ISO 27799
(Main)Health informatics — Information security controls in health based on ISO/IEC 27002
Health informatics — Information security controls in health based on ISO/IEC 27002
ISO 27799:2016 gives guidelines for organizational information security standards and information security management practices including the selection, implementation and management of controls taking into consideration the organization's information security risk environment(s). It defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that International Standard. ISO 27799:2016 provides implementation guidance for the controls described in ISO/IEC 27002 and supplements them where necessary, so that they can be effectively used for managing health information security. By implementing ISO 27799:2016, healthcare organizations and other custodians of health information will be able to ensure a minimum requisite level of security that is appropriate to their organization's circumstances and that will maintain the confidentiality, integrity and availability of personal health information in their care. It applies to health information in all its aspects, whatever form the information takes (words and numbers, sound recordings, drawings, video, and medical images), whatever means are used to store it (printing or writing on paper or storage electronically), and whatever means are used to transmit it (by hand, through fax, over computer networks, or by post), as the information is always be appropriately protected. ISO 27799:2016 and ISO/IEC 27002 taken together define what is required in terms of information security in healthcare, they do not define how these requirements are to be met. That is to say, to the fullest extent possible, ISO 27799:2016 is technology-neutral. Neutrality with respect to implementing technologies is an important feature. Security technology is still undergoing rapid development and the pace of that change is now measured in months rather than years. By contrast, while subject to periodic review, International Standards are expected on the whole to remain valid for years. Just as importantly, technological neutrality leaves vendors and service providers free to suggest new or developing technologies that meet the necessary requirements that ISO 27799:2016 describes. As noted in the introduction, familiarity with ISO/IEC 27002 is indispensable to an understanding of ISO 27799:2016. The following areas of information security are outside the scope of ISO 27799:2016: a) methodologies and statistical tests for effective anonymization of personal health information; b) methodologies for pseudonymization of personal health information (see Bibliography for a brief description of a Technical Specification that deals specifically with this topic); c) network quality of service and methods for measuring availability of networks used for health informatics; d) data quality (as distinct from data integrity).
Informatique de santé — Contrôles de sécurité de l'information dans le domaine de la santé basés sur l'ISO/IEC 27002
L'ISO 27799 :2016 donne des lignes directrices en matière de normes organisationnelles relatives à la sécurité de l'information et des bonnes pratiques de management de la sécurité de l'information, incluant la sélection, la mise en ?uvre et la gestion de mesures de sécurité prenant en compte le ou les environnement(s) à risques pour la sécurité de l'information de l'organisme. Elle spécifie des lignes directrices permettant d'interpréter et de mettre en ?uvre l'ISO/IEC 27002 dans le domaine de l'informatique de santé et constitue un complément à cette dernière. L'ISO 27799 :2016 fournit des préconisations de mise en ?uvre des mesures décrites dans l'ISO/IEC 27002 et les complète, le cas échéant, de façon à ce qu'elles puissent être utilisées efficacement dans le mangement de la sécurité des informations de santé. La mise en ?uvre de l'ISO 27799 :2016 permettra aux organismes de santé et aux autres dépositaires d'informations de santé de garantir le niveau minimal requis de sécurité approprié aux conditions de leur organisme et de protéger la confidentialité, l'intégrité et la disponibilité des informations personnelles de santé dans leurs activités de soins. L'ISO 27799 :2016 s'applique à tous les aspects des informations de santé, quelle que soit la forme (mots, chiffres, enregistrements sonores, dessins, vidéos et images médicales), le support utilisé pour les stocker (imprimés, documents manuscrits ou stockage électronique) ou les moyens mis en ?uvre pour leur transmission (en main propre, par fax, par réseau informatique ou par courrier), de sorte que l'information soit toujours correctement protégée. L'ISO 27799 :2016 et l'ISO/IEC 27002 définissent les exigences en termes de sécurité de l'information dans les soins de santé, mais elles ne définissent pas la façon de satisfaire à ces exigences. En d'autres termes, dans toute la mesure du possible, la technologie est absente de l'ISO 27799 :2016. La neutralité sur les technologies de mise en ?uvre est une caractéristique importante. La technologie en matière de sécurité continue de se développer rapidement. Le rythme de cette évolution se mesure actuellement en mois et non plus en années. En revanche, bien que les Normes internationales soient soumises à des révisions régulières, il est prévu qu'elles restent valides pendant plusieurs années. De manière également importante, la neutralité sur les technologies laisse aux fournisseurs et aux prestataires de services l'entière liberté de suggérer des technologies nouvelles ou en développement qui peuvent répondre aux exigences décrites dans l'ISO 27799 :2016. Comme mentionné dans l'introduction, la connaissance de l'ISO/IEC 27002 est indispensable à la compréhension de l'ISO 27799 :2016. Les domaines suivants de la sécurité de l'information ne relèvent pas du domaine d'application de l'ISO 27799 :2016: a) les méthodologies et les essais statistiques en vue d'une anonymisation efficace des informations personnelles de santé; b) les méthodologies en vue de la pseudonymisation des informations personnelles de santé (voir la bibliographie pour une brève description d'une Spécification technique qui traite spécifiquement de ce sujet); c) la qualité des services fournis par le réseau et les méthodes pour évaluer la disponibilité des réseaux utilisés pour l'informatique de santé; d) la qualité des données (par opposition à l'intégrité des données).
General Information
Relations
Standards Content (Sample)
FINAL DRAFT
International
Standard
ISO/FDIS 27799
ISO/TC 215
Health informatics — Information
Secretariat: ANSI
security controls in health based on
Voting begins on:
ISO/IEC 27002
2025-09-18
Voting terminates on:
2025-11-13
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
ISO/CEN PARALLEL PROCESSING LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
ISO/FDIS 27799:2025(en) © ISO 2025
FINAL DRAFT
ISO/FDIS 27799:2025(en)
International
Standard
ISO/FDIS 27799
ISO/TC 215
Health informatics — Information
Secretariat: ANSI
security controls in health based on
Voting begins on:
ISO/IEC 27002
Voting terminates on:
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
ISO/CEN PARALLEL PROCESSING
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
ISO/FDIS 27799:2025(en) © ISO 2025
ii
ISO/FDIS 27799:2025(en)
Contents Page
Foreword .vi
Introduction .vii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions .2
3.2 Abbreviated terms .3
4 General . 3
4.1 Structure of this document .3
4.2 Safety.3
4.3 Selecting and applying controls .4
4.3.1 Determining controls .4
4.3.2 Application of guidance .4
4.3.3 Use with ISO/IEC 27001:2022 .4
5 Organizational controls . 4
5.1 Policies for information security . .4
5.2 Information security roles and responsibilities .6
5.3 Segregation of duties.7
5.4 Management responsibilities .7
5.5 Contact with authorities .7
5.6 Contact with special interest groups . .7
5.7 Threat intelligence .7
5.8 Information security in project management .8
5.9 Inventory of information and other associated assets .8
5.10 Acceptable use of information and other associated assets .9
5.11 Return of assets .9
5.12 Classification of information .9
5.13 Labelling of information .10
5.14 Information transfer .10
5.15 Access control .11
5.16 Identity management .11
5.17 Authentication information . 12
5.18 Access rights . 12
5.19 Information security in supplier relationships . 13
5.20 Addressing information security within supplier agreements . 13
5.21 Managing information security in the ICT supply chain . 13
5.22 Monitoring, review and change management of supplier services .14
5.23 Information security for use of cloud services .14
5.24 Information security incident management planning and preparation .14
5.25 Assessment and decision on information security events .14
5.26 Response to information security incidents .14
5.27 Learning from information security incidents .14
5.28 Collection of evidence . . 15
5.29 Information security during disruption . 15
5.30 ICT readiness for business continuity . 15
5.31 Legal, statutory, regulatory and contractual requirements .16
5.32 Intellectual property rights .16
5.33 Protection of records .16
5.34 Privacy and protection of PII .16
5.35 Independent review of information security .17
5.36 Conformance with policies, rules and standards for information security .17
5.37 Documented operating procedures .18
5.38 HLT – Information security requirements analysis and specification .18
iii
ISO/FDIS 27799:2025(en)
5.39 HLT – Uniquely identifying subjects of care .19
5.40 HLT – Validation of displayed/printed data . 20
5.41 HLT – Publicly available health information . 20
5.42 HLT – Emergency communication .21
5.43 HLT – External incident reporting .21
6 People controls .22
6.1 Screening . 22
6.2 Terms and conditions of employment . 22
6.3 Information security awareness, education and training . 23
6.4 Disciplinary process . 23
6.5 Responsibilities after termination or change of employment. 23
6.6 Confidentiality or non-disclosure agreements .24
6.7 Remote working .24
6.8 Information security event reporting.24
6.9 HLT – Management training . 25
7 Physical controls .25
7.1 Physical security perimeters . 25
7.2 Physical entry . 26
7.3 Securing offices, rooms and facilities . 26
7.4 Physical security monitoring . . 26
7.5 Protecting against physical and environmental threats . 26
7.6 Working in secure areas . 26
7.7 Clear desk and clear screen . 26
7.8 Equipment siting and protection .27
7.9 Security of assets off-premises .27
7.10 Storage media .27
7.11 Supporting utilities . 28
7.12 Cabling security . 28
7.13 Equipment maintenance . 28
7.14 Secure disposal or re-use of equipment . 29
8 Technological controls .29
8.1 User endpoint devices . 29
8.2 Privileged access rights . 29
8.3 Information access restriction . 29
8.4 Access to source code . 29
8.5 Secure authentication . 30
8.6 Capacity management . 30
8.7 Protection against malware . 30
8.8 Management of technical vulnerabilities . 30
8.9 Configuration management .31
8.10 Information deletion .31
8.11 Data masking .32
8.12 Data leakage prevention .32
8.13 Information backup.32
8.14 Redundancy of information processing facilities .32
8.15 Logging .32
8.16 Monitoring activities .32
8.17 Clock synchronization . 33
8.18 Use of privileged utility programs . 33
8.19 Installation of software on operational systems . 33
8.20 Networks security . 33
8.21 Security of network services . 33
8.22 Segregation of networks . 33
8.23 Web filtering . 34
8.24 Use of cryptography . 34
8.25 Secure development life cycle . 34
8.26 Application security requirements . 34
iv
ISO/FDIS 27799:2025(en)
8.27 Secure system architecture and engineering principles . 34
8.28 Secure coding. 34
8.29 Security testing in development and acceptance . 35
8.30 Outsourced development . 35
8.31 Separation of development, test and production environments. 35
8.32 Change management . 35
8.33 Test information . 35
8.34 Protection of information systems during audit testing . 35
8.35 HLT – Zero trust principles. 36
Annex A (informative) Information security controls for health reference .37
Annex B (informative) Correspondence of this document with ISO 27799:2016 .39
Annex C (informative) Information security in health organizations .40
Annex D (informative) Example security and privacy requirements for health information
systems and their mapping to the ISO 27799 controls and IEC/TS 81001-2-2 security
capabilities . 51
Bibliography . 74
v
ISO/FDIS 27799:2025(en)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO’s adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 215, Health informatics, in collaboration with
the European Committee for Standardization (CEN) Technical Committee CEN/TC 251, Health informatics, in
accordance with the Agreement on technical cooperation between ISO and CEN (Vienna Agreement).
