LOW (P4)

---

Response Procedures

Phase 1: Detection and Reporting

Objective: Identify and report security incidents promptly.

Steps: 1. Identify potential incident through monitoring, alerts, or reports 2. Document initial observations (time, systems, symptoms) 3. Report to Security Team via designated channel 4. Assign incident ID and log in tracking system

Validation: Incident logged within 15 minutes of detection.

Documentation Required:

• Date/time of detection
• Detection source (monitoring, user report, automated alert)
• Affected systems/users (initial assessment)
• Reporter information

Phase 2: Triage and Assessment

Objective: Determine incident scope and severity.

Steps: 1. Gather additional information (logs, system state) 2. Determine incident category and severity 3. Identify affected assets and potential impact 4. Assign incident owner and response team

Validation: Severity assigned and escalation triggered if needed.

Assessment Checklist:

• [ ] Systems affected identified
• [ ] Data types potentially impacted
• [ ] Attack vector determined
• [ ] Scope (single system vs. widespread)
• [ ] Business impact assessed

Phase 3: Containment

Objective: Limit damage and prevent spread.

Immediate Containment (Short-term): 1. Isolate affected systems from network 2. Disable compromised accounts 3. Block malicious IPs/domains 4. Preserve evidence before changes

Long-term Containment: 1. Apply temporary fixes 2. Implement additional monitoring 3. Strengthen access controls 4. Prepare for eradication

Validation: Containment confirmed, no ongoing spread.

Containment Actions by Incident Type:

Phase 4: Eradication

Objective: Remove threat from environment.

Steps: 1. Identify root cause 2. Remove malware/backdoors 3. Close vulnerabilities exploited 4. Reset compromised credentials 5. Verify threat elimination

Validation: No indicators of compromise remain.

Eradication Checklist:

• [ ] Malware removed from all systems
• [ ] Vulnerabilities patched
• [ ] Backdoors/persistence removed
• [ ] Compromised credentials rotated
• [ ] Security gaps closed

Phase 5: Recovery

Objective: Restore systems to normal operation.

Steps: 1. Restore from clean backups if needed 2. Rebuild compromised systems 3. Verify system integrity 4. Monitor for re-infection 5. Return to production gradually

Validation: Systems operational with enhanced monitoring.

Recovery Checklist:

• [ ] Systems restored to known-good state
• [ ] Integrity verification completed
• [ ] Enhanced monitoring in place
• [ ] Business operations resumed
• [ ] User access restored (verified accounts only)

Phase 6: Lessons Learned

Objective: Improve security posture and response capability.

Steps: 1. Conduct post-incident review (within 5 business days) 2. Document timeline and actions taken 3. Identify what worked and what didn't 4. Update procedures and controls 5. Share relevant findings (internally, externally if required)

Validation: Post-incident report completed and actions tracked.

---

Escalation Matrix

Escalation Paths

Contact Information (Template)

External Notifications

---

Communication Templates

Internal Notification (Initial)

Subject: [SEVERITY] Security Incident - [Brief Description]

INCIDENT SUMMARY
----------------
Incident ID: INC-[YYYY]-[###]
Detected: [Date/Time]
Severity: [Critical/High/Medium/Low]
Status: [Investigating/Contained/Resolved]

WHAT HAPPENED
[Brief description of the incident]

CURRENT IMPACT
[Systems affected, business impact]

ACTIONS BEING TAKEN
[Current response activities]

WHAT YOU NEED TO DO
[Any required user actions]

NEXT UPDATE
Expected by: [Time]

Contact: Security Team - [contact info]

External Notification (Breach)

Subject: Important Security Notice from [Organization]

Dear [Affected Party],

We are writing to inform you of a security incident that may have
involved your personal information.

WHAT HAPPENED
On [date], we discovered [brief description].

WHAT INFORMATION WAS INVOLVED
[Types of data potentially affected]

WHAT WE ARE DOING
[Actions taken to address the incident]

WHAT YOU CAN DO
[Recommended protective actions]

FOR MORE INFORMATION
[Contact information, resources]

We sincerely regret any concern this may cause and are committed
to protecting your information.

