Healthcare Security & ISMS Articles
Security articles for medical institutions and healthcare companies, covering MHLW and three-ministry guideline compliance, ISMS certification, ransomware, two-factor authentication, and vendor management, based on official publications. To browse by theme, see the Security Guide for Medical Institutions.
102 articles available in English
The full collection has 106 security articles; 4 are in Japanese only. See them all in the Security Guide or the Japanese article list.
Security Measures Clinics Must Take in an Era of Data Breaches: Priorities and a Checklist by Leak Route
Clinic data breaches happen through four routes: human error, compromised passwords, external attacks and contractors. Using public data, we set out where to start for each route and a checklist you can work through this week.
Why Is Two-Factor Authentication Necessary? Security Lessons from a Data Leak at an Online Consultation Service
Unauthorized logins using IDs and passwords leaked from other services were found at MICIN's online consultation service. We outline the case, why two-factor authentication is needed, and what clinics should do now.
Access Control and Privileged ID Management: What Is Realistic in a Hospital
Role-based permissions, least privilege, offboarding and transfer reviews, vendor maintenance accounts, and what to do where shared IDs genuinely cannot be eliminated. Access design that actually limits blast radius within the constraints of clinical work.
Reading the 37 Organizational Controls
The 37 organizational controls of Annex A.5, grouped into eight clusters rather than translated one by one: policy and governance, assets and classification, access policy, suppliers and cloud, threat intelligence, incident management, continuity, and compliance. What each cluster is asking for, and what you end up producing.
Annex A 2022: 93 Controls Across Four Themes
A map of the 93 Annex A controls in ISO/IEC 27001:2022 across four themes — 37 organizational, 8 people, 14 physical, 34 technological. Why there is no duty to implement all 93, how inclusion and exclusion are justified in the Statement of Applicability, what the attributes are for, and the order a healthcare company should work in.
Reading the 8 People Controls
The 8 people controls of Annex A.6, grouped into entry, employment, exit, where people work, and reporting culture. How they connect to existing employment rules, how to handle segregation of duties when the team is too small for it, and how far to go on remote working — written for healthcare companies.
Reading the 14 Physical Controls
The 14 physical controls of Annex A.7 in five clusters, with a concrete treatment of what a fully remote, cloud-only organisation can exclude and what must be reassigned to home-working rules and supplier management — data centres, media and disposal, and equipment off premises.
Reading the 34 Technological Controls
The 34 technological controls of Annex A.8 in six clusters: access control and authentication, vulnerabilities and configuration, the data protection lifecycle, logging and monitoring, networks, and secure development — written in the context of building and operating healthcare SaaS.
Antivirus and EDR: What a Hospital Should Decide Before Buying
How EDR differs from conventional antivirus, why it is not a product that protects you simply by being installed, how to choose an operating model for the alerts it produces, what to do about devices it cannot be installed on, and what to settle before you buy.
Audit Fees: Ranges and What Moves Them
ISMS audit fees are auditor-days multiplied by a rate. What drives the day count — headcount in scope, number of sites, complexity of activities, integration with other certifications — plus how year one differs from the years that follow, how to compare across three years, and a checklist of line items to verify in every quote.
Logging and Audit Trails: Getting Past 'We Collect It but Nobody Looks'
What to log, how long to retain it, and the real problem — logs collected but never read. Which logs actually matter during an incident, and how to make review a sustainable routine in a hospital with limited staff.
Backup Design for Hospitals: The 3-2-1 Rule and the Tier 1 Requirement
Japan's FY2026 revision makes multi-method backup with part of it held offline a tier 1 requirement. We cover the three methods accepted as meeting it — external media, automated transfer to a permanently detached NAS, and a logically separated area within a cloud service — plus generation management and why an untested backup does not count.
Connecting Business Continuity Planning to the ISMS
How ISMS availability requirements connect to business continuity planning: who sets RTO and RPO and on what basis, how an ISMS-scoped continuity plan relates to the company-wide BCP, what it actually means when a clinical system stops, and what an exercise record must contain.