This third edition cancels and replaces ISO 27799:2016 and ISO/TS 14441:2013, which have been technically
revised.
The main changes are as follows:
— alignment with the new structure of ISO/IEC 27002:2022 and other changes to that standard from the
previous version;
— revision and addition of controls specific to health;
— removal of material that was originally only in the second edition of this document but was subsequently
included in ISO/IEC 27002:2022;
— addition of informative Annexes providing supplementary guidance on cybersecurity in health
organizations and example security and privacy requirements for health information systems.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
vi
ISO/FDIS 27799:2025(en)
Introduction
0.1 General
This document contains a set of information security controls for health organizations. It considers all the
controls in ISO/IEC 27002:2022 and, in some cases, supplements the controls or provides guidance on their
application in health. There are also some additional controls specific to health which are not derived from
any in ISO/IEC 27002:2022.
0.2 Context and background
Factors that affect information security in healthcare include the following:
a) Use of equipment that relies on digital technologies for its operation and is deployed exclusively or
predominantly in the healthcare domain. Medical devices incorporating health software are the prime
example.
b) The need to balance clinical safety and effectiveness with information security.
c) Maintaining the privacy of subjects of care while ensuring access to relevant personal health information
for diagnosis and treatment.
d) The distributed nature of personal health information both within and between organizations (possibly
in different jurisdictions) resulting in the need for high levels of interoperability between diverse
systems, applications and devices.
e) Users of many different kinds including doctors, nurses, other clinicians, trainees, students, healthcare
assistants, technicians, administrative staff and volunteers as well as subjects of care and their proxies.
f) The multiple interdependencies and information flows between and within organizations responsible
for one or more of: healthcare, clinical research, teaching, education and training.
g) The need for some healthcare services to be available on a continuous basis (24 hours a day every day)
under normal circumstances. In addition, natural disasters and other unusual events that can lead to
surges in demand for healthcare services.
h) Organizations providing health services as well as manufacturers or suppliers of systems, devices and
equipment are all subject to a wide range of legal, statutory, regulatory and contractual requirements
which can vary between jurisdictions.
i) Overlapping or incomplete requirements for accountability and professional responsibility between
different professions (such as ICT and medical devices staff) for ensuring security and safety of systems,
devices and equipment.
Given this overall context, healthcare has a number of sector-specific, if not unique, information security
requirements. However, the controls in ISO/IEC 27002:2022 are intentionally generic, hence the need for
this document.
0.3 Audience and uses
This document is targeted at organizations that:
— provide healthcare services or are custodians of personal health information for other reasons;
— supply software, systems, devices, equipment or services that are used to process personal health
information;
— are responsible for healthcare regulation, accreditation, inspection, assurance or similar.
Individuals for whom this document is particularly relevant include:
— ICT and medical devices or equipment professionals working in the types of organizations listed above;
vii
ISO/FDIS 27799:2025(en)
— information security professionals (particularly those unfamiliar with the health domain): these
professionals can include consultants, penetration testers, auditors and those working for bodies that
provide accreditation, inspection, assurance or certification services for information security.
Appropriate implementation of the controls in this document can provide assurance to individuals, including
subjects of care, their proxies and members of an organization’s workforce. Appropriate implementation
can also provide assurance to a wide range of stakeholder bodies including management and governance
boards of healthcare organizations, other healthcare organizations with which information is exchanged or
shared, public authorities, regulators, auditors, and organizations that finance, insure, accredit or inspect
healthcare services.
This document can be used in healthcare settings when determining and implementing controls for an
information security management system (ISMS) conformant to ISO/IEC 27001.
viii
FINAL DRAFT International Standard ISO/FDIS 27799:2025(en)
Health informatics — Information security controls in health
based on ISO/IEC 27002
1 Scope
This document provides information security controls, including implementation guidance, for health
organizations. It is based on ISO/IEC 27002:2022
In addition to generic ICT equipment and software used in many other environments, the scope of this
document includes software and systems specifically for healthcare, such as electronic health record
systems and medical devices incorporating health software. Such medical devices can be programmed or
programmable and can contain software, firmware or both.
Other digital equipment (such as that for environmental and infection control, building management, and
physical security), which can be used in premises where healthcare is provided, is also in scope.
This document applies to information in all its aspects, whatever form the information takes (including text
and numbers, sound recordings, drawings, images and video), by whatever means it has been acquired or
captured, whatever means are used to store it (such as printing or writing on paper or storage electronically),
and whatever means are used to transfer or exchange it (orally, by hand, by post, movement of storage media,
direct links or networking).
This document is for organizations of all types and sizes that provide healthcare or are custodians of personal
health information for other reasons. The information that they are responsible for can be stored and
processed in many possible ways and locations, including on premises or in the cloud, but remains in scope.
This document applies to all physical settings where healthcare is intended to be delivered, such as hospitals,
clinics and other locations or facilities designated for healthcare purposes such as ambulances and mobile
imaging or diagnostic units. It also applies to care provided elsewhere, such as in residential premises. In
addition to the range of settings, this document applies to all methods of service provision including remote
or virtual healthcare.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security
controls
ISO 81001-1, Health software and health IT systems safety, effectiveness and security — Part 1: Principles and
concepts
3 Terms, definitions and abbreviated terms
For the purposes of this document, the terms and definitions given in ISO/IEC 27002:2022, ISO 81001-1 and
the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
ISO/FDIS 27799:2025(en)
3.1 Terms and definitions
3.1.1
health
complete physical, mental and social well-being
Note 1 to entry: Health is not merely the absence of disease or infirmity.
1)
Note 2 to entry: Adapted from World Health Organization .
3.1.2
health software
software intended to be used specifically for managing, maintaining, or improving health (3.1.1) of individual
persons, or the delivery of care, or which has been developed for the purpose of being incorporated into a
medical device
Note 1 to entry: Health software fully includes what is considered software as a medical device.
[SOURCE: ISO 81001-1:2021, 3.3.9]
3.1.3
healthcare
care activities, services, management or supplies related to the health (3.1.1) of an individual
3.1.4
personal health information
information about an identifiable person that relates to the physical or mental health (3.1.1) of the individual
or to provision of health services to the individual
Note 1 to entry: Personal health information can include the following:
a) information about the registration of the individual for the provision of health services;
b) information about payments or eligibility for healthcare in respect to the individual;
c) a number, symbol, or particular assigned to an individual to uniquely identify the individual for health purposes;
d) any information about the individual that is collected in the course of the provision of health services to the
individual;
e) information derived from the testing or examination of a body part or bodily substance;
f) identification of a person (for instance a health professional) as a provider of healthcare to the individual.
Note 2 to entry: Personal health information does not include information that, either by itself or when combined with
other information available to the holder, is anonymised.
