Information Security Manager - ISO 27001

Implement and manage Information Security Management Systems (ISMS) aligned with ISO 27001:2022 and healthcare regulatory requirements.

Table of Contents

• Trigger Phrases
• Quick Start
• Tools
• Workflows
• Reference Guides
• Validation Checkpoints

Trigger Phrases

Use this skill when you hear:

• "implement ISO 27001"
• "ISMS implementation"
• "security risk assessment"
• "information security policy"
• "ISO 27001 certification"
• "security controls implementation"
• "incident response plan"
• "healthcare data security"
• "medical device cybersecurity"
• "security compliance audit"

Quick Start

Run Security Risk Assessment

python scripts/risk_assessment.py --scope "patient-data-system" --output risk_register.json

Check Compliance Status

python scripts/compliance_checker.py --standard iso27001 --controls-file controls.csv

Generate Gap Analysis Report

python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output gaps.md

Tools

risk_assessment.py

Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.

Usage:

# Full risk assessment
python scripts/risk_assessment.py --scope "cloud-infrastructure" --output risks.json

# Healthcare-specific assessment
python scripts/risk_assessment.py --scope "ehr-system" --template healthcare --output risks.json

# Quick asset-based assessment
python scripts/risk_assessment.py --assets assets.csv --output risks.json

Parameters:

--scope

--template

general

healthcare

cloud

--assets

--output

--format

json

csv

markdown

Output:

• Asset inventory with classification
• Threat and vulnerability mapping
• Risk scores (likelihood × impact)
• Treatment recommendations
• Residual risk calculations

compliance_checker.py

Verify ISO 27001/27002 control implementation status.

Usage:

# Check all ISO 27001 controls
python scripts/compliance_checker.py --standard iso27001

# Gap analysis with recommendations
python scripts/compliance_checker.py --standard iso27001 --gap-analysis

# Check specific control domains
python scripts/compliance_checker.py --standard iso27001 --domains "access-control,cryptography"

# Export compliance report
python scripts/compliance_checker.py --standard iso27001 --output compliance_report.md

Parameters:

--standard

iso27001

iso27002

hipaa

--controls-file

--gap-analysis

--domains

--output

Output:

• Control implementation status
• Compliance percentage by domain
• Gap analysis with priorities
• Remediation recommendations

Workflows

Workflow 1: ISMS Implementation

Step 1: Define Scope and Context

Document organizational context and ISMS boundaries:

• Identify interested parties and requirements
• Define ISMS scope and boundaries
• Document internal/external issues

Validation: Scope statement reviewed and approved by management.

Step 2: Conduct Risk Assessment

python scripts/risk_assessment.py --scope "full-organization" --template general --output initial_risks.json

• Identify information assets
• Assess threats and vulnerabilities
• Calculate risk levels
• Determine risk treatment options

Validation: Risk register contains all critical assets with assigned owners.

Step 3: Select and Implement Controls

Map risks to ISO 27002 controls:

python scripts/compliance_checker.py --standard iso27002 --gap-analysis --output control_gaps.md

Control categories:

• Organizational (policies, roles, responsibilities)
• People (screening, awareness, training)
• Physical (perimeters, equipment, media)
• Technological (access, crypto, network, application)

Validation: Statement of Applicability (SoA) documents all controls with justification.

Step 4: Establish Monitoring

Define security metrics:

• Incident count and severity trends
• Control effectiveness scores
• Training completion rates
• Audit findings closure rate

Validation: Dashboard shows real-time compliance status.

Workflow 2: Security Risk Assessment

Step 1: Asset Identification

Create asset inventory:

Validation: All assets have assigned owners and classifications.

Step 2: Threat Analysis

Identify threats per asset category:

Validation: Threat model covers top-10 industry threats.

Step 3: Vulnerability Assessment

python scripts/risk_assessment.py --scope "network-infrastructure" --output vuln_risks.json

Document vulnerabilities:

• Technical (unpatched systems, weak configs)
• Process (missing procedures, gaps)
• People (lack of training, insider risk)

Validation: Vulnerability scan results mapped to risk register.

