Skill: alirezarezvani/information-security-manager-iso27001 (version 2.1.1)

--- name: [REDACTED_SECRET] description: ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use for ISMS design, security risk assessment, control implementation, ISO 27001 certification, security audits, incident response, and compliance verification. Covers ISO 27001, ISO 27002, healthcare security, and medical device cybersecurity. --- # Information Security Manager - ISO 27001 Implement and manage Information Security Management Systems (ISMS) aligned with ISO 27001:2022 and healthcare regulatory requirements. --- ## Table of Contents - [Trigger Phrases](#trigger-phrases) - [Quick Start](#quick-start) - [Tools](#tools) - [Workflows](#workflows) - [Reference Guides](#reference-guides) - [Validation Checkpoints](#validation-checkpoints) --- ## Trigger Phrases Use this skill when you hear: - "implement ISO 27001" - "ISMS implementation" - "security risk assessment" - "information security policy" - "ISO 27001 certification" - "security controls implementation" - "incident response plan" - "healthcare data security" - "medical device cybersecurity" - "security compliance audit" --- ## Quick Start ### Run Security Risk Assessment ```bash python scripts/risk_assessment.py --scope "patient-data-system" --output risk_register.json ``` ### Check Compliance Status ```bash python scripts/compliance_checker.py --standard iso27001 --controls-file controls.csv ``` ### Generate Gap Analysis Report ```bash python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output gaps.md ``` --- ## Tools ### risk_assessment.py Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology. **Usage:** ```bash # Full risk assessment python scripts/risk_assessment.py --scope "cloud-infrastructure" --output risks.json # Healthcare-specific assessment python scripts/risk_assessment.py --scope "ehr-system" --template healthcare --output risks.json # Quick asset-based assessment python scripts/risk_assessment.py --assets assets.csv --output risks.json ``` **Parameters:** | Parameter | Required | Description | |-----------|----------|-------------| | `--scope` | Yes | System or area to assess | | `--template` | No | Assessment template: `general`, `healthcare`, `cloud` | | `--assets` | No | CSV file with asset inventory | | `--output` | No | Output file (default: stdout) | | `--format` | No | Output format: `json`, `csv`, `markdown` | **Output:** - Asset inventory with classification - Threat and vulnerability mapping - Risk scores (likelihood × impact) - Treatment recommendations - Residual risk calculations ### compliance_checker.py Verify ISO 27001/27002 control implementation status. **Usage:** ```bash # Check all ISO 27001 controls python scripts/compliance_checker.py --standard iso27001 # Gap analysis with recommendations python scripts/compliance_checker.py --standard iso27001 --gap-analysis # Check specific control domains python scripts/compliance_checker.py --standard iso27001 --domains "access-control,cryptography" # Export compliance report python scripts/compliance_checker.py --standard iso27001 --output compliance_report.md ``` **Parameters:** | Parameter | Required | Description | |-----------|----------|-------------| | `--standard` | Yes | Standard to check: `iso27001`, `iso27002`, `hipaa` | | `--controls-file` | No | CSV with current control status | | `--gap-analysis` | No | Include remediation recommendations | | `--domains` | No | Specific control domains to check | | `--output` | No | Output file path | **Output:** - Control implementation status - Compliance percentage by domain - Gap analysis with priorities - Remediation recommendations --- ## Workflows ### Workflow 1: ISMS Implementation **Step 1: Define Scope and Context** Document organizational context and ISMS boundaries: - Identify interested parties and requirements - Define ISMS scope and boundaries - Document internal/external issues **Validation:** Scope statement reviewed and approved by management. **Step 2: Conduct Risk Assessment** ```bash python scripts/risk_assessment.py --scope "full-organization" --template general --output initial_risks.json ``` - Identify information assets - Assess threats and vulnerabilities - Calculate risk levels - Determine risk treatment options **Validation:** Risk register contains all critical assets with assigned owners. **Step 3: Select and Implement Controls** Map risks to ISO 27002 controls: ```bash python scripts/compliance_checker.py --standard iso27002 --gap-analysis --output control_gaps.md ``` Control categories: - Organizational (policies, roles, responsibilities) - People (screening, awareness, training) - Physical (perimeters, equipment, media) - Technological (access, crypto, network, application) **Validation:** Statement of Applicability (SoA) documents all controls with justification. **Step 4: Establish Monitoring** Define security metrics: - Incident count and severity trends - Control effectiveness scores - Training completion rates - Audit findings closure rate **Validation:** Dashboard shows real-time compliance status. ### Workflow 2: Security Risk Assessment **Step 1: Asset Identification** Create asset inventory: | Asset Type | Examples | Classification | |------------|----------|----------------| | Information | Patient records, source code | Confidential | | Software | EHR system, APIs | Critical | | Hardware | Servers, medical devices | High | | Services | Cloud hosting, backup | High | | People | Admin accounts, developers | Varies | **Validation:** All assets have assigned owners and classifications. **Step 2: Threat Analysis** Identify threats per asset category: | Asset | Threats | Likelihood | |-------|---------|------------| | Patient