ISO/IEC 27799 - Healthcare Information Security Consulting

• Define the Scope: Determine the boundaries and applicability of the ISMS.
  

• Conduct a Gap Analysis: Assess current security practices against ISO 27001 requirements to identify gaps.

• Develop an ISMS Policy: Create a high-level policy that outlines the organization's approach to information security.
  

• Develop a Privacy Policy: Create a high-level policy that outlines the organization's approach to managing personal data and privacy.
  

• Define Roles and Responsibilities: Assign responsibilities for the ISMS and its maintenance.
  

• Risk Assessment and Treatment: Identify, analyze, and evaluate information security risks. Implement controls to mitigate risks.
  

• Statement of Applicability (SoA): Document which controls have been selected to manage risks.

• Implement Necessary Controls: Based on the risk assessment, implement the required controls from Annex A.
  

• Document Procedures: Develop and document information security policies, procedures, and guidelines.
  

• Training and Awareness: Conduct training sessions to ensure employees understand their roles and responsibilities.

• Internal Audits: Conduct regular internal audits to check compliance with ISO 27001.
  

• Management Review: Perform regular reviews by management to ensure the ISMS is functioning correctly and aligned with organizational goals.
  

• Continual Improvement: Implement a continual improvement process to enhance the ISMS over time.

• Stage 1 Audit (Documentation Review): An external auditor reviews the ISMS documentation to ensure it meets ISO 27001 requirements.
  

• Stage 2 Audit (Implementation Review): The auditor evaluates the implementation and effectiveness of the ISMS in practice.
  

• Address Non-Conformities: If the auditor identifies non-conformities, address them and take corrective actions.

• Receive Certification: Once the auditor is satisfied that the ISMS meets ISO 27001 requirements, the organization is awarded certification.
  

• Surveillance Audits: Periodic audits (usually annual) by the certification body to ensure continued compliance.
  

• Recertification: Every three years, a full recertification audit is conducted to maintain the certification

Extending ISO 27001 with ISO 27701, ISO 27017, ISO 27018, and ISO 27799 involves integrating additional controls and guidelines specific to privacy management, cloud security, cloud privacy, and healthcare information security into the existing Information Security Management System (ISMS).