Skip to main content Home Creators thiagofernandes1987-create apex information-security-manager-iso27001
information-security-manager-iso27001 Manage — ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use for ISMS design, security risk assessment, control implementation, ISO 27001 ce
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/thiagofernandes1987-create/APEX --skill information-security-manager-iso27001The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Token-aware reasoning workflow with real tools: picks an operating mode to control cost, runs a structured pipeline (decompose → validate → verify → snapshot), and gives Claude Program-of-Thought, RK4/Euler, a code gate, and a safe skill router. Use when: multi-step or high-stakes tasks, real math, precise computation, audits, or the user mentions APEX, PoT, pipeline, or scientific mode.
Related occupations SOC
Based on SOC occupation classification
name information-security-manager-iso27001 description Manage — ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use for ISMS design, security risk assessment, control implementation, ISO 27001 ce executor HYBRID skill_id business.ra-qm-team.information-security-manager-iso27001 status ADOPTED security {"level":"high","pii":false,"approval_required":true} anchors ["business","security","design"] tier 1 input_schema [{"name":"code_or_task","type":"string","description":"Code snippet, script, or task description to process","required":true}] output_schema [{"name":"result","type":"string","description":"Generated or refactored code output"},{"name":"explanation","type":"string","description":"Explanation of changes or implementation decisions"}]
Information Security Manager - ISO 27001
Implement and manage Information Security Management Systems (ISMS) aligned with ISO 27001:2022 and healthcare regulatory requirements.
Table of Contents
Trigger Phrases
Use this skill when you hear:
"implement ISO 27001"
"ISMS implementation"
"security risk assessment"
"information security policy"
"ISO 27001 certification"
"security controls implementation"
"incident response plan"
"healthcare data security"
"medical device cybersecurity"
"security compliance audit"
Quick Start
Run Security Risk Assessment
python scripts/risk_assessment.py --scope "patient-data-system" --output risk_register.json
Check Compliance Status
python scripts/compliance_checker.py --standard iso27001 --controls-file controls.csv
Generate Gap Analysis Report
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output gaps.md
Tools
risk_assessment.py
Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.
Usage:
python scripts/risk_assessment.py --scope "cloud-infrastructure" --output risks.json
python scripts/risk_assessment.py --scope "ehr-system" --template healthcare --output risks.json
python scripts/risk_assessment.py --assets assets.csv --output risks.json
Parameters:
Parameter Required Description
--templateNo Assessment template: general, healthcare, cloud
--assetsNo CSV file with asset inventory
--outputNo Output file (default: stdout)
--formatNo Output format: json, csv, markdown
Asset inventory with classification
Threat and vulnerability mapping
Risk scores (likelihood × impact)
Treatment recommendations
Residual risk calculations
compliance_checker.py Verify ISO 27001/27002 control implementation status.
python scripts/compliance_checker.py --standard iso27001
python scripts/compliance_checker.py --standard iso27001 --gap-analysis
python scripts/compliance_checker.py --standard iso27001 --domains "access-control,cryptography"
python scripts/compliance_checker.py --standard iso27001 --output compliance_report.md
Parameter Required Description --standardYes Standard to check: iso27001, iso27002, hipaa --controls-fileNo CSV with current control status --gap-analysisNo Include remediation recommendations --domainsNo Specific control domains to check --outputNo Output file path
Control implementation status
Compliance percentage by domain
Gap analysis with priorities
Remediation recommendations
Workflows
Workflow 1: ISMS Implementation Step 1: Define Scope and Context
Document organizational context and ISMS boundaries:
Identify interested parties and requirements
Define ISMS scope and boundaries
Document internal/external issues
Validation: Scope statement reviewed and approved by management.
Step 2: Conduct Risk Assessment
python scripts/risk_assessment.py --scope "full-organization" --template general --output initial_risks.json
Identify information assets
Assess threats and vulnerabilities
Calculate risk levels
Determine risk treatment options
Validation: Risk register contains all critical assets with assigned owners.
Step 3: Select and Implement Controls
Map risks to ISO 27002 controls:
python scripts/compliance_checker.py --standard iso27002 --gap-analysis --output control_gaps.md
Organizational (policies, roles, responsibilities)
People (screening, awareness, training)
Physical (perimeters, equipment, media)
Technological (access, crypto, network, application)
Validation: Statement of Applicability (SoA) documents all controls with justification.
Step 4: Establish Monitoring
Incident count and severity trends
Control effectiveness scores
Training completion rates
Audit findings closure rate
Validation: Dashboard shows real-time compliance status.