data | Unauthorized access, breach | High | | Medical devices | Malware, tampering | Medium | | Cloud services | Misconfiguration, outage | Medium | | Credentials | Phishing, brute force | High | **Validation:** Threat model covers top-10 industry threats. **Step 3: Vulnerability Assessment** ```bash python scripts/risk_assessment.py --scope "network-infrastructure" --output vuln_risks.json ``` Document vulnerabilities: - Technical (unpatched systems, weak configs) - Process (missing procedures, gaps) - People (lack of training, insider risk) **Validation:** Vulnerability scan results mapped to risk register. **Step 4: Risk Evaluation and Treatment** Calculate risk: `Risk = Likelihood × Impact` | Risk Level | Score | Treatment | |------------|-------|-----------| | Critical | 20-25 | Immediate action required | | High | 15-19 | Treatment plan within 30 days | | Medium | 10-14 | Treatment plan within 90 days | | Low | 5-9 | Accept or monitor | | Minimal | 1-4 | Accept | **Validation:** All high/critical risks have approved treatment plans. ### Workflow 3: Incident Response **Step 1: Detection and Reporting** Incident categories: - Security breach (unauthorized access) - Malware infection - Data leakage - System compromise - Policy violation **Validation:** Incident logged within 15 minutes of detection. **Step 2: Triage and Classification** | Severity | Criteria | Response Time | |----------|----------|---------------| | Critical | Data breach, system down | Immediate | | High | Active threat, significant risk | 1 hour | | Medium | Contained threat, limited impact | 4 hours | | Low | Minor violation, no impact | 24 hours | **Validation:** Severity assigned and escalation triggered if needed. **Step 3: Containment and Eradication** Immediate actions: 1. Isolate affected systems 2. Preserve evidence 3. Block threat vectors 4. Remove malicious artifacts **Validation:** Containment confirmed, no ongoing compromise. **Step 4: Recovery and Lessons Learned** Post-incident activities: 1. Restore systems from clean backups 2. Verify integrity before reconnection 3. Document timeline and actions 4. Conduct post-incident review 5. Update controls and procedures **Validation:** Post-incident report completed within 5 business days. --- ## Reference Guides ### When to Use Each Reference **references/iso27001-controls.md** - Control selection for SoA - Implementation guidance - Evidence requirements - Audit preparation **references/risk-assessment-guide.md** - Risk methodology selection - Asset classification criteria - Threat modeling approaches - Risk calculation methods **references/incident-response.md** - Response procedures - Escalation matrices - Communication templates - Recovery checklists --- ## Validation Checkpoints ### ISMS Implementation Validation | Phase | Checkpoint | Evidence Required | |-------|------------|-------------------| | Scope | Scope approved | Signed scope document | | Risk | Register complete | Risk register with owners | | Controls | SoA approved | Statement of Applicability | | Operation | Metrics active | Dashboard screenshots | | Audit | Internal audit done | Audit report | ### Certification Readiness Before Stage 1 audit: - [ ] ISMS scope documented and approved - [ ] Information security policy published - [ ] Risk assessment completed - [ ] Statement of Applicability finalized - [ ] Internal audit conducted - [ ] Management review completed - [ ] Nonconformities addressed Before Stage 2 audit: - [ ] Controls implemented and operational - [ ] Evidence of effectiveness available - [ ] Staff trained and aware - [ ] Incidents logged and managed - [ ] Metrics collected for 3+ months ### Compliance Verification Run periodic checks: ```bash # Monthly compliance check python scripts/compliance_checker.py --standard iso27001 --output monthly_$(date +%Y%m).md # Quarterly gap analysis python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output quarterly_gaps.md ``` --- ## Worked Example: Healthcare Risk Assessment **Scenario:** Assess security risks for a patient data management system. ### Step 1: Define Assets ```bash python scripts/risk_assessment.py --scope "patient-data-system" --template healthcare ``` **Asset inventory output:** | Asset ID | Asset | Type | Owner | Classification | |----------|-------|------|-------|----------------| | A001 | Patient database | Information | DBA Team | Confidential | | A002 | EHR application | Software | App Team | Critical | | A003 | Database server | Hardware | Infra Team | High | | A004 | Admin credentials | Access | Security | Critical | ### Step 2: Identify Risks **Risk register output:** | Risk ID | Asset | Threat | Vulnerability | L | I | Score | |---------|-------|--------|---------------|---|---|-------| | R001 | A001 | Data breach | Weak encryption | 3 | 5 | 15 | | R002 | A002 | SQL injection | Input validation | 4 | 4 | 16 | | R003 | A004 | Credential theft | No MFA | 4 | 5 | 20 | ### Step 3: Determine Treatment | Risk | Treatment | Control | Timeline | |------|-----------|---------|----------| | R001 | Mitigate | Implement AES-256 encryption | 30 days | | R002 | Mitigate | Add input validation, WAF | 14 days | | R003 | Mitigate | Enforce MFA for all admins | 7 days | ### Step 4: Verify Implementation ```bash python scripts/compliance_checker.py --controls-file implemented_controls.csv ``` **Verification output:** ``` Control Implementation Status ============================= Cryptography (A.8.24): IMPLEMENTED - AES-256 at rest: YES - TLS 1.3 in transit: YES Access Control (A.8.5): IMPLEMENTED - MFA enabled: YES - Admin accounts: 100% coverage Application Security (A.8.26): PARTIAL - Input validation: YES - WAF deployed: PENDING Overall Compliance: 87% ```

