← Frameworks / ISO 27799 / Control Mappings

Machine-readable: JSON API guide

ISO 27799:2016 Health Informatics — Information Security Management in Health

International standard providing implementation guidance for ISO 27002 controls in the health informatics context. 48 control areas addressing health-specific requirements including patient data confidentiality, clinical system availability, health information exchange security, consent management, audit trail requirements for clinical systems, mobile health device security, telemedicine security, medical device integration, health cloud security, and cross-border health data transfer. Applies to all organisations holding or processing health information regardless of size.

Controls: 176
Total Mappings: 325
Publisher: ISO/IEC Version: 2016
ISO 27799 → SP 800-53 SP 800-53 → ISO 27799 Coverage Analysis
AC (18) AT (5) AU (12) CA (7) CM (9) CP (13) IA (7) IR (9) MA (4) MP (5) PE (14) PL (3) PM (15) PS (8) PT (7) RA (4) SA (10) SC (13) SI (7) SR (6)

AC Access Control

Control Name ISO 27799 References
AC-01 Policy and Procedures
5.19.1
AC-02 Account Management
7.39.19.29.3
AC-03 Access Enforcement
9.19.5H.4
AC-04 Information Flow Enforcement
9.513.113.2H.2H.4
AC-05 Separation of Duties
9.3
AC-06 Least Privilege
9.19.39.5H.4
AC-07 Unsuccessful Logon Attempts
9.5
AC-08 System Use Notification
9.5
AC-10 Concurrent Session Control
9.5
AC-11 Device Lock
9.4
AC-12 Session Termination
9.4
AC-14 Permitted Actions Without Identification or Authentication
9.2
AC-16 Security and Privacy Attributes
5.38.2
AC-17 Remote Access
6.39.5H.5
AC-19 Access Control for Mobile Devices
6.311.2
AC-20 Use of External Systems
6.38.313.215.2H.2
AC-24 Access Control Decisions
9.1
AC-25 Reference Monitor
9.1

AT Awareness and Training

Control Name ISO 27799 References
AT-01 Policy and Procedures
5.17.2
AT-02 Literacy Training and Awareness
7.2
AT-03 Role-based Training
7.2
AT-04 Training Records
7.2
AT-06 Training Feedback
7.2

AU Audit and Accountability

Control Name ISO 27799 References
AU-01 Policy and Procedures
5.112.4
AU-02 Event Logging
9.212.4H.4H.5
AU-03 Content of Audit Records
12.4H.4
AU-04 Audit Log Storage Capacity
12.4
AU-05 Response to Audit Logging Process Failures
12.4
AU-06 Audit Record Review, Analysis, and Reporting
9.212.4
AU-07 Audit Record Reduction and Report Generation
12.4
AU-08 Time Stamps
12.4
AU-09 Protection of Audit Information
12.4
AU-11 Audit Record Retention
12.4
AU-12 Audit Record Generation
9.212.4
AU-14 Session Audit
12.4

CA Security Assessment and Authorization

Control Name ISO 27799 References
CA-01 Policy and Procedures
5.118.3
CA-02 Control Assessments
18.318.4
CA-03 Information Exchange
13.113.2H.2
CA-05 Plan of Action and Milestones
18.3
CA-07 Continuous Monitoring
5.218.3
CA-08 Penetration Testing
18.318.4
CA-09 Internal System Connections
13.1

CM Configuration Management

Control Name ISO 27799 References
CM-01 Policy and Procedures
5.112.1
CM-02 Baseline Configuration
12.1
CM-03 Configuration Change Control
12.5
CM-04 Impact Analyses
12.514.2
CM-06 Configuration Settings
12.118.4
CM-07 Least Functionality
6.3
CM-08 System Component Inventory
8.111.2H.3
CM-12 Information Location
8.1
CM-13 Data Action Mapping
8.1

CP Contingency Planning

Control Name ISO 27799 References
CP-01 Policy and Procedures
5.117.1
CP-02 Contingency Plan
9.217.117.2
CP-03 Contingency Training
17.1
CP-04 Contingency Plan Testing
17.1
CP-05 Contingency Plan Update
17.1
CP-06 Alternate Storage Site
12.317.217.3
CP-07 Alternate Processing Site
17.217.3
CP-08 Telecommunications Services
17.217.3
CP-09 System Backup
12.317.2
CP-10 System Recovery and Reconstitution
9.217.2
CP-11 Alternate Communications Protocols
17.2
CP-12 Safe Mode
17.2
CP-13 Alternative Security Mechanisms
17.2

IA Identification and Authentication

Control Name ISO 27799 References
IA-01 Policy and Procedures
5.1
IA-02 Identification and Authentication (Organizational Users)
9.39.4H.5
IA-04 Identifier Management
7.39.3
IA-05 Authenticator Management
9.39.4
IA-08 Identification and Authentication (Non-organizational Users)
H.5
IA-11 Re-authentication
9.4
IA-12 Identity Proofing
9.3

IR Incident Response

Control Name ISO 27799 References
IR-01 Policy and Procedures
5.116.1
IR-02 Incident Response Training
16.1
IR-03 Incident Response Testing
16.1
IR-04 Incident Handling
16.116.2
IR-05 Incident Monitoring
16.2
IR-06 Incident Reporting
16.216.3
IR-07 Incident Response Assistance
16.1
IR-08 Incident Response Plan
16.1
IR-09 Information Spillage Response
16.2

MA Maintenance

Control Name ISO 27799 References
MA-01 Policy and Procedures
5.111.2H.3
MA-02 Controlled Maintenance
11.2H.3
MA-05 Maintenance Personnel
11.2
MA-06 Timely Maintenance
H.3

