ISO 27000 Series

The ISO 27000 series is a collection of international standards that provide a framework for establishing, implementing, maintaining, and improving information security management systems (ISMS).

Access Control Implementation (ISO 27002 Control 5.15)

# ISO 27001 compliant access control
class ISO27001AccessControl:
    def __init__(self):
        self.roles = {
            'admin': ['read', 'write', 'delete', 'admin'],
            'user': ['read', 'write'],
            'auditor': ['read', 'audit'],
            'guest': ['read']
        }
        self.access_log = []
    
    def grant_access(self, user_id, resource, action):
        user_role = self.get_user_role(user_id)
        
        # Principle of least privilege
        if action not in self.roles.get(user_role, []):
            self.log_access_attempt(user_id, resource, action, 'DENIED')
            raise PermissionError(f"Access denied for {action}")
        
        # Log successful access (monitoring requirement)
        self.log_access_attempt(user_id, resource, action, 'GRANTED')
        return True
    
    def review_access_rights(self):
        """Regular access review as per ISO 27002"""
        expired_users = self.get_expired_user_accounts()
        inactive_users = self.get_inactive_users(days=90)
        
        return {
            'expired_accounts': expired_users,
            'inactive_accounts': inactive_users,
            'review_date': datetime.utcnow(),
            'recommendations': self.generate_access_recommendations()
        }

# ISO 27035 incident management
class IncidentManagement:
    def __init__(self):
        self.severity_levels = {
            'critical': {'response_time': 1, 'escalation': 'immediate'},
            'high': {'response_time': 4, 'escalation': '2_hours'},
            'medium': {'response_time': 24, 'escalation': '8_hours'},
            'low': {'response_time': 72, 'escalation': '24_hours'}
        }
    
    def report_incident(self, description, reporter, affected_systems):
        incident = {
            'id': self.generate_incident_id(),
            'timestamp': datetime.utcnow(),
            'description': description,
            'reporter': reporter,
            'affected_systems': affected_systems,
            'severity': self.assess_severity(affected_systems),
            'status': 'reported'
        }
        
        # Immediate response for critical incidents
        if incident['severity'] == 'critical':
            self.activate_incident_response_team()
            self.notify_management()
        
        self.log_incident(incident)
        return incident['id']
    
    def conduct_lessons_learned(self, incident_id):
        """Post-incident review for continual improvement"""
        incident = self.get_incident(incident_id)
        return {
            'what_happened': incident['timeline'],
            'what_went_well': self.identify_successes(incident),
            'what_can_improve': self.identify_improvements(incident),
            'action_items': self.generate_improvement_actions(incident)
        }

Risk Assessment Framework

# ISO 27005 risk assessment implementation
class RiskAssessment:
    def __init__(self):
        self.likelihood_scale = {
            'very_low': 1, 'low': 2, 'medium': 3, 'high': 4, 'very_high': 5
        }
        self.impact_scale = {
            'negligible': 1, 'minor': 2, 'moderate': 3, 'major': 4, 'catastrophic': 5
        }
        self.risk_appetite = {
            'low': (1, 6),      # Risk scores 1-6: Acceptable
            'medium': (7, 15),  # Risk scores 7-15: Monitor and mitigate
            'high': (16, 25)    # Risk scores 16-25: Immediate action required
        }
    
    def assess_risk(self, asset, threat, vulnerability):
        # Calculate inherent risk
        likelihood = self.assess_likelihood(threat, vulnerability)
        impact = self.assess_impact(asset, threat)
        inherent_risk = likelihood * impact
        
        # Consider existing controls
        control_effectiveness = self.evaluate_controls(asset, threat)
        residual_risk = inherent_risk * (1 - control_effectiveness)
        
        risk_assessment = {
            'asset': asset,
            'threat': threat,
            'vulnerability': vulnerability,
            'inherent_risk': inherent_risk,
            'residual_risk': residual_risk,
            'risk_level': self.categorize_risk(residual_risk),
            'treatment_required': residual_risk > self.risk_appetite['low'][1]
        }
        
        return risk_assessment
    
    def generate_treatment_plan(self, high_risks):
        """Generate risk treatment plan for high-risk items"""
        treatment_plan = []
        for risk in high_risks:
            if risk['residual_risk'] >= self.risk_appetite['high'][0]:
                treatment_plan.append({
                    'risk_id': risk['id'],
                    'priority': 'immediate',
                    'recommended_controls': self.suggest_controls(risk),
                    'target_risk_level': 'medium',
                    'implementation_timeline': '30_days'
                })
        return treatment_plan