Comparing the Main Certification Bodies: BSI, JQA, BV, SGS, DQS
An overview of five certification bodies commonly shortlisted for ISO/IEC 27001 in Japan — BSI Group Japan, JQA, Bureau Veritas Japan, SGS Japan, and DQS Japan — covering their accreditations and distinguishing characteristics, plus how to narrow the field from your own requirements.
How to Choose a Certification Body: What to Look for When Comparing Quotes
Any accredited certification body issues an equally valid ISO/IEC 27001 certificate — so what should you actually compare? This article walks through how audit fees are built from auditor-days, the assumptions you must fix before requesting quotes, and the non-price factors that matter: accreditation, scheduling flexibility, and sector knowledge.
ISMS for Clinical Trial Systems and Japan's ER/ES Guidance
Systems supporting clinical trials — EDC, eConsent — are judged not only against an ISMS but against Japan's ER/ES guidance on electronic records and signatures. The three requirements, what an audit trail must capture, how GCP fits, and exactly where ISMS documentation stops being sufficient.
Selecting a Cloud Provider: Seven Things a Hospital Must Check
How a hospital should choose the cloud provider that will hold its medical information: verifying guideline alignment, data residency across production, backups and logs, how to read ISO/IEC 27001 and 27017 certifications, data return on exit, and transparency of subcontracting — set out as tables to use before comparing quotes.
Common Audit Nonconformities and How to Prevent Them
The nonconformities that surface in ISO/IEC 27001 audits, sorted by severity and by pattern: internal audits performed as a formality, missing training records, risk assessments never updated, supplier management left undone, records that diverge from practice, and a Statement of Applicability out of step with the procedures. Why each happens, how to clear them before the audit, and how to run corrective action afterwards.
Writing a Corrective Action Report
How to turn the corrective action report from a form-filling exercise into actual prevention: the difference between correction and corrective action, root cause analysis that does not stop at the five whys, when and how to verify effectiveness, how to convert an audit finding into corrective action, and the structure of a worked example.
A BCP for Cyberattacks: How It Differs from Disaster Planning, and Prioritising Clinical Continuity
Building a cyberattack BCP for a healthcare provider by contrasting it with disaster planning: recovery time cannot be estimated, paper operation lasts far longer, and the backups themselves may be hit. Covers RTO/RPO, prioritising clinical functions, and the FY2026 requirement to develop and drill a cyber BCP.
Cyber Insurance for Healthcare Providers: What Is Covered, and What Is Not
How a hospital or clinic should read a cyber insurance proposal: which costs tend to be covered, what is typically excluded, the controls insurers expect before binding, where exclusions bite, and why insurance is not a substitute for controls.
Breach Reporting Duties: Preliminary and Final Reports, and Notifying Individuals
What healthcare providers in Japan must report when personal data is leaked: when reporting to the Personal Information Protection Commission is required, the two-stage preliminary/final report structure, notifying affected individuals, and why clinical records being special-care-required data changes the threshold.
Reviewing EMR Access Logs: Detecting and Deterring Improper Viewing
EMR access logs are usually collected and rarely read. Viewing the record of an acquaintance or a well-known patient outside any clinical need is an internal event, not an external attack. This article covers what signals to look for, how to set the cadence and ownership of reviews, and why telling staff that reviews happen is itself a control.
Security Requirements for EMR Replacement: Migration Is the Dangerous Window
The riskiest phase of an EMR replacement is the migration itself. Carrying out the entire patient database, running old and new systems in parallel, and disposing of the old system and its media — what goes wrong in each, how to manage the migration contractor, and how to dispose of old media.
Endpoint Management: Securing Laptops and Tablets Taken Off Site
Tablets taken on home visits, laptops used from home, staff reading work email on personal phones. How to manage devices once they leave the building, what must be possible when one is lost, and how endpoint management connects to the asset register.
Guideline Compliance When Using the Cloud
When adopting a cloud EMR or departmental system, what must a hospital confirm and document under Japan's three-ministry guidelines? A procedural walkthrough: external storage requirements, provider selection, agreeing demarcation, confirming data location, and what remains after go-live.
