An Information Security Management System Creating a Cohesive Framework

Who We Are

Information Security – What does that mean? As stated within ISO 27001:2013 “The information security management system preserves the confidentiality, the integrity, and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed.”

ISO 27001 – A Platform to an Integrated Framework Source: Cisco GRC PPT

What is ISO/IEC 27001:2013 Internationally recognized standard Family of Standards Accepted in the US within the private and public sectors as a preferred standard Integrates with other Management Systems Auditable/certifiable framework – ‘Shall’ requirements Aligned with Annex SL verbiage and requirements

Introduction to ISMS Focus on Risk Identification Ownership Assessment Mitigation – policy and process Acceptance Holistic approach with other Management Systems and Standards Aligned with other frameworks – NIST and CobiT, Presidents Cyber-security framework Supports legal, regulatory, and contractual requirements such as HIPAA, PCI, and CJIS

Risk Methodology

Risk Process Establish context Identify the people, technology, interested parties Identify the information assets Determine impact and probability criteria Identify Risks Evaluate Risk Treat the risk (or not treat the risk) – Mitigation Management Approval of residual risk Communicate Monitor Improve

Iso 27001 Annex A Information Security Policies Organization of Information Security Human Resources Security Asset Management Access Control Cryptography Physical and Environmental Security Operations Security Communications Security System acquisition, development, and maintenance Supplier Relationships Information Security Incident Management Information security aspects of Business Continuity Management Compliance ISO 27001:2013 Annex A

Bigger Bang for Your Buck ISO 27001 is becoming the basis for adding additional requirements such as HIPAA and PCI into your Information Security Management System.

Lets discuss HIPAA Specific to Health Information Numerous HIPAA requirements surrounding the protection of confidential information Commonly referred to as PII and PHI Does the HIPAA privacy rules apply to your organization? Are you on a business associate?

Privacy Rule – What is it? Protected Health Information. The Privacy Rules protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. (PHI) “Individually identifiable health information” is information, including demographic data, that relates to: Past, present, or future physical or mental health or condition, The provision of health care, or Past, present, or future payment for the provision of health care to the individual, And that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.13 The Privacy Rules excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.

Health Insurance Portability & Accountability Ex. ISO 27001 to HIPAA

National Institute of Standards Technology 800-53 Supports government centric information security requirements Taken on within the commercial markets to create a non auditable information security management posture Requires use of additional NIST documents to successfully implement 800-39 Controls support a low, moderate, or high

Ex. ISO 27001 to NIST

Payment Card Industry (PCI) Required if organizations have e-commerce or hold paper or legacy data with consumer credit card information Public site of “shame” if you are not in compliance to PCI or present a high risk to merchant services Can take overlapping controls and implement or add to common framework even though you do not have PCI requirements today

Ex. ISO 27001 to PCI

Why Comply? Mandates from the Federal Government: FedRAMP for Cloud Service FAR/DFAR Requirements Laws to protect Personally Identifiable Information HIPAA 48 DIFFERENT data breach laws Protection of Intellectual Property and Corporate Records Customer Requirements

Why use ISO for Compliance? Governance, Risk and Compliance can be managed at all levels of the organization with an auditable standard that requires management commitment, internal audit, external audit, and continuous improvement

Closing Thoughts

Questions? Matthew Kolcz Northern Territory Manager DNV GL Business Assurance 773.255.1946 Matthew.Kolcz@dnvgl.com Sally Smoczynski Managing Partner Radian Compliance, LLC 630.728.7181. Ssmoczynski@RadianCompliance.com Lisa DuBrock Managing Partner Radian Compliance, LLC 847.997.2032 LDuBrock@RadianCompliance.com