Step 4: Risk Evaluation and Treatment

Calculate risk:

Risk = Likelihood × Impact

Validation: All high/critical risks have approved treatment plans.

Workflow 3: Incident Response

Step 1: Detection and Reporting

Incident categories:

• Security breach (unauthorized access)
• Malware infection
• Data leakage
• System compromise
• Policy violation

Validation: Incident logged within 15 minutes of detection.

Step 2: Triage and Classification

Validation: Severity assigned and escalation triggered if needed.

Step 3: Containment and Eradication

Immediate actions:

1. Isolate affected systems
2. Preserve evidence
3. Block threat vectors
4. Remove malicious artifacts

Validation: Containment confirmed, no ongoing compromise.

Step 4: Recovery and Lessons Learned

Post-incident activities:

1. Restore systems from clean backups
2. Verify integrity before reconnection
3. Document timeline and actions
4. Conduct post-incident review
5. Update controls and procedures

Validation: Post-incident report completed within 5 business days.

Reference Guides

When to Use Each Reference

references/iso27001-controls.md

• Control selection for SoA
• Implementation guidance
• Evidence requirements
• Audit preparation

references/risk-assessment-guide.md

• Risk methodology selection
• Asset classification criteria
• Threat modeling approaches
• Risk calculation methods

references/incident-response.md

• Response procedures
• Escalation matrices
• Communication templates
• Recovery checklists

Validation Checkpoints

ISMS Implementation Validation

Certification Readiness

Before Stage 1 audit:

• ISMS scope documented and approved
• Information security policy published
• Risk assessment completed
• Statement of Applicability finalized
• Internal audit conducted
• Management review completed
• Nonconformities addressed

Before Stage 2 audit:

• Controls implemented and operational
• Evidence of effectiveness available
• Staff trained and aware
• Incidents logged and managed
• Metrics collected for 3+ months

Compliance Verification

Run periodic checks:

# Monthly compliance check
python scripts/compliance_checker.py --standard iso27001 --output monthly_$(date +%Y%m).md

# Quarterly gap analysis
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output quarterly_gaps.md

Worked Example: Healthcare Risk Assessment

Scenario: Assess security risks for a patient data management system.

Step 1: Define Assets

python scripts/risk_assessment.py --scope "patient-data-system" --template healthcare

Asset inventory output:

Step 2: Identify Risks

Risk register output:

Step 3: Determine Treatment

Step 4: Verify Implementation

python scripts/compliance_checker.py --controls-file implemented_controls.csv

Verification output:

Control Implementation Status
=============================
Cryptography (A.8.24): IMPLEMENTED
  - AES-256 at rest: YES
  - TLS 1.3 in transit: YES

Access Control (A.8.5): IMPLEMENTED
  - MFA enabled: YES
  - Admin accounts: 100% coverage

Application Security (A.8.26): PARTIAL
  - Input validation: YES
  - WAF deployed: PENDING

Overall Compliance: 87%

ISO 27001:2022 Annex A Controls — Complete Reference

The 2022 revision restructured controls from 14 domains (114 controls) to 4 themes (93 controls). All organizations must update their Statement of Applicability (SoA) accordingly.

Theme 1: Organizational Controls (37 controls)

Theme 2: People Controls (8 controls)

Theme 3: Physical Controls (14 controls)

Theme 4: Technological Controls (34 controls)

New Controls in ISO 27001:2022

11 controls are entirely new in the 2022 revision:

Cross-Reference: SOC 2 Control Mapping

Map ISO 27001:2022 controls to SOC 2 Trust Services Criteria for organizations requiring both certifications:

See also:

../soc2-compliance-specialist/SKILL.md

for full SOC 2 compliance workflows.

