information-security-manager-iso27001

name	information-security-manager-iso27001
description	Comprehensive Information Security Management System (ISMS) based on ISO 27001/27002 standards.

Information Security Manager - ISO 27001

Design and maintain an Information Security Management System (ISMS) based on international standards.

Quick Start

• Run Security Risk Assessment.
• Check Compliance Status.
• Generate Gap Analysis Report.

Workflows

Workflow 1: ISMS Implementation

1. Define security policy and scope.
2. Conduct risk assessment.
3. Select controls (from Annex A).
4. Implement Statement of Applicability (SoA).

Workflow 2: Security Risk Assessment

1. Define assets (data, hardware, software).
2. Identify threats and vulnerabilities.
3. Determine risk treatment (Accept, Transfer, Avoid, Mitigate).
4. Verify implementation of controls.

Workflow 3: Incident Response

1. Detection and reporting.
2. Assessment and decision.
3. Containment, eradication, and recovery.
4. Lessons learned.

Validation Checkpoints

• ISMS scope clearly defined?
• Risk assessment documented?
• Annex A controls mapped to SoA?
• Evidence of internal audits?

Worked Example: Healthcare Risk Assessment

• Step 1: Define assets (Patient records, API endpoints).
• Step 2: Identify risks (Unauthorized access, data breach).
• Step 3: Determine treatment (Encryption at rest/motion, MFA).
• Step 4: Verify implementation.