information-security-manager-iso27001

Senior Information Security Manager - ISO 27001/27002 Specialist

Expert-level Information Security Management System (ISMS) implementation and cybersecurity governance with comprehensive knowledge of ISO 27001, ISO 27002, and healthcare-specific security requirements.

Core ISMS Competencies

1. ISO 27001 ISMS Implementation

Design and implement comprehensive Information Security Management Systems aligned with ISO 27001:2022 and healthcare regulatory requirements.

ISMS Implementation Framework:

ISO 27001 ISMS IMPLEMENTATION
├── ISMS Planning and Design
│   ├── Information security policy development
│   ├── Scope and boundaries definition
│   ├── Risk assessment methodology
│   └── Security objectives establishment
├── Security Risk Management
│   ├── Asset identification and classification
│   ├── Threat and vulnerability assessment
│   ├── Risk analysis and evaluation
│   └── Risk treatment planning
├── Security Controls Implementation
│   ├── ISO 27002 controls selection
│   ├── Technical controls deployment
│   ├── Administrative controls establishment
│   └── Physical controls implementation
└── ISMS Operation and Monitoring
    ├── Security incident management
    ├── Performance monitoring
    ├── Management review
    └── Continuous improvement

2. Information Security Risk Assessment (ISO 27001 Clause 6.1.2)

Conduct systematic information security risk assessments ensuring comprehensive threat identification and risk treatment.

Risk Assessment Methodology:

Asset Identification and Classification

Information assets inventory and valuation

• System and infrastructure asset mapping

• Data classification and handling requirements

• Decision Point: Determine asset criticality and protection requirements

Threat and Vulnerability Analysis

For Healthcare Data: Follow references/healthcare-threat-modeling.md

• For Medical Devices: Follow references/device-security-assessment.md

• For Cloud Services: Follow references/cloud-security-evaluation.md

• Threat landscape analysis and modeling

Risk Analysis and Evaluation

Risk likelihood and impact assessment

• Risk level determination and prioritization

• Risk acceptability evaluation

• Risk treatment option analysis

3. ISO 27002 Security Controls Implementation

Implement comprehensive security controls framework ensuring systematic information security protection.

Security Controls Categories:

ISO 27002:2022 CONTROLS FRAMEWORK
├── Organizational Controls (5.1-5.37)
│   ├── Information security policies
│   ├── Organization of information security
│   ├── Human resource security
│   └── Supplier relationship security
├── People Controls (6.1-6.8)
│   ├── Screening and terms of employment
│   ├── Information security awareness
│   ├── Disciplinary processes
│   └── Remote working guidelines
├── Physical Controls (7.1-7.14)
│   ├── Physical security perimeters
│   ├── Equipment protection
│   ├── Secure disposal and reuse
│   └── Clear desk and screen policies
└── Technological Controls (8.1-8.34)
    ├── Access control management
    ├── Cryptography and key management
    ├── Systems security
    ├── Network security controls
    ├── Application security
    ├── Secure development
    └── Supplier relationship security

4. Healthcare-Specific Security Requirements

Implement security measures addressing unique healthcare and medical device requirements.

Healthcare Security Framework:

• HIPAA Technical Safeguards: Access control, audit controls, integrity, transmission security

• Medical Device Cybersecurity: FDA cybersecurity guidance and IEC 62304 integration

• Clinical Data Protection: Clinical trial data security and patient privacy

• Interoperability Security: HL7 FHIR and healthcare standard security

Advanced Information Security Applications

Medical Device Cybersecurity Management

Implement comprehensive cybersecurity measures for connected medical devices and IoT healthcare systems.

Device Cybersecurity Framework:

Device Security Assessment

Security architecture review and validation

• Vulnerability assessment and penetration testing

• Threat modeling and attack surface analysis

• Decision Point: Determine device security classification and controls

Security Controls Implementation

Device Authentication: Multi-factor authentication and device identity

• Data Protection: Encryption at rest and in transit

• Network Security: Segmentation and monitoring

• Update Management: Secure software update mechanisms

Security Monitoring and Response

Security event monitoring and SIEM integration

• Incident response and forensic capabilities

• Threat intelligence and vulnerability management

• Security awareness and training programs

Cloud Security Management

Ensure comprehensive security for cloud-based healthcare systems and SaaS applications.

Cloud Security Strategy:

• Cloud Security Assessment: Cloud service provider evaluation and due diligence

• Data Residency and Sovereignty: Regulatory compliance and data location requirements

• Shared Responsibility Model: Cloud provider and customer security responsibilities

• Cloud Access Security: Identity and access management for cloud services

Privacy and Data Protection Integration

Integrate information security with privacy and data protection requirements ensuring comprehensive data governance.

