iso27001-compliance

Name: iso27001-compliance
Author: BagelHole

42stars4forks

How to install iso27001-compliance?

bagelhole/devops-security-agent-skills/iso27001-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill iso27001-compliance

Installs into the current project.

Summary

Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.

Files · 1

View on GitHub

SKILL.md

1	# ISO 27001 Compliance
2
3	Implement an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022.
4
5	## When to Use
6
7	- Establishing an ISMS for the first time in an organization
8	- Preparing for ISO 27001 certification audit
9	- Conducting risk assessments and developing risk treatment plans
10	- Creating the Statement of Applicability (SoA)
11	- Transitioning from ISO 27001:2013 to the 2022 revision
12	- Meeting customer or regulatory requirements for ISO 27001 certification
13
14	## ISMS Plan-Do-Check-Act Cycle
15
16	```yaml
17	pdca_cycle:
18	plan:
19	- Define ISMS scope and boundaries
20	- Establish information security policy
21	- Conduct risk assessment
22	- Develop risk treatment plan
23	- Produce Statement of Applicability
24	- Obtain management approval and commitment
25	- Define security objectives and metrics
26
27	do:
28	- Implement selected Annex A controls
29	- Deploy technical security controls
30	- Conduct security awareness training
31	- Document all procedures and processes
32	- Implement incident management process
33	- Establish supplier security management
34
35	check:
36	- Conduct internal audits (at least annual)
37	- Perform management review meetings
38	- Monitor and measure control effectiveness
39	- Review incident trends and near misses
40	- Assess compliance with legal requirements
41	- Evaluate security metrics against objectives
42
43	act:
44	- Address nonconformities with corrective actions
45	- Implement continual improvement initiatives
46	- Update risk assessment based on changes
47	- Refine controls based on audit findings
48	- Communicate improvements to stakeholders
49	```
50
51	## ISMS Scope Definition
52
53	```yaml
54	isms_scope:
55	template:
56	organization: "Company Name, Ltd."
57	scope_statement: \|
58	The ISMS covers the design, development, operation, and support of
59	the Company's cloud-based SaaS platform, including all supporting
60	infrastructure, personnel, and processes at the following locations.
61
62	included:
63	locations:
64	- "Primary office: 123 Main Street, City, Country"
65	- "AWS us-east-1 and eu-west-1 regions"
66	- "Remote workers accessing corporate systems"
67	business_processes:
68	- "Software development and deployment"
69	- "Cloud infrastructure management"
70	- "Customer data processing and storage"
71	- "Customer support operations"
72	- "Corporate IT and internal systems"
73	information_assets:
74	- "Customer data (PII, business data)"
75	- "Source code and intellectual property"
76	- "Employee personal data"
77	- "Financial records"
78	- "Security configurations and credentials"
79	technology:
80	- "AWS cloud infrastructure"
81	- "SaaS application stack"
82	- "Corporate IT systems (Google Workspace, Okta, Jira)"
83	- "Development tools (GitHub, CI/CD pipelines)"
84
85	excluded:
86	- "Physical data center operations (inherited from AWS)"
87	- "Third-party SaaS platforms beyond integration points"
88	exclusion_justification: "Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification."
89
90	interfaces:
91	- "Customer API endpoints"
92	- "Third-party integrations (payment processor, email provider)"
93	- "AWS management plane"
94	```
95
96	## Risk Assessment Process
97
98	```yaml
99	risk_assessment:
100	methodology:
101	approach: "Asset-based risk assessment"
102	risk_formula: "Risk = Likelihood x Impact"
103	scale: "1-5 for both likelihood and impact (total 1-25)"
104
105	likelihood_scale:
106	1: "Rare - less than once per 5 years"
107	2: "Unlikely - once per 2-5 years"
108	3: "Possible - once per 1-2 years"
109	4: "Likely - multiple times per year"
110	5: "Almost Certain - monthly or more frequent"
111
112	impact_scale:
113	1: "Negligible - minimal operational impact, no data loss"
114	2: "Minor - limited impact, small data exposure, <$10K cost"
115	3: "Moderate - significant impact, data breach <1K records, <$100K cost"
116	4: "Major - severe impact, large data breach, <$1M cost, regulatory action"
117	5: "Critical - catastrophic, massive breach, >$1M cost, business viability at risk"
118
119	risk_matrix:
120	# Impact: 1 2 3 4 5
121	likelihood_5: [5, 10, 15, 20, 25]
122	likelihood_4: [4, 8, 12, 16, 20]
123	likelihood_3: [3, 6, 9, 12, 15]
124	likelihood_2: [2, 4, 6, 8, 10]
125	likelihood_1: [1, 2, 3, 4, 5]
126
127	risk_appetite:
128	accept: "Score 1-4 (low risk, accept with monitoring)"
129	mitigate: "Score 5-14 (medium risk, implement controls to reduce)"
130	escalate: "Score 15-25 (high/critical risk, immediate action required)"
131
132	treatment_options:
133	mitigate: "Implement controls to reduce likelihood

People who liked this also viewed

6 picks

Type

iso27001-compliance

42stars4forks

View on GitHub

How to install iso27001-compliance?

bagelhole/devops-security-agent-skills/iso27001-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill iso27001-compliance

Installs into the current project.