Cross-Reference: NIS2 Directive Alignment

The NIS2 Directive (EU 2022/2555) mandates cybersecurity measures for essential and important entities, including healthcare organizations. ISO 27001 provides a strong foundation for NIS2 compliance:

NIS2-specific additions beyond ISO 27001:

• Incident reporting: 24-hour early warning to CSIRT, 72-hour incident notification, 1-month final report
• Management accountability: Senior management must approve cybersecurity measures and undergo training
• Penalties: Up to EUR 10M or 2% of global turnover for essential entities
• Supply chain: Must assess each direct supplier's cybersecurity practices

See also:

../nis2-compliance-specialist/SKILL.md

for complete NIS2 implementation workflows.

Cloud Security Controls

AWS-Specific Controls

Azure-Specific Controls

GCP-Specific Controls

Zero Trust Architecture Integration

Align ISO 27001 controls with Zero Trust principles (NIST SP 800-207):

Zero Trust Pillars Mapped to ISO 27001

Zero Trust Implementation Roadmap

Phase 1: Foundation (0-6 months)
├── Implement identity provider with MFA for all users
├── Deploy EDR on all endpoints
├── Enable centralized logging and SIEM
└── Classify critical data assets

Phase 2: Enhancement (6-12 months)
├── Implement network microsegmentation
├── Deploy conditional access policies
├── Enable continuous device compliance monitoring
└── Implement DLP for classified data

Phase 3: Maturation (12-18 months)
├── Deploy zero-trust network access (ZTNA) replacing VPN
├── Implement just-in-time (JIT) privileged access
├── Enable automated threat response (SOAR)
└── Continuous verification with behavioral analytics

Hardware Security Key Requirements

FIDO2/WebAuthn Implementation

For high-assurance authentication per A.5.17 and A.8.5:

Supported standards:

• FIDO2 / WebAuthn (passwordless primary authentication)
• FIDO U2F (second-factor authentication)
• PIV/Smart Card (legacy enterprise systems)
• TOTP (fallback only — hardware keys preferred)

Deployment checklist:

• Procure minimum 2 hardware keys per critical user (primary + backup)
• Register keys with identity provider (Entra ID, Okta, Google Workspace)
• Enforce phishing-resistant MFA policy for privileged access
• Disable SMS/voice MFA for admin accounts
• Document key recovery procedures
• Test break-glass procedures with backup keys

Supply Chain Security Controls

ICT Supply Chain Risk Management (A.5.19-A.5.22)

Software Bill of Materials (SBOM) Requirements

Third-Party Risk Tiers

Cross-Framework Mapping Table

Cross-references: See

../gdpr-dsgvo-expert/SKILL.md

for GDPR privacy controls mapping, and

../risk-management-specialist/SKILL.md

for ISO 14971 risk management integration with ISO 27001.

ISO 27001:2022 Enhanced Controls & Cross-Framework Integration

Annex A Control Themes (93 Controls)

Hardware Security Key Requirements

• YubiKey 5 Series: Required for admin accounts, cloud console access, VPN, code signing
• FIDO2/WebAuthn: Phishing-resistant MFA for all users within 90 days of ISMS deployment
• Policy: SMS/voice MFA PROHIBITED (SIM swapping risk). TOTP acceptable as interim for non-admin
• Backup Keys: Minimum 2 hardware keys per user (primary + backup stored securely)
• Recovery: Manager approval + identity verification required for key replacement

Zero Trust Architecture Integration

• Never Trust, Always Verify: All access decisions based on identity, device, and context
• Microsegmentation: Network segmentation at workload level, not just network perimeter
• Least Privilege: Just-in-time access, time-bounded permissions, automated deprovisioning
• Continuous Verification: Session-level authentication, device health checks, behavioral analytics

Cross-Framework Mapping (ISO 27001 ↔ SOC 2 ↔ NIST CSF ↔ NIS2)

Supply Chain Security Controls

• Supplier Risk Assessment: Due diligence before onboarding, annual reassessment
• Contractual Security Clauses: Data protection, incident reporting, audit rights, exit terms
• Continuous Monitoring: Vendor security ratings, certificate expiry alerts, breach notifications
• SBOM Requirements: Software Bill of Materials for all third-party software components

