Agent skill

Information Security Manager Iso27001

by alirezarezvani in alirezarezvani/claude-skills

ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies.

MITAuto-check passedLegal & Compliance

Install Information Security Manager Iso27001

skills CLI
$ npx skills add alirezarezvani/claude-skills --skill information-security-manager-iso27001 -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install alirezarezvani/claude-skills information-security-manager-iso27001 --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/alirezarezvani/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/ra-qm-team/skills/information-security-manager-iso27001 .claude/skills/information-security-manager-iso27001 && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
information-security-manager-iso27001
GitHub stars
28k
Used in
1 other repo
Token cost
~2.9k tokens
SKILL.md length
934 words
Files
6 (incl. scripts, references)
Skills in repo
342
Repo updated
First seen
Licence
MIT

At a glance

ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies.

  • Works in 4 steps: Define Assets → Identify Risks → Determine Treatment → …
  • Designing an ISMS
  • SKILL.md covers Table of Contents, Trigger Phrases, Quick Start and Tools, plus 4 more sections
  • Runs Python scripts from its folder; calls python

What it does

Information Security Manager Iso27001 is an agent skill from alirezarezvani/claude-skills. ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use when designing an ISMS, running security risk assessments, implementing controls, pursuing ISO 27001 certification, preparing security audits, responding to security incidents, or verifying compliance. Covers ISO 27001, ISO 27002, healthcare security, and medical device cybersecurity.

Its SKILL.md is about 2.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts and reference files (for example `references/incident-response.md`, `references/iso27001-controls.md` and `references/risk-assessment-guide.md`).

It sits in Legal & Compliance, covering SOC 2 and security compliance. The repository describes itself as: 380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8… The licence is MIT.

When your agent uses it

  • Designing an ISMS
  • Running security risk assessments
  • Implementing controls
  • Pursuing ISO 27001 certification

Example prompts

  • “/information-security-manager-iso27001”

Requirements

  • Python 3

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Define Assets
  2. Identify Risks
  3. Determine Treatment
  4. Verify Implementation

What it can do on your machine

Read from SKILL.md and the folder at commit 19392f7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Information Security Manager Iso27001 loads about 2.9k tokens when it runs, and up to ~10k if it reads all its reference files. Until then it costs about 106 tokens; SKILL.md has 934 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~106
When it runs · the whole SKILL.md, loaded when a task matches
~2.9k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~10k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from alirezarezvani/claude-skills at commit 19392f7, republished under its MIT licence (© alirezarezvani). 934 words, ~2,923 tokens.

Download SKILL.mdSave it as .claude/skills/information-security-manager-iso27001/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
information-security-manager-iso27001
description
ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use when designing an ISMS, running security risk assessments, implementing controls, pursuing ISO 27001 certification, preparing security audits, responding to security incidents, or verifying compliance. Covers ISO 27001, ISO 27002, healthcare security, and medical device cybersecurity.

Information Security Manager - ISO 27001

Implement and manage Information Security Management Systems (ISMS) aligned with ISO 27001:2022 and healthcare regulatory requirements.


Table of Contents


Trigger Phrases

Use this skill when you hear:

  • "implement ISO 27001"
  • "ISMS implementation"
  • "security risk assessment"
  • "information security policy"
  • "ISO 27001 certification"
  • "security controls implementation"
  • "incident response plan"
  • "healthcare data security"
  • "medical device cybersecurity"
  • "security compliance audit"

Quick Start

Run Security Risk Assessment
bash
python scripts/risk_assessment.py --scope "patient-data-system" --output risk_register.json
Check Compliance Status
bash
python scripts/compliance_checker.py --standard iso27001 --controls-file controls.csv
Generate Gap Analysis Report
bash
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output gaps.md

Tools

risk_assessment.py

Automated security risk assessment following ISO 27001 Clause 6.1.2 methodology.

Usage:

bash
# Full risk assessment
python scripts/risk_assessment.py --scope "cloud-infrastructure" --output risks.json

# Healthcare-specific assessment
python scripts/risk_assessment.py --scope "ehr-system" --template healthcare --output risks.json

# Quick asset-based assessment
python scripts/risk_assessment.py --assets assets.csv --output risks.json

Parameters:

ParameterRequiredDescription
--scopeYesSystem or area to assess
--templateNoAssessment template: general, healthcare, cloud
--assetsNoCSV file with asset inventory
--outputNoOutput file (default: stdout)
--formatNoOutput format: json, csv, markdown

Output:

  • Asset inventory with classification
  • Threat and vulnerability mapping
  • Risk scores (likelihood × impact)
  • Treatment recommendations
  • Residual risk calculations
compliance_checker.py

Verify ISO 27001/27002 control implementation status.

