Model Answer Strategy:
"ISO 27001 provides the technical and operational backbone for DPDP Act compliance. Under Section 8(5) of DPDP and Rule 6 of the 2025 Rules, Data Fiduciaries must implement 'reasonable security safeguards' to prevent breaches. DPDP does not prescribe technical configurations — ISO 27001's controls in access control (A.8.2), encryption (A.8.24), logging (A.8.15), and incident handling (A.5.24) directly constitute those safeguards.

However, ISO 27001 alone does not cover legal privacy principles like consent notices, Consent Manager integration, data erasure requests, and Data Principal grievance workflows. Therefore, we use ISO 27001 for technical security while layering DPDP-specific privacy procedures on top — all before the ~May 2027 full-enforcement deadline."

Model Answer Strategy:
"I activate our 5-stage Computer Security Incident Response Plan (CSIRP):
1. Containment (Hour 0–2): Isolate infected segments immediately at the firewall/switch level to stop lateral movement, while preserving forensic volatile memory and firewall/SIEM logs.
2. Triage & Impact Assessment (Hour 2–6): Determine scope: was patient health information exfiltrated or merely encrypted? Verify integrity of air-gapped/immutable backups.
3. Regulatory Clocks: CERT-In within 6 hours for the cyber incident; under DPDP Rules, notify Data Principals without delay and submit the detailed report to the Data Protection Board within 72 hours. I coordinate Legal and CXOs in parallel.
4. Eradication & Recovery: Rebuild systems from validated clean backups, patch entry vulnerabilities, reset all domain credentials.
5. Post-Incident Review: Root cause analysis, updated threat intelligence, and audit evidence submission."

Model Answer Strategy:
"Security should never impede patient life-safety. We implement Frictionless Security:
• Role-Based Access Control (RBAC): Doctors automatically see assigned ward patients; no complex administrative menus.
• Break-Glass Procedures: In emergency trauma cases, doctors can access unassigned charts with a single logged 'Emergency Access' override button that triggers an alert and requires retrospective justification.
• Badge/RFID Tap + Fast PIN: Replace repeated 16-character password logins on clinical workstations with smart badge authentication and auto-lock screen timers.
• Education: Training clinicians on why protecting charts shields them and the hospital from legal liabilities."

Model Answer Strategy:
"I implement an Annex A.5.19–A.5.22 Supplier Security Governance framework:
1. Pre-engagement Assessment: Require vendors processing patient data to complete a security questionnaire and demonstrate ISO 27001/SOC 2 certifications.
2. Mandatory DPA (Data Protection Addendum): Incorporate DPDP Act obligations: data processing only under instruction, no sub-contracting without consent, mandatory breach reporting within 24 hours to HIIMS, and deletion upon contract end.
3. Technical Controls: API integration via encrypted endpoints (TLS 1.3), IP whitelisting on firewalls, least-privilege service accounts, and API access logging.
4. Annual Vendor Audit: Periodic re-evaluation of high-risk vendors — the Change Healthcare and 2026 vendor-wave attacks prove this control is existential."

Model Answer Strategy:
"Both sectors share three mission-critical characteristics: Zero Tolerance for Downtime (24x7 Operations), Strict Regulatory Compliance (ISO frameworks), and Multi-Site Distributed Architecture.

At Coca-Cola India plant and Ludhiana Steel Rolling Mills, any network downtime halts production lines and causes massive revenue loss. In healthcare, downtime directly impacts clinical patient care. The technical controls I operated — Checkpoint/Fortinet firewalls, Active Directory PAM, centralized logging, and immutable backups — are identical. The transition is adapting the terminology and workflows to NABH IMS and hospital clinical software (HIS/EMR), which I am fully equipped to do."

Model Answer Strategy:
"The Statement of Applicability (Clause 6.1.3d) is the single most important operational document in ISO 27001. It is a comprehensive matrix of all 93 controls from Annex A. For each control, the organization must explicitly document:
1. Whether it is Applicable or Excluded.
2. The justification (risk assessment result, legal requirement, contract obligation).
3. The implementation status (implemented, in progress).
4. The link to policies, procedures, and audit evidence.
External certification auditors spend up to 70% of their time verifying the SoA against actual live operations."

Model Answer Strategy:
"I ensure that our technical IT controls produce the exact documentary evidence NABH assessors demand under the IMS chapter:
• Confidentiality: Access control policies and user privilege review logs proving only authorized clinical staff access specific patient files.
• Disaster Recovery: Demonstrated RTO and RPO benchmarks with signed records of quarterly restoration drills.
• Audit Trails: Verifiable logs showing who viewed, edited, or printed clinical records.
• Downtime SOP: Documented Business Continuity Plans detailing how doctors maintain medical records during power or network outages."

Model Answer Strategy:
"I can deliver enterprise-grade compliance and monitoring using proven open-source and existing assets:
• GRC & Compliance Management: Deploy CISO Assistant or Eramba Community to manage the ISMS framework, risk register, and SoA at zero software cost.
• SIEM, Log Analysis & File Integrity: Implement Wazuh across all hospital servers. Wazuh gives us automated compliance monitoring for ISO 27001, PCI-DSS, and HIPAA out of the box.
• Vulnerability Management: Use OpenVAS/Greenbone and Nmap for routine vulnerability assessments.
• Perimeter & Network: Maximize existing enterprise firewalls (Fortinet / Checkpoint) with granular zone segmentation.
This establishes solid audit compliance before committing to high-cost SaaS platforms like Vanta or OneTrust."

Model Answer Strategy:
"Days 1–30 (Discovery & Rapid Risk Assessment):
• Map all personal data flows and clinical systems across Head Office and sample hospitals.
• Meet key stakeholders (Clinical Heads, Quality/NABH Lead, IT Infrastructure, HR, Legal).
• Audit current Active Directory privileges, firewall rules, and backup restoration validity.

Days 31–60 (Framework & High-Risk Remediation):
• Establish ISMS Steering Committee and draft the Information Security Policy.
• Complete ISO 27001 Gap Analysis and initial Risk Register.
• Enforce immediate quick wins: User Access Reviews, MFA on administrative portals, deploy centralized log collector.

Days 61–90 (Roadmap Execution & Audit Prep):
• Draft Statement of Applicability (SoA) and DPDP Incident Response / Breach Notification procedure.
• Launch basic cyber security awareness campaign for hospital personnel.
• Present the executive 12-month ISO 27001 certification and DPDP compliance roadmap — backwards-planned from the May 2027 enforcement date — to Top Management."