Information Security Management system

Quantitative + qualitative risk assessment using likelihood × impact matrix (5×5). Assets classified by confidentiality, integrity, and availability. Risk appetite defined by leadership. Threat modeling follows STRIDE methodology.

Centralized risk register with 45+ identified risks. Each risk has owner, treatment plan, residual risk score, and review date. Reviewed quarterly by ISMS Manager and annually by Security Committee.

Annex A Statement of Applicability mapping maintained with justification, implementation status, and evidence references where available.

Every control has a designated owner responsible for implementation, monitoring, and evidence collection. Ownership matrix reviewed during management reviews.

Controls tested per risk-based schedule: Critical controls monthly, High quarterly, Medium semi-annually, Low annually. Testing results feed into continuous improvement register.

Full ISMS audit cycle completed annually. Each Annex A domain audited at least once per year. Auditors are independent of the areas being audited. Findings tracked to closure.

Semi-annual management review covering: ISMS performance metrics, risk treatment progress, audit findings, incident trends, resource requirements, and improvement opportunities.

Five-tier severity model (P0–P4) with defined response SLAs. HIPAA breach determination integrated. Post-incident reviews mandatory for P0–P2. Lessons learned feed risk register updates.