Health Sector Controls Profile Template (ISO 27799)

Clinical systems and health data, health-specific considerations, break-glass access, sector supplement register, health topics mapped to Annex A, medical devices by reference

ISMS・ISO/IEC 27001フルISO 27799:2025; ISO/IEC 27001:2022 + Amd 1:2024 6.1.3 and Annex A (cited only); medical device standards cited by namehealth 27799 controls更新 2026/11/01

エディタで開く.mdをダウンロード

使い方: Use it when the ISMS covers personal health information or systems used to deliver care. Fill the clinical system landscape and the sector supplement register from your licensed copy of ISO 27799 first. The main pitfall is locking clinicians out: design emergency access and monitor it rather than blocking it.

プレビュー

Health Sector Controls Profile (ISO 27799): [Organization name]

Sector profile for organizations that provide healthcare or hold personal health information: hospitals, clinics, laboratories, telehealth services, health insurers, and suppliers of clinical software and managed services. It records how the guidance in ISO 27799:2025 (information security controls in health, based on ISO/IEC 27002:2022) is applied inside an ISMS that meets ISO/IEC 27001:2022 + Amd 1:2024, mainly through risk treatment (6.1.3) and the Statement of Applicability. Medical devices are covered by reference only. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-110
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@ciso], [@clinical-safety-officer], [@data-protection-officer], [@head-of-clinical-systems]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO 27799:2025; ISO/IEC 27002:2022; ISO/IEC 27001:2022 + Amd 1:2024
Next scheduled review	YYYY-MM-DD
Role in health data processing	[Care provider / Controller / Processor for care providers / Insurer / Research organization]
Care settings in scope	[Hospital / Clinic / Laboratory / Telehealth / Home care / None: software supplier]
Medical devices on the network	[Yes, see section 8 / No]

Approvals

Role	Name	Decision	Date
ISMS manager (author)	[@isms-manager]	[Prepared]	YYYY-MM-DD
Clinical safety officer	[@clinical-safety-officer]	[Reviewed: no patient safety conflict]	YYYY-MM-DD
Data protection officer	[@data-protection-officer]	[Reviewed]	YYYY-MM-DD
CISO	[@ciso]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0	YYYY-MM-DD	[@isms-manager]	First issue
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Purpose and scope
2. ISO 27799 at a glance
3. Clinical system and information landscape
4. Health-specific considerations
5. Sector supplement register
6. Mapping of health topics to Annex A
7. Implementation table
8. Medical devices and clinical equipment
9. Worked risk example
10. Regulatory examples
11. Size tiers
12. Records and evidence
13. References
Standard and licence note

1. Purpose and scope

This profile explains how [Organization name] protects personal health information and the systems used to deliver or support care. It:

describes the clinical systems, information types and care settings in scope (section 3);
sets out the health-specific considerations that shape every control decision (section 4);
records which health-specific controls and guidance from ISO 27799:2025 apply and why (section 5);
maps each health topic to the ISO/IEC 27001:2022 Annex A controls in the Statement of Applicability, DOC-ISMS-011 (section 6), and assigns owners and evidence (section 7).

In scope: [clinical applications, health data stores, integration engines, telehealth platforms, connected devices on clinical networks, building and environmental systems in care premises].

Out of scope: [device manufacturing and conformity assessment, handled by the manufacturer's quality system; clinical decisions themselves].

2. ISO 27799 at a glance

Question	Answer for this profile
What it is	Information security controls, with implementation guidance, for health organizations, based on ISO/IEC 27002:2022
Edition	ISO 27799:2025 (third edition, published 2025-12-18; replaces the 2016 edition)
Publisher	ISO/TC 215, health informatics
Certifiable?	No. Certification is to ISO/IEC 27001:2022 + Amd 1:2024
Systems it addresses	Generic ICT plus health-specific software and systems such as electronic health records and medical devices with health software, and other digital equipment in care premises such as environmental, infection control, building management and physical security systems (summarised from the public scope)
Settings it addresses	Hospitals, clinics, ambulances, mobile units, care at home, and remote or virtual care (summarised from the public scope)
How it is organised	In line with the four themes of ISO/IEC 27002:2022, with health guidance on existing controls and some health-specific content (check your copy for the exact structure and annexes)
Licensed copy held by	[@isms-manager], [document repository path]