Note 3 to entry: Personal health information is a subset of personally identifiable information (PII).
[SOURCE: ISO/TS 17975:2022, 3.21, modified — Note 3 to entry was added.]
3.1.5
proxy
subject of care proxy
person with the right to take decisions on behalf of the subject of care (3.1.6)
EXAMPLE 1 Parents of children who are not yet adults.
EXAMPLE 2 Guardians of adults with learning disabilities or lacking mental capacity.
Note 1 to entry: Adapted from ISO 13940:2015, 5.2.4.3.
1) https:// www .who .int/ about/ governance/ constitution.
ISO/FDIS 27799:2025(en)
3.1.6
subject of care
person who seeks to receive, is receiving, or has received healthcare (3.1.3)
Note 1 to entry: Adapted from ISO 13940:2015, 5.2.1.
3.2 Abbreviated terms
HLT health
ICT information and communication technology
ISMS information security management system
PII personally identifiable information
4 General
4.1 Structure of this document
This document adopts the structure of ISO/IEC 27002:2022, Clauses 5 to 8 and lists all the control titles in
that standard. Using that framework, this document:
a) indicates which controls (including their purposes, guidance and any other information) in
ISO/IEC 27002:2022 apply unchanged in health;
b) for certain controls in ISO/IEC 27002:2022, provides guidance, other information, or both on how to
apply the controls in health;
c) for the remaining controls in ISO/IEC 27002:2022, supplements what each control is, its purpose and
guidance. Other information for health is also provided in some of these instances;
d) specifies controls that are specific to health and that are not based on any existing controls in
ISO/IEC 27002:2022. These additional controls have the same layout as the controls in ISO/IEC 27002
and the control titles are prefixed with “HLT” (for HeaLTh).
In relation to ISO/IEC 27002:2022, controls in c) and d) are supplementary and additional respectively.
This document contains 4 Annexes:
— Annex A is a reference list of the controls specific to health, namely those under c) and d). Annex A also
complements ISO/IEC 27001:2022, Annex A.
— Annex B provides a mapping table showing the correspondence of the HLT controls in this document
with controls in ISO 27799:2016. It provides support for the transition between the two editions and
complements ISO/IEC 27002:2022, Annex B.
— Annex C provides information on aspects of healthcare that are of particular importance in the context
of information security.
— Annex D provides example requirements for the development and acquisition of health IT systems and a
mapping to MDS2 (manufacturer disclosure statement for medical device security).
4.2 Safety
Security, safety and health information system effectiveness are interdependent. This should always be
taken into account when assessing and managing risks and their risk control measures. For example, a risk
that systems or data will not be available at the point-of-care is not just a security risk; it can have significant
impact on safety if decision making about care is compromised. In turn, this can impact the effectiveness of
the health system.
ISO/FDIS 27799:2025(en)
A consequence of the interdependence of security, safety and effectiveness is that well-intended risk control
measures can, in some instances, adversely impact one or both of the other properties. For instance, adding
controls to reduce the risk resulting from unauthorized access can impact system usability and availability and
hence compromise system effectiveness. It can also result in system workarounds that adversely impact safety.
Safety should be taken into account in all aspects of information security management in health, including
the selection and application of controls. Accordingly, any impacts on safety should be considered when
implementing controls in this document.
4.3 Selecting and applying controls
4.3.1 Determining controls
Determining controls is dependent on the organization’s decisions following a risk assessment with a clearly
defined scope. Decisions related to identified risks should be based on the criteria for risk acceptance, risk
treatment options and the risk management approach applied by the organization. The determination
of controls should also take into consideration all relevant national and international legislation and
regulations. Control determination also depends on the manner in which controls interact with one another
to provide defence in depth.
Health organizations should select information security controls from this document and ISO/IEC 27002
as appropriate. In addition, new information security controls can be designed to meet specific needs as
necessary.
4.3.2 Application of guidance
Where healthcare-specific guidance for a control is provided in this document and the control is being
implemented, that guidance should either be followed or the reason for not following it should be documented
along with an explanation of how the control’s purpose will be met ('comply or explain').
Within the guidance for some controls, there are cross references to other controls in this document or to
other standards, or both. Such cross-references are for information.
4.3.3 Use with ISO/IEC 27001:2022
The supplementary and additional controls
...
ISO/FDIS 27799:2025(en)
ISO/TC 215/ WG 4
Secretariat: ANSI
Date: 2025-07-1509-03
Health informatics — Information security controls in health based
on ISO/IEC 27002
FDIS stage
ISO/DISFDIS 27799:2025(en)
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
EmailE-mail: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/DIS 27799 2025 – All rights reserved
ii
ISO/FDIS 27799:2025(en)
Contents
Foreword . vi
Introduction . vii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions . 2
3.2 Abbreviated terms . 3
4 General . 3
4.1 Structure of this document . 3
4.2 Safety . 4
4.3 Selecting and applying controls . 4
5 Organizational controls . 5
5.1 Policies for information security . 5
5.2 Information security roles and responsibilities . 7
5.3 Segregation of duties . 8
5.4 Management responsibilities . 8
5.5 Contact with authorities . 8
5.6 Contact with special interest groups . 8
5.7 Threat intelligence . 8
5.8 Information security in project management . 9
5.9 Inventory of information and other associated assets . 9
5.10 Acceptable use of information and other associated assets . 10
5.11 Return of assets . 10
5.12 Classification of information . 10
5.13 Labelling of information . 11
5.14 Information transfer . 11
5.15 Access control . 12
5.16 Identity management . 13
5.17 Authentication information . 14
5.18 Access rights . 14
5.19 Information security in supplier relationships . 14
5.20 Addressing information security within supplier agreements . 15
5.21 Managing information security in the ICT supply chain . 15
5.22 Monitoring, review and change management of supplier services . 15
5.23 Information security for use of cloud services . 15
5.24 Information security incident management planning and preparation . 16
5.25 Assessment and decision on information security events . 16
5.26 Response to information security incidents . 16
5.27 Learning from information security incidents . 16
5.28 Collection of evidence . 16
5.29 Information security during disruption . 16
5.30 ICT readiness for business continuity . 17
5.31 Legal, statutory, regulatory and contractual requirements . 17
5.32 Intellectual property rights . 17
5.33 Protection of records . 17
5.34 Privacy and protection of PII . 18
5.35 Independent review of information security . 19
5.36 Conformance with policies, rules and standards for information security . 19
5.37 Documented operating procedures . 20
iii
ISO/DISFDIS 27799:2025(en)
5.38 HLT – Information security requirements analysis and specification . 20
5.39 HLT – Uniquely identifying subjects of care . 21
5.40 HLT – Validation of displayed/printed data. 22
5.41 HLT – Publicly available health information . 23
5.42 HLT – Emergency communication . 23
5.43 HLT – External incident reporting . 24
6 People controls . 25
6.1 Screening. 25
6.2 Terms and conditions of employment . 25
6.3 Information security awareness, education and training . 26
6.4 Disciplinary process . 26
6.5 Responsibilities after termination or change of employment . 26
6.6 Confidentiality or non-disclosure agreements . 27
6.7 Remote working . 27
6.8 Information security event reporting . 27
6.9 HLT – Management training . 28
7 Physical controls . 28
7.1 Physical security perimeters . 28
7.2 Physical entry . 29
7.3 Securing offices, rooms and facilities . 29
7.4 Physical security monitoring . 29
7.5 Protecting against physical and environmental threats . 29
7.6 Working in secure areas . 29
7.7 Clear desk and clear screen. 30
7.8 Equipment siting and protection . 30
7.9 Security of assets off-premises . 30
7.10 Storage media . 30
7.11 Supporting utilities . 31
7.12 Cabling security . 31
7.13 Equipment maintenance . 32
7.14 Secure disposal or re-use of equipment . 32
8 Technological controls . 33
8.1 User endpoint devices . 33
8.2 Privileged access rights . 33
8.3 Information access restriction . 33
8.4 Access to source code . 33
8.5 Secure authentication . 33
8.6 Capacity management . 34
8.7 Protection against malware . 34
8.8 Management of technical vulnerabilities . 34
8.9 Configuration management . 34
8.10 Information deletion . 35
8.11 Data masking . 35
8.12 Data leakage prevention . 36
8.13 Information backup . 36
8.14 Redundancy of information processing facilities . 36
8.15 Logging . 36
8.16 Monitoring activities . 36
8.17 Clock synchronization . 36
8.18 Use of privileged utility programs . 36
8.19 Installation of software on operational systems . 37
8.20 Networks security . 37
8.21 Security of network services . 37
© ISO/DIS 27799 2025 – All rights reserved
iv
ISO/FDIS 27799:2025(en)
8.22 Segregation of networks . 37
8.23 Web filtering . 37
8.24 Use of cryptography . 38
8.25 Secure development life cycle . 38
8.26 Application security requirements . 38
8.27 Secure system architecture and engineering principles . 38
8.28 Secure coding . 38
8.29 Security testing in development and acceptance . 39
8.30 Outsourced development . 39
8.31 Separation of development, test and production environments . 39
8.32 Change management. 39
8.33 Test information . 39
8.34 Protection of information systems during audit testing . 40
8.35 HLT – Zero trust principles . 40
Annex A (informative) Information security controls for health reference . 41
Annex B (informative) Correspondence of this document with ISO 27799:2016 . 43
Annex C (informative) Information security in health organizations . 44
Annex D (informative) Example security and privacy requirements for health information
systems and their mapping to the ISO 27799 controls and IEC/TS 81001-2-2 security
capabilities . 56
Bibliography . 82
v
ISO/DISFDIS 27799:2025(en)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
ISO documentdocuments should be noted. This document was drafted in accordance with the editorial rules
of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights
in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s)
which may be required to implement this document. However, implementers are cautioned that this may not
represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO'sISO’s adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 215, Health informatics, in collaboration with
the European Committee for Standardization (CEN) Technical Committee CEN/TC 251, Health informatics, in
accordance with the Agreement on technical cooperation between ISO and CEN (Vienna Agreement).