A Three-Ministry Guidelines Compliance Checklist
A practical self-assessment checklist for hospitals against Japan's three-ministry healthcare guidelines: governance, technical operations, and outsourcing/cloud, laid out as tables — plus how to sequence the work on whatever comes back unchecked.
The Governance Part of the Guidelines: What Executives Are Accountable For
The governance part of Edition 7.0 is written for directors, board members, and administrators. What must executives decide, and what do they answer for? This article covers why outsourcing does not transfer responsibility, and what it means that FY2026 made a dedicated medical information system security manager a condition of the new add-on.
The System Operations Part of the Guidelines
The system operations part of Edition 7.0 is written for the people who actually run the systems: access control, logging, backups, equipment management, and what to do when an incident occurs — including the FY2026 add-on's backup requirements for multiple methods, offline copies, and generation retention.
Outsourcing Guideline Compliance: What Can and Cannot Be Delegated
When a hospital engages an outside firm to help with three-ministry guideline compliance, what can actually be delegated and what cannot? The principle that responsibility does not transfer, how to choose a partner, how to inspect the deliverables, and why wholesale delegation structurally fails.
The Planning and Management Part of the Guidelines
The planning and management part of Edition 7.0 is written for system administrators. How to run a risk assessment, which procedures you actually need to write, how to manage suppliers, how to design staff training — and how much documentation is enough to be able to explain yourself.
Guideline Compliance for Small Clinics: How Far to Go
Japan's three-ministry guidelines apply regardless of facility size — but a ten-person clinic cannot build what a 500-bed hospital builds. What to do first, what can wait, why backups and access control come first, what your vendor can carry, and what a small practice must still do itself.
Designing ISMS Scope for a Healthcare Company
How to draw ISMS scope when medical-data businesses and non-medical businesses coexist in one company: how far to extend it across development, operations, and support, and which line on the certificate your customers actually read. A practical guide to widening or narrowing scope in healthcare.
Incident Response Planning for Healthcare Providers: Who Decides What, and How Care Continues
How to build an incident response plan for a hospital or clinic around three questions: who decides, how people are reached, and how clinical care continues. Framed by Japan's FY2026 fee revision, which made BCP development and drills a requirement of the new coordinated-records add-on.
Learning from the Structure of Incidents: Failure Patterns Common to Healthcare
Published cyber incidents at healthcare providers share a structure regardless of the institution: a known vulnerability in a perimeter device as the entry point, backups encrypted alongside production, undocumented recovery procedures, contact lists trapped inside the affected system. Seven patterns and what to do about each.
Building an Incident Response Procedure (for Service Providers)
How to design an incident response procedure for a healthcare company across five stages — detect, report, assess, respond, learn. Covers lowering the barrier to reporting, the criteria that separate an event from an incident, wiring customer-hospital notification duties and statutory reporting deadlines into the procedure, and designing tabletop exercises.
Building an Information Asset Register
How to build an information asset register you can actually maintain: choosing the right granularity (and why one row per laptop is a mistake), what to include across servers, SaaS, paper and undocumented know-how, how to build usable confidentiality/integrity/availability scales, and the update triggers that stop the register going stale — with worked healthcare examples.
Writing an Information Security Policy
What the standard actually requires of an information security policy, how to split the public version from the internal one, the recognisable patterns of a policy so abstract it decides nothing, and how the policy connects to the security objectives of Clause 6.2 — with examples of the sentences a healthcare company should add.
Running an Internal Audit: Plan, Checklist, Report
An internal audit can be made to look complete in half a day, but that produces no improvement. This article covers independence — not auditing your own work — the annual audit programme and scope, how to write a checklist that actually finds things, the line between a nonconformity and an observation, report structure, and what to watch when a small organisation brings in outside auditors.
