mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
86 lines
1.6 KiB
Markdown
86 lines
1.6 KiB
Markdown
---
|
|
name: iso27001-compliance
|
|
description: Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.
|
|
license: MIT
|
|
metadata:
|
|
author: devops-skills
|
|
version: "1.0"
|
|
---
|
|
|
|
# ISO 27001 Compliance
|
|
|
|
Implement ISO 27001 Information Security Management System.
|
|
|
|
## ISMS Framework
|
|
|
|
```yaml
|
|
plan_do_check_act:
|
|
plan:
|
|
- Define scope
|
|
- Risk assessment
|
|
- Risk treatment plan
|
|
- Statement of Applicability
|
|
|
|
do:
|
|
- Implement controls
|
|
- Security awareness
|
|
- Document procedures
|
|
|
|
check:
|
|
- Internal audits
|
|
- Management review
|
|
- Performance measurement
|
|
|
|
act:
|
|
- Corrective actions
|
|
- Continual improvement
|
|
```
|
|
|
|
## Annex A Controls
|
|
|
|
```yaml
|
|
control_domains:
|
|
A.5: Information security policies
|
|
A.6: Organization of information security
|
|
A.7: Human resource security
|
|
A.8: Asset management
|
|
A.9: Access control
|
|
A.10: Cryptography
|
|
A.11: Physical security
|
|
A.12: Operations security
|
|
A.13: Communications security
|
|
A.14: System acquisition/development
|
|
A.15: Supplier relationships
|
|
A.16: Incident management
|
|
A.17: Business continuity
|
|
A.18: Compliance
|
|
```
|
|
|
|
## Risk Assessment
|
|
|
|
```yaml
|
|
risk_assessment:
|
|
identify:
|
|
- Asset inventory
|
|
- Threat identification
|
|
- Vulnerability assessment
|
|
|
|
analyze:
|
|
- Likelihood rating
|
|
- Impact rating
|
|
- Risk calculation
|
|
|
|
evaluate:
|
|
- Risk acceptance criteria
|
|
- Prioritization
|
|
- Treatment options
|
|
```
|
|
|
|
## Best Practices
|
|
|
|
- Management commitment
|
|
- Risk-based approach
|
|
- Document everything
|
|
- Regular internal audits
|
|
- Continuous improvement
|