path: references/incident-response.md
content: # Incident Response Procedures

Security incident detection, response, and recovery procedures per ISO 27001 requirements.

---

## Table of Contents

- [Incident Classification](#incident-classification)
- [Response Procedures](#response-procedures)
- [Escalation Matrix](#escalation-matrix)
- [Communication Templates](#communication-templates)
- [Recovery Checklists](#recovery-checklists)
- [Post-Incident Activities](#post-incident-activities)

---

## Incident Classification

### Incident Categories

| Category | Description | Examples |
|----------|-------------|----------|
| Security Breach | Unauthorized access to systems/data | Account compromise, data exfiltration |
| Malware | Malicious software infection | Ransomware, virus, trojan |
| Data Leakage | Unauthorized data disclosure | Accidental email, misconfigured storage |
| Denial of Service | Service availability impact | DDoS attack, resource exhaustion |
| Policy Violation | Security policy breach | Unauthorized software, data handling |
| Physical | Physical security incident | Theft, unauthorized entry |

### Severity Levels

| Level | Criteria | Response Time | Examples |
|-------|----------|---------------|----------|
| **Critical (P1)** | Active breach, data loss, system down | Immediate (15 min) | Ransomware, confirmed breach |
| **High (P2)** | Active threat, potential data exposure | 1 hour | Malware detected, suspicious access |
| **Medium (P3)** | Contained threat, limited impact | 4 hours | Failed attacks, policy violations |
| **Low (P4)** | Minor issue, no immediate risk | 24 hours | Suspicious emails, minor violations |

### Severity Decision Tree

```
Is there active data loss or system compromise?
├── Yes → CRITICAL (P1)
└── No → Is there an active uncontained threat?
          ├── Yes → HIGH (P2)
          └── No → Is there potential for data exposure?
                    ├── Yes → MEDIUM (P3)
                    └── No → LOW (P4)
```

---

## Response Procedures

### Phase 1: Detection and Reporting

**Objective:** Identify and report security incidents promptly.

**Steps:**
1. Identify potential incident through monitoring, alerts, or reports
2. Document initial observations (time, systems, symptoms)
3. Report to Security Team via designated channel
4. Assign incident ID and log in tracking system

**Validation:** Incident logged within 15 minutes of detection.

**Documentation Required:**
- Date/time of detection
- Detection source (monitoring, user report, automated alert)
- Affected systems/users (initial assessment)
- Reporter information

### Phase 2: Triage and Assessment

**Objective:** Determine incident scope and severity.

**Steps:**
1. Gather additional information (logs, system state)
2. Determine incident category and severity
3. Identify affected assets and potential impact
4. Assign incident owner and response team