ISMS-AC, UKAS and ANAB: Choosing an Accreditation Body
ISMS certification has two tiers: accreditation bodies and certification bodies. This article explains the difference between ISMS-AC, UKAS and ANAB, what accreditation actually guarantees, and the practical rule of thumb — ISMS-AC for domestic business, a UKAS or ANAB mark alongside it when overseas counterparties are reading your certificate.
When ISMS Becomes a Condition of Trade: Hospital, Pharma and Government Procurement
Why hospitals require ISMS certification from suppliers: how their own obligations under Japan's three-ministry guidelines propagate down the supply chain, how the requirement is worded in pharmaceutical and public-sector procurement documents, the difference between mandatory and scored criteria in tenders, and how to negotiate before you are certified.
The Benefits and Drawbacks of ISMS Certification
An honest two-sided look at ISO/IEC 27001 certification: what it actually buys you — market access, internal control, and the ability to explain yourself after an incident — against the first-year effort, the recurring audits, and the risk of the system becoming an empty ritual. Includes the cases where not certifying is the right call.
The Full Cost of ISMS Certification: Audit Fees, Consulting, and Internal Effort
A structural breakdown of what ISO/IEC 27001 certification costs, in three layers: audit fees, consulting fees, and internal effort. Why you must compare over three years rather than year one, a checklist of what to verify in every quote, and how to estimate the most overlooked cost of all — your own team's time.
The ISMS Timeline: What Six Months Actually Looks Like
A stage-by-stage account of the standard six-month path to ISO/IEC 27001 certification, including where the internal load actually falls. The hinge is a constraint people miss: you need records of one completed cycle of internal audit and management review. Here is how to schedule backwards from the audit date — and why timelines slip.
ISMS Document Architecture: What to Write and How Far to Go
Too many ISMS documents breaks operation as surely as too few. This article separates the documented information the standard explicitly requires from what the organisation decides it needs, lays out the policy / procedure / work-instruction / record hierarchy, and gives the criteria that keep you from building an impressive architecture nobody reads.
What Is an ISMS (ISO/IEC 27001)? A Complete Guide for Healthcare Companies
A complete overview of ISO/IEC 27001 from the perspective of a healthcare company: the structure of the standard, its 93 controls, the certification process and timeline, the cost breakdown, how it differs from the Privacy Mark, and how it connects to Japan's three-ministry healthcare guidelines.
When Not to Certify: ISMS vs Answering Security Check Sheets
A cost comparison between answering customer security questionnaires one by one and obtaining ISMS certification: how to think about the break-even point as the number of questionnaires grows, and the situations where a certificate is optional versus where its absence is disqualifying.
Defining the Scope of Your ISMS
How to decide what your ISMS covers, framed as practical judgement calls: whole company or one division, drawing physical and logical boundaries, how cloud services and suppliers are handled, and the trade-off between a narrow scope that costs less and a certificate whose stated scope has to satisfy the customers asking for it — with worked examples from healthcare businesses.
ISMS for Small Organisations: Certifying With Fewer Than 50 People
What works in a small organisation's favour when certifying an ISMS — narrow scope, fast agreement — and what works against it: no separation of duties, no independent internal audit. How to document role overlap defensibly, and which roles can legitimately be outsourced.
Adapting Template Procedures to Your Organisation
Using ISMS template procedures unchanged is very likely to surface at the stage 2 audit. This article shows the routes by which it surfaces, the criteria for cutting clauses that do not match how you work, the principle of never writing a rule you cannot keep, and how to handle verb forms, frequencies and proper nouns — with worked rewrites and the auditor questions that expose templates.
Integrating ISMS Documents with the Three-Ministry Guidelines
Treating your ISMS and Japan's three-ministry healthcare guidelines as separate projects doubles the procedures, doubles the records, and stalls operation. How the guidelines split between hospitals (MHLW) and suppliers (METI/MIC), how to map ISMS documents onto supplier requirements, and how to derive hospital-facing material from the ISMS set.
ISMS vs Privacy Mark: Which One Should You Take?
A structured comparison of ISO/IEC 27001 and Japan's Privacy Mark across four axes: what each protects, how scope is defined, audit frequency, and recognition. Includes the practical difference over whether you can certify a single division, how to read what a client is really asking for, and a decision table for healthcare companies.
