Manual de boas práticas de segurança da informação para os sistemas de telemedicina tendo como base a norma ABNT NBR ISO/IEC 27002 e o framework CIS Controls

Abstract

Organizations that use ISO/IEC 27002 and the CIS Controls framework for managing the security of their information are concerned with the reliability, integrity and availability of information meaning that they can securely manage their information. Currently, there are laws with the purpose of dealing with data protection, and these standards are relevant support in compliance with such rules. Compliance with ISO/IEC 27002 and the CIS Controls framework are mandatory for any organization that wants to remain competitive by ensuring the best market practices. The big issue to be reported is that the information protection within an organization depends on several internal and external factors that need previously to be managed. The ISO/IEC 27002 standard and the CIS Controls framework are generic to be applied in any sector, therefore not being instantiated in a good practice manual for the Telemedicine sector. In this sense, the main contribution of this study is the presentation of a proposal for oriented and systematized processes and sub-processes in the form of a manual of good practices, which direct and guide the implementation and maintenance of an information security management system for the Telemedicine, aiming to guarantee the reliability, integrity, and availability of information through the ISO/IEC 27002 standard and the CIS Controls framework. In other words, the good practices presented to serve all Telemedicine systems are intended to guarantee an acceptable degree of Information Security, preventing data from being improperly shared. For this purpose, the best practices manual was presented to guide professionals in the health sector regarding the procedures that must be adopted in telemedicine systems concerning information security.