ISO/FDIS 27799
(Main)Health informatics — Information security controls in health based on ISO/IEC 27002
Health informatics — Information security controls in health based on ISO/IEC 27002
ISO 27799:2016 gives guidelines for organizational information security standards and information security management practices including the selection, implementation and management of controls taking into consideration the organization's information security risk environment(s). It defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that International Standard. ISO 27799:2016 provides implementation guidance for the controls described in ISO/IEC 27002 and supplements them where necessary, so that they can be effectively used for managing health information security. By implementing ISO 27799:2016, healthcare organizations and other custodians of health information will be able to ensure a minimum requisite level of security that is appropriate to their organization's circumstances and that will maintain the confidentiality, integrity and availability of personal health information in their care. It applies to health information in all its aspects, whatever form the information takes (words and numbers, sound recordings, drawings, video, and medical images), whatever means are used to store it (printing or writing on paper or storage electronically), and whatever means are used to transmit it (by hand, through fax, over computer networks, or by post), as the information is always be appropriately protected. ISO 27799:2016 and ISO/IEC 27002 taken together define what is required in terms of information security in healthcare, they do not define how these requirements are to be met. That is to say, to the fullest extent possible, ISO 27799:2016 is technology-neutral. Neutrality with respect to implementing technologies is an important feature. Security technology is still undergoing rapid development and the pace of that change is now measured in months rather than years. By contrast, while subject to periodic review, International Standards are expected on the whole to remain valid for years. Just as importantly, technological neutrality leaves vendors and service providers free to suggest new or developing technologies that meet the necessary requirements that ISO 27799:2016 describes. As noted in the introduction, familiarity with ISO/IEC 27002 is indispensable to an understanding of ISO 27799:2016. The following areas of information security are outside the scope of ISO 27799:2016: a) methodologies and statistical tests for effective anonymization of personal health information; b) methodologies for pseudonymization of personal health information (see Bibliography for a brief description of a Technical Specification that deals specifically with this topic); c) network quality of service and methods for measuring availability of networks used for health informatics; d) data quality (as distinct from data integrity).
Titre manque
L'ISO 27799 :2016 donne des lignes directrices en matière de normes organisationnelles relatives à la sécurité de l'information et des bonnes pratiques de management de la sécurité de l'information, incluant la sélection, la mise en ?uvre et la gestion de mesures de sécurité prenant en compte le ou les environnement(s) à risques pour la sécurité de l'information de l'organisme. Elle spécifie des lignes directrices permettant d'interpréter et de mettre en ?uvre l'ISO/IEC 27002 dans le domaine de l'informatique de santé et constitue un complément à cette dernière. L'ISO 27799 :2016 fournit des préconisations de mise en ?uvre des mesures décrites dans l'ISO/IEC 27002 et les complète, le cas échéant, de façon à ce qu'elles puissent être utilisées efficacement dans le mangement de la sécurité des informations de santé. La mise en ?uvre de l'ISO 27799 :2016 permettra aux organismes de santé et aux autres dépositaires d'informations de santé de garantir le niveau minimal requis de sécurité approprié aux conditions de leur organisme et de protéger la confidentialité, l'intégrité et la disponibilité des informations personnelles de santé dans leurs activités de soins. L'ISO 27799 :2016 s'applique à tous les aspects des informations de santé, quelle que soit la forme (mots, chiffres, enregistrements sonores, dessins, vidéos et images médicales), le support utilisé pour les stocker (imprimés, documents manuscrits ou stockage électronique) ou les moyens mis en ?uvre pour leur transmission (en main propre, par fax, par réseau informatique ou par courrier), de sorte que l'information soit toujours correctement protégée. L'ISO 27799 :2016 et l'ISO/IEC 27002 définissent les exigences en termes de sécurité de l'information dans les soins de santé, mais elles ne définissent pas la façon de satisfaire à ces exigences. En d'autres termes, dans toute la mesure du possible, la technologie est absente de l'ISO 27799 :2016. La neutralité sur les technologies de mise en ?uvre est une caractéristique importante. La technologie en matière de sécurité continue de se développer rapidement. Le rythme de cette évolution se mesure actuellement en mois et non plus en années. En revanche, bien que les Normes internationales soient soumises à des révisions régulières, il est prévu qu'elles restent valides pendant plusieurs années. De manière également importante, la neutralité sur les technologies laisse aux fournisseurs et aux prestataires de services l'entière liberté de suggérer des technologies nouvelles ou en développement qui peuvent répondre aux exigences décrites dans l'ISO 27799 :2016. Comme mentionné dans l'introduction, la connaissance de l'ISO/IEC 27002 est indispensable à la compréhension de l'ISO 27799 :2016. Les domaines suivants de la sécurité de l'information ne relèvent pas du domaine d'application de l'ISO 27799 :2016: a) les méthodologies et les essais statistiques en vue d'une anonymisation efficace des informations personnelles de santé; b) les méthodologies en vue de la pseudonymisation des informations personnelles de santé (voir la bibliographie pour une brève description d'une Spécification technique qui traite spécifiquement de ce sujet); c) la qualité des services fournis par le réseau et les méthodes pour évaluer la disponibilité des réseaux utilisés pour l'informatique de santé; d) la qualité des données (par opposition à l'intégrité des données).