ISMS vs SOC 2: Choosing for Overseas Deals and SaaS Businesses
How ISO/IEC 27001 and SOC 2 differ at the level of what they are: a certification versus an attestation report. Covers the Trust Services Criteria, Type 1 versus Type 2, how each is disclosed to counterparties, and which a Japanese healthcare company should pursue first.
ISO/IEC 27001:2022 — What Changed from the 2013 Edition
The transition deadline of 31 October 2025 has passed and new certifications target the 2022 edition. You still need the diff, because internal documents, books, and third-party material written against the 2013 edition remain in circulation. The 114-to-93 restructure (58 updated, 24 merged, 11 new), four themes replacing fourteen categories, attributes, and the main-text changes.
Clause 10: Improvement — Nonconformity and Corrective Action
From detecting a nonconformity to completing corrective action and reviewing its effectiveness. The difference between correction (containment) and corrective action (removing the cause), the typical ways root cause analysis stays shallow, when and how to review effectiveness, and how to leave a record of continual improvement.
ISO/IEC 27001 Clause 4: Context of the Organisation
Clause 4 is the first gate in building an ISMS. This article translates it into practical steps: identifying internal and external issues, determining interested parties and their requirements, and defining the ISMS scope. Getting scope wrong here locks in both audit cost and operational load — with the healthcare-specific considerations that go with it.
ISO/IEC 27001 Clause 5: Leadership and Top Management's Responsibility
Clause 5 asks the executive team for far more than a signature on a policy: integrating the ISMS into business processes, providing resources, and being accountable for its effectiveness. This article covers writing the information security policy, assigning roles and authority, and what the management interview at audit is really testing — with healthcare examples.
ISO/IEC 27001 Clause 6: Planning — Risk Assessment and Security Objectives
Clause 6 is the heart of an ISMS. This article turns it into practice: designing risk criteria, running the risk assessment, producing the risk treatment plan and Statement of Applicability, and setting information security objectives — including how the 93 Annex A controls relate to inclusion decisions, and the risk-owner question auditors always ask.
ISO/IEC 27001 Clause 7: Support — Competence, Awareness and Documented Information
Clause 7 covers the foundations that keep an ISMS running: resources, demonstrating competence through training and evaluation records, how competence differs from awareness, internal and external communication, and control of documented information — versioning, approval, distribution and retention. Practical guidance on avoiding record-keeping findings, with healthcare examples.
ISO/IEC 27001 Clause 8: Operation
Clause 8 is where you do what you planned and leave evidence that you did. Operational planning and control, change management, externally provided processes, and periodic or triggered risk assessments. Why this is the clause where thin records surface first in an audit, and how to keep evidence that holds up.
Clause 9: Performance Evaluation — Monitoring, Measurement, and Internal Audit
Clause 9 of ISO/IEC 27001 comprises monitoring and measurement, internal audit, and management review. How to decide what to measure (never set an objective you cannot measure), how to secure auditor independence in a small organisation, and how to avoid gaps in management review inputs — the cycle you must complete once before certification.
ISO 27017 and ISO 27018: The Cloud Add-Ons to ISO 27001
How ISO/IEC 27017 (cloud security controls) and ISO/IEC 27018 (protection of PII in public clouds) sit on top of an existing ISO 27001 certification, why the controls differ for cloud providers and cloud customers, and when a healthcare SaaS company should — or should not — add them.
ISO 27701 (PIMS): Connecting Privacy to Your ISMS
ISO/IEC 27701 specifies a privacy information management system (PIMS); since the 2025 edition it is a standalone standard rather than an extension of ISO 27001. This article covers how it relates to ISO 27001, why controls split between PII controllers and PII processors, how it is used to demonstrate GDPR alignment, and when a PHR or healthcare SaaS operator should consider it.