This third edition cancels and replaces the second edition (ISO 27799:2016), and ISO/TS 14441:2013, which
hashave been technically revised.
The main changes are as follows:
— — alignment with the new structure of ISO/IEC 27002:2022 and other changes to that standard from the
previous version;
— — revision and addition of controls specific to health;
— — removal of material that was originally only in the second edition of this document but was
subsequently included in ISO/IEC 27002:2022;
— — addition of informative Annexes providing i) supplementary guidance on cybersecurity in health
organizations and ii) example security and privacy requirements for health information systems.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
© ISO/DIS 27799 2025 – All rights reserved
vi
ISO/FDIS 27799:2025(en)
Introduction
0.1 0.1 General
This document contains a set of information security controls for health organizations. It considers all the
controls in ISO/IEC 27002:2022 and, in some cases, supplements the controls or provides guidance on their
application in health. There are also some additional controls specific to health which are not derived from
any in ISO/IEC 27002:2022.
0.2 0.2 Context and background
Factors that affect information security in healthcare include the following:
a) a) Use of equipment that relies on digital technologies for its operation and is deployed
exclusively or predominantly in the healthcare domain. Medical devices incorporating health software are
the prime example.
b) b) The need to balance clinical safety and effectiveness with information security.
c) c) Maintaining the privacy of subjects of care while ensuring access to relevant personal health
information for diagnosis and treatment.
d) d) The distributed nature of personal health information both within and between organizations
(possibly in different jurisdictions) resulting in the need for high levels of interoperability between
diverse systems, applications and devices.
e) e) Users of many different kinds including doctors, nurses, other clinicians, trainees, students,
healthcare assistants, technicians, administrative staff and volunteers as well as subjects of care and their
proxies.
f) f) The multiple interdependencies and information flows between and within organizations
responsible for one or more of: healthcare, clinical research, teaching, education and training.
g) g) The need for some healthcare services to be available on a continuous basis (24 hours a day
every day) under normal circumstances. In addition, natural disasters and other unusual events that can
lead to surges in demand for healthcare services.
h) h) Organizations providing health services as well as manufacturers or suppliers of systems,
devices and equipment are all subject to a wide range of legal, statutory, regulatory and contractual
requirements which can vary between jurisdictions.
i) i) Overlapping or incomplete requirements for accountability and professional responsibility
between different professions (such as ICT and medical devices staff) for ensuring security and safety of
systems, devices and equipment.
Given this overall context, healthcare has a number of sector-specific, if not unique, information security
requirements. However, the controls in ISO/IEC 27002:2022 are intentionally generic, hence the need for this
document.
0.3 0.3 Audience and uses
This document is targeted at organizations that:
— — provide healthcare services or are custodians of personal health information for other reasons;
vii
ISO/DISFDIS 27799:2025(en)
— — supply software, systems, devices, equipment or services that are used to process personal health
information;
— — are responsible for healthcare regulation, accreditation, inspection, assurance or similar.
Individuals for whom this document is particularly relevant include:
— — ICT and medical devices or equipment professionals working in the types of organizations listed
above;
— — information security professionals (particularly those unfamiliar with the health domain): these
professionals can include consultants, penetration testers, auditors and those working for bodies that
provide accreditation, inspection, assurance or certification services for information security.
Appropriate implementation of the controls in this document can provide assurance to individuals, including
subjects of care, their proxies and members of an organization'sorganization’s workforce. Appropriate
implementation can also provide assurance to a wide range of stakeholder bodies including management and
governance boards of healthcare organizations, other healthcare organizations with which information is
exchanged or shared, public authorities, regulators, auditors, and organizations that finance, insure, accredit
or inspect healthcare services.
This document can be used in healthcare settings when determining and implementing controls for an
information security management system (ISMS) conformant to ISO/IEC 27001.
© ISO/DIS 27799 2025 – All rights reserved
viii
FINAL DRAFT International Standard ISO/FDIS 27799:2025(en)
Health informatics — Information security controls in health based on
ISO/IEC 27002
1 Scope
This document provides information security controls, including implementation guidance, for health
organizations. It is based on ISO/IEC 27002:2022
In addition to generic ICT equipment and software used in many other environments, the scope of this
document includes software and systems specifically for healthcare, such as electronic health record systems
and medical devices incorporating health software. Such medical devices can be programmed or
programmable and can contain software, firmware or both.
Other digital equipment (such as that for environmental and infection control, building management, and
physical security), which can be used in premises where healthcare is provided, is also in scope.
This document applies to information in all its aspects, whatever form the information takes (including text
and numbers, sound recordings, drawings, images and video), by whatever means it has been acquired or
captured, whatever means are used to store it (such as printing or writing on paper or storage electronically),
and whatever means are used to transfer or exchange it (orally, by hand, by post, movement of storage media,
direct links or networking).
This document is for organizations of all types and sizes that provide healthcare or are custodians of personal
health information for other reasons. The information that they are responsible for can be stored and
processed in many possible ways and locations, including on premises or in the cloud, but remains in scope.
This document applies to all physical settings where healthcare is intended to be delivered, such as hospitals,
clinics and other locations or facilities designated for healthcare purposes such as ambulances and mobile
imaging or diagnostic units. It also applies to care provided elsewhere, such as in residential premises. In
addition to the range of settings, this document applies to all methods of service provision including remote
or virtual healthcare.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security
controls
ISO 81001-1, Health software and health IT systems safety, effectiveness and security — Part 1: Principles and
concepts
3 Terms, definitions and abbreviated terms
For the purposes of this document, the terms and definitions given in ISO/IEC 27002:2022, ISO 81001-1 and
the following apply.
ISO/FDIS 27799:2025(en)
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— — ISO Online browsing platform: available at https://www.iso.org/obp
— — IEC Electropedia: available at https://www.electropedia.org/
3.1 Terms and definitions
3.1.1 3.1.1
health
complete physical, mental and social well-being
Note 1 to entry: Health is not merely the absence of disease or infirmity.
1 1)
Note 2 to entry: Adapted from World Health Organization . .
3.1.2 3.1.2
health software
software intended to be used specifically for managing, maintaining, or improving health (3.1.1(3.1.1)) of
individual persons, or the delivery of care, or which has been developed for the purpose of being incorporated
into a medical device
Note 1 to entry: Health software fully includes what is considered software as a medical device.
[SOURCE: ISO 81001-1:2021, 3.3.9]
3.1.3 3.1.3
healthcare
care activities, services, management or supplies related to the health (3.1.1(3.1.1)) of an individual
3.1.4 3.1.4
personal health information
information about an identifiable person that relates to the physical or mental health (3.1.1) of the individual
or to provision of health services to the individual
Note 1 to entry: Personal health information can include the following:
a) a) information about the registration of the individual for the provision of health services;
b) b) information about payments or eligibility for healthcare in respect to the individual;
c) c) a number, symbol, or particular assigned to an individual to uniquely identify the individual for health
purposes;
d) d) any information about the individual that is collected in the course of the provision of health services to
the individual;
e) e) information derived from the testing or examination of a body part or bodily substance;
f) f) identification of a person (for instance a health professional) as a provider of healthcare to the
individual.
Note 2 to entry: Personal health information does not include information that, either by itself or when combined with
other information available to the holder, is anonymizedanonymised.
https://www.who.int/about/governance/constitution.
1) https://www.who.int/about/governance/constitution.
© ISO/DIS 27799 2025 – All rights reserved
ISO/FDIS 27799:2025(en)
Note 3 to entry: personal Personal health information is a subset of personally identifiable information (PII).
[SOURCE: ISO/TS 17975:2022, 3.21 with note , modified — Note 3 to entry was added].]
3.1.5
3.1.5
proxy
subject of care proxy
person with the right to take decisions on behalf of the subject of care (3.1.6(3.1.6))
EXAMPLE 1 Parents of children who are not yet adults.
EXAMPLE 2 Guardians of adults with learning disabilities or lacking mental capacity.
