ISO 27001 + DPDP Act Readiness for a Health-Tech Start-up

<p>Arogya Telehealth, a fictional Pune telehealth start-up, wants ISO 27001 certification to win hospital contracts, and its CEO keeps asking what India's Digital Personal Data Protection Act, 2023 means for a company that holds patients' diagnoses and prescriptions.</p><p>In four lessons you learn how an information security management system (ISMS) is built around risk, how the 93 Annex A controls are decided in a Statement of Applicability, how auditors read evidence and how to run a gap assessment, and what the DPDP Act requires: notice and consent, security safeguards, breach intimation, erasure, children's data and the rights of Data Principals. You finish with a readiness memo to the CEO in the Word lab.</p><p>You work in Bartman's in-browser GRC Workspace (Statement of Applicability, evidence tracker, control library) and Word lab. Arogya's facts and evidence pack are generated for you, so your decisions differ from everyone else's. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: ISO 27001, Statement of Applicability, Gap assessment, DPDP Act 2023, Compliance, GRC