Running a Management Review and Writing the Minutes
How to make the ISMS management review an actual decision-making forum rather than a status briefing: assembling the inputs the standard requires, the four kinds of decision top management must make, the right level of detail for the minutes, and whether once a year is really enough — with healthcare examples.
Requirements for External Storage of Medical Information: What Can Leave the Hospital
What is required when clinical records are stored outside the hospital: the three principles of electronic storage (authenticity, legibility, preservability), where responsibility sits, what must be secured by contract, the questions cloud raises, and data return at the end of a contract.
Securing Network-Connected Medical Devices: Protecting Equipment That Cannot Be Patched
Imaging systems, patient monitors, analysers. Network-connected medical devices often run an operating system that stopped receiving support years ago. This article explains why patching is structurally hard, how to defend such devices through network segmentation, and what to specify at the next procurement.
The Medical Information System Security Manager: Role and Appointment
Japan's FY2026 fee revision made the appointment of a dedicated medical information system security manager a condition of the new electronic clinical information coordination add-on. Who should be appointed, how dual-hatting is treated, what the role actually owns, and how a small clinic can make it work in practice.
ISMS for Healthcare SaaS: Assessing Multi-Tenant Risk
In healthcare SaaS, where many hospitals share one platform, tenant separation sits at the centre of ISMS risk assessment. Logical versus physical separation, data location and cross-border transfer, backup and restore isolation, tenant administrator privileges, and a workable answer to per-customer audit demands.
The METI/MIC Guidelines: What Is Required of Service Providers
Of the two documents behind Japan's "three-ministry, two-guideline" framework, the METI/MIC guideline governs the provider side. This article organizes what providers are expected to do, in practical terms, and shows how a hospital can use the same document as a lens for evaluating vendors.
Deploying Multi-Factor Authentication Under Clinical Constraints
Where to start with MFA (remote access and privileged IDs first), how to handle the operational load specific to clinical settings — shared terminals, emergencies, night shifts — and how to reduce risk meaningfully without attempting an all-staff rollout.
Network Segmentation and Asset Management: Knowing What Connects to What
The biggest problem in hospital security is not knowing what connects to what. Segment design across billing, EMR, departmental systems and networked medical devices; controlling internet connectivity; and building an asset register that is actually usable — laid out as a sequence a small team can follow.
Designing a Password Policy That a Hospital Can Actually Follow
How to set length, complexity, and rotation. Whether to force periodic changes at all. How to detect reuse. And how to reconcile any of it with the shared terminals on a ward or in an outpatient clinic. A practical guide to revising a hospital password policy, informed by how international guidance has shifted.
Phishing Simulations: Raise the Report Rate, Not Lower the Open Rate
Rethinking phishing simulations in healthcare from the objective up: why targeting a lower open rate suppresses reporting, how to design a no-blame exercise, building scenarios, following up afterwards, and which metrics actually matter.
ISMS for PHR Operators: The Relationship with Japan's Personal Information Protection Act
Much of what a PHR operator handles — checkup results, clinical records — is 'special care-required personal information' under Japanese law, requiring consent to collect and barring opt-out third-party provision. How the government's basic policy for private PHR operators divides labour with an ISMS, and where consent design lands in ISMS documentation.
Putting Security into Your Procurement Requirements for Medical Information Systems
Where and how to write security requirements into a procurement specification for an EMR or departmental system: why asking after contract signature does not work, concrete wording for making guideline compliance a requirement, whether to treat certifications such as ISO/IEC 27001 as mandatory or as scored criteria, and how to verify that requirements were actually met.
Ransomware Defence for Hospitals: Why You Are Targeted and Where to Start
Why hospitals are structurally attractive ransomware targets, the intrusion patterns common to publicly disclosed incidents, and how to build defence in depth. With security controls now tied to reimbursement under Japan's FY2026 fee revision, we lay out seven measures — backup, edge devices, segmentation, privilege, logging, authentication, endpoints — in priority order.
First Response to Ransomware: What to Do in the First Hour and the First Day
A timeline-based guide to the first hour and first day after a ransomware incident at a healthcare provider: the disconnection decision, whether to power down, how to think about ransom demands, how to call for outside help, and why contemporaneous records matter.