[Signature]

Status Update

Subject: UPDATE: Security Incident INC-[ID] - [Status]

CURRENT STATUS
--------------
Status: [Contained/Eradicating/Recovering]
Last Update: [Time]

PROGRESS SINCE LAST UPDATE
[Actions completed]

CURRENT ACTIVITIES
[Ongoing response work]

REMAINING ACTIONS
[What still needs to be done]

ESTIMATED RESOLUTION
[Timeframe if known]

NEXT UPDATE
Expected: [Time]

---

Recovery Checklists

System Recovery Checklist

• [ ] Verify backup integrity before restoration
• [ ] Restore to isolated environment first
• [ ] Scan restored systems for malware
• [ ] Apply all security patches
• [ ] Reset all credentials on system
• [ ] Review and harden configurations
• [ ] Verify application functionality
• [ ] Enable enhanced logging/monitoring
• [ ] Conduct security scan before production
• [ ] Document recovery steps taken

Account Compromise Recovery

• [ ] Disable compromised account
• [ ] Revoke all active sessions
• [ ] Reset password with strong credential
• [ ] Enable MFA if not already
• [ ] Review account activity logs
• [ ] Check for unauthorized changes
• [ ] Review connected applications
• [ ] Verify account recovery options
• [ ] Notify account owner securely
• [ ] Monitor for suspicious activity

Ransomware Recovery

• [ ] Isolate affected systems immediately
• [ ] Identify ransomware variant
• [ ] Check for decryption tools available
• [ ] Assess backup availability/integrity
• [ ] Report to law enforcement
• [ ] Document encrypted files/systems
• [ ] Restore from clean backups
• [ ] Rebuild systems that cannot be restored
• [ ] Patch vulnerability exploited
• [ ] Implement additional controls

---

Post-Incident Activities

Post-Incident Review Meeting

Timing: Within 5 business days of resolution

Attendees:

• Incident response team
• Affected system owners
• Security management
• Relevant stakeholders

Agenda: 1. Incident timeline review 2. What worked well 3. What could be improved 4. Root cause analysis 5. Preventive measures 6. Action items and owners

Post-Incident Report Template

INCIDENT POST-MORTEM REPORT
===========================

Incident ID: INC-[YYYY]-[###]
Date: [Report date]
Author: [Name]
Classification: [Internal/Confidential]

EXECUTIVE SUMMARY
[2-3 paragraph summary]

INCIDENT TIMELINE
[Detailed chronological events]

ROOT CAUSE ANALYSIS
[5 Whys or similar analysis]

IMPACT ASSESSMENT
- Systems affected: [list]
- Data impacted: [description]
- Business impact: [description]
- Financial impact: [estimate if known]

RESPONSE EFFECTIVENESS
What worked well:
- [item]
- [item]

Areas for improvement:
- [item]
- [item]

RECOMMENDATIONS
| # | Recommendation | Priority | Owner | Due Date |
|---|----------------|----------|-------|----------|
| 1 | [action] | High | [name] | [date] |
| 2 | [action] | Medium | [name] | [date] |

LESSONS LEARNED
[Key takeaways for future incidents]

APPENDICES
- Detailed logs
- Evidence inventory
- Communication records

Metrics to Track

ISO 27001:2022 Controls Implementation Guide

Implementation guidance for Annex A controls with evidence requirements and audit preparation.

---

Table of Contents

• Control Categories Overview
• Organizational Controls (A.5)
• People Controls (A.6)
• Physical Controls (A.7)
• Technological Controls (A.8)
• Evidence Requirements
• Statement of Applicability

---

Control Categories Overview

ISO 27001:2022 Annex A contains 93 controls across 4 categories:

---

Organizational Controls (A.5)

A.5.1 - Policies for Information Security

Requirement: Define, approve, publish, and communicate information security policies.

Implementation: 1. Draft information security policy covering scope, objectives, principles 2. Obtain management approval signature 3. Communicate to all employees and relevant parties 4. Review annually or after significant changes

Evidence:

• Signed policy document
• Communication records (email, intranet)
• Acknowledgment records
• Review meeting minutes

A.5.2 - Information Security Roles and Responsibilities

Requirement: Define and allocate information security responsibilities.