[SOURCE:Note 1 to entry: Adapted from ISO 13940:2015, 5.2.3.3.1 modified — “healthcare third party having
person role” was changed to “person”; examples were added.]
4.3.1.6
3.1.6
subject of care
person who seeks to receive, is receiving, or has received healthcare (3.1.3(3.1.3))
[SOURCE:Note 1 to entry: Adapted from ISO 13940:2015, 5.2.1, modified —"healthcare actor with a person role"
replaced with "person".].
3.2 Abbreviated terms
HLT health
ICT information and communication technology
ISMS information security management system
PII personally identifiable information
4 General
4.1 Structure of this document
This document adopts the structure of Clauses 5-8 in ISO/IEC 27002:2022, Clauses 5 to 8 and lists all the
control titles in that standard. Using that framework, this document:
a) a) indicates which controls (including their purposes, guidance and any other information) in
ISO/IEC 27002:2022 apply unchanged in health;
b) b) for certain controls in ISO/IEC 27002:2022, provides guidance, other information, or both on
how to apply the controls in health;
c) c) for the remaining controls in ISO/IEC 27002:2022, supplements what each control is, its
purpose and guidance. Other information for health is also provided in some of these instances;
d) d) specifies controls that are specific to health and that are not based on any existing controls in
ISO/IEC 27002:2022. These additional controls have the same layout as the controls in ISO/IEC 27002
and the control titles are prefixed with "“HLT"” (for HeaLTh).
ISO/FDIS 27799:2025(en)
In relation to ISO/IEC 27002:2022, controls in c) and d) are supplementary and additional respectively.
This document contains 4 Annexes:
— Annex A— Annex A is a reference list of the controls specific to health, namely those under c) and d). The
Annex A also complements ISO/IEC 27001:2022, Annex A.
— Annex B— Annex B provides a mapping table showing the correspondence of the HLT controls in this
document with controls in ISO 27799:2016. It provides support for the transition between the two
editions and complements ISO/IEC 27002:2022, Annex B.
— Annex C— Annex C provides information on aspects of healthcare that are of particular importance in the
context of information security.
— Annex D— Annex D provides example requirements for the development and acquisition of health IT
systems and a mapping to MDS2 (manufacturer disclosure statement for medical device security).
4.2 Safety
Security, safety and health information system effectiveness are interdependent. This should always be taken
into account when assessing and managing risks and their risk control measures. For example, a risk that
systems or data will not be available at the point-of-care is not just a security risk; it can have significant impact
on safety if decision -making about care is compromised. In turn, this can impact the effectiveness of the health
system.
A consequence of the interdependence of security, safety and effectiveness is that well-intended risk control
measures can, in some instances, adversely impact one or both of the other properties. For instance, adding
controls to reduce the risk resulting from unauthorized access can impact system usability and availability
and hence compromise system effectiveness. It can also result in system workarounds that adversely impact
safety.
Safety should be taken into account in all aspects of information security management in health, including the
selection and application of controls. Accordingly, any impacts on safety should be considered when
implementing controls in this document.
4.3 Selecting and applying controls
4.3.1 Determining controls
Determining controls is dependent on the organization’s decisions following a risk assessment with a clearly
defined scope. Decisions related to identified risks should be based on the criteria for risk acceptance, risk
treatment options and the risk management approach applied by the organization. The determination of
controls should also take into consideration all relevant national and international legislation and regulations.
Control determination also depends on the manner in which controls interact with one another to provide
defence in depth.
Health organizations should select information security controls from this document and ISO/IEC 27002 as
appropriate. In addition, new information security controls can be designed to meet specific needs as
necessary.
4.3.2 Application of guidance
Where healthcare-specific guidance for a control is provided in this document and the control is being
implemented, that guidance should either be followed or the reason for not following it should be documented
along with an explanation of how the control’s purpose will be met ('comply or explain').
© ISO/DIS 27799 2025 – All rights reserved
ISO/FDIS 27799:2025(en)
Within the guidance for some controls, there are cross references to other controls in this document and/or
to other standards, or both. Such cross-references are for information.
4.3.3 Use with ISO/IEC 27001:2022
The supplementary and additional controls, as listed in Annex AAnnex A,, can be used when determining and
implementing controls in health settings for an information security management system (ISMS) that is
conformant to ISO/IEC 27001.
It is a requirement of ISO/IEC 27001:2022, 6.1.3 that organizations produce a Statement of Applicability. The
controls in Annex AAnnex A can also be used in this connection.
5 Organizational controls
5.1 Policies for information security
The control, associated attribute table, purpose, guidance and other information as given in
ISO/IEC 27002:2022, 5.1 apply.
Control for health (supplementary)
The information security policy should set out the approach to managing information security and be
approved by the highest management level, then reviewed at least annually and after the occurrence of any
serious security incident.
Purpose for health (supplementary)
To ensure top-management commitment to information security, that is kept up to date.
Guidance for health
The information security policy should contain statements on:
a) a) the need for health information security;
b) b) the goals of health information security;
c) c) compliance scope;
d) d) legislative, regulatory, and contractual requirements, including those for the protection of
personal health information and the legal and ethical responsibilities of health professionals to protect
this information;
e) e) arrangements for notification of information security incidents, including a channel for raising
concerns regarding confidentiality, without fear of blame or recrimination;
f) f) the importance of reporting actual or suspected incidents including near misses as soon as
possible so that any incidents that do occur can be dealt with at the earliest opportunity and do not
become more serious;
g) g) the identification of processes and systems that are vital in healthcare (that is failure can lead
to adverse effects in care or to reduced patient safety).
Revision of the policy'spolicy’s contents should be driven by the findings of a risk assessment.
ISO/FDIS 27799:2025(en)
In creating and maintaining the information security policy and topic specific policies, the following factors
should be considered:
a) a) the breadth of health information;
b) b) the rights and responsibilities of staff, which include legal and ethical requirements, standards
set by professional bodies, and any local requirements;
c) c) the rights of subjects of care to privacy and, where applicable, to access to their records;
d) d) the obligations of clinicians with respect to obtaining informational consent from subjects of
care and maintaining the confidentiality of personal health information;
e) e) multiple organisations (which can be in different jurisdictions from each other) providing
healthcare or supporting services, as well as individuals (including the subjects of care themselves and
their relatives or close companions) who can be involved in the current or past delivery, determination,
administration or funding of a subject'ssubject’s health and social care (see Annex CAnnex C););
f) f) the protocols and procedures to be applied to the sharing of information for the purposes of
research and clinical trials;
g) g) the arrangements for and access limits of:
1) 1) personnel involved in the delivery of care, including permanent and temporary or visiting staff
such as locums, trainees, students and “on-call” or agency staff (see Annex CAnnex C for further
information);
2) 2) personnel who are supporting direct care, including administrative and support staff as well
as clergy, charity workers and other volunteers (see Annex CAnnex C for further information);
3) 3) personnel from regulatory and inspection bodies, financial and other auditors, health
professionals and others investigating clinical or other incidents involving care provisioning;
h) h) situations where information about a subject must be provided externally or is requested by
authorities or other third parties: such situations can include where someone has been harmed during a
crime, when there is suspected abuse or inadequate care of children, women, elderly, learning-impaired
or other vulnerable subjects of care;
i) i) the implications of security measures on patient safety;
j) j) the implications of information security measures on the functionality and performance of
health information systems.
Where support from or collaboration with third parties is obtained, and especially where it receives services
from other jurisdictions, the policy framework should include documented policy and procedures that cover
such interactions and specify the responsibilities of all parties.
Where applicable, reviews of policies should address:
a) a) the changing nature of operations and the concomitant changes to risk profile and risk
management needs;
b) b) the changes made to the ICT architecture and/or infrastructure, or both, and the concomitant
changes these bring to the risk profile;
c) c) the changes identified in the external environment that similarly impact the risk profile;
© ISO/DIS 27799 2025 – All rights reserved
ISO/FDIS 27799:2025(en)
d) d) the latest controls, compliance and assurance requirements and arrangements mandated by
jurisdictional health bodies or by new legislation or regulation;
e) e) the latest guidance and recommendations from health professional associations and from
supervisory authorities in the field of protection of PII (see also 5.345.34););
f) f) the results of legal cases tested in the courts, which have established or negated precedents or
established practices;
g) g) the challenges and issues regarding the policy, as expressed to the organization by its staff,
subjects of care and their partners and care giverscaregivers
...
PROJET FINAL
Norme
internationale
ISO/FDIS 27799
ISO/TC 215
Informatique de santé — Contrôles
Secrétariat: ANSI
de sécurité de l'information dans le
Début de vote:
domaine de la santé basés sur l'ISO/
2025-09-18
IEC 27002
Vote clos le:
2025-11-13
Health informatics — Information security controls in health
based on ISO/IEC 27002
LES DESTINATAIRES DU PRÉSENT PROJET SONT
INVITÉS À PRÉSENTER, AVEC LEURS OBSERVATIONS,
NOTIFICATION DES DROITS DE PROPRIÉTÉ DONT ILS
AURAIENT ÉVENTUELLEMENT CONNAISSANCE ET À
FOURNIR UNE DOCUMENTATION EXPLICATIVE.