**Validation:** Severity assigned and escalation triggered if needed.

**Assessment Checklist:**
- [ ] Systems affected identified
- [ ] Data types potentially impacted
- [ ] Attack vector determined
- [ ] Scope (single system vs. widespread)
- [ ] Business impact assessed

### Phase 3: Containment

**Objective:** Limit damage and prevent spread.

**Immediate Containment (Short-term):**
1. Isolate affected systems from network
2. Disable compromised accounts
3. Block malicious IPs/domains
4. Preserve evidence before changes

**Long-term Containment:**
1. Apply temporary fixes
2. Implement additional monitoring
3. Strengthen access controls
4. Prepare for eradication

**Validation:** Containment confirmed, no ongoing spread.

**Containment Actions by Incident Type:**

| Incident Type | Containment Actions |
|---------------|---------------------|
| Account Compromise | Disable account, revoke sessions, reset credentials |
| Malware | Isolate host, block C2 domains, scan related systems |
| Data Breach | Block exfiltration path, revoke access, enable DLP |
| DDoS | Enable DDoS protection, rate limiting, traffic scrubbing |

### Phase 4: Eradication

**Objective:** Remove threat from environment.

**Steps:**
1. Identify root cause
2. Remove malware/backdoors
3. Close vulnerabilities exploited
4. Reset compromised credentials
5. Verify threat elimination

**Validation:** No indicators of compromise remain.

**Eradication Checklist:**
- [ ] Malware removed from all systems
- [ ] Vulnerabilities patched
- [ ] Backdoors/persistence removed
- [ ] Compromised credentials rotated
- [ ] Security gaps closed

### Phase 5: Recovery

**Objective:** Restore systems to normal operation.

**Steps:**
1. Restore from clean backups if needed
2. Rebuild compromised systems
3. Verify system integrity
4. Monitor for re-infection
5. Return to production gradually

**Validation:** Systems operational with enhanced monitoring.

**Recovery Checklist:**
- [ ] Systems restored to known-good state
- [ ] Integrity verification completed
- [ ] Enhanced monitoring in place
- [ ] Business operations resumed
- [ ] User access restored (verified accounts only)

### Phase 6: Lessons Learned

**Objective:** Improve security posture and response capability.

**Steps:**
1. Conduct post-incident review (within 5 business days)
2. Document timeline and actions taken
3. Identify what worked and what didn't
4. Update procedures and controls
5. Share relevant findings (internally, externally if required)

**Validation:** Post-incident report completed and actions tracked.

---

## Escalation Matrix

### Escalation Paths

| Severity | Initial Response | 1 Hour | 4 Hours | 24 Hours |
|----------|------------------|--------|---------|----------|
| Critical | Security Team | CISO + Management | Executive Team | Board notification |
| High | Security Team | CISO | Management | - |
| Medium | Security Team | Security Manager | CISO if unresolved | - |
| Low | Security Analyst | Security Team Lead | - | - |

### Contact Information (Template)

| Role | Primary | Backup | Contact Method |
|------|---------|--------|----------------|
| Security On-Call | [Name] | [Name] | Phone, Slack |
| CISO | [Name] | [Name] | Phone, Email |
| IT Director | [Name] | [Name] | Phone, Email |
| Legal Counsel | [Name] | [Firm] | Phone |
| PR/Communications | [Name] | [Name] | Phone |
| Executive Sponsor | [Name] | [Name] | Phone |

### External Notifications

| Condition | Notify | Timeline |
|-----------|--------|----------|
| Patient data breach | HHS (HIPAA) | 60 days |
| EU personal data breach | Supervisory Authority (GDPR) | 72 hours |
| Significant breach | Law enforcement | As appropriate |
| Third-party involved | Affected vendor | Immediately |

---

## Communication Templates

### Internal Notification (Initial)

```
Subject: [SEVERITY] Security Incident - [Brief Description]

INCIDENT SUMMARY
----------------
Incident ID: INC-[YYYY]-[###]
Detected: [Date/Time]
Severity: [Critical/High/Medium/Low]
Status: [Investigating/Contained/Resolved]

WHAT HAPPENED
[Brief description of the incident]

CURRENT IMPACT
[Systems affected, business impact]

ACTIONS BEING TAKEN
[Current response activities]

WHAT YOU NEED TO DO
[Any required user actions]

NEXT UPDATE
Expected by: [Time]

Contact: Security Team - [contact info]
```