Implementation: 1. Create RACI matrix for security activities 2. Appoint Information Security Manager 3. Define responsibilities in job descriptions 4. Establish reporting lines

Evidence:

• RACI matrix document
• ISM appointment letter
• Job descriptions with security duties
• Organizational chart

A.5.9 - Inventory of Information and Assets

Requirement: Identify and maintain inventory of information assets.

Implementation: 1. Create asset register with classification 2. Assign owners for each asset 3. Define acceptable use rules 4. Review quarterly

Evidence:

• Asset inventory/register
• Classification scheme
• Owner assignment records
• Review logs

A.5.15 - Access Control

Requirement: Establish and implement rules for controlling access.

Implementation: 1. Document access control policy 2. Implement role-based access control (RBAC) 3. Define access provisioning/deprovisioning process 4. Conduct access reviews quarterly

Evidence:

• Access control policy
• RBAC role definitions
• Access request forms
• Review reports

---

People Controls (A.6)

A.6.1 - Screening

Requirement: Verify backgrounds of candidates prior to employment.

Implementation: 1. Define screening requirements by role 2. Conduct background checks 3. Verify references and qualifications 4. Document screening results

Evidence:

• Screening policy
• Background check reports
• Verification records
• Consent forms

A.6.3 - Information Security Awareness and Training

Requirement: Ensure personnel receive appropriate awareness and training.

Implementation: 1. Develop annual training program 2. Include role-specific training 3. Conduct phishing simulations 4. Track completion and effectiveness

Evidence:

• Training materials
• Completion records
• Test/quiz results
• Phishing simulation reports

A.6.7 - Remote Working

Requirement: Implement security measures for remote working.

Implementation: 1. Establish remote working policy 2. Require VPN for network access 3. Mandate endpoint protection 4. Secure home network guidance

Evidence:

• Remote working policy
• VPN configuration records
• Endpoint compliance reports
• User acknowledgments

---

Physical Controls (A.7)

A.7.1 - Physical Security Perimeters

Requirement: Define and use security perimeters to protect information.

Implementation: 1. Define secure areas and boundaries 2. Implement access controls (badges, locks) 3. Monitor entry points 4. Maintain visitor logs

Evidence:

• Site security plan
• Access control system records
• CCTV footage retention
• Visitor logs

A.7.4 - Physical Security Monitoring

Requirement: Monitor premises continuously for unauthorized access.

Implementation: 1. Deploy CCTV coverage 2. Implement intrusion detection 3. Define monitoring procedures 4. Establish incident response

Evidence:

• CCTV deployment records
• Monitoring procedures
• Alert configurations
• Incident logs

---

Technological Controls (A.8)

A.8.2 - Privileged Access Rights

Requirement: Restrict and manage privileged access.

Implementation: 1. Implement privileged access management (PAM) 2. Enforce separate admin accounts 3. Require MFA for privileged access 4. Monitor and log privileged activities

Evidence:

• PAM solution records
• Admin account inventory
• MFA enforcement reports
• Privileged activity logs

A.8.5 - Secure Authentication

Requirement: Implement secure authentication mechanisms.

Implementation: 1. Enforce strong password policy 2. Implement MFA for all users 3. Use secure authentication protocols 4. Monitor authentication events

Evidence:

• Password policy
• MFA enrollment records
• Authentication configuration
• Failed login reports

A.8.7 - Protection Against Malware

Requirement: Implement detection, prevention, and recovery for malware.

Implementation: 1. Deploy endpoint protection on all devices 2. Configure automatic updates 3. Implement email filtering 4. Define malware incident response

Evidence:

• Endpoint protection deployment
• Update/patch status
• Email filter configuration
• Malware incident records

A.8.8 - Management of Technical Vulnerabilities

Requirement: Identify and address technical vulnerabilities.