Preparing for Recertification in Year Three
ISO/IEC 27001 certification runs on a three-year cycle ending in a recertification audit. Unlike surveillance, it re-evaluates the effectiveness of the whole ISMS rather than sampling parts of it. How to present three years of accumulated improvement, when to revisit your scope, and a backward-planned schedule that avoids letting the certificate lapse.
Securing Remote Maintenance: Managing Vendor Support Connections
Vendors need a way into hospital networks to maintain EMRs and departmental systems. That maintenance path is essential to operations — and it is also a way in from outside. This article sets out what a hospital can control itself: ending always-on connections, restricting where connections may originate, keeping work records, and writing the terms into the contract.
Managing USB Drives and Removable Media in Hospitals
USB drives, optical media, and external disks stay in use however firmly they are banned, because clinical work needs them: transferring images, preparing a conference presentation, moving data between devices. This article covers restricting them, encrypting them, keeping a register — and the measure that actually works, providing a usable alternative.
Drawing the Line: Demarcating Responsibility Between Hospitals and Vendors
When a system fails or data leaks, where does the hospital's responsibility end and the vendor's begin? A practical guide to shared responsibility in the cloud, the six areas that most often stay ambiguous, and how to write the answer into contracts and SLAs.
How to Run a Risk Assessment: Designing the Criteria
A practical guide to ISO/IEC 27001 risk assessment, approached through the design of the criteria: asset-based versus scenario-based methods and when each fits, whether to use a three- or five-point scale, how to fix the criteria so repeated assessments stay comparable, and how to assign risk owners — with the risk entries healthcare companies need but generic registers miss.
Risk Treatment Plans and Accepting Residual Risk
How to choose among the four risk treatment options — reduce, avoid, transfer, accept — who approves residual risk and how, and why a treatment plan without owners and deadlines cannot feed Clause 9 monitoring. Includes why missing acceptance records are a guaranteed audit finding, and the record format that avoids it, with healthcare worked examples.
SaMD: How ISMS Relates to QMS (ISO 13485)
Companies building Software as a Medical Device carry both a quality management system (ISO 13485) and an ISMS. One protects patients from harm, the other protects information assets. Whether to run two documentation sets or integrate them — including how design controls and ISO 14971 risk management fit in.
Designing Security Awareness Training: Operating at 100% Completion
Sending one e-learning module a year does not meet the requirement. This article separates competence from awareness as the standard does, designs role-based and organisation-wide training, sets out what a completion record must contain, covers mid-year joiners, returners and contractor personnel, and explains why the target has to be 100% rather than 95%.
Building a Security Governance Structure in a Hospital, Including One-Person IT Departments
How to build a security governance structure in a healthcare provider: who is accountable, how to constitute a committee, and what executive involvement actually means — including a realistic design for hospitals with a single IT staff member.
Setting Information Security Objectives and KPIs
Badly written security objectives sit unused for a whole year. This article explains why "zero incidents" fails as an objective, what "measurable" actually requires, how to fix the metric, target, deadline and evaluation method together, and how to cascade objectives to departments — with a worked objectives register and healthcare examples.
Writing SLAs and Responsibility Boundaries: Why Uptime Alone Is Not Enough
Why a 99.9% uptime figure protects nothing in a medical information system SLA. Time to first response, recovery targets (RTO/RPO), notification thresholds, how to draw the responsibility boundary, and what actually happens when the SLA is missed — the items to settle before signing.
Designing Security Training and Drills That Work in a Hospital
Designing security training for healthcare staff on the assumption that nobody has spare time: the minimum everyone needs, what to split by role, how to set frequency and delivery, and how to keep records that stand up to scrutiny.
What Stage 1 (Documentation Review) Actually Examines
Stage 1 of an ISO/IEC 27001 audit is not a check that your documents exist. It examines whether your risk assessment, Statement of Applicability, and procedures connect logically. This article covers how the one-to-two-day review runs, the findings that recur, and what to do between stage 1 and stage 2.