### External Notification (Breach)

```
Subject: Important Security Notice from [Organization]

Dear [Affected Party],

We are writing to inform you of a security incident that may have
involved your personal information.

WHAT HAPPENED
On [date], we discovered [brief description].

WHAT INFORMATION WAS INVOLVED
[Types of data potentially affected]

WHAT WE ARE DOING
[Actions taken to address the incident]

WHAT YOU CAN DO
[Recommended protective actions]

FOR MORE INFORMATION
[Contact information, resources]

We sincerely regret any concern this may cause and are committed
to protecting your information.

[Signature]
```

### Status Update

```
Subject: UPDATE: Security Incident INC-[ID] - [Status]

CURRENT STATUS
--------------
Status: [Contained/Eradicating/Recovering]
Last Update: [Time]

PROGRESS SINCE LAST UPDATE
[Actions completed]

CURRENT ACTIVITIES
[Ongoing response work]

REMAINING ACTIONS
[What still needs to be done]

ESTIMATED RESOLUTION
[Timeframe if known]

NEXT UPDATE
Expected: [Time]
```

---

## Recovery Checklists

### System Recovery Checklist

- [ ] Verify backup integrity before restoration
- [ ] Restore to isolated environment first
- [ ] Scan restored systems for malware
- [ ] Apply all security patches
- [ ] Reset all credentials on system
- [ ] Review and harden configurations
- [ ] Verify application functionality
- [ ] Enable enhanced logging/monitoring
- [ ] Conduct security scan before production
- [ ] Document recovery steps taken

### Account Compromise Recovery

- [ ] Disable compromised account
- [ ] Revoke all active sessions
- [ ] Reset password with strong credential
- [ ] Enable MFA if not already
- [ ] Review account activity logs
- [ ] Check for unauthorized changes
- [ ] Review connected applications
- [ ] Verify account recovery options
- [ ] Notify account owner securely
- [ ] Monitor for suspicious activity

### Ransomware Recovery

- [ ] Isolate affected systems immediately
- [ ] Identify ransomware variant
- [ ] Check for decryption tools available
- [ ] Assess backup availability/integrity
- [ ] Report to law enforcement
- [ ] Document encrypted files/systems
- [ ] Restore from clean backups
- [ ] Rebuild systems that cannot be restored
- [ ] Patch vulnerability exploited
- [ ] Implement additional controls

---

## Post-Incident Activities

### Post-Incident Review Meeting

**Timing:** Within 5 business days of resolution

**Attendees:**
- Incident response team
- Affected system owners
- Security management
- Relevant stakeholders

**Agenda:**
1. Incident timeline review
2. What worked well
3. What could be improved
4. Root cause analysis
5. Preventive measures
6. Action items and owners

### Post-Incident Report Template

```
INCIDENT POST-MORTEM REPORT
===========================

Incident ID: INC-[YYYY]-[###]
Date: [Report date]
Author: [Name]
Classification: [Internal/Confidential]

EXECUTIVE SUMMARY
[2-3 paragraph summary]

INCIDENT TIMELINE
[Detailed chronological events]

ROOT CAUSE ANALYSIS
[5 Whys or similar analysis]

IMPACT ASSESSMENT
- Systems affected: [list]
- Data impacted: [description]
- Business impact: [description]
- Financial impact: [estimate if known]

RESPONSE EFFECTIVENESS
What worked well:
- [item]
- [item]

Areas for improvement:
- [item]
- [item]

RECOMMENDATIONS
| # | Recommendation | Priority | Owner | Due Date |
|---|----------------|----------|-------|----------|
| 1 | [action] | High | [name] | [date] |
| 2 | [action] | Medium | [name] | [date] |

LESSONS LEARNED
[Key takeaways for future incidents]

APPENDICES
- Detailed logs
- Evidence inventory
- Communication records
```

### Metrics to Track

| Metric | Target | Purpose |
|--------|--------|---------|
| Mean Time to Detect (MTTD) | < 1 hour | Detection capability |
| Mean Time to Respond (MTTR) | < 4 hours | Response speed |
| Mean Time to Contain (MTTC) | < 2 hours | Containment effectiveness |
| Incidents by severity | Decreasing trend | Overall security posture |
| Repeat incidents | 0 | Root cause resolution |


path: references/risk-assessment-guide.md
content: # Risk Assessment Methodology Guide

Comprehensive guidance for conducting information security risk assessments per ISO 27001 Clause 6.1.2.