3. Clinical system and information landscape

3.1 Systems

System	Purpose	Health data held	Clinical criticality	Downtime procedure	Owner
Electronic health record	[Clinical documentation, orders, results]	[Full record]	[High]	[Paper forms, read-only replica]	[@head-of-clinical-systems]
Scheduling platform (Example)	Clinical appointment and theatre scheduling for hospital customers	Patient name, contact, procedure, clinician	Medium	Daily printed schedule, offline export	Product director
Laboratory system	[Orders, results]	[Results]	[High]	[Phone results for critical values]	[@lab-manager]
Imaging archive	[Images, reports]	[Images]	[High]	[Modality local storage]	[@radiology-it]
Integration engine	[Message routing between systems]	[In transit]	[High]	[Queueing, manual re-send]	[@integration-lead]
Telehealth platform	[Video consultations]	[Session metadata, notes]	[Medium]	[Phone consultation]	[@telehealth-lead]

3.2 Information types

Information	Why it needs extra care	Classification
Clinical records	Sensitive personal data; errors can harm patients	[Restricted]
Genetic and mental health data	Higher harm if disclosed; extra legal protection in many jurisdictions	[Restricted, need to know]
Results needing urgent action	Time-sensitive: delay can harm patients	[Restricted, integrity and availability critical]
De-identified research datasets	Re-identification risk	[Confidential]
Staff and clinician credentials	Enable prescribing and record access	[Restricted]

4. Health-specific considerations

Consideration	What it means for controls	Your approach
Patient safety first	Security controls must not prevent timely care; integrity and availability can outrank confidentiality in an emergency	[Clinical safety review of every control that affects access]
Emergency access	Clinicians may need records they are not normally entitled to see	[Break-glass with reason entry, alert and next-day review]
Shared workstations	Wards use shared devices with frequent user switching	[Fast user switching with badge tap, session timeouts tuned per area]
Patient rights	Patients can access, and in many laws restrict or correct, their data	[Request procedure, see `compliance/data-subject-request-procedure`]
Consent and sharing	Sharing across care providers depends on law and patient choices	[Consent records linked to sharing rules]
Long retention	Clinical records are often kept for decades	[Retention schedule, format migration plan]
Secondary use	Research and analytics need de-identification or a legal basis	[De-identification assessment, ethics approval]
Mixed estate	Clinical devices, building systems and IT share premises and sometimes networks	[Segmented clinical device network, section 8]

5. Sector supplement register

Entry ID	Reference in 27799	Type	Your short label	Related Annex A	Applicable	Section 7 item
HLT-REG-001 (Example)	[Section number from your copy]	Health guidance on existing control	Emergency access to patient records	A.5.15, A.5.18, A.8.15	Yes	HLT-IMP-001
HLT-REG-002 (Example)	[Section number from your copy]	Health guidance on existing control	Audit trail of access to health records	A.8.15, A.8.16	Yes	HLT-IMP-002
HLT-REG-003 (Example)	[Section number from your copy]	Health guidance on existing control	Security of medical devices on the network	A.8.1, A.8.20, A.8.22	Yes	HLT-IMP-004
HLT-REG-004 (Example)	[Section number from your copy]	[Health-specific control or guidance]	Patient identification and record matching	A.8.3, A.5.34	Yes	HLT-IMP-005
HLT-REG-005	[Section number from your copy]	[Type]	[Your label]	[A.x.y]	[Yes / No]	[HLT-IMP-nnn]
HLT-REG-006	[Section number from your copy]	[Type]	[Your label]	[A.x.y]	[Yes / No]	[HLT-IMP-nnn]

Confirm that each example label matches an entry in your copy before keeping it. Where your copy contains controls that are specific to health and not derived from ISO/IEC 27002, record them as additional controls in the SoA.

6. Mapping of health topics to Annex A

Health topic	Primary Annex A controls (short labels)	Notes
Classification of health information	A.5.12 information classification, A.5.13 information labelling	Special categories handled as Restricted
Role-based clinical access	A.5.15 access control rules, A.5.18 access rights provisioning and review, A.8.3 restricting access	Access by care relationship and role
Emergency access	A.5.15, A.8.2 privileged access rights, A.8.15 logging	Break-glass with retrospective review
Privacy of patient data	A.5.34 privacy and PII protection, A.5.31 legal requirements	Link to PIMS (DOC-ISMS-100) where in place
Records retention and integrity	A.5.33 protection of records, A.8.10 information deletion	Clinical retention periods per law
Data sharing with other providers	A.5.14 information transfer	Standard interfaces, encryption, sharing agreements
Suppliers of clinical software	A.5.19 to A.5.22 supplier relationships, A.5.23 cloud services	Processor terms, uptime, security updates
Workforce awareness	A.6.3 awareness, education and training	Clinical staff training in short formats
Care premises	A.7.1 to A.7.4 physical security, A.7.7 clear desk and clear screen	Public areas, shared terminals
Clinical devices and building systems	A.8.1 user endpoint devices, A.8.8 vulnerability management, A.8.22 network segregation	Section 8
Monitoring access to records	A.8.15 logging, A.8.16 monitoring activities	Detect snooping on colleagues or public figures
Resilience of clinical systems	A.5.29, A.5.30 continuity, A.8.13 backup, A.8.14 redundancy	Downtime procedures tested with clinicians
Test data	A.8.33 test information, A.8.11 data masking	No real patient data in test without approval and masking
Incident management	A.5.24 to A.5.28 incident management	Joint with clinical incident reporting

