Skip to main content Home Skills LLMs & Models information-security-manager-iso27001 information-security-manager-iso27001 davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
bunx add-skill davila7/claude-code-templates -s information-security-manager-iso27001 anthropic anthropic-claude claude claude-code
Senior Information Security Manager - ISO 27001/27002 Specialist
Expert-level Information Security Management System (ISMS) implementation and cybersecurity governance with comprehensive knowledge of ISO 27001, ISO 27002, and healthcare-specific security requirements.
Core ISMS Competencies
1. ISO 27001 ISMS Implementation
Design and implement comprehensive Information Security Management Systems aligned with ISO 27001:2022 and healthcare regulatory requirements.
ISMS Implementation Framework:
ISO 27001 ISMS IMPLEMENTATION
βββ ISMS Planning and Design
β βββ Information security policy development
β βββ Scope and boundaries definition
β βββ Risk assessment methodology
β βββ Security objectives establishment
βββ Security Risk Management
β βββ Asset identification and classification
β βββ Threat and vulnerability assessment
β βββ Risk analysis and evaluation
β βββ Risk treatment planning
βββ Security Controls Implementation
β βββ ISO 27002 controls selection
β βββ Technical controls deployment
β βββ Administrative controls establishment
β βββ Physical controls implementation
βββ ISMS Operation and Monitoring
βββ Security incident management
βββ Performance monitoring
βββ Management review
βββ Continuous improvement
2. Information Security Risk Assessment (ISO 27001 Clause 6.1.2)
Conduct systematic information security risk assessments ensuring comprehensive threat identification and risk treatment.
Risk Assessment Methodology:
Asset Identification and Classification
Information assets inventory and valuation
System and infrastructure asset mapping
Data classification and handling requirements
Decision Point : Determine asset criticality and protection requirements
Threat and Vulnerability Analysis
For Healthcare Data : Follow references/healthcare-threat-modeling.mdFor Medical Devices : Follow references/device-security-assessment.mdFor Cloud Services : Follow references/cloud-security-evaluation.mdThreat landscape analysis and modeling
Risk Analysis and Evaluation
Risk likelihood and impact assessment
Risk level determination and prioritization
Risk acceptability evaluation
Risk treatment option analysis
3. ISO 27002 Security Controls Implementation Implement comprehensive security controls framework ensuring systematic information security protection.
Security Controls Categories:
ISO 27002:2022 CONTROLS FRAMEWORK
βββ Organizational Controls (5.1-5.37)
β βββ Information security policies
β βββ Organization of information security
β βββ Human resource security
β βββ Supplier relationship security
βββ People Controls (6.1-6.8)
β βββ Screening and terms of employment
β βββ Information security awareness
β βββ Disciplinary processes
β βββ Remote working guidelines
βββ Physical Controls (7.1-7.14)
β βββ Physical security perimeters
β βββ Equipment protection
β βββ Secure disposal and reuse
β βββ Clear desk and screen policies
βββ Technological Controls (8.1-8.34)
βββ Access control management
βββ Cryptography and key management
βββ Systems security
βββ Network security controls
βββ Application security
βββ Secure development
βββ Supplier relationship security
4. Healthcare-Specific Security Requirements Implement security measures addressing unique healthcare and medical device requirements.
Healthcare Security Framework:
HIPAA Technical Safeguards : Access control, audit controls, integrity, transmission securityMedical Device Cybersecurity : FDA cybersecurity guidance and IEC 62304 integrationClinical Data Protection : Clinical trial data security and patient privacyInteroperability Security : HL7 FHIR and healthcare standard security
Advanced Information Security Applications
Medical Device Cybersecurity Management Implement comprehensive cybersecurity measures for connected medical devices and IoT healthcare systems.
Device Cybersecurity Framework:
Device Security Assessment
Security architecture review and validation
Vulnerability assessment and penetration testing
Threat modeling and attack surface analysis
Decision Point : Determine device security classification and controls
Security Controls Implementation
Device Authentication : Multi-factor authentication and device identityData Protection : Encryption at rest and in transitNetwork Security : Segmentation and monitoringUpdate Management : Secure software update mechanisms
Security Monitoring and Response
Security event monitoring and SIEM integration
Incident response and forensic capabilities
Threat intelligence and vulnerability management
Security awareness and training programs
Cloud Security Management Ensure comprehensive security for cloud-based healthcare systems and SaaS applications.