---

## Table of Contents

- [Risk Assessment Process](#risk-assessment-process)
- [Asset Identification](#asset-identification)
- [Threat Analysis](#threat-analysis)
- [Vulnerability Assessment](#vulnerability-assessment)
- [Risk Calculation](#risk-calculation)
- [Risk Treatment](#risk-treatment)
- [Templates and Tools](#templates-and-tools)

---

## Risk Assessment Process

### ISO 27001 Requirements (Clause 6.1.2)

The organization shall:
1. Define risk assessment process
2. Establish risk criteria (acceptance, assessment)
3. Identify information security risks
4. Analyze and evaluate risks
5. Ensure repeatable and consistent results

### Process Overview

```
1. Context → 2. Asset ID → 3. Threat ID → 4. Vuln ID → 5. Risk Calc → 6. Treatment
     ↑                                                                      |
     └──────────────────── Review & Update ←───────────────────────────────┘
```

---

## Asset Identification

### Asset Categories

| Category | Examples | Typical Classification |
|----------|----------|----------------------|
| Information | Patient records, source code, contracts | Confidential-Critical |
| Software | EHR systems, databases, custom apps | High-Critical |
| Hardware | Servers, medical devices, network gear | High |
| Services | Cloud hosting, backup, email | High |
| People | Admin accounts, key personnel | Critical |
| Intangibles | Reputation, intellectual property | High |

### Classification Scheme

| Level | Definition | Impact if Compromised |
|-------|------------|----------------------|
| Critical | Business-critical, regulated data | Severe - regulatory fines, safety risk |
| High | Important business data | Significant - major disruption |
| Medium | Internal business data | Moderate - operational impact |
| Low | Non-sensitive data | Minor - limited impact |
| Public | Intended for public release | Minimal - no impact |

### Asset Inventory Template

| ID | Asset Name | Type | Owner | Location | Classification | Value |
|----|------------|------|-------|----------|----------------|-------|
| A001 | Patient DB | Information | DBA Lead | AWS RDS | Critical | $5M |
| A002 | EHR App | Software | App Team | AWS ECS | Critical | $2M |
| A003 | Admin Creds | Access | Security | Vault | Critical | N/A |

---

## Threat Analysis

### Healthcare Threat Landscape

| Threat | Likelihood | Target Assets | Motivation |
|--------|------------|---------------|------------|
| Ransomware | High | All systems | Financial |
| Data breach | High | Patient data | Financial/Competitive |
| Phishing | Very High | User accounts | Access |
| Insider threat | Medium | Sensitive data | Various |
| DDoS | Medium | Public services | Disruption |
| Supply chain | Medium | Third-party systems | Access |

### Threat Modeling Approaches

**STRIDE Model:**
- **S**poofing identity
- **T**ampering with data
- **R**epudiation
- **I**nformation disclosure
- **D**enial of service
- **E**levation of privilege

**Threat Actor Categories:**

| Actor | Capability | Motivation | Typical Targets |
|-------|-----------|------------|-----------------|
| Nation-state | Very High | Espionage, disruption | Critical infrastructure |
| Organized crime | High | Financial gain | Healthcare, finance |
| Hacktivists | Medium | Ideology | Public-facing systems |
| Insiders | Varies | Financial, revenge | Sensitive data |
| Script kiddies | Low | Notoriety | Unpatched systems |

---

## Vulnerability Assessment

### Vulnerability Categories

| Category | Examples | Detection Method |
|----------|----------|------------------|
| Technical | Unpatched software, weak configs | Vulnerability scans |
| Process | Missing procedures, gaps | Process audits |
| People | Lack of training, social engineering | Phishing tests |
| Physical | Inadequate access controls | Physical audits |

### Vulnerability Scoring (CVSS Alignment)

| Score Range | Severity | Example |
|-------------|----------|---------|
| 9.0-10.0 | Critical | RCE without authentication |
| 7.0-8.9 | High | Authentication bypass |
| 4.0-6.9 | Medium | Information disclosure |
| 0.1-3.9 | Low | Minor configuration issue |