General Information
Relations
Standards Content (Sample)
FINAL DRAFT
International
Standard
ISO/TC 215
Health informatics — Information
Secretariat: ANSI
security controls in health based on
Voting begins on:
ISO/IEC 27002
2025-09-18
Voting terminates on:
2025-11-13
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
ISO/CEN PARALLEL PROCESSING LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
FINAL DRAFT
International
Standard
ISO/TC 215
Health informatics — Information
Secretariat: ANSI
security controls in health based on
Voting begins on:
ISO/IEC 27002
Voting terminates on:
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
ISO/CEN PARALLEL PROCESSING
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
ii
Contents Page
Foreword .vi
Introduction .vii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions .2
3.2 Abbreviated terms .3
4 General . 3
4.1 Structure of this document .3
4.2 Safety.3
4.3 Selecting and applying controls .4
4.3.1 Determining controls .4
4.3.2 Application of guidance .4
4.3.3 Use with ISO/IEC 27001:2022 .4
5 Organizational controls . 4
5.1 Policies for information security . .4
5.2 Information security roles and responsibilities .6
5.3 Segregation of duties.7
5.4 Management responsibilities .7
5.5 Contact with authorities .7
5.6 Contact with special interest groups . .7
5.7 Threat intelligence .7
5.8 Information security in project management .8
5.9 Inventory of information and other associated assets .8
5.10 Acceptable use of information and other associated assets .9
5.11 Return of assets .9
5.12 Classification of information .9
5.13 Labelling of information .10
5.14 Information transfer .10
5.15 Access control .11
5.16 Identity management .11
5.17 Authentication information . 12
5.18 Access rights . 12
5.19 Information security in supplier relationships . 13
5.20 Addressing information security within supplier agreements . 13
5.21 Managing information security in the ICT supply chain . 13
5.22 Monitoring, review and change management of supplier services .14
5.23 Information security for use of cloud services .14
5.24 Information security incident management planning and preparation .14
5.25 Assessment and decision on information security events .14
5.26 Response to information security incidents .14
5.27 Learning from information security incidents .14
5.28 Collection of evidence . . 15
5.29 Information security during disruption . 15
5.30 ICT readiness for business continuity . 15
5.31 Legal, statutory, regulatory and contractual requirements .16
5.32 Intellectual property rights .16
5.33 Protection of records .16
5.34 Privacy and protection of PII .16
5.35 Independent review of information security .17
5.36 Conformance with policies, rules and standards for information security .17
5.37 Documented operating procedures .18
5.38 HLT – Information security requirements analysis and specification .18
iii
5.39 HLT – Uniquely identifying subjects of care .19
5.40 HLT – Validation of displayed/printed data . 20
5.41 HLT – Publicly available health information . 20
5.42 HLT – Emergency communication .21
5.43 HLT – External incident reporting .21
6 People controls .22
6.1 Screening . 22
6.2 Terms and conditions of employment . 22
6.3 Information security awareness, education and training . 23
6.4 Disciplinary process . 23
6.5 Responsibilities after termination or change of employment. 23
6.6 Confidentiality or non-disclosure agreements .24
6.7 Remote working .
...