7. Implementation table

Item ID	Register entry	What is done	Owner	Status	Due	Evidence
HLT-IMP-001 (Example)	HLT-REG-001	Break-glass access with mandatory reason; privacy team reviews every use within 2 working days	Head of clinical systems	Implemented	2027-03-31	Break-glass review log
HLT-IMP-002 (Example)	HLT-REG-002	Access to records logged; weekly automated report flags staff viewing records of patients sharing their surname	Privacy team	Implemented	2027-02-28	Monitoring reports, investigation records
HLT-IMP-003 (Example)	Annex A A.8.33 guidance	Test environments loaded only with synthetic or masked data	Engineering	Partial	2027-06-30	Test data approvals
HLT-IMP-004 (Example)	HLT-REG-003	Clinical device network segment with allow-listed flows and passive monitoring	Network team	Planned	2027-12-31	Network diagram, device inventory
HLT-IMP-005 (Example)	HLT-REG-004	Duplicate patient record detection with a monthly data quality review	Health records manager	Implemented	2027-01-31	Data quality report
HLT-IMP-006	[HLT-REG-nnn]	[Action]	[@owner]	[Status]	YYYY-MM-DD	[Record]

Status summary (Example): 6 rows, of which 3 implemented, 1 partial, 1 planned and 1 blank row awaiting entries.

8. Medical devices and clinical equipment

Rules for devices that connect to [Organization name] networks:

Inventory: every connected device is in the asset inventory (DOC-ISMS-012) with manufacturer, model, software version, support end date, location and clinical owner.
Network placement: devices sit in a clinical device segment with only the flows they need; no internet access unless the manufacturer's service requires it through a controlled gateway.
Updates: install only manufacturer-approved updates; where none exist, apply compensating controls and record the risk.
Procurement: request the manufacturer's security documentation, including a software bill of materials and the support period, before purchase (see security/sbom-vex-policy).
Incidents: report suspected device compromise to the manufacturer and, where the law requires, to the device regulator; treat it as a clinical safety incident too.

Reference standards for devices and health software (cite by name, check editions): IEC 80001-1 (safety, effectiveness and security when health software and IT networks are combined), IEC 81001-5-1 (security in the health software lifecycle), ISO 81001-1 (health software safety and security principles), ISO 14971 (medical device risk management, see compliance/iso-14971-risk-file). For telehealth, ISO/TS 6268-3:2026 gives telehealth cybersecurity controls mapped to ISO 27799:2025.

9. Worked risk example

Example: Quillmere Health Systems (320 staff, two offices and one colocation suite) runs clinical scheduling as a managed service and acts as processor for its hospital customers.

Field	Value
Risk ID	R-073 (Example)
Scenario	Ransomware encrypts the scheduling platform; hospitals cannot see theatre lists for the next day
Inherent likelihood x impact	3 x 5 = 15, High
Treatment	Immutable backups with restore test twice a year (DOC-ISMS-071), daily offline schedule export for each hospital, EDR on all servers, tested hospital downtime procedure
Residual likelihood x impact	2 x 3 = 6, Medium
Acceptance	Medium residual risk accepted by the risk owner (the product director) and the department head (head of service operations), as DOC-ISMS-010 requires for Medium risks (DOC-ISMS-019 record ACC-073 (Example))
Review	After each restore test and yearly

10. Regulatory examples

Framework	Region	Relevance	Check
Regulation (EU) 2016/679 (GDPR), Article 9	EU and EEA	Health data is a special category of personal data	Supervisory authority guidance
Directive (EU) 2022/2555 (NIS2)	EU	Health is a sector of high criticality	National transposition
Regulation (EU) 2025/327 (European Health Data Space)	EU	Electronic health record systems and data access; obligations apply in stages from 2027	Article 105 of the official text for dates
Regulation (EU) 2017/745 (MDR)	EU	Cybersecurity of medical devices including software	Manufacturer obligations
HIPAA Security Rule, 45 CFR Part 164 Subpart C	United States	Safeguards for electronic protected health information; amendments proposed in January 2025 (RIN 0945-AA22) were not final at the time of writing; the regulatory agenda moved them to long-term actions with a July 2027 target, which can change	Current status on the regulator's site
[National health information law]	[Country]	[Record retention, data localisation, health ID]	[Source]