Usage:

bash
# Check all ISO 27001 controls
python scripts/compliance_checker.py --standard iso27001

# Gap analysis with recommendations
python scripts/compliance_checker.py --standard iso27001 --gap-analysis

# Check specific control domains
python scripts/compliance_checker.py --standard iso27001 --domains "access-control,cryptography"

# Export compliance report
python scripts/compliance_checker.py --standard iso27001 --output compliance_report.md

Parameters:

ParameterRequiredDescription
--standardYesStandard to check: iso27001, iso27002, hipaa
--controls-fileNoCSV with current control status
--gap-analysisNoInclude remediation recommendations
--domainsNoSpecific control domains to check
--outputNoOutput file path

Output:

  • Control implementation status
  • Compliance percentage by domain
  • Gap analysis with priorities
  • Remediation recommendations

Workflows

Workflow 1: ISMS Implementation

Step 1: Define Scope and Context

Document organizational context and ISMS boundaries:

  • Identify interested parties and requirements
  • Define ISMS scope and boundaries
  • Document internal/external issues

Validation: Scope statement reviewed and approved by management.

Step 2: Conduct Risk Assessment

bash
python scripts/risk_assessment.py --scope "full-organization" --template general --output initial_risks.json
  • Identify information assets
  • Assess threats and vulnerabilities
  • Calculate risk levels
  • Determine risk treatment options

Validation: Risk register contains all critical assets with assigned owners.

Step 3: Select and Implement Controls

Map risks to ISO 27002 controls:

bash
python scripts/compliance_checker.py --standard iso27002 --gap-analysis --output control_gaps.md

Control categories:

  • Organizational (policies, roles, responsibilities)
  • People (screening, awareness, training)
  • Physical (perimeters, equipment, media)
  • Technological (access, crypto, network, application)

Validation: Statement of Applicability (SoA) documents all controls with justification.

Step 4: Establish Monitoring

Define security metrics:

  • Incident count and severity trends
  • Control effectiveness scores
  • Training completion rates
  • Audit findings closure rate

Validation: Dashboard shows real-time compliance status.

Workflow 2: Security Risk Assessment

Step 1: Asset Identification

Create asset inventory:

Asset TypeExamplesClassification
InformationPatient records, source codeConfidential
SoftwareEHR system, APIsCritical
HardwareServers, medical devicesHigh
ServicesCloud hosting, backupHigh
PeopleAdmin accounts, developersVaries

Validation: All assets have assigned owners and classifications.

Step 2: Threat Analysis

Identify threats per asset category:

AssetThreatsLikelihood
Patient dataUnauthorized access, breachHigh
Medical devicesMalware, tamperingMedium
Cloud servicesMisconfiguration, outageMedium
CredentialsPhishing, brute forceHigh

Validation: Threat model covers top-10 industry threats.

Step 3: Vulnerability Assessment

bash
python scripts/risk_assessment.py --scope "network-infrastructure" --output vuln_risks.json

Document vulnerabilities:

  • Technical (unpatched systems, weak configs)
  • Process (missing procedures, gaps)
  • People (lack of training, insider risk)

Validation: Vulnerability scan results mapped to risk register.

Step 4: Risk Evaluation and Treatment

Calculate risk: Risk = Likelihood × Impact

Risk LevelScoreTreatment
Critical20-25Immediate action required
High15-19Treatment plan within 30 days
Medium10-14Treatment plan within 90 days
Low5-9Accept or monitor
Minimal1-4Accept

Validation: All high/critical risks have approved treatment plans.

Show full SKILL.md (418 more words)Show less
Workflow 3: Incident Response

Step 1: Detection and Reporting

Incident categories:

  • Security breach (unauthorized access)
  • Malware infection
  • Data leakage
  • System compromise
  • Policy violation

Validation: Incident logged within 15 minutes of detection.

Step 2: Triage and Classification

SeverityCriteriaResponse Time
CriticalData breach, system downImmediate
HighActive threat, significant risk1 hour
MediumContained threat, limited impact4 hours
LowMinor violation, no impact24 hours

Validation: Severity assigned and escalation triggered if needed.

Step 3: Containment and Eradication

Immediate actions:

  1. Isolate affected systems
  2. Preserve evidence
  3. Block threat vectors
  4. Remove malicious artifacts

Validation: Containment confirmed, no ongoing compromise.

Step 4: Recovery and Lessons Learned

Post-incident activities:

  1. Restore systems from clean backups
  2. Verify integrity before reconnection
  3. Document timeline and actions
  4. Conduct post-incident review
  5. Update controls and procedures

Validation: Post-incident report completed within 5 business days.