Implementation: 1. Conduct regular vulnerability scans 2. Define remediation SLAs by severity 3. Track remediation progress 4. Verify patches applied

Evidence:

• Vulnerability scan reports
• Remediation tracking
• Patch deployment records
• Penetration test reports

A.8.13 - Information Backup

Requirement: Maintain and test backup copies of information.

Implementation: 1. Define backup policy (frequency, retention) 2. Implement automated backups 3. Encrypt backup data 4. Test restoration regularly

Evidence:

• Backup policy
• Backup job logs
• Encryption configuration
• Restoration test records

A.8.15 - Logging

Requirement: Produce, retain, and protect logs of activities.

Implementation: 1. Define logging requirements 2. Deploy centralized log management (SIEM) 3. Set retention periods per compliance 4. Protect log integrity

Evidence:

• Logging policy
• SIEM configuration
• Log retention settings
• Access controls on logs

A.8.24 - Use of Cryptography

Requirement: Define and implement cryptographic controls.

Implementation: 1. Document cryptography policy 2. Encrypt data at rest (AES-256) 3. Encrypt data in transit (TLS 1.3) 4. Manage keys securely

Evidence:

• Cryptography policy
• Encryption configuration
• Certificate inventory
• Key management procedures

---

Evidence Requirements

Document Evidence

Technical Evidence

Retention Requirements

---

Statement of Applicability

SoA Structure

For each Annex A control, document:

Sample SoA Entry

Control: A.8.5 - Secure Authentication

Applicable: Yes
Justification: Required for all user and system access to protect
information assets from unauthorized access.

Implementation Status: Implemented

Implementation Description:
- MFA enforced for all user accounts via Azure AD
- Admin accounts require hardware token
- Password policy: 12+ chars, complexity, 90-day rotation
- Failed login lockout after 5 attempts

Evidence:
- Azure AD MFA configuration (screenshot)
- Password policy document (DOC-SEC-015)
- Authentication audit logs (SIEM dashboard)

Exclusion Justification Examples

Risk Assessment Methodology Guide

Comprehensive guidance for conducting information security risk assessments per ISO 27001 Clause 6.1.2.

---

Table of Contents

• Risk Assessment Process
• Asset Identification
• Threat Analysis
• Vulnerability Assessment
• Risk Calculation
• Risk Treatment
• Templates and Tools

---

Risk Assessment Process

ISO 27001 Requirements (Clause 6.1.2)

The organization shall: 1. Define risk assessment process 2. Establish risk criteria (acceptance, assessment) 3. Identify information security risks 4. Analyze and evaluate risks 5. Ensure repeatable and consistent results

Process Overview

1. Context → 2. Asset ID → 3. Threat ID → 4. Vuln ID → 5. Risk Calc → 6. Treatment
     ↑                                                                      |
     └──────────────────── Review & Update ←───────────────────────────────┘

---

Asset Identification

Asset Categories

Classification Scheme

Asset Inventory Template

---

Threat Analysis

Healthcare Threat Landscape

Threat Modeling Approaches

STRIDE Model:

• Spoofing identity
• Tampering with data
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

Threat Actor Categories:

---

Vulnerability Assessment

Vulnerability Categories

Vulnerability Scoring (CVSS Alignment)

Vulnerability Sources

1. Automated Scans: Nessus, Qualys, OpenVAS 2. Penetration Testing: Annual third-party tests 3. Code Analysis: SAST/DAST tools 4. Configuration Audits: CIS benchmarks 5. Threat Intelligence: CVE feeds, vendor advisories

---

Risk Calculation

Risk Formula

Risk = Likelihood × Impact

Likelihood Scale (1-5)

Impact Scale (1-5)

Risk Matrix

Risk Levels

---

Risk Treatment

Treatment Options (ISO 27001)

Control Selection Criteria

1. Effectiveness: Reduces likelihood or impact 2. Cost: Implementation and maintenance costs 3. Feasibility: Technical and operational viability 4. Compliance: Meets regulatory requirements 5. Integration: Works with existing controls

Residual Risk

After implementing controls:

Residual Risk = Inherent Risk × (1 - Control Effectiveness)

