A Study of the ISO/IEC 27001:2022-Based Framework for Hospital Data Backup System Management
Keywords:
ISO/IEC 27001; Information Security; Data Backup; Data Management; HealthcareAbstract
Medical information is a critical asset for hospitals. However, as cyber threats, especially ransomware, intensify, an effective data backup system aligned with international standards has become an urgent necessity. This article aims to study the ISO/IEC 27001:2022 framework for hospital data backup management. It focuses on analyzing the relevant requirements in Appendix A and synthesizing them into a practical framework using the PDCA quality cycle. This framework serves as a model for data backup management to ensure security and compliance with personal data protection laws. The expected outcome is that hospitals will establish a robust and secure backup management process, mitigating risks from threats and ensuring compliance with personal data protection laws, thereby sustainably enhancing the organization’s security posture.
References
ฝ่ายสารสนเทศ. (2560). ฝ่ายสารสนเทศ ผ่านการรับรองมาตรฐาน ISO27001 มาตรฐานเกี่ยวกับการบริหารจัดการสารสนเทศให้มั่นคงปลอดภัย. กรุงเทพฯ: คณะแพทยศาสตร์ศิริราชพยาบาล มหาวิทยาลัยมหิดล.
สำนักงานคณะกรรมการการรักษาความมั่นคงปลอดภัยไซเบอร์แห่งชาติ. (2567). แนวทางการดำเนินงานด้านการรักษาความมั่นคงปลอดภัยไซเบอร์ สำหรับโรงพยาบาลของรัฐ. สืบค้นจาก https://drive.ncsa.or.th/s/8tnTy6GTBenT5M6
Brezavšček, A., & Vidmar, D. (2023). Spremembe, ki jih prinašajo nove različice v družini standardov za informacijsko varnost ISO/IEC 27000 [Changes brought by new versions in the ISO/IEC 27000 family of information security standards] (pp. 179-195). In 42nd International Conference on Organizational Science Development. Retrieved from https://doi.org/10.18690/um.fov.3.2023.15
Guo, H., Wei, M., Huang, P., & Chekole, E. (2021). Enhance enterprise security through implementing ISO/IEC 27001 standard (pp. 1-6). 2021 IEEE International Conference on Service Operations and Logistics, and Informatics. New York: IEEE Press.
International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—Information security management systems—Requirements. Switzerland: ISO.
Lobur, M., Shcherbovskykh, S., & Stefanovych, T. (2020). Availability audit of IoT system data reserved by 3-2-1 backup strategy based on fault tree and state transition diagram analysis (pp. 343-346). 2020 IEEE 15th International Conference on Computer Sciences and Information Technologies. New York: IEEE Press.
Malatji, M. (2023). Management of enterprise cyber security: A review of ISO/IEC 27001:2022 (pp. 117-122). 2023 International Conference on Cyber Management and Engineering. New York: IEEE Press.
Soraya, Oktoriyani, E. N., & Mawan, M. S. A. (2025). Evaluasi keamanan dan privasi sistem rekam medis elektronik: Studi kasus di Rumah Sakit Wava Husada [Evaluation of security and privacy of electronic medical record systems: A case study at Wava Husada Hospital]. Jurnal Rekam Medis dan Informasi Kesehatan, 6(1), 16-24.
Tistiyani, S., Briliyant, O., & Trianto, N. (2023). Tailoring e-Government’s ICT readiness for business continuity based on Cyber-Risk approach (pp. 1-8). 2023 IEEE International Conference on Cryptography, Informatics, and Cybersecurity. New York: IEEE Press.
Wibawa, I. N. A. A., Susila, A. A. N. H., & Pasirulloh, M. A. (2024). Information security evaluation at hospital using Index KAMI 5.0 and recommendations based on ISO/IEC 27001:2022. Journal of Information Systems and Informatics, 6(4), 949-963.
Downloads
Published
How to Cite
Issue
Section
Categories
License
Copyright (c) 2025 CUAST Journal
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