Reference Guides

When to Use Each Reference

references/iso27001-controls.md

  • Control selection for SoA
  • Implementation guidance
  • Evidence requirements
  • Audit preparation

references/risk-assessment-guide.md

  • Risk methodology selection
  • Asset classification criteria
  • Threat modeling approaches
  • Risk calculation methods

references/incident-response.md

  • Response procedures
  • Escalation matrices
  • Communication templates
  • Recovery checklists

Validation Checkpoints

ISMS Implementation Validation
PhaseCheckpointEvidence Required
ScopeScope approvedSigned scope document
RiskRegister completeRisk register with owners
ControlsSoA approvedStatement of Applicability
OperationMetrics activeDashboard screenshots
AuditInternal audit doneAudit report
Certification Readiness

Before Stage 1 audit:

  • ISMS scope documented and approved
  • Information security policy published
  • Risk assessment completed
  • Statement of Applicability finalized
  • Internal audit conducted
  • Management review completed
  • Nonconformities addressed

Before Stage 2 audit:

  • Controls implemented and operational
  • Evidence of effectiveness available
  • Staff trained and aware
  • Incidents logged and managed
  • Metrics collected for 3+ months
Compliance Verification

Run periodic checks:

bash
# Monthly compliance check
python scripts/compliance_checker.py --standard iso27001 --output monthly_$(date +%Y%m).md

# Quarterly gap analysis
python scripts/compliance_checker.py --standard iso27001 --gap-analysis --output quarterly_gaps.md

Worked Example: Healthcare Risk Assessment

Scenario: Assess security risks for a patient data management system.

Step 1: Define Assets
bash
python scripts/risk_assessment.py --scope "patient-data-system" --template healthcare

Asset inventory output:

Asset IDAssetTypeOwnerClassification
A001Patient databaseInformationDBA TeamConfidential
A002EHR applicationSoftwareApp TeamCritical
A003Database serverHardwareInfra TeamHigh
A004Admin credentialsAccessSecurityCritical
Step 2: Identify Risks

Risk register output:

Risk IDAssetThreatVulnerabilityLIScore
R001A001Data breachWeak encryption3515
R002A002SQL injectionInput validation4416
R003A004Credential theftNo MFA4520
Step 3: Determine Treatment
RiskTreatmentControlTimeline
R001MitigateImplement AES-256 encryption30 days
R002MitigateAdd input validation, WAF14 days
R003MitigateEnforce MFA for all admins7 days
Step 4: Verify Implementation
bash
python scripts/compliance_checker.py --controls-file implemented_controls.csv

Verification output:

Control Implementation Status
=============================
Cryptography (A.8.24): IMPLEMENTED
  - AES-256 at rest: YES
  - TLS 1.3 in transit: YES

Access Control (A.8.5): IMPLEMENTED
  - MFA enabled: YES
  - Admin accounts: 100% coverage

Application Security (A.8.26): PARTIAL
  - Input validation: YES
  - WAF deployed: PENDING

Overall Compliance: 87%

© alirezarezvani, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (scripts, references) in ra-qm-team/skills/information-security-manager-iso27001 of alirezarezvani/claude-skills.

  • SKILL.md
  • references/incident-response.md
  • references/iso27001-controls.md
  • references/risk-assessment-guide.md
  • scripts/compliance_checker.py
  • scripts/risk_assessment.py

Open the folder on GitHubat commit 19392f7

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in alirezarezvani/claude-skills, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Information Security Manager Iso27001 next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Information Security Manager Iso27001 compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Information Security Manager Iso27001 this skillalirezarezvani/claude-skills28k1 repos~2.9kAutomated safety check: PassMIT
Nist 800 53Sushegaad/Claude-Skills-Governance-Risk-and-Compliance9461 repos~3.3kAutomated safety check: PassMIT
Soc2Sushegaad/Claude-Skills-Governance-Risk-and-Compliance9461 repos~2.7kAutomated safety check: PassMIT
Grc Knowledgemlunato47/claude-grc-plugin184—~6.1kAutomated safety check: PassMIT
Information Security Manager Iso27001davila7/claude-code-templates33k1 repos~2.9kAutomated safety check: PassMIT
Audit Frameworkscartography-cncf/cartography4.1k—~2.8kAutomated safety check: PassApache-2.0

Similar skills

  • Nist 800 53

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…

    946 GitHub starsUsed in 1 repo~3.3k tokens
    Legal & ComplianceAuto-check passed
  • Soc2

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P).

    946 GitHub starsUsed in 1 repo~2.7k tokens
    Legal & ComplianceAuto-check passed
  • Grc Knowledge

    mlunato47/claude-grc-plugin

    Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…

    184 GitHub stars~6.1k tokensUpdated 4 days ago
    Legal & ComplianceAuto-check passed
  • Information Security Manager Iso27001

    davila7/claude-code-templates

    Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies.