Troubleshooting

compliance_checker.py --gap-analysis

--template healthcare

--template cloud

Success Criteria

• Overall compliance score above 85% -- as measured by

  compliance_checker.py

  , with all high-priority controls implemented and operating effectively
• Risk register complete with assigned owners for all high/critical risks -- every risk assessed using Likelihood x Impact methodology with documented treatment plans and target remediation dates
• Statement of Applicability current and approved -- covering all 93 Annex A controls with justification for inclusion/exclusion, aligned with the 2022 four-theme structure
• Internal audit conducted annually -- covering all ISMS clauses (4-10) and all Annex A controls within the 3-year certification cycle, with findings documented and corrective actions tracked
• Management review completed with documented outputs -- including ISMS performance metrics, audit findings, risk treatment status, and improvement decisions
• Security awareness training completion rate above 95% -- all personnel trained annually with records maintained; specialized training for security and IT staff
• Incident response tested and validated -- at least one tabletop exercise or simulation annually; post-incident reviews conducted for all actual incidents; lessons learned documented and implemented

Scope & Limitations

In Scope:

• ISO 27001:2022 ISMS implementation guidance including all 93 Annex A controls across 4 themes
• Security risk assessment following ISO 27001 Clause 6.1.2 methodology with configurable threat catalogs (general, healthcare, cloud)
• Compliance checking and gap analysis against ISO 27001 and ISO 27002 controls
• Cross-framework mapping to SOC 2 TSC, NIST CSF 2.0, and NIS2 Directive
• Cloud-specific security controls for AWS, Azure, and GCP
• Zero Trust architecture integration with phased implementation roadmap
• Hardware security key (FIDO2/WebAuthn) requirements and deployment guidance
• Supply chain security controls including SBOM requirements and vendor risk tiering

Out of Scope:

• ISO 27001 certification audit execution -- this skill provides preparation guidance, not audit services
• Implementation of specific security tools (SIEM, EDR, DLP, WAF) -- this skill maps requirements to tool categories
• Penetration testing or vulnerability scanning execution -- use

  infrastructure-compliance-auditor

  for technical checks
• ISO 27701 (privacy information management), ISO 27017 (cloud security), or ISO 27018 (cloud privacy) implementation beyond cross-reference
• Physical security system design or installation beyond control requirements

Important Notes:

• The ISO 27001:2013 to 2022 transition deadline was October 2025; all certifications must now conform to the 2022 edition
• The 2022 revision introduced 11 entirely new controls, notably A.5.7 (Threat intelligence), A.5.23 (Cloud services), A.8.9 (Configuration management), A.8.16 (Monitoring activities), and A.8.28 (Secure coding)
• Integration with other standards (ISO 27701, ISO 42001, ISO 9001) via the harmonized Annex SL structure is becoming standard practice

Integration Points

isms-audit-expert

infrastructure-compliance-auditor

soc2-compliance-expert

gdpr-dsgvo-expert

nist-csf-specialist

dora-compliance-expert

Tool Reference

risk_assessment.py

Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.

--scope <name>

--assets

cloud-infrastructure

ehr-system

patient-data-system

--template <type>

general

healthcare

cloud

--assets <file>

--output <file>

--format <fmt>

json

csv

markdown

Output: Asset inventory with classification, threat and vulnerability mapping, risk scores (Likelihood x Impact on 1-5 scale), treatment recommendations per risk level, and residual risk calculations.

compliance_checker.py

Verifies ISO 27001/27002 control implementation status with gap analysis and remediation recommendations.

--standard <std>

iso27001

iso27002

hipaa

--controls-file <file>

--gap-analysis

--domains <domains>

access-control,cryptography

--output <file>

Output: Control implementation status per domain, compliance percentage by theme/domain, gap analysis with priorities (when

--gap-analysis