Summary

Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.

Files · 1

View on GitHub

SKILL.md

1	# ISO 27001 Compliance
2
3	Implement an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022.
4
5	## When to Use
6
7	- Establishing an ISMS for the first time in an organization
8	- Preparing for ISO 27001 certification audit
9	- Conducting risk assessments and developing risk treatment plans
10	- Creating the Statement of Applicability (SoA)
11	- Transitioning from ISO 27001:2013 to the 2022 revision
12	- Meeting customer or regulatory requirements for ISO 27001 certification
13
14	## ISMS Plan-Do-Check-Act Cycle
15
16	```yaml
17	pdca_cycle:
18	plan:
19	- Define ISMS scope and boundaries
20	- Establish information security policy
21	- Conduct risk assessment
22	- Develop risk treatment plan
23	- Produce Statement of Applicability
24	- Obtain management approval and commitment
25	- Define security objectives and metrics
26
27	do:
28	- Implement selected Annex A controls
29	- Deploy technical security controls
30	- Conduct security awareness training
31	- Document all procedures and processes
32	- Implement incident management process
33	- Establish supplier security management
34
35	check:
36	- Conduct internal audits (at least annual)
37	- Perform management review meetings
38	- Monitor and measure control effectiveness
39	- Review incident trends and near misses
40	- Assess compliance with legal requirements
41	- Evaluate security metrics against objectives
42
43	act:
44	- Address nonconformities with corrective actions
45	- Implement continual improvement initiatives
46	- Update risk assessment based on changes
47	- Refine controls based on audit findings
48	- Communicate improvements to stakeholders
49	```
50
51	## ISMS Scope Definition
52
53	```yaml
54	isms_scope:
55	template:
56	organization: "Company Name, Ltd."
57	scope_statement: \|
58	The ISMS covers the design, development, operation, and support of
59	the Company's cloud-based SaaS platform, including all supporting
60	infrastructure, personnel, and processes at the following locations.
61
62	included:
63	locations:
64	- "Primary office: 123 Main Street, City, Country"
65	- "AWS us-east-1 and eu-west-1 regions"
66	- "Remote workers accessing corporate systems"
67	business_processes:
68	- "Software development and deployment"
69	- "Cloud infrastructure management"
70	- "Customer data processing and storage"
71	- "Customer support operations"
72	- "Corporate IT and internal systems"
73	information_assets:
74	- "Customer data (PII, business data)"
75	- "Source code and intellectual property"
76	- "Employee personal data"
77	- "Financial records"
78	- "Security configurations and credentials"
79	technology:
80	- "AWS cloud infrastructure"
81	- "SaaS application stack"
82	- "Corporate IT systems (Google Workspace, Okta, Jira)"
83	- "Development tools (GitHub, CI/CD pipelines)"
84
85	excluded:
86	- "Physical data center operations (inherited from AWS)"
87	- "Third-party SaaS platforms beyond integration points"
88	exclusion_justification: "Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification."
89
90	interfaces:
91	- "Customer API endpoints"
92	- "Third-party integrations (payment processor, email provider)"
93	- "AWS management plane"
94	```
95
96	## Risk Assessment Process
97
98	```yaml
99	risk_assessment:
100	methodology:
101	approach: "Asset-based risk assessment"
102	risk_formula: "Risk = Likelihood x Impact"
103	scale: "1-5 for both likelihood and impact (total 1-25)"
104
105	likelihood_scale:
106	1: "Rare - less than once per 5 years"
107	2: "Unlikely - once per 2-5 years"
108	3: "Possible - once per 1-2 years"
109	4: "Likely - multiple times per year"
110	5: "Almost Certain - monthly or more frequent"
111
112	impact_scale:
113	1: "Negligible - minimal operational impact, no data loss"
114	2: "Minor - limited impact, small data exposure, <$10K cost"
115	3: "Moderate - significant impact, data breach <1K records, <$100K cost"
116	4: "Major - severe impact, large data breach, <$1M cost, regulatory action"
117	5: "Critical - catastrophic, massive breach, >$1M cost, business viability at risk"
118
119	risk_matrix:
120	# Impact: 1 2 3 4 5
121	likelihood_5: [5, 10, 15, 20, 25]
122	likelihood_4: [4, 8, 12, 16, 20]
123	likelihood_3: [3, 6, 9, 12, 15]
124	likelihood_2: [2, 4, 6, 8, 10]
125	likelihood_1: [1, 2, 3, 4, 5]
126
127	risk_appetite:
128	accept: "Score 1-4 (low risk, accept with monitoring)"
129	mitigate: "Score 5-14 (medium risk, implement controls to reduce)"
130	escalate: "Score 15-25 (high/critical risk, immediate action required)"
131
132	treatment_options:
133	mitigate: "Implement controls to reduce likelihood

People who liked this also viewed

6 picks

Type