---

Templates and Tools

Risk Register Template

Risk Assessment Report Sections

1. Executive Summary

• Key findings
• Critical/high risks count
• Overall risk posture

2. Methodology

• Assessment scope
• Criteria used
• Limitations

3. Asset Summary

• Asset inventory
• Classification distribution

4. Risk Findings

• Risk register
• Heat map visualization
• Trend analysis

5. Recommendations

• Priority treatments
• Timeline and resources
• Residual risk projection

6. Appendices

• Detailed asset list
• Threat catalog
• Control mapping

ISMS Workflows, Validation & Tool Reference

Step-by-step procedures for ISMS implementation, security risk assessment, and incident response; validation checkpoints and certification-readiness checklists; a fully worked healthcare risk-assessment example; troubleshooting and success criteria; and complete risk_assessment.py / compliance_checker.py flag references. Read this when executing any end-to-end ISMS workflow, preparing for a certification audit, diagnosing a tooling result, or looking up a script flag.

Tools

risk_assessment.py

Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.

Usage:

# Full risk assessment
python scripts/risk_assessment.py --scope "cloud-infrastructure" --output risks.json

# Healthcare-specific assessment
python scripts/risk_assessment.py --scope "ehr-system" --template healthcare --output risks.json

# Quick asset-based assessment
python scripts/risk_assessment.py --assets assets.csv --output risks.json

Parameters:

Output:

• Asset inventory with classification
• Threat and vulnerability mapping
• Risk scores (likelihood × impact)
• Treatment recommendations
• Residual risk calculations

compliance_checker.py

Verify ISO 27001/27002 control implementation status.

Usage:

# Check all ISO 27001 controls
python scripts/compliance_checker.py --standard iso27001

# Gap analysis with recommendations
python scripts/compliance_checker.py --standard iso27001 --gap-analysis

# Check specific control domains
python scripts/compliance_checker.py --standard iso27001 --domains "access-control,cryptography"

# Export compliance report
python scripts/compliance_checker.py --standard iso27001 --output compliance_report.md

Parameters:

Output:

• Control implementation status
• Compliance percentage by domain
• Gap analysis with priorities
• Remediation recommendations

---

Workflows

Workflow 1: ISMS Implementation

Step 1: Define Scope and Context

Document organizational context and ISMS boundaries:

• Identify interested parties and requirements
• Define ISMS scope and boundaries
• Document internal/external issues

Validation: Scope statement reviewed and approved by management.

Step 2: Conduct Risk Assessment

python scripts/risk_assessment.py --scope "full-organization" --template general --output initial_risks.json

• Identify information assets
• Assess threats and vulnerabilities
• Calculate risk levels
• Determine risk treatment options

Validation: Risk register contains all critical assets with assigned owners.

Step 3: Select and Implement Controls

Map risks to ISO 27002 controls:

python scripts/compliance_checker.py --standard iso27002 --gap-analysis --output control_gaps.md

Control categories:

• Organizational (policies, roles, responsibilities)
• People (screening, awareness, training)
• Physical (perimeters, equipment, media)
• Technological (access, crypto, network, application)

Validation: Statement of Applicability (SoA) documents all controls with justification.

Step 4: Establish Monitoring

Define security metrics:

• Incident count and severity trends
• Control effectiveness scores
• Training completion rates
• Audit findings closure rate

Validation: Dashboard shows real-time compliance status.

Workflow 2: Security Risk Assessment

Step 1: Asset Identification

Create asset inventory:

Validation: All assets have assigned owners and classifications.

Step 2: Threat Analysis

Identify threats per asset category:

Validation: Threat model covers top-10 industry threats.

Step 3: Vulnerability Assessment

python scripts/risk_assessment.py --scope "network-infrastructure" --output vuln_risks.json

Document vulnerabilities:

• Technical (unpatched systems, weak configs)
• Process (missing procedures, gaps)
• People (lack of training, insider risk)

Validation: Vulnerability scan results mapped to risk register.

Step 4: Risk Evaluation and Treatment

Calculate risk: Risk = Likelihood × Impact

Validation: All high/critical risks have approved treatment plans.

