← Frameworks / ISO 27799 / Control Mappings

ISO 27799:2016 Health Informatics — Information Security Management in Health

International standard providing implementation guidance for ISO 27002 controls in the health informatics context. 48 control areas addressing health-specific requirements including patient data confidentiality, clinical system availability, health information exchange security, consent management, audit trail requirements for clinical systems, mobile health device security, telemedicine security, medical device integration, health cloud security, and cross-border health data transfer. Applies to all organisations holding or processing health information regardless of size.

Controls: 176
Total Mappings: 325
Publisher: ISO/IEC Version: 2016
ISO 27799 → SP 800-53 SP 800-53 → ISO 27799 Coverage Analysis
AC (18) AT (5) AU (12) CA (7) CM (9) CP (13) IA (7) IR (9) MA (4) MP (5) PE (14) PL (3) PM (15) PS (8) PT (7) RA (4) SA (10) SC (13) SI (7) SR (6)

AC Access Control

Control Name ISO 27799 References
AC-01 Access Control Policies and Procedures
5.19.1
AC-02 Account Management
7.39.19.29.3
AC-03 Access Enforcement
9.19.5H.4
AC-04 Information Flow Enforcement
13.113.29.5H.2H.4
AC-05 Separation Of Duties
9.3
AC-06 Least Privilege
9.19.39.5H.4
AC-07 Unsuccessful Login Attempts
9.5
AC-08 System Use Notification
9.5
AC-10 Concurrent Session Control
9.5
AC-11 Session Lock
9.4
AC-12 Session Termination
9.4
AC-14 Permitted Actions Without Identification Or Authentication
9.2
AC-16 Automated Labeling
5.38.2
AC-17 Remote Access
6.39.5H.5
AC-19 Access Control For Portable And Mobile Devices
11.26.3
AC-20 Use Of External Information Systems
13.215.26.38.3H.2
AC-24 Access Control Decisions
9.1
AC-25 Reference Monitor
9.1

AT Awareness and Training

Control Name ISO 27799 References
AT-01 Security Awareness And Training Policy And Procedures
5.17.2
AT-02 Security Awareness
7.2
AT-03 Security Training
7.2
AT-04 Security Training Records
7.2
AT-06 Training Feedback
7.2

AU Audit and Accountability

Control Name ISO 27799 References
AU-01 Audit And Accountability Policy And Procedures
12.45.1
AU-02 Auditable Events
12.49.2H.4H.5
AU-03 Content Of Audit Records
12.4H.4
AU-04 Audit Storage Capacity
12.4
AU-05 Response To Audit Processing Failures
12.4
AU-06 Audit Monitoring, Analysis, And Reporting
12.49.2
AU-07 Audit Reduction And Report Generation
12.4
AU-08 Time Stamps
12.4
AU-09 Protection Of Audit Information
12.4
AU-11 Audit Record Retention
12.4
AU-12 Audit Record Generation
12.49.2
AU-14 Session Audit
12.4

CA Security Assessment and Authorization

Control Name ISO 27799 References
CA-01 Certification, Accreditation, And Security Assessment Policies And Procedures
18.35.1
CA-02 Security Assessments
18.318.4
CA-03 Information System Connections
13.113.2H.2
CA-05 Plan Of Action And Milestones
18.3
CA-07 Continuous Monitoring
18.35.2
CA-08 Penetration Testing
18.318.4
CA-09 Internal System Connections
13.1

CM Configuration Management

Control Name ISO 27799 References
CM-01 Configuration Management Policy And Procedures
12.15.1
CM-02 Baseline Configuration
12.1
CM-03 Configuration Change Control
12.5
CM-04 Monitoring Configuration Changes
12.514.2
CM-06 Configuration Settings
12.118.4
CM-07 Least Functionality
6.3
CM-08 Information System Component Inventory
11.28.1H.3
CM-12 Information Location
8.1
CM-13 Data Action Mapping
8.1

CP Contingency Planning

Control Name ISO 27799 References
CP-01 Contingency Planning Policy And Procedures
17.15.1
CP-02 Contingency Plan
17.117.29.2
CP-03 Contingency Training
17.1
CP-04 Contingency Plan Testing And Exercises
17.1
CP-05 Contingency Plan Update
17.1
CP-06 Alternate Storage Site
12.317.217.3
CP-07 Alternate Processing Site
17.217.3
CP-08 Telecommunications Services
17.217.3
CP-09 Information System Backup
12.317.2
CP-10 Information System Recovery And Reconstitution
17.29.2
CP-11 Alternate Communications Protocols
17.2
CP-12 Safe Mode
17.2
CP-13 Alternative Security Mechanisms
17.2

IA Identification and Authentication

Control Name ISO 27799 References
IA-01 Identification And Authentication Policy And Procedures
5.1
IA-02 User Identification And Authentication
9.39.4H.5
IA-04 Identifier Management
7.39.3
IA-05 Authenticator Management
9.39.4
IA-08 Identification and Authentication (Non-Organizational Users)
H.5
IA-11 Re-authentication
9.4
IA-12 Identity Proofing
9.3

IR Incident Response

Control Name ISO 27799 References
IR-01 Incident Response Policy And Procedures
16.15.1
IR-02 Incident Response Training
16.1
IR-03 Incident Response Testing And Exercises
16.1
IR-04 Incident Handling
16.116.2
IR-05 Incident Monitoring
16.2
IR-06 Incident Reporting
16.216.3
IR-07 Incident Response Assistance
16.1
IR-08 Incident Response Plan
16.1
IR-09 Information Spillage Response
16.2

MA Maintenance

Control Name ISO 27799 References
MA-01 System Maintenance Policy And Procedures
11.25.1H.3
MA-02 Controlled Maintenance
11.2H.3
MA-05 Maintenance Personnel
11.2
MA-06 Timely Maintenance
H.3

