Skip to main content Accueil Créateurs seaworld008 commonly-used-high-value-skills information-security-manager-iso27001
information-security-manager-iso27001 ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use for ISMS design, security risk assessment, control implementation, ISO 27001 certification, security audits, incident response, and compliance verification. Covers ISO 27001, ISO 27002, healthcare security, and medical device cybersecurity.
Aller à l'installation Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill information-security-manager-iso27001La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.
Métiers associés SOC
Basé sur la classification professionnelle SOC
name information-security-manager-iso27001 description ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use for ISMS design, security risk assessment, control implementation, ISO 27001 certification, security audits, incident response, and compliance verification. Covers ISO 27001, ISO 27002, healthcare security, and medical device cybersecurity. zh_description 用于information、安全、管理、iso27001，支持安全扫描、审计、加固和风险治理。 version 1.0.0 author alirezarezvani source github:alirezarezvani/claude-skills source_url https://github.com/alirezarezvani/claude-skills/blob/main/ra-qm-team/skills/information-security-manager-iso27001/SKILL.md license MIT tags ["security", "iso27001", "isms", "compliance", "risk-assessment", "governance", "agent-skill"] created_at 2026-06-01 updated_at 2026-06-01 quality 4 complexity intermediate
Information Security Manager - ISO 27001
Implement and manage Information Security Management Systems (ISMS) aligned with ISO 27001:2022 and healthcare regulatory requirements.
Table of Contents
Trigger Phrases
Use this skill when you hear:
"implement ISO 27001"
"ISMS implementation"
"security risk assessment"
"information security policy"
"ISO 27001 certification"
"security controls implementation"
"incident response plan"
"healthcare data security"
"medical device cybersecurity"
"security compliance audit"
Quick Start
Run Security Risk Assessment
python scripts/risk_assessment.py --scope "patient-data-system" --output risk_register.json
Check Compliance Status
python scripts/compliance_checker.py --standard iso27001 --controls-file controls.csv
Generate Gap Analysis Report
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output gaps.md
Tools
risk_assessment.py
Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.
Usage:
python scripts/risk_assessment.py --scope "cloud-infrastructure" --output risks.json
python scripts/risk_assessment.py --scope "ehr-system" --template healthcare --output risks.json
python scripts/risk_assessment.py --assets assets.csv --output risks.json
Parameters:
Parameter Required Description
--templateNo Assessment template: general, healthcare, cloud
--assetsNo CSV file with asset inventory
--outputNo Output file (default: stdout)
--formatNo Output format: json, csv, markdown
Asset inventory with classification
Threat and vulnerability mapping
Risk scores (likelihood × impact)
Treatment recommendations
Residual risk calculations
compliance_checker.py Verify ISO 27001/27002 control implementation status.
python scripts/compliance_checker.py --standard iso27001
python scripts/compliance_checker.py --standard iso27001 --gap-analysis
python scripts/compliance_checker.py --standard iso27001 --domains "access-control,cryptography"
python scripts/compliance_checker.py --standard iso27001 --output compliance_report.md
Parameter Required Description --standardYes Standard to check: iso27001, iso27002, hipaa --controls-fileNo CSV with current control status --gap-analysisNo Include remediation recommendations --domainsNo Specific control domains to check --outputNo Output file path
Control implementation status
Compliance percentage by domain
Gap analysis with priorities
Remediation recommendations
Workflows
Workflow 1: ISMS Implementation Step 1: Define Scope and Context
Document organizational context and ISMS boundaries:
Identify interested parties and requirements
Define ISMS scope and boundaries
Document internal/external issues
Validation: Scope statement reviewed and approved by management.
Step 2: Conduct Risk Assessment
python scripts/risk_assessment.py --scope "full-organization" --template general --output initial_risks.json
Identify information assets
Assess threats and vulnerabilities
Calculate risk levels
Determine risk treatment options
Validation: Risk register contains all critical assets with assigned owners.
Step 3: Select and Implement Controls
Map risks to ISO 27002 controls:
python scripts/compliance_checker.py --standard iso27002 --gap-analysis --output control_gaps.md
Organizational (policies, roles, responsibilities)
People (screening, awareness, training)
Physical (perimeters, equipment, media)
Technological (access, crypto, network, application)
Validation: Statement of Applicability (SoA) documents all controls with justification.
Step 4: Establish Monitoring
Incident count and severity trends
Control effectiveness scores
Training completion rates
Audit findings closure rate
Validation: Dashboard shows real-time compliance status.