Workflow 3: Incident Response

Step 1: Detection and Reporting

Incident categories:

• Security breach (unauthorized access)
• Malware infection
• Data leakage
• System compromise
• Policy violation

Validation: Incident logged within 15 minutes of detection.

Step 2: Triage and Classification

Validation: Severity assigned and escalation triggered if needed.

Step 3: Containment and Eradication

Immediate actions: 1. Isolate affected systems 2. Preserve evidence 3. Block threat vectors 4. Remove malicious artifacts

Validation: Containment confirmed, no ongoing compromise.

Step 4: Recovery and Lessons Learned

Post-incident activities: 1. Restore systems from clean backups 2. Verify integrity before reconnection 3. Document timeline and actions 4. Conduct post-incident review 5. Update controls and procedures

Validation: Post-incident report completed within 5 business days.

---

Validation Checkpoints

ISMS Implementation Validation

Certification Readiness

Before Stage 1 audit:

• [ ] ISMS scope documented and approved
• [ ] Information security policy published
• [ ] Risk assessment completed
• [ ] Statement of Applicability finalized
• [ ] Internal audit conducted
• [ ] Management review completed
• [ ] Nonconformities addressed

Before Stage 2 audit:

• [ ] Controls implemented and operational
• [ ] Evidence of effectiveness available
• [ ] Staff trained and aware
• [ ] Incidents logged and managed
• [ ] Metrics collected for 3+ months

Compliance Verification

Run periodic checks:

# Monthly compliance check
python scripts/compliance_checker.py --standard iso27001 --output monthly_$(date +%Y%m).md

# Quarterly gap analysis
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output quarterly_gaps.md

---

Worked Example: Healthcare Risk Assessment

Scenario: Assess security risks for a patient data management system.

Step 1: Define Assets

python scripts/risk_assessment.py --scope "patient-data-system" --template healthcare

Asset inventory output:

Step 2: Identify Risks

Risk register output:

Step 3: Determine Treatment

Step 4: Verify Implementation

python scripts/compliance_checker.py --controls-file implemented_controls.csv

Verification output:

Control Implementation Status
=============================
Cryptography (A.8.24): IMPLEMENTED
  - AES-256 at rest: YES
  - TLS 1.3 in transit: YES

Access Control (A.8.5): IMPLEMENTED
  - MFA enabled: YES
  - Admin accounts: 100% coverage

Application Security (A.8.26): PARTIAL
  - Input validation: YES
  - WAF deployed: PENDING

Overall Compliance: 87%

---

Troubleshooting

---

Success Criteria

• Overall compliance score above 85% -- as measured by compliance_checker.py, with all high-priority controls implemented and operating effectively
• Risk register complete with assigned owners for all high/critical risks -- every risk assessed using Likelihood x Impact methodology with documented treatment plans and target remediation dates
• Statement of Applicability current and approved -- covering all 93 Annex A controls with justification for inclusion/exclusion, aligned with the 2022 four-theme structure
• Internal audit conducted annually -- covering all ISMS clauses (4-10) and all Annex A controls within the 3-year certification cycle, with findings documented and corrective actions tracked
• Management review completed with documented outputs -- including ISMS performance metrics, audit findings, risk treatment status, and improvement decisions
• Security awareness training completion rate above 95% -- all personnel trained annually with records maintained; specialized training for security and IT staff
• Incident response tested and validated -- at least one tabletop exercise or simulation annually; post-incident reviews conducted for all actual incidents; lessons learned documented and implemented

---

Tool Reference (Full Flag Tables)

risk_assessment.py

Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.

Output: Asset inventory with classification, threat and vulnerability mapping, risk scores (Likelihood x Impact on 1-5 scale), treatment recommendations per risk level, and residual risk calculations.

compliance_checker.py

Verifies ISO 27001/27002 control implementation status with gap analysis and remediation recommendations.

Output: Control implementation status per domain, compliance percentage by theme/domain, gap analysis with priorities (when --gap-analysis flag used), and remediation recommendations mapped to ISO 27002 control guidance.