    33k GitHub starsUsed in 1 repo~2.9k tokens
    Legal & ComplianceAuto-check passed
  • Audit Frameworks

    cartography-cncf/cartography

    Audit Cartography's rules and compliance frameworks under cartography/rules/data/rules/.

    4.1k GitHub stars~2.8k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed
  • Trust Center Builder

    GRCEngClub/claude-grc-engineering

    Builds and deploys a serverless trust center that publishes a company's compliance posture, with gated access to audit reports and an admin dashboard.

    419 GitHub stars~2.6k tokensUpdated 6 days ago
    Legal & ComplianceAuto-check passed

More from alirezarezvani/claude-skills

All 342 skills in this repo
  • Agile Product Owner

    alirezarezvani/claude-skills

    Writes INVEST-checked user stories with acceptance criteria, splits epics, plans sprints from velocity and ranks the backlog with a weighted score.

    28k GitHub starsUsed in 3 repos~3.2k tokens
    Auto-check passed
  • Product Strategist

    alirezarezvani/claude-skills

    OKR cascade toolkit for product leaders: generates aligned company-to-team OKRs from five strategy types and scores how well they line up.

    28k GitHub starsUsed in 2 repos~1.8k tokens
    Auto-check passed
  • App Store Optimization

    alirezarezvani/claude-skills

    App Store Optimization (ASO) toolkit for researching keywords, analyzing competitor rankings, generating metadata suggestions, and improving app visibility on Apple App Store and Google Play Store.

    28k GitHub starsUsed in 1 repo~4.2k tokens
    Auto-check passed
  • AWS Solution Architect

    alirezarezvani/claude-skills

    Design AWS architectures for startups using serverless patterns and IaC templates.

    28k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed
  • Campaign Analytics

    alirezarezvani/claude-skills

    Calculates attribution, funnel and ROI figures for marketing campaigns with three Python scripts that need only the standard library.

    28k GitHub starsUsed in 1 repo~2.1k tokens
    Auto-check passed
  • Code to PRD

    alirezarezvani/claude-skills

    Reverse-engineers a frontend, backend or fullstack codebase into a product requirements document with per-page docs, an enum dictionary and an API inventory.

    28k GitHub starsUsed in 1 repo~4.9k tokens
    Auto-check passed

Questions about Information Security Manager Iso27001

What does Information Security Manager Iso27001 do?

ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Information Security Manager Iso27001 is an agent skill from alirezarezvani/claude-skills. ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies.

When should I use Information Security Manager Iso27001?

Information Security Manager Iso27001 fits situations like: designing an ISMS; running security risk assessments; implementing controls; pursuing ISO 27001 certification.

How do I install Information Security Manager Iso27001 in Claude Code?

Run `npx skills add alirezarezvani/claude-skills --skill information-security-manager-iso27001 -a claude-code`. Or copy the skill folder (ra-qm-team/skills/information-security-manager-iso27001 in alirezarezvani/claude-skills) into .claude/skills/information-security-manager-iso27001 in your project. Claude Code loads it when a task matches its description.

How do I install Information Security Manager Iso27001 in Codex?

Run `npx skills add alirezarezvani/claude-skills --skill information-security-manager-iso27001 -a codex`. Or copy the skill folder (ra-qm-team/skills/information-security-manager-iso27001 in alirezarezvani/claude-skills) into .agents/skills/information-security-manager-iso27001 in your project. Codex loads it when a task matches its description.

Can I use Information Security Manager Iso27001 in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add alirezarezvani/claude-skills --skill information-security-manager-iso27001 -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/information-security-manager-iso27001, .gemini/skills/information-security-manager-iso27001, .github/skills/information-security-manager-iso27001 and .opencode/skills/information-security-manager-iso27001 in your project.

What does Information Security Manager Iso27001 need to run?

Going by SKILL.md and its folder, Information Security Manager Iso27001 needs Python for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3.

Does Information Security Manager Iso27001 access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Information Security Manager Iso27001 safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Information Security Manager Iso27001 use?

Information Security Manager Iso27001 is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Information Security Manager Iso27001 use?

About 2.9k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 7.3k tokens, read only when the agent opens those files.

What are the alternatives to Information Security Manager Iso27001?

Skills that share tags, products or a category with Information Security Manager Iso27001: Nist 800 53 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Soc2 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Grc Knowledge (mlunato47/claude-grc-plugin, 184 stars) and Information Security Manager Iso27001 (davila7/claude-code-templates, 33k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Information Security Manager Iso27001?

alirezarezvani (a GitHub user) maintains it in alirezarezvani/claude-skills, which has 27,938 GitHub stars. The repository holds 342 skills in this directory. The repository was last updated on August 30, 2026.

Source: alirezarezvani/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.