What Stage 2 (On-Site Audit) Actually Examines
Stage 2 of an ISO/IEC 27001 audit checks whether you operate as you decided — verified against both records and reality. This article covers how the two-to-three-day audit runs, what staff interviews ask, what is checked on the floor, where executives are expected, and what to prepare.
How to Write a Statement of Applicability (SoA)
The Statement of Applicability records, for each of the 93 Annex A controls, whether it applies and why. How to link it to risk assessment results, how to structure the columns, how to justify exclusions, and when to update it — with a worked layout. It is the document auditors open first and keep returning to.
Supplier Security Management: Questionnaires and Contract Clauses
Designing supplier security management across four stages — selection, contract, monitoring, exit. Covers tiering suppliers by criticality, keeping questionnaires from becoming theatre, the clauses that must be in the contract (sub-processing, audit rights, incident notification, data deletion), how to treat cloud providers, and how this connects to Japan's three-ministry guidelines when medical information is involved.
Supply Chain Risk for Hospitals: Seeing the Suppliers You Cannot See
A hospital's security does not end at its own walls. Invisible sub-subcontractors, paths through departmental systems and medical device manufacturers, intrusion by way of partners and affiliated facilities. Where the risk sits structurally, how to prioritise visibility with limited staff, and what to fix in contracts and operations.
Preparing for the Surveillance Audit
ISO/IEC 27001 certification is not a one-off: a surveillance audit follows every year. How it differs from the initial audit, what twelve months of operating records must show, how to evidence closure of previous findings, and when and how to report changes to your organisation, systems, and scope — with an annual schedule and a preparation checklist.
Questions to Ask Your Vendor: Telling a Good Answer from a Worrying One
A ready-to-use list of the questions a hospital should put to its system vendors. Across five areas — organisation, data location, incident response, subcontracting, and end of contract — each question comes with why it is asked, what a good answer looks like, and what a worrying one looks like.
Security Check Sheets for Vendors: What to Ask, and How
How to design the security check sheet a hospital sends to its system vendors. Six domains — organisation, subcontracting, incident response, data location, deletion, and audit rights — set out as tables, with guidance on phrasing questions so answers cannot be a row of 'yes, we comply', and on how to read what comes back.
Managing VPN Device Vulnerabilities: Perimeter Operations for Hospitals
Known vulnerabilities in internet-facing devices recur in disclosed hospital incidents. Why perimeter devices become the entrance, what to inventory, how to build patch operations that do not stall, how to handle end-of-life equipment, and why multi-factor authentication has to sit alongside patching.
Securing Hospital Wi-Fi: Separating Clinical and Patient Networks
In many hospitals the clinical network and the patient guest network share the same access points. This article covers how to separate them, how to choose encryption and authentication, how to handle devices staff and patients bring in, and the physical fact that radio does not stop at the building line.
Cloud Security for Medical Institutions: Shared Responsibility, the Three-Ministry Guidelines, and Zero Trust
As cloud adoption spreads in healthcare, this guide organizes cloud security—the shared-responsibility model, the three-ministry guidelines, data residency (cross-border transfer), encryption/key management/IAM/audit logs, zero trust, and third-party certifications (ISMS/ISO 27017/ISMAP).
Implementing the Three-Ministry Guidelines: Practical Steps, Accountability, and Risk Assessment
Beyond 'what are the guidelines': a practitioner's walkthrough of implementation—asset inventory, risk assessment, the three storage principles, accountability boundaries with cloud vendors, auditing, and BCP.
The Three Ministries' Two Guidelines Explained Simply: Essential Checks When Adopting an EMR
The "Three Ministries' Two Guidelines" always comes up when choosing an EMR. What do they stipulate, and what should medical institutions check? This article explains the points to grasp at adoption, avoiding jargon.
Talk to us about ISMS certification
From scope design and documentation to training, internal audit, and dealing with the certification body. Pottech supports healthcare companies through ISO/IEC 27001 certification end to end.
We will respond to your inquiry within 2 business days.