MP Media Protection

Control Name ISO 27799 References
MP-01 Policy and Procedures
5.1
MP-03 Media Marking
5.38.2
MP-04 Media Storage
12.3
MP-05 Media Transport
12.313.2
MP-07 Media Use
8.3

PE Physical and Environmental Protection

Control Name ISO 27799 References
PE-01 Policy and Procedures
5.111.111.2
PE-02 Physical Access Authorizations
11.1
PE-03 Physical Access Control
11.1
PE-04 Access Control for Transmission
11.1
PE-05 Access Control for Output Devices
9.411.1
PE-06 Monitoring Physical Access
11.1
PE-07 Visitor Control
11.1
PE-08 Visitor Access Records
11.1
PE-09 Power Equipment and Cabling
17.3
PE-11 Emergency Power
17.3
PE-14 Environmental Controls
11.2
PE-17 Alternate Work Site
6.3
PE-18 Location of System Components
11.111.2
PE-23 Facility Location
11.2

PL Planning

Control Name ISO 27799 References
PL-01 Policy and Procedures
5.15.26.2
PL-02 System Security and Privacy Plans
12.1H.1
PL-04 Rules of Behavior
7.28.39.418.1

PM Program Management

Control Name ISO 27799 References
PM-01 Information Security Program Plan
5.15.26.118.1H.1
PM-02 Information Security Program Leadership Role
6.16.2
PM-05 System Inventory
8.1
PM-06 Measures of Performance
5.218.3
PM-08 Critical Infrastructure Plan
17.1
PM-09 Risk Management Strategy
H.1
PM-10 Authorization Process
6.1
PM-11 Mission and Business Process Definition
17.1H.1
PM-13 Security and Privacy Workforce
7.2
PM-14 Testing, Training, and Monitoring
18.3
PM-15 Security and Privacy Groups and Associations
16.116.3
PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
18.2
PM-26 Complaint Management
16.318.2
PM-27 Privacy Reporting
18.2
PM-29 Risk Management Program Leadership Roles
6.1

PS Personnel Security

Control Name ISO 27799 References
PS-01 Policy and Procedures
5.16.16.27.1
PS-02 Position Risk Designation
6.27.1
PS-03 Personnel Screening
7.19.3
PS-04 Personnel Termination
7.38.3
PS-05 Personnel Transfer
7.38.3
PS-06 Access Agreements
7.17.2
PS-07 External Personnel Security
7.2
PS-09 Position Descriptions
6.16.2

PT Personally Identifiable Information Processing and Transparency

Control Name ISO 27799 References
PT-01 Policy and Procedures
5.118.1
PT-02 Authority to Process Personally Identifiable Information
5.38.218.118.2
PT-03 Personally Identifiable Information Processing Purposes
5.38.218.2
PT-04 Consent
16.318.118.2H.4
PT-05 Privacy Notice
16.318.118.2
PT-06 System of Records Notice
8.214.318.2H.4
PT-07 Specific Categories of Personally Identifiable Information
8.214.318.2H.4

RA Risk Assessment

Control Name ISO 27799 References
RA-01 Policy and Procedures
5.1
RA-02 Security Categorization
5.38.18.2
RA-03 Risk Assessment
H.1
RA-05 Vulnerability Monitoring and Scanning
12.518.4H.3

SA System and Services Acquisition

Control Name ISO 27799 References
SA-01 Policy and Procedures
5.1
SA-03 System Development Life Cycle
14.114.2
SA-04 Acquisition Process
14.115.118.1
SA-05 System Documentation
12.1
SA-08 Security and Privacy Engineering Principles
14.114.2
SA-09 External System Services
14.115.115.2
SA-10 Developer Configuration Management
14.2
SA-11 Developer Testing and Evaluation
14.214.3
SA-15 Development Process, Standards, and Tools
14.214.3
SA-17 Developer Security and Privacy Architecture and Design
14.2

SC System and Communications Protection

Control Name ISO 27799 References
SC-01 Policy and Procedures
5.1
SC-07 Boundary Protection
13.1H.2H.3
SC-08 Transmission Confidentiality and Integrity
10.113.113.2H.2H.5
SC-10 Network Disconnect
9.5
SC-12 Cryptographic Key Establishment and Management
10.110.213.2H.2
SC-13 Cryptographic Protection
10.113.2H.2H.5
SC-17 Public Key Infrastructure Certificates
10.2
SC-23 Session Authenticity
9.5H.5
SC-28 Protection of Information at Rest
6.310.112.3H.4
SC-32 System Partitioning
13.1
SC-36 Distributed Processing and Storage
17.3
SC-44 Detonation Chambers
12.2
SC-46 Cross Domain Policy Enforcement
13.1H.2

SI System and Information Integrity

Control Name ISO 27799 References
SI-01 Policy and Procedures
5.1
SI-02 Flaw Remediation
12.518.4H.3
SI-03 Malicious Code Protection
12.2
SI-04 System Monitoring
12.216.2
SI-05 Security Alerts, Advisories, and Directives
12.516.2
SI-08 Spam Protection
12.2
SI-19 De-identification
14.3H.4

SR Supply Chain Risk Management

Control Name ISO 27799 References
SR-01 Policy and Procedures
5.114.115.115.2
SR-02 Supply Chain Risk Management Plan
14.115.1
SR-03 Supply Chain Controls and Processes
14.115.115.2
SR-05 Acquisition Strategies, Tools, and Methods
15.115.2
SR-06 Supplier Assessments and Reviews
15.115.2
SR-11 Component Authenticity
15.2H.3