Workflow 2: Security Risk Assessment Step 1: Asset Identification
Asset Type Examples Classification Information Patient records, source code Confidential Software EHR system, APIs Critical Hardware Servers, medical devices High Services Cloud hosting, backup High People Admin accounts, developers Varies
Validation: All assets have assigned owners and classifications.
Identify threats per asset category:
Asset Threats Likelihood Patient data Unauthorized access, breach High Medical devices Malware, tampering Medium Cloud services Misconfiguration, outage Medium Credentials Phishing, brute force High
Validation: Threat model covers top-10 industry threats.
Step 3: Vulnerability Assessment
python scripts/risk_assessment.py --scope "network-infrastructure" --output vuln_risks.json
Document vulnerabilities:
Technical (unpatched systems, weak configs)
Process (missing procedures, gaps)
People (lack of training, insider risk)
Validation: Vulnerability scan results mapped to risk register.
Step 4: Risk Evaluation and Treatment
Calculate risk: Risk = Likelihood × Impact
Risk Level Score Treatment Critical 20-25 Immediate action required High 15-19 Treatment plan within 30 days Medium 10-14 Treatment plan within 90 days Low 5-9 Accept or monitor Minimal 1-4 Accept
Validation: All high/critical risks have approved treatment plans.
Workflow 3: Incident Response Step 1: Detection and Reporting
Security breach (unauthorized access)
Malware infection
Data leakage
System compromise
Policy violation
Validation: Incident logged within 15 minutes of detection.
Step 2: Triage and Classification
Severity Criteria Response Time Critical Data breach, system down Immediate High Active threat, significant risk 1 hour Medium Contained threat, limited impact 4 hours Low Minor violation, no impact 24 hours
Validation: Severity assigned and escalation triggered if needed.
Step 3: Containment and Eradication
Isolate affected systems
Preserve evidence
Block threat vectors
Remove malicious artifacts
Validation: Containment confirmed, no ongoing compromise.
Step 4: Recovery and Lessons Learned
Post-incident activities:
Restore systems from clean backups
Verify integrity before reconnection
Document timeline and actions
Conduct post-incident review
Update controls and procedures
Validation: Post-incident report completed within 5 business days.
Reference Guides
When to Use Each Reference references/iso27001-controls.md
Control selection for SoA
Implementation guidance
Evidence requirements
Audit preparation
references/risk-assessment-guide.md
Risk methodology selection
Asset classification criteria
Threat modeling approaches
Risk calculation methods
references/incident-response.md
Response procedures
Escalation matrices
Communication templates
Recovery checklists
Validation Checkpoints
ISMS Implementation Validation Phase Checkpoint Evidence Required Scope Scope approved Signed scope document Risk Register complete Risk register with owners Controls SoA approved Statement of Applicability Operation Metrics active Dashboard screenshots Audit Internal audit done Audit report
Certification Readiness
Compliance Verification
python scripts/compliance_checker.py --standard iso27001 --output monthly_$(date +%Y%m).md
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output quarterly_gaps.md
Worked Example: Healthcare Risk Assessment Scenario: Assess security risks for a patient data management system.
Step 1: Define Assets python scripts/risk_assessment.py --scope "patient-data-system" --template healthcare
Asset ID Asset Type Owner Classification A001 Patient database Information DBA Team Confidential A002 EHR application Software App Team Critical A003 Database server Hardware Infra Team High A004 Admin credentials Access Security Critical
Step 2: Identify Risks Risk ID Asset Threat Vulnerability L I Score R001 A001 Data breach Weak encryption 3 5 15 R002 A002 SQL injection Input validation 4 4 16 R003 A004 Credential theft No MFA 4 5 20
Step 3: Determine Treatment Risk Treatment Control Timeline R001 Mitigate Implement AES-256 encryption 30 days R002 Mitigate Add input validation, WAF 14 days R003 Mitigate Enforce MFA for all admins 7 days
Step 4: Verify Implementation python scripts/compliance_checker.py --controls-file implemented_controls.csv
Control Implementation Status
=============================
Cryptography (A.8.24): IMPLEMENTED
- AES-256 at rest: YES
- TLS 1.3 in transit: YES
Access Control (A.8.5): IMPLEMENTED
- MFA enabled: YES
- Admin accounts: 100% coverage
Application Security (A.8.26): PARTIAL
- Input validation: YES
- WAF deployed: PENDING
Overall Compliance: 87%