11. Size tiers

Aspect	Small (under 50 people)	Medium (50 to 500)	Large or multi-site (over 500 or several sites)
Size reference	Quillmere Analytics Ltd, 46 staff (38 employees, 8 contractors), part-time ISMS manager	Quillmere Health Systems, 320 staff, full-time ISMS manager and 3-person security team	Quillmere Group, 2,400 staff, 6 sites in 4 countries, CISO and 14-person security office
Typical health role (Example)	Analytics supplier processing hospital data as processor, or a small clinic	Clinical software and managed service provider (Quillmere Health Systems itself)	Hospital group or regional health network with many sites
Use of ISO 27799	Privacy, supplier, logging and test data entries	Most entries, clinical safety review, device guidance for customers	Full register per site, clinical device programme, building systems
Governance	ISMS manager with DPO support	ISMS manager, security team, clinical safety officer	CISO, site security leads, clinical safety committee
Access monitoring	Platform logs reviewed monthly	Automated weekly reports on record access	Dedicated privacy monitoring team
Review cycle	Yearly	Yearly plus after major release	Yearly per site, rolling group review

12. Records and evidence

Record	Proves	Owner	Location	Retention
Sector supplement register and SoA rows	Applicability decisions	ISMS manager	[ISMS repository]	[Life of the ISMS plus 3 years]
Break-glass review log	Emergency access is used properly	Privacy team	[Clinical system reports]	[Example: 6 years]
Record access monitoring reports and investigations	A.8.15 and A.8.16 applied to health data	Privacy team	[Restricted repository]	[Example: 6 years]
Clinical device inventory and segment rules	Device controls in section 8	Clinical engineering	DOC-ISMS-012	[Current plus 3 years]
Downtime procedure tests	Clinical continuity	Head of clinical systems	[BC folder]	[Example: 3 years]
Test data approvals	A.8.33	Engineering	[Change tool]	[Example: 3 years]
Clinical safety reviews of security changes	Patient safety considered	Clinical safety officer	[Safety case file]	[Example: life of system]

Link each record to its control in isms/control-evidence-matrix (DOC-ISMS-033).

13. References

Reference	Edition and status	Use
ISO 27799:2025, information security controls in health based on ISO/IEC 27002	Current (https://www.iso.org/standard/84647.html)	Health controls and guidance
ISO/IEC 27001:2022 + Amd 1:2024	Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html)	ISMS requirements, clause 6.1.3, Annex A
ISO/IEC 27002:2022	Current (https://www.iso.org/standard/75652.html)	Control guidance
ISO/IEC 27701:2025	Current (https://www.iso.org/standard/85819.html)	Privacy information management
ISO/IEC 27559:2022	Current (cited without link)	De-identification framework
ISO/TS 6268-3:2026	Current (cited without link)	Telehealth cybersecurity controls
IEC 80001-1, IEC 81001-5-1, ISO 81001-1, ISO 14971	Check current editions (cited without link)	Devices and health software
Related templates	`compliance/statement-of-applicability`, `compliance/risk-methodology`, `compliance/hipaa-security-solution-design`, `compliance/dpia`, `compliance/de-identification-assessment`, `compliance/data-subject-request-procedure`, `compliance/medical-device-software-lifecycle`, `compliance/iso-14971-risk-file`, `healthcare/fhir-integration-design`, `isms/pims-27701-scope-roles`, `isms/iot-27400-security`, `isms/backup-restore-test-log`, `isms/control-evidence-matrix`, `security/sbom-vex-policy`	Linked documents

Standard and licence note

Structure aligned with ISO 27799:2025 and ISO/IEC 27001:2022 + Amd 1:2024 (clause 6.1.3 and Annex A). The register, considerations, mapping and examples are original. No text, control wording, tables or definitions from ISO or IEC standards are reproduced; the scope summary is a short paraphrase of the public catalogue description. You need your own licensed copy of ISO 27799 to fill section 5. Check the current editions before use. Official ISO text, purchase or licensed access: https://www.iso.org/standard/84647.html and https://www.iso.org/standard/82875.html. Regulatory summaries are short paraphrases; this is a documentation format, not legal advice.

Template licence: MIT.