MP Media Protection

Control Name ISO 27799 References
MP-01 Media Protection Policy And Procedures
5.1
MP-03 Media Labeling
5.38.2
MP-04 Media Storage
12.3
MP-05 Media Transport
12.313.2
MP-07 Media Use
8.3

PE Physical and Environmental Protection

Control Name ISO 27799 References
PE-01 Physical And Environmental Protection Policy And Procedures
11.111.25.1
PE-02 Physical Access Authorizations
11.1
PE-03 Physical Access Control
11.1
PE-04 Access Control For Transmission Medium
11.1
PE-05 Access Control For Display Medium
11.19.4
PE-06 Monitoring Physical Access
11.1
PE-07 Visitor Control
11.1
PE-08 Access Records
11.1
PE-09 Power Equipment And Power Cabling
17.3
PE-11 Emergency Power
17.3
PE-14 Temperature And Humidity Controls
11.2
PE-17 Alternate Work Site
6.3
PE-18 Location Of Information System Components
11.111.2
PE-23 Facility Location
11.2

PL Planning

Control Name ISO 27799 References
PL-01 Security Planning Policy And Procedures
5.15.26.2
PL-02 System Security Plan
12.1H.1
PL-04 Rules Of Behavior
18.17.28.39.4

PM Program Management

Control Name ISO 27799 References
PM-01 Information Security Program Plan
18.15.15.26.1H.1
PM-02 Information Security Program Leadership Role
6.16.2
PM-05 System Inventory
8.1
PM-06 Measures of Performance
18.35.2
PM-08 Critical Infrastructure Plan
17.1
PM-09 Risk Management Strategy
H.1
PM-10 Authorization Process
6.1
PM-11 Mission and Business Process Definition
17.1H.1
PM-13 Security and Privacy Workforce
7.2
PM-14 Testing, Training, and Monitoring
18.3
PM-15 Security and Privacy Groups and Associations
16.116.3
PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
18.2
PM-26 Complaint Management
16.318.2
PM-27 Privacy Reporting
18.2
PM-29 Risk Management Program Leadership Roles
6.1

PS Personnel Security

Control Name ISO 27799 References
PS-01 Personnel Security Policy And Procedures
5.16.16.27.1
PS-02 Position Categorization
6.27.1
PS-03 Personnel Screening
7.19.3
PS-04 Personnel Termination
7.38.3
PS-05 Personnel Transfer
7.38.3
PS-06 Access Agreements
7.17.2
PS-07 Third-Party Personnel Security
7.2
PS-09 Position Descriptions
6.16.2

PT Personally Identifiable Information Processing and Transparency

Control Name ISO 27799 References
PT-01 Policy and Procedures
18.15.1
PT-02 Authority to Process Personally Identifiable Information
18.118.25.38.2
PT-03 Personally Identifiable Information Processing Purposes
18.25.38.2
PT-04 Consent
16.318.118.2H.4
PT-05 Privacy Notice
16.318.118.2
PT-06 System of Records Notice
14.318.28.2H.4
PT-07 Specific Categories of Personally Identifiable Information
14.318.28.2H.4

RA Risk Assessment

Control Name ISO 27799 References
RA-01 Risk Assessment Policy And Procedures
5.1
RA-02 Security Categorization
5.38.18.2
RA-03 Risk Assessment
H.1
RA-05 Vulnerability Scanning
12.518.4H.3

SA System and Services Acquisition

Control Name ISO 27799 References
SA-01 System And Services Acquisition Policy And Procedures
5.1
SA-03 Life Cycle Support
14.114.2
SA-04 Acquisitions
14.115.118.1
SA-05 Information System Documentation
12.1
SA-08 Security Engineering Principles
14.114.2
SA-09 External Information System Services
14.115.115.2
SA-10 Developer Configuration Management
14.2
SA-11 Developer Security Testing
14.214.3
SA-15 Development Process, Standards, and Tools
14.214.3
SA-17 Developer Security and Privacy Architecture and Design
14.2

SC System and Communications Protection

Control Name ISO 27799 References
SC-01 System And Communications Protection Policy And Procedures
5.1
SC-07 Boundary Protection
13.1H.2H.3
SC-08 Transmission Integrity
10.113.113.2H.2H.5
SC-10 Network Disconnect
9.5
SC-12 Cryptographic Key Establishment And Management
10.110.213.2H.2
SC-13 Use Of Cryptography
10.113.2H.2H.5
SC-17 Public Key Infrastructure Certificates
10.2
SC-23 Session Authenticity
9.5H.5
SC-28 Protection of Information at Rest
10.112.36.3H.4
SC-32 System Partitioning
13.1
SC-36 Distributed Processing and Storage
17.3
SC-44 Detonation Chambers
12.2
SC-46 Cross Domain Policy Enforcement
13.1H.2

SI System and Information Integrity

Control Name ISO 27799 References
SI-01 System And Information Integrity Policy And Procedures
5.1
SI-02 Flaw Remediation
12.518.4H.3
SI-03 Malicious Code Protection
12.2
SI-04 Information System Monitoring Tools And Techniques
12.216.2
SI-05 Security Alerts And Advisories
12.516.2
SI-08 Spam Protection
12.2
SI-19 De-identification
14.3H.4

SR Supply Chain Risk Management

Control Name ISO 27799 References
SR-01 Policy and Procedures
14.115.115.25.1
SR-02 Supply Chain Risk Management Plan
14.115.1
SR-03 Supply Chain Controls and Processes
14.115.115.2
SR-05 Acquisition Strategies, Tools, and Methods
15.115.2
SR-06 Supplier Assessments and Reviews
15.115.2
SR-11 Component Authenticity
15.2H.3