ISO/TC 215/ WG 4
Secretariat: ANSI
Date: 2025-07-1509-03
Health informatics — Information security controls in health based
on ISO/IEC 27002
FDIS stage
ISO/DISFDIS 27799:2025(en)
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
EmailE-mail: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/DIS 27799 2025 – All rights reserved
ii
Contents
Foreword . vi
Introduction . vii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions . 2
3.2 Abbreviated terms . 3
4 General . 3
4.1 Structure of this document . 3
4.2 Safety . 4
4.3 Selecting and applying controls . 4
5 Organizational controls . 5
5.1 Policies for information security . 5
5.2 Information security roles and responsibilities . 7
5.3 Segregation of duties . 8
5.4 Management responsibilities . 8
5.5 Contact with authorities . 8
5.6 Contact with special interest groups . 8
5.7 Threat intelligence . 8
5.8 Information security in project management . 9
5.9 Inventory of information and other associated assets . 9
5.10 Acceptable use of information and other associated assets . 10
5.11 Return of assets . 10
5.12 Classification of information . 10
5.13 Labelling of information . 11
5.14 Information transfer . 11
5.15 Access control . 12
5.16 Identity management . 13
5.17 Authentication information . 14
5.18 Access rights . 14
5.19 Information security in supplier relationships . 14
5.20 Addressing information security within supplier agreements . 15
5.21 Managing information security in the ICT supply chain . 15
5.22 Monitoring, review and change management of supplier services . 15
5.23 Information security for use of cloud services . 15
5.24 Information security incident management planning and preparation . 16
5.25 Assessment and decision on information security events . 16
5.26 Response to information security incidents . 16
5.27 Learning from information security incidents . 16
5.28 Collection of evidence . 16
5.29 Information security during disruption . 16
5.30 ICT readiness for business continuity . 17
5.31 Legal, statutory, regulatory and contractual requirements . 17
5.32 Intellectual property rights . 17
5.33 Protection of records . 17
5.34 Privacy and protection of PII . 18
5.35 Independent review of information security . 19
5.36 Conformance with policies, rules and standards for information security . 19
5.37 Documented operating procedures . 20
iii
ISO/DISFDIS 27799:2025(en)
5.38 HLT – Information security requirements analysis and specification . 20
5.39 HLT – Uniquely identifying subjects of care . 21
5.40 HLT – Validation of displayed/printed data. 22
5.41 HLT – Publicly available health information . 23
5.42 HLT – Emergency communication . 23
5.43 HLT – External incident reporting . 24
6 People controls . 25
6.1 Screening. 25
6.2 Terms and conditions of employment . 25
6.3 Information security awareness, education and training . 26
6.4 Disciplinary process . 26
6.5 Responsibilities after termination or change of employment . 26
6.6 Confidentiality or non-disclosure agreements . 27
6.7 Remote working . 27
6.8 Information security event reporting . 27
6.9 HLT – Management training . 28
7 Physical controls . 28
7.1 Physical security perimeters . 28
7.2 Physical entry . 29
7.3 Securing offices, rooms and facilities . 29
7.4 Physical security monitoring . 29
7.5 Protecting against physical and environmental threats . 29
7.6 Working in secure areas . 29
7.7 Clear desk and clear screen. 30
7.8 Equipment siting and protection . 30
7.9 Security of assets off-premises . 30
7.10 Storage media . 30
7.11 Supporting utilities . 31
7.12 Cabling security . 31
7.13 Equipment maintenance . 32
7.14 Secure disposal or re-use of equipment . 32
8 Technological controls . 33
8.1 User endpoint devices . 33
8.2 Privileged access rights . 33
8.3 Information access restriction . 33
8.4 Access to source code . 33
8.5 Secure authentication . 33
8.6 Capacity management . 34
8.7 Protection against malware . 34
8.8 Management of technical vulnerabilities . 34
8.9 Configuration management . 34
8.10 Information deletion . 35
8.11 Data masking .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.