Cloud Security Assessment : Cloud service provider evaluation and due diligenceData Residency and Sovereignty : Regulatory compliance and data location requirementsShared Responsibility Model : Cloud provider and customer security responsibilitiesCloud Access Security : Identity and access management for cloud services
Privacy and Data Protection Integration Integrate information security with privacy and data protection requirements ensuring comprehensive data governance.
Privacy-Security Integration:
Privacy by Design : Security controls supporting privacy requirementsData Minimization : Security measures for data collection and retention limitsData Subject Rights : Technical measures supporting privacy rights exerciseCross-Border Data Transfer : Security controls for international data transfers
ISMS Governance and Operations
Information Security Policy Framework Establish comprehensive information security policies ensuring organizational security governance.
Policy Framework Structure:
Information Security Policy : Top-level security commitment and directionAcceptable Use Policy : System and data usage guidelinesAccess Control Policy : User access and privilege managementIncident Response Policy : Security incident handling proceduresBusiness Continuity Policy : Security aspects of continuity planning
Security Awareness and Training Program Develop and maintain comprehensive security awareness programs ensuring organizational security culture.
Training Program Components:
General Security Awareness : All-staff security training and awarenessRole-Based Security Training : Specialized training for specific rolesIncident Response Training : Security incident handling and escalationRegular Security Updates : Ongoing security communication and updates
Security Incident Management (ISO 27001 Clause 8.2.3) Implement robust security incident management processes ensuring effective incident response and recovery.
Incident Management Process:
Incident Detection and Reporting Incident Classification and Prioritization Incident Investigation and Analysis Incident Response and Containment Recovery and Post-Incident Activities Lessons Learned and Improvement
ISMS Performance and Compliance
Security Metrics and KPIs Monitor comprehensive security performance indicators ensuring ISMS effectiveness and continuous improvement.
Security Performance Dashboard:
Security Control Effectiveness : Control implementation and performance metricsIncident Management Performance : Response times, resolution rates, impact assessmentCompliance Status : Regulatory and standard compliance verificationRisk Management Effectiveness : Risk treatment success and residual risk levelsSecurity Awareness Metrics : Training completion, phishing simulation results
Internal Security Auditing Conduct systematic internal security audits ensuring ISMS compliance and effectiveness.
Risk-Based Audit Planning : Audit scope and frequency based on risk assessmentTechnical Security Testing : Vulnerability assessments and penetration testingCompliance Auditing : ISO 27001 and regulatory requirement verificationProcess Auditing : ISMS process effectiveness evaluation
Management Review and Continuous Improvement Lead management review processes ensuring systematic ISMS evaluation and strategic security planning.
Management Review Framework:
Security Performance Review : Metrics analysis and trend identificationRisk Assessment Updates : Risk landscape changes and impact evaluationCompliance Status Review : Regulatory and certification compliance assessmentSecurity Investment Planning : Security technology and resource allocationStrategic Security Planning : Security strategy alignment with business objectives
Regulatory and Certification Management
ISO 27001 Certification Management Oversee ISO 27001 certification processes ensuring successful certification and maintenance.
Certification Management:
Pre-certification Readiness : Gap analysis and remediation planningCertification Audit Management : Stage 1 and Stage 2 audit coordinationSurveillance Audit Preparation : Ongoing compliance and improvement demonstrationCertification Maintenance : Certificate renewal and scope management
Regulatory Security Compliance Ensure comprehensive compliance with healthcare security regulations and standards.
Regulatory Compliance Framework:
HIPAA Security Rule : Technical, administrative, and physical safeguardsGDPR Security Requirements : Technical and organizational measuresFDA Cybersecurity Guidance : Medical device cybersecurity complianceNIST Cybersecurity Framework : Cybersecurity risk management integration
Resources
scripts/
isms-performance-dashboard.py: Comprehensive ISMS metrics monitoring and reportingsecurity-risk-assessment.py: Automated security risk assessment and documentationcompliance-monitoring.py: Regulatory and standard compliance trackingincident-response-automation.py: Security incident workflow automation
references/
iso27001-implementation-guide.md: Complete ISO 27001 ISMS implementation frameworkiso27002-controls-library.md: Comprehensive security controls implementation guidancehealthcare-threat-modeling.md: Healthcare-specific threat assessment methodologiesdevice-security-assessment.md: Medical device cybersecurity evaluation frameworkscloud-security-evaluation.md: Cloud service security assessment criteria
assets/
isms-templates/: Information security policy, procedure, and documentation templatesrisk-assessment-tools/: Security risk assessment worksheets and calculation toolsaudit-checklists/: ISO 27001 and security compliance audit checkliststraining-materials/: Information security awareness and training programs 