Workflow 2: Security Risk Assessment Step 1: Asset Identification
Asset Type Examples Classification Information Patient records, source code Confidential Software EHR system, APIs Critical Hardware Servers, medical devices High Services Cloud hosting, backup High People Admin accounts, developers Varies
Validation: All assets have assigned owners and classifications.
Identify threats per asset category:
Asset Threats Likelihood Patient data Unauthorized access, breach High Medical devices Malware, tampering Medium Cloud services Misconfiguration, outage Medium Credentials Phishing, brute force High
Validation: Threat model covers top-10 industry threats.
Step 3: Vulnerability Assessment
python scripts/risk_assessment.py --scope "network-infrastructure" --output vuln_risks.json
Document vulnerabilities:
Technical (unpatched systems, weak configs)
Process (missing procedures, gaps)
People (lack of training, insider risk)
Validation: Vulnerability scan results mapped to risk register.
Step 4: Risk Evaluation and Treatment
Calculate risk: Risk = Likelihood × Impact
Risk Level Score Treatment Critical 20-25 Immediate action required High 15-19 Treatment plan within 30 days Medium 10-14 Treatment plan within 90 days Low 5-9 Accept or monitor Minimal 1-4 Accept
Validation: All high/critical risks have approved treatment plans.
Workflow 3: Incident Response Step 1: Detection and Reporting
Security breach (unauthorized access)
Malware infection
Data leakage
System compromise
Policy violation
Validation: Incident logged within 15 minutes of detection.
Step 2: Triage and Classification
Severity Criteria Response Time Critical Data breach, system down Immediate High Active threat, significant risk 1 hour Medium Contained threat, limited impact 4 hours Low Minor violation, no impact 24 hours
Validation: Severity assigned and escalation triggered if needed.
Step 3: Containment and Eradication
Isolate affected systems
Preserve evidence
Block threat vectors
Remove malicious artifacts
Validation: Containment confirmed, no ongoing compromise.
Step 4: Recovery and Lessons Learned
Post-incident activities:
Restore systems from clean backups
Verify integrity before reconnection
Document timeline and actions
Conduct post-incident review
Update controls and procedures
Validation: Post-incident report completed within 5 business days.
Reference Guides
When to Use Each Reference references/iso27001-controls.md
Control selection for SoA
Implementation guidance
Evidence requirements
Audit preparation
references/risk-assessment-guide.md
Risk methodology selection
Asset classification criteria
Threat modeling approaches
Risk calculation methods
references/incident-response.md
Response procedures
Escalation matrices
Communication templates
Recovery checklists
Validation Checkpoints
ISMS Implementation Validation Phase Checkpoint Evidence Required Scope Scope approved Signed scope document Risk Register complete Risk register with owners Controls SoA approved Statement of Applicability Operation Metrics active Dashboard screenshots Audit Internal audit done Audit report
Certification Readiness
Compliance Verification
python scripts/compliance_checker.py --standard iso27001 --output monthly_$(date +%Y%m).md
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output quarterly_gaps.md
Worked Example: Healthcare Risk Assessment Scenario: Assess security risks for a patient data management system.
Step 1: Define Assets python scripts/risk_assessment.py --scope "patient-data-system" --template healthcare
Asset ID Asset Type Owner Classification A001 Patient database Information DBA Team Confidential A002 EHR application Software App Team Critical A003 Database server Hardware Infra Team High A004 Admin credentials Access Security Critical
Step 2: Identify Risks Risk ID Asset Threat Vulnerability L I Score R001 A001 Data breach Weak encryption 3 5 15 R002 A002 SQL injection Input validation 4 4 16 R003 A004 Credential theft No MFA 4 5 20
Step 3: Determine Treatment Risk Treatment Control Timeline R001 Mitigate Implement AES-256 encryption 30 days R002 Mitigate Add input validation, WAF 14 days R003 Mitigate Enforce MFA for all admins 7 days
Step 4: Verify Implementation python scripts/compliance_checker.py --controls-file implemented_controls.csv
Control Implementation Status
=============================
Cryptography (A.8.24): IMPLEMENTED
- AES-256 at rest: YES
- TLS 1.3 in transit: YES
Access Control (A.8.5): IMPLEMENTED
- MFA enabled: YES
- Admin accounts: 100% coverage
Application Security (A.8.26): PARTIAL
- Input validation: YES
- WAF deployed: PENDING
Overall Compliance: 87%
Why This Skill Exists Manage — ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use for ISMS design, security risk assessment, control implementation, ISO 27001 ce
When to Use Use this skill when the task requires information security manager iso27001 capabilities.
What If Fails If this skill fails to produce the expected output: (1) verify input completeness, (2) retry with more specific context, (3) fall back to the parent workflow without this skill.