OUTRE LE FAIT D’ÊTRE EXAMINÉS POUR
ÉTABLIR S’ILS SONT ACCEPTABLES À DES FINS
INDUSTRIELLES, TECHNOLOGIQUES ET COM-MERCIALES,
AINSI QUE DU POINT DE VUE DES UTILISATEURS, LES
PROJETS DE NORMES
TRAITEMENT PARALLÈLE ISO/CEN
INTERNATIONALES DOIVENT PARFOIS ÊTRE CONSIDÉRÉS
DU POINT DE VUE DE LEUR POSSI BILITÉ DE DEVENIR DES
NORMES POUVANT
SERVIR DE RÉFÉRENCE DANS LA RÉGLEMENTATION
NATIONALE.
Numéro de référence
ISO/FDIS 27799:2025(fr) © ISO 2025
PROJET FINAL
ISO/FDIS 27799:2025(fr)
Norme
internationale
ISO/FDIS 27799
ISO/TC 215
Informatique de santé — Contrôles
Secrétariat: ANSI
de sécurité de l'information dans le
Début de vote:
domaine de la santé basés sur l'ISO/
2025-09-18
IEC 27002
Vote clos le:
2025-11-13
Health informatics — Information security controls in health
based on ISO/IEC 27002
LES DESTINATAIRES DU PRÉSENT PROJET SONT
INVITÉS À PRÉSENTER, AVEC LEURS OBSERVATIONS,
NOTIFICATION DES DROITS DE PROPRIÉTÉ DONT ILS
AURAIENT ÉVENTUELLEMENT CONNAISSANCE ET À
FOURNIR UNE DOCUMENTATION EXPLICATIVE.
DOCUMENT PROTÉGÉ PAR COPYRIGHT
OUTRE LE FAIT D’ÊTRE EXAMINÉS POUR
ÉTABLIR S’ILS SONT ACCEPTABLES À DES FINS
© ISO 2025 INDUSTRIELLES, TECHNOLOGIQUES ET COM-MERCIALES,
AINSI QUE DU POINT DE VUE DES UTILISATEURS, LES
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
PROJETS DE NORMES
TRAITEMENT PARALLÈLE ISO/CEN
INTERNATIONALES DOIVENT PARFOIS ÊTRE CONSIDÉRÉS
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,
DU POINT DE VUE DE LEUR POSSI BILITÉ DE DEVENIR DES
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut
NORMES POUVANT
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
SERVIR DE RÉFÉRENCE DANS LA RÉGLEMENTATION
NATIONALE.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: +41 22 749 01 11
E-mail: copyright@iso.org
Web: www.iso.org
Publié en Suisse Numéro de référence
ISO/FDIS 27799:2025(fr) © ISO 2025
ii
ISO/FDIS 27799:2025(fr)
Sommaire Page
Avant-propos .vi
Introduction .vii
1 Domaine d’application . 1
2 Références normatives . 1
3 Termes, définitions et abréviations . 2
3.1 Termes et définitions .2
3.2 Abréviations.3
4 Généralités . 3
4.1 Structure du présent document .3
4.2 Sécurité .4
4.3 Sélection et application des contrôles.4
4.3.1 Détermination des contrôles .4
4.3.2 Recommandations pour l'application de la loi .4
4.3.3 Utilisation avec la norme ISO/IEC 27001:2022 .5
5 Contrôles organisationnels . 5
5.1 Politiques de sécurité de l'information .5
5.2 Rôles et responsabilités en matière de sécurité de l'information.7
5.3 Séparation des tâches .7
5.4 Responsabilités de la direction .8
5.5 Contact avec les autorités .8
5.6 Contact avec des groupes d'intérêt.8
5.7 Renseignements sur les menaces .8
5.8 Sécurité de l'information dans la gestion de projet .9
5.9 Inventaire des informations et autres actifs associés .9
5.10 Utilisation acceptable de l'information et des autres actifs associés .9
5.11 Rendement des actifs .9
5.12 Classification des informations .10
5.13 Marquage des informations .11
5.14 Transfert d'informations .11
5.15 Contrôle d'accès . 12
5.16 Gestion de l'identité . 12
5.17 Informations d'authentification . 13
5.18 Droits d'accès . 13
5.19 Sécurité de l'information dans les relations avec les fournisseurs .14
5.20 Prise en compte de la sécurité de l'information dans les accords conclus avec les
fournisseurs . 15
5.21 Gérer la sécurité de l'information dans la chaîne d'approvisionnement des TIC . 15
5.22 Suivi, révision et gestion des changements des services des fournisseurs . 15
5.23 Sécurité de l'information dans l'utilisation de services en nuage . 15
5.24 Planification et préparation de la gestion des incidents de sécurité de l'information . 15
5.25 Évaluation et décision sur les événements liés à la sécurité de l'information . 15
5.26 Réponse aux incidents liés à la sécurité de l'information .16
5.27 Tirer les leçons des incidents liés à la sécurité de l'information .16
5.28 Recueil de preuves.16
5.29 Sécurité de l'information en cas de perturbation .16
5.30 Préparation des TIC pour la continuité d'activité .16
5.31 Exigences légales, statutaires, réglementaires et contractuelles .17
5.32 Droits de propriété intellectuelle .17
5.33 Protection des enregistrements .17
5.34 Vie privée et protection des IPI.17
5.35 Examen indépendant de la sécurité de l'information .18
5.36 Conformité aux politiques, règles et normes de sécurité de l'information .19
5.37 Procédures d'exploitation documentées .19
iii
ISO/FDIS 27799:2025(fr)
5.38 HLT - Analyse et spécification des exigences en matière de sécurité de l'information .19
5.39 HLT - Identification unique des sujets de soins .21
5.40 HLT - Validation des données affichées/imprimées .21
5.41 HLT - Informations sur la santé accessibles au public . 22
5.42 HLT - Communication d'urgence . 23
5.43 HLT - Rapport d'incident externe. 23
6 Contrôle des personnes .24
6.1 Présélection .24
6.2 Conditions d'emploi .24
6.3 Sensibilisation, apprentissage et formation à la sécurité de l'information . 25
6.4 Processus disciplinaire . 25
6.5 Responsabilités après un licenciement ou un changement d'emploi . 25
6.6 Accords de confidentialité ou de non-divulgation . 26
6.7 Travail à distance . 26
6.8 Rapport sur les événements liés à la sécurité de l'information . 26
6.9 HLT - Formation à la gestion .27
7 Contrôles physiques .27
7.1 Périmètres de sécurité physique .27
7.2 Entrée physique . 28
7.3 Sécurisation des bureaux, des salles et des équipements. 28
7.4 Surveillance de la sécurité physique . 28
7.5 Protection contre les menaces physiques et environnementales . 28
7.6 Travail dans les zones sécurisées . 28
7.7 Bureau et écran dégagés . 29
7.8 Emplacement et protection du matériel . 29
7.9 Sécurité des actifs hors des locaux . 29
7.10 Supports de stockage . 29
7.11 Services généraux . 30
7.12 Sécurité du câblage . 30
7.13 Maintenance du matériel .31
7.14 Élimination ou réutilisation des équipements en toute sécurité .31
8 Contrôles technologiques .32
8.1 Terminaux finaux des utilisateurs .32
8.2 Droits d'accès privilégiés . .32
8.3 Restriction d'accès à l'information .32
8.4 Accès au code source .32
8.5 Authentification sécurisée .32
8.6 Dimensionnement .32
8.7 Protection contre les logiciels malveillants. 33
8.8 Gestion des vulnérabilités techniques . 33
8.9 Gestion de la configuration . 33
8.10 Suppression d'informations . 34
8.11 Masquage des données . 34
8.12 Prévention de la fuite de données . 34
8.13 Sauvegarde de l'information . 34
8.14 Redondance des moyens de traitement de l'information . 35
8.15 Journalisation . 35
8.16 Activités de surveillance . 35
8.17 Synchronisation des horloges . 35
8.18 Utilisation de programmes utilitaires à privilèges . 35
8.19 Installation de logiciels sur des systèmes en exploitation . 35
8.20 Sécurité des réseaux . . 36
8.21 Sécurité des services de réseau . 36
8.22 Cloisonnement des réseaux . 36
8.23 Filtrage du web . 36
8.24 Utilisation de la cryptographie .37
8.25 Cycle de vie de développement sécurisé .37
iv
ISO/FDIS 27799:2025(fr)
8.26 Exigences de sécurité des applications .37
8.27 Principes d'architecture et d'ingénierie des systèmes sécurisés .37
8.28 Codage sécurisé .37
8.29 Tests de sécurité dans le développement et l'acceptation .37
8.30 Développement externalisé .37
8.31 Séparation des environnements de développement, de test et de production. 38
8.32 Gestion des changements . . 38
8.33 Informations sur les tests . 38
8.34 Protection des systèmes d'information pendant les tests d'audit . 38
8.35 HLT - Principes de la confiance zéro . 38
Annexe A (informative) Contrôles de sécurité de l'information pour les références de santé .40
Annexe B (informative) Correspondance du présent document avec la norme ISO 27799:2016 .42
Annexe C (informative) Sécurité de l'information dans les organismes de santé .43
Annexe D (informative) Exemples d'exigences en matière de sécurité et de confidentialité
pour les systèmes d'information sur la santé et leur mise en correspondance avec les
contrôles ISO 27799 et les capacités de sécurité IEC/TS 81001-2-2 .55
Bibliographie .81
v
ISO/FDIS 27799:2025(fr)
Avant-propos
L'ISO (Organisation internationale de normalisation) est une fédération mondiale d'organismes nationaux
de normalisation (comités membres de l'ISO). L'élaboration des Normes internationales est en général
confiée aux comités techniques de l'ISO. Chaque comité membre intéressé par une étude a le droit de faire
partie du comité technique créé à cet effet. Les organisations internationales, gouvernementales et non
gouvernementales, en liaison avec l'ISO participent également aux travaux. L'ISO collabore étroitement avec
la Commission électrotechnique internationale (IEC) en ce qui concerne la normalisation électrotechnique.
Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont décrites
dans les Directives ISO/IEC, Partie 1. Il convient, en particulier, de prendre note des différents critères
d'approbation requis pour les différents types de documents ISO. Ce document a été rédigé selon les règles
éditoriales des Directives ISO/CEI, Partie 2 (voir www.iso.org/directives).
L'ISO attire l'attention sur le fait que la mise en œuvre du présent document peut impliquer l'utilisation d'un
ou de plusieurs brevets. L'ISO ne prend pas position concernant la preuve, la validité ou l'applicabilité de tout
droit de brevet allégué à cet égard (1402, environnement). À la date de publication du présent document,
l'ISO n'avait pas reçu notification qu'un ou plusieurs brevets pouvaient être nécessaires à sa mise en
application. Toutefois, il y a lieu d'avertir les responsables de la mise en application du présent document que
des informations plus récentes sont susceptibles de figurer dans la base de données de brevets, disponible à
l'adresse www.iso.org/brevets. L'ISO ne saurait être tenue pour responsable de ne pas avoir identifié tout ou
partie de tels droits de brevet.
Les appellations commerciales éventuellement mentionnées dans le présent document sont données pour
information, par souci de commodité, à l'intention des utilisateurs et ne sauraient constituer un engagement.
Pour une explication de la nature volontaire des normes, la signification des termes et expressions
spécifiques de l'ISO liés à l'évaluation de la conformité, ou pour toute information au sujet de l'adhésion de
l'ISO aux principes de l’Organisation mondiale du commerce (OMC) concernant les obstacles techniques au
commerce (OTC), voir le lien suivant: www.iso.org/iso/fr/avant-propos.html.
Ce document a été préparé par le comité technique ISO/TC 215, Informatique de santé, en collaboration avec
le comité technique CEN/TC 251 du Comité européen de normalisation (CEN), Informatique de santé, selon
l'accord sur la coopération technique entre l'ISO et le CEN (accord de Vienne).
Cette troisième édition annule et remplace les normes ISO 27799:2016 et ISO/TS 14441:2013, qui ont fait
l'objet d'une révision technique.
Les principales modifications sont les suivantes:
— l'alignement sur la nouvelle structure de la norme ISO/IEC 27002:2022 et les autres modifications
apportées à cette norme par rapport à la version précédente;
— la révision et l'ajout de contrôles spécifiques à la santé;
— la suppression d'éléments qui ne figuraient à l'origine que dans la deuxième édition du présent document,
mais qui ont été inclus par la suite dans la norme ISO/CEI 27002:2022;
— ajout d'Annexes informatives fournissant des recommandations relatives à la cybersécurité dans les
organismes de santé et des exemples d'exigences en matière de sécurité et de protection de la vie privée
pour les systèmes d'information de santé.
Tout commentaire ou question sur le présent document doit être adressé à l'organisme national
de normalisation de l'usager. Une liste complète de ces organismes peut être consultée à l'adresse
www.iso.org/members.html.
vi
ISO/FDIS 27799:2025(fr)
Introduction
0.1 Généralités
Le présent document contient un ensemble de contrôles de la sécurité de l'information pour les organismes
de santé. Il prend en considération tous les contrôles de la norme ISO/IEC 27002:2022 et, dans certains cas,
complète les contrôles ou fournit des recommandations pour leur application dans le domaine de la santé. Il
existe également quelques contrôles supplémentaires spécifiques à la santé qui ne sont dérivés d'aucun des
contrôles de la norme ISO/IEC 27002:2022.
0.2 Contexte et historique
Les facteurs qui ont une incidence sur la sécurité de l'information dans les soins de santé sont notamment
les suivants:
a) Utilisation d'un équipement dont le fonctionnement repose sur les technologies numériques et qui
est déployé exclusivement ou majoritairement dans le domaine de la santé. Les dispositifs médicaux
intégrant des logiciels de santé en sont le meilleur exemple.
b) La nécessité de trouver un équilibre entre la sécurité et l'efficacité cliniques et la sécurité de
l'information.
c) Préserver la vie privée des personnes soignées tout en assurant l'accès aux informations personnelles
pertinentes en matière de santé à des fins de diagnostic et de traitement.
d) La nature distribuée des informations personnelles sur la santé, à la fois au sein des organisations et
entre elles (éventuellement dans des juridictions différentes), entraîne la nécessité de niveaux élevés
d'interopérabilité entre divers systèmes, applications et dispositifs.
e) Les usagers sont très divers: médecins, infirmières, autres cliniciens, stagiaires, étudiants, aides-
soignants, techniciens, personnel administratif et bénévoles, ainsi que les personnes soignées et leurs
mandataires.
f) Les multiples interdépendances et flux d'informations entre et au sein des organisations responsables
d'un ou plusieurs des domaines suivants: soins de santé, recherche clinique, enseignement, éducation et
formation.
g) La nécessité pour certains services de santé d'être disponibles en permanence (24 heures sur 24, tous
les jours) dans des circonstances normales. En outre, les catastrophes naturelles et autres événements
inhabituels qui peuvent entraîner une augmentation de la demande de services de soins de santé.
h) Les organismes fournissant des services de santé ainsi que les fabricants ou fournisseurs de systèmes,
d'appareils et d'équipements sont tous soumis à un large éventail d'exigences légales, statutaires,
réglementaires et contractuelles qui peuvent varier d'une juridiction à l'autre.
i) Exigences superposées ou incomplètes en matière d'obligation de rendre compte et de responsabilité
professionnelle entre différentes professions (telles que le personnel des TIC et des dispositifs médicaux)
pour assurer la sécurité et la sûreté des systèmes, des dispositifs et des équipements.
Dans ce contexte général, les soins de santé ont un certain nombre d'exigences spécifiques, voire uniques,
en matière de sécurité de l'information. Toutefois, les contrôles figurant dans la norme ISO/IEC 27002:2022
sont intentionnellement génériques, d'où la nécessité du présent document.
0.3 Public et utilisations
Le présent document s'adresse aux organisations qui:
— fournissent des services de soins de santé ou sont dépositaires d'informations personnelles sur la santé
pour d'autres raisons;
— fournir des logiciels, des systèmes, des dispositifs, des équipements ou des services qui sont utilisés pour
traiter les informations de santé à caractère personnel;
vii
ISO/FDIS 27799:2025(fr)
— sont responsables de la réglementation, de l'accréditation, de l'inspection et de l'assurance des soins de
santé ou d'une activité similaire.
Les personnes pour lesquelles ce document est particulièrement pertinent sont les suivantes:
— Les professionnels des TIC et des dispositifs ou équipements médicaux travaillant dans les types
d'organisations énumérés ci-dessus;
— les professionnels de la sécurité de l'information (en particulier ceux qui ne connaissent pas le domaine
de la santé): ces professionnels peuvent être des consultants, des testeurs de pénétration, des auditeurs et
des personnes travaillant pour des organismes qui fournissent des services d'accréditation, d'inspection,
d'assurance ou de certification dans le domaine de la sécurité de l'information.
La mise en œuvre appropriée des contrôles décrits dans le présent document peut donner une assurance
aux personnes, y compris les personnes concernées, leurs mandataires et les membres du personnel d'une
organisation. Une mise en œuvre appropriée peut également donner des garanties à un large éventail de
parties prenantes, notamment les conseils d'administration et de gouvernance des organismes de soins de
santé, les autres organismes de soins de santé avec lesquels des informations sont échangées ou partagées,
les autorités publiques, les régulateurs, les auditeurs et les organismes qui financent, assurent, accréditent
ou inspectent les services de soins de santé.