### Vulnerability Sources

1. **Automated Scans:** Nessus, Qualys, OpenVAS
2. **Penetration Testing:** Annual third-party tests
3. **Code Analysis:** SAST/DAST tools
4. **Configuration Audits:** CIS benchmarks
5. **Threat Intelligence:** CVE feeds, vendor advisories

---

## Risk Calculation

### Risk Formula

```
Risk = Likelihood × Impact
```

### Likelihood Scale (1-5)

| Score | Likelihood | Definition |
|-------|-----------|------------|
| 5 | Almost Certain | Expected to occur multiple times per year |
| 4 | Likely | Expected to occur at least once per year |
| 3 | Possible | Could occur within 2-3 years |
| 2 | Unlikely | Could occur within 5 years |
| 1 | Rare | Unlikely to occur |

### Impact Scale (1-5)

| Score | Impact | Financial | Operational | Reputational |
|-------|--------|-----------|-------------|--------------|
| 5 | Catastrophic | >$10M | Total shutdown | International news |
| 4 | Major | $1M-$10M | Major disruption | National news |
| 3 | Moderate | $100K-$1M | Significant impact | Local news |
| 2 | Minor | $10K-$100K | Minor disruption | Complaints |
| 1 | Negligible | <$10K | Minimal impact | Internal only |

### Risk Matrix

|     | Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 |
|-----|----------|----------|----------|----------|----------|
| **L5** | 5 (Low) | 10 (Med) | 15 (High) | 20 (Crit) | 25 (Crit) |
| **L4** | 4 (Low) | 8 (Med) | 12 (Med) | 16 (High) | 20 (Crit) |
| **L3** | 3 (Min) | 6 (Low) | 9 (Med) | 12 (Med) | 15 (High) |
| **L2** | 2 (Min) | 4 (Low) | 6 (Low) | 8 (Med) | 10 (Med) |
| **L1** | 1 (Min) | 2 (Min) | 3 (Min) | 4 (Low) | 5 (Low) |

### Risk Levels

| Level | Score Range | Action Required |
|-------|-------------|-----------------|
| Critical | 20-25 | Immediate action, escalate to management |
| High | 15-19 | Treatment plan within 30 days |
| Medium | 10-14 | Treatment plan within 90 days |
| Low | 5-9 | Accept or implement low-cost controls |
| Minimal | 1-4 | Accept risk, document decision |

---

## Risk Treatment

### Treatment Options (ISO 27001)

| Option | Description | When to Use |
|--------|-------------|-------------|
| Modify | Implement controls to reduce risk | Most risks |
| Avoid | Eliminate the risk source | Unacceptable risks |
| Share | Transfer via insurance/outsourcing | High financial impact |
| Retain | Accept the risk | Low risks, cost-prohibitive controls |

### Control Selection Criteria

1. **Effectiveness:** Reduces likelihood or impact
2. **Cost:** Implementation and maintenance costs
3. **Feasibility:** Technical and operational viability
4. **Compliance:** Meets regulatory requirements
5. **Integration:** Works with existing controls

### Residual Risk

After implementing controls:

```
Residual Risk = Inherent Risk × (1 - Control Effectiveness)
```

| Control Effectiveness | Residual Risk Factor |
|----------------------|---------------------|
| 90%+ | Very Low (0.1×) |
| 70-89% | Low (0.2-0.3×) |
| 50-69% | Moderate (0.4-0.5×) |
| <50% | Limited reduction |

---

## Templates and Tools

### Risk Register Template

| Risk ID | Asset | Threat | Vulnerability | L | I | Inherent | Control | Residual | Owner | Status |
|---------|-------|--------|---------------|---|---|----------|---------|----------|-------|--------|
| R001 | Patient DB | Data breach | Weak encryption | 4 | 5 | 20 | AES-256 | 8 | DBA | Open |
| R002 | Admin access | Credential theft | No MFA | 5 | 5 | 25 | MFA | 5 | Security | Closed |

### Risk Assessment Report Sections

1. **Executive Summary**
   - Key findings
   - Critical/high risks count
   - Overall risk posture

2. **Methodology**
   - Assessment scope
   - Criteria used
   - Limitations

3. **Asset Summary**
   - Asset inventory
   - Classification distribution

4. **Risk Findings**
   - Risk register
   - Heat map visualization
   - Trend analysis

5. **Recommendations**
   - Priority treatments
   - Timeline and resources
   - Residual risk projection

6. **Appendices**
   - Detailed asset list
   - Threat catalog
   - Control mapping


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)