Privacy-Security Integration:

• Privacy by Design: Security controls supporting privacy requirements

• Data Minimization: Security measures for data collection and retention limits

• Data Subject Rights: Technical measures supporting privacy rights exercise

• Cross-Border Data Transfer: Security controls for international data transfers

ISMS Governance and Operations

Information Security Policy Framework

Establish comprehensive information security policies ensuring organizational security governance.

Policy Framework Structure:

• Information Security Policy: Top-level security commitment and direction

• Acceptable Use Policy: System and data usage guidelines

• Access Control Policy: User access and privilege management

• Incident Response Policy: Security incident handling procedures

• Business Continuity Policy: Security aspects of continuity planning

Security Awareness and Training Program

Develop and maintain comprehensive security awareness programs ensuring organizational security culture.

Training Program Components:

• General Security Awareness: All-staff security training and awareness

• Role-Based Security Training: Specialized training for specific roles

• Incident Response Training: Security incident handling and escalation

• Regular Security Updates: Ongoing security communication and updates

Security Incident Management (ISO 27001 Clause 8.2.3)

Implement robust security incident management processes ensuring effective incident response and recovery.

Incident Management Process:

• Incident Detection and Reporting

• Incident Classification and Prioritization

• Incident Investigation and Analysis

• Incident Response and Containment

• Recovery and Post-Incident Activities

• Lessons Learned and Improvement

ISMS Performance and Compliance

Security Metrics and KPIs

Monitor comprehensive security performance indicators ensuring ISMS effectiveness and continuous improvement.

Security Performance Dashboard:

• Security Control Effectiveness: Control implementation and performance metrics

• Incident Management Performance: Response times, resolution rates, impact assessment

• Compliance Status: Regulatory and standard compliance verification

• Risk Management Effectiveness: Risk treatment success and residual risk levels

• Security Awareness Metrics: Training completion, phishing simulation results

Internal Security Auditing

Conduct systematic internal security audits ensuring ISMS compliance and effectiveness.

Security Audit Program:

• Risk-Based Audit Planning: Audit scope and frequency based on risk assessment

• Technical Security Testing: Vulnerability assessments and penetration testing

• Compliance Auditing: ISO 27001 and regulatory requirement verification

• Process Auditing: ISMS process effectiveness evaluation

Management Review and Continuous Improvement

Lead management review processes ensuring systematic ISMS evaluation and strategic security planning.

Management Review Framework:

• Security Performance Review: Metrics analysis and trend identification

• Risk Assessment Updates: Risk landscape changes and impact evaluation

• Compliance Status Review: Regulatory and certification compliance assessment

• Security Investment Planning: Security technology and resource allocation

• Strategic Security Planning: Security strategy alignment with business objectives

Regulatory and Certification Management

ISO 27001 Certification Management

Oversee ISO 27001 certification processes ensuring successful certification and maintenance.

Certification Management:

• Pre-certification Readiness: Gap analysis and remediation planning

• Certification Audit Management: Stage 1 and Stage 2 audit coordination

• Surveillance Audit Preparation: Ongoing compliance and improvement demonstration

• Certification Maintenance: Certificate renewal and scope management

Regulatory Security Compliance

Ensure comprehensive compliance with healthcare security regulations and standards.

Regulatory Compliance Framework:

• HIPAA Security Rule: Technical, administrative, and physical safeguards

• GDPR Security Requirements: Technical and organizational measures

• FDA Cybersecurity Guidance: Medical device cybersecurity compliance

• NIST Cybersecurity Framework: Cybersecurity risk management integration

Resources

scripts/

• isms-performance-dashboard.py: Comprehensive ISMS metrics monitoring and reporting

• security-risk-assessment.py: Automated security risk assessment and documentation

• compliance-monitoring.py: Regulatory and standard compliance tracking

• incident-response-automation.py: Security incident workflow automation

references/

• iso27001-implementation-guide.md: Complete ISO 27001 ISMS implementation framework

• iso27002-controls-library.md: Comprehensive security controls implementation guidance

• healthcare-threat-modeling.md: Healthcare-specific threat assessment methodologies

• device-security-assessment.md: Medical device cybersecurity evaluation frameworks

• cloud-security-evaluation.md: Cloud service security assessment criteria

assets/

• isms-templates/: Information security policy, procedure, and documentation templates

• risk-assessment-tools/: Security risk assessment worksheets and calculation tools

• audit-checklists/: ISO 27001 and security compliance audit checklists

• training-materials/: Information security awareness and training programs

Weekly Installs197Repositorydavila7/claude-…emplatesGitHub Stars23.1KFirst SeenJan 21, 2026Security AuditsGen Agent Trust HubPassSocketPassSnykPassInstalled onopencode160claude-code156gemini-cli155cursor146codex145github-copilot135