Ce document peut être utilisé dans les établissements de santé lors de la détermination et de la mise en
œuvre des contrôles d'un système de management de la sécurité de l'information (SMSI) conforme à la
norme ISO/CEI 27001.
viii
PROJET FINAL Norme internationale ISO/FDIS 27799:2025(fr)
Informatique de santé — Contrôles de sécurité de l'information
dans le domaine de la santé basés sur l'ISO/IEC 27002
1 Domaine d’application
Le présent document fournit des contrôles de sécurité de l'information, y compris des recommandations
pour leur mise en œuvre, à l'intention des organismes de santé. Il est basé sur la norme ISO/IEC 27002:2022.
Outre les équipements et logiciels TIC génériques utilisés dans de nombreux autres environnements, le
domaine d'application du présent document comprend les logiciels et systèmes spécifiquement destinés
aux soins de santé, tels que les systèmes de dossiers médicaux électroniques et les dispositifs médicaux
intégrant des logiciels de santé. Ces dispositifs médicaux peuvent être programmés ou programmables et
peuvent contenir des logiciels, des microprogrammes ou les deux.
D'autres équipements numériques (tels que ceux destinés au contrôle de l'environnement et des infections,
à la gestion des bâtiments et à la sécurité physique), qui peuvent être utilisés dans les locaux où des soins de
santé sont dispensés, entrent également dans le domaine d'application.
Le présent document s'applique à l'information sous tous ses aspects, quelle que soit sa forme (y compris
les textes et les chiffres, les enregistrements sonores, les dessins, les images et les vidéos), quels que soient
les moyens utilisés pour l'acquérir ou la saisir, quels que soient les moyens utilisés pour la stocker (tels que
l'impression ou l'écriture sur papier ou le stockage électronique) et quels que soient les moyens utilisés
pour la transférer ou l'échanger (oralement, en main propre, par courrier, par déplacement de supports de
stockage, par liens directs ou par mise en réseau).
Le présent document s'adresse aux organisations de tous types et de toutes tailles qui fournissent des soins
de santé ou qui sont dépositaires d'informations de santé à caractère personnel pour d'autres raisons. Les
informations dont ils sont responsables peuvent être stockées et traitées de nombreuses manières et dans de
nombreux endroits possibles, y compris dans les locaux ou dans le cloud, mais elles restent dans le domaine
d'application.
Le présent document s'applique à tous les lieux physiques où les soins de santé sont censés être dispensés,
tels que les hôpitaux, les cliniques et autres lieux ou installations désignés à des fins de soins de santé,
comme les ambulances et les unités mobiles d'imagerie ou de diagnostic. Elle s'applique également aux soins
dispensés ailleurs, par exemple dans des locaux résidentiels. Outre l'éventail des contextes, ce document
s'applique à toutes les méthodes de prestation de services, y compris les soins de santé à distance ou virtuels.
2 Références normatives
Les documents suivants sont cités dans le texte de sorte qu'ils constituent, pour tout ou partie de leur
contenu, des exigences du présent document. Pour les références datées, seule l'édition citée s'applique. Pour
les références non datées, la dernière édition du document de référence s'applique (y compris les éventuels
amendements).
ISO/IEC 27002:2022, Sécurité de l'information, cybersécurité et protection de la vie privée — Mesures de
sécurité de l'information
ISO 81001-1, Sécurité, efficacité et sûreté des logiciels de santé et des systèmes TI de santé — Partie 1: Principes
et concepts
ISO/FDIS 27799:2025(fr)
3 Termes, définitions et abréviations
Aux fins du présent document, les termes et définitions figurant dans les normes ISO/IEC 27002:2022,
ISO 81001-1 et les suivantes s'appliquent.
L'ISO et la CEI tiennent à jour des bases de données terminologiques destinées à être utilisées dans le cadre
de la normalisation aux adresses suivantes:
— ISO Plate-forme de navigation en ligne: disponible à https:// www .iso .org/ obp
— IEC Electropedia: disponible sur https:// www .electropedia .org/
3.1 Termes et définitions
3.1.1
santé
un bien-être physique, mental et social complet
Note 1 à l'article: La santé n'est pas seulement l'absence de maladie ou d'infirmité.
1)
Note 2 à l'article: Adapté de l'Organisation mondiale de la santé .
3.1.2
logiciel de santé
les logiciels destinés à être utilisés spécifiquement pour la gestion, le maintien ou l'amélioration de la santé
(3.1.1) de personnes individuelles, ou la prestation de soins, ou qui ont été développés dans le but d'être
incorporés dans un dispositif médical
Note 1 à l'article: Les logiciels de santé comprennent entièrement ce qui est pris en considération en tant que dispositif
médical.
[SOURCE: ISO 81001-1:2021, 3.3.9]
3.1.3
soins de santé
activités de soins, services, gestion ou fournitures liés à la santé (3.1.1) d'un individu
3.1.4
les informations personnelles sur la santé
les informations concernant une personne identifiable qui se rapportent à la santé physique ou mentale
(3.1.1) de l'individu ou à la fourniture de services de santé à l'individu
Note 1 à l'article: Les informations personnelles sur la santé peuvent comprendre les éléments suivants:
a) les informations relatives à l'enregistrement de la personne en vue de la prestation de services de santé;
b) des informations sur les paiements ou l'éligibilité aux soins de santé concernant la personne;
c) un numéro, un symbole ou un élément particulier attribué à un individu pour l'identifier de manière unique à des
fins de santé;
d) toute information sur la personne collectée dans le cadre de la fourniture de services de santé à la personne;
e) les informations tirées du test ou de l'examen d'une partie du corps ou d'une substance corporelle;
f) l'identification d'une personne (par exemple un professionnel de la santé) en tant que prestataire de soins de
santé à l'individu.
Note 2 à l'article: Les informations personnelles sur la santé ne comprennent pas les informations qui, en elles-mêmes
ou lorsqu'elles sont combinées à d'autres informations dont dispose le détenteur, sont rendues anonymes.
1) https:// www .who .int/ about/ governance/ constitution.
ISO/FDIS 27799:2025(fr)
Note 3 à l'article: Les informations personnelles sur la santé sont un sous-ensemble des informations personnelles
identifiables (IPI).
[SOURCE: ISO/TS 17975:2022, 3.21, modifié - La Note 3 de l'entrée a été ajoutée].
3.1.5
représentant du sujet de soins
personne ayant le droit de prendre des décisions au nom de la substance de soins (3.1.6)
EXEMPLE 1 Parents d'enfants qui ne sont pas encore adultes.
EXEMPLE 2 Tuteurs d'adultes souffrant de troubles de l'apprentissage ou dépourvus de capacité mentale.
Note 1 à l'article: Adapté de la norme ISO 13940:2015, 5.2.4.3.
3.1.6
sujet des soins
personne qui cherche à recevoir, reçoit ou a reçu des soins de santé (3.1.3)
Note 1 à l'article: Adapté de la norme ISO 13940:2015, 5.2.1.
3.2 Abréviations
HLT santé
TIC Technologies de l'Information et de la Communication
SMSI système de management de la sécurité de l'information
DCP données à caractère personnel
4 Généralités
4.1 Structure du présent document
Le présent document adopte la structure de la norme ISO/IEC 27002:2022, Articles 5 à 8, et énumère tous les
titres de contrôle de cette norme. C'est dans ce cadre que s'inscrit le présent document:
a) indique les contrôles (y compris leurs objectifs, les recommandations et toute autre information) de la
norme ISO/IEC 27002:2022 qui s'appliquent de manière inchangée dans le domaine de la santé;
b) pour certains contrôles dans la norme ISO/IEC 27002:2022, fournit des recommandations, d'autres
informations ou les deux sur la manière d'appliquer les contrôles dans le domaine de la santé;
c) pour les autres contrôles de la norme ISO/IEC 27002:2022, complète ce qu'est chaque contrôle, son
objectif et les recommandations qui s'y rapportent. D'autres informations relatives à la santé sont
également fournies dans certains de ces cas;
d) spécifie les contrôles qui sont spécifiques à la santé et qui ne sont basés sur aucun contrôle existant
dans la norme ISO/IEC 27002:2022. Ces contrôles supplémentaires ont la même présentation que les
contrôles de la norme ISO/IEC 27002 et les titres des contrôles sont précédés du préfixe “HLT” (pour
HeaLTh).
Par rapport à la norme ISO/IEC 27002:2022, les contrôles visés aux points c) et d) sont respectivement
supplémentaires et additionnels.
Le présent document contient 4 Annexes:
— L'Annexe A est une liste de référence des contrôles spécifiques à la santé, à savoir ceux visés aux points
c) et d). L'Annexe A complète également la norme ISO/IEC 27001:2022, Annexe A.
ISO/FDIS 27799:2025(fr)
— L'Annexe B fournit un tableau de correspondance montrant la correspondance des contrôles HLT dans le
présent document avec les contrôles de la norme ISO 27799:2016. Il fournit un support pour la transition
entre les deux éditions et complète l'ISO/IEC 27002:2022, Annexe B.
— L'Annexe C fournit des informations sur les aspects des soins de santé qui revêtent une importance
particulière dans le contexte de la sécurité de l'information.
— L'Annexe D fournit des exemples d'exigences pour le
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...