Skip to main content
Cyber bullying in ISO 27799

Cyber bullying in ISO 27799

$299.00
Toolkit Included:
Includes a practical, ready-to-use toolkit containing implementation templates, worksheets, checklists, and decision-support materials used to accelerate real-world application and reduce setup time.
Who trusts this:
Trusted by professionals in 160+ countries
How you learn:
Self-paced • Lifetime updates
Your guarantee:
30-day money-back guarantee — no questions asked
When you get access:
Course access is prepared after purchase and delivered via email
Adding to cart… The item has been added

This curriculum spans the design and operationalization of controls across policy, technology, and human behavior, comparable in scope to an organization-wide program integrating information security governance with behavioral risk management, akin to a multi-phase advisory engagement addressing insider threat and cultural resilience.

Module 1: Defining Cyber Bullying within Health Information Security Frameworks

  • Determine whether repeated hostile messaging among clinical staff via secure messaging platforms constitutes a reportable incident under organizational policy.
  • Map cyber bullying behaviors (e.g., targeted exclusion, rumor spreading via email) to existing ISO 27799 control objectives related to information security culture.
  • Establish criteria for distinguishing between interpersonal conflict and policy-violating cyber bullying in electronic communications.
  • Integrate definitions of cyber bullying into the organization’s information security policy to align with ISO 27799 A.6.1.2 (Segregation of Duties) where roles enable harassment.
  • Define jurisdictional boundaries for handling cyber bullying incidents that occur outside work hours but involve work-issued devices.
  • Align internal cyber bullying definitions with regional legal standards (e.g., EU Directive 89/391/EEC, U.S. state laws) to ensure policy enforceability.
  • Develop classification tiers (low, medium, high severity) for cyber bullying incidents based on impact to information confidentiality, integrity, or availability.
  • Specify data sources (email logs, chat metadata, access records) to be preserved during preliminary investigations of alleged incidents.

Module 2: Risk Assessment and Threat Modeling for Interpersonal Cyber Threats

  • Conduct threat modeling exercises that include insider actors who misuse authorized access to target colleagues via digital channels.
  • Assess the risk of information leakage resulting from retaliatory disclosures by victims of cyber bullying.
  • Include social engineering vectors in risk assessments where perpetrators manipulate access permissions or escalate privileges to harass.
  • Quantify the impact of degraded team collaboration on incident response effectiveness during security events.
  • Identify high-risk roles (e.g., system administrators, data stewards) where power imbalances may facilitate coercive online behavior.
  • Evaluate third-party collaboration platforms (e.g., shared cloud workspaces) for potential misuse in cyber bullying campaigns.
  • Incorporate psychological safety metrics into information security risk registers as contributing factors to human-related threats.
  • Update risk treatment plans to include behavioral mitigation controls alongside technical safeguards.

Module 3: Policy Development and Integration with ISO 27799 Controls

  • Modify A.7.2.2 (Information Security in Job Descriptions) to include expectations for respectful digital communication.
  • Enforce A.8.1.1 (Inventory of Assets) by requiring users to report unauthorized use of shared devices in harassment incidents.
  • Implement A.8.2.1 (Classification of Information) to restrict access to sensitive staff data that could be weaponized in bullying.
  • Apply A.8.3.3 (Electronic Messaging) to monitor and audit misuse of email and messaging systems for hostile communications.
  • Strengthen A.11.2.7 (Use of Encryption) to protect private employee communications during formal complaints.
  • Enforce A.13.2.3 (Use of Cryptographic Controls) to secure evidence collected during cyber bullying investigations.
  • Integrate A.16.1.5 (Assessment of Information Security Events) to include behavioral indicators of digital harassment.
  • Customize A.18.1.3 (Privacy and Protection of Personally Identifiable Information) to protect complainants and respondents during investigations.

Module 4: Technical Controls for Detection and Monitoring

  • Configure SIEM rules to flag repeated access to a colleague’s EHR by a non-treating staff member following a conflict.
  • Deploy DLP policies to detect exfiltration of private employee data used in public shaming campaigns.
  • Enable audit logging on collaboration tools to capture timestamps, IP addresses, and message content for incident reconstruction.
  • Implement keyword alerting on internal communication platforms for terms associated with harassment, calibrated to avoid false positives.
  • Restrict screen capture and forwarding functions in clinical messaging apps to prevent non-consensual sharing of communications.
  • Use UEBA tools to identify anomalous behavior patterns, such as sudden spikes in after-hours messaging to a single recipient.
  • Preserve metadata integrity in archived messages to ensure admissibility during disciplinary proceedings.
  • Balance monitoring capabilities with privacy requirements under HIPAA and GDPR when analyzing employee communications.

Module 5: Incident Response Planning for Cyber Bullying Events

  • Define inclusion criteria for activating the incident response team when cyber bullying compromises system access or data integrity.
  • Assign roles within the CSIRT for handling human-factor incidents, including liaison with HR and legal departments.
  • Establish chain-of-custody procedures for digital evidence collected from mobile devices and workstations.
  • Develop playbooks for scenarios such as coordinated smear campaigns using spoofed accounts or leaked credentials.
  • Coordinate containment actions that avoid public exposure of victim identities during internal investigations.
  • Integrate communication holds and access revocation into response workflows when perpetrators have administrative privileges.
  • Conduct post-incident reviews that assess not only technical failures but also cultural and procedural weaknesses.
  • Ensure incident logs are stored separately from HR records to maintain audit independence under ISO 27799 A.16.1.4.

Module 6: Role-Based Access Control and Privilege Management

  • Enforce least privilege in EHR systems to prevent clinicians from accessing records of colleagues outside their care team.
  • Review access logs quarterly for evidence of privilege misuse in targeting specific individuals through data access.
  • Implement time-bound access for temporary staff to reduce opportunities for relationship-based harassment.
  • Restrict administrative rights on messaging platforms to prevent deletion of evidence by perpetrators.
  • Apply segregation of duties between IT support roles to prevent collusion in surveillance or data manipulation.
  • Require dual authorization for access to employee communication archives during investigations.
  • Automate deprovisioning of access upon termination to prevent post-employment harassment using retained credentials.
  • Monitor privileged user activity for signs of coercion, such as repeated failed access attempts to a colleague’s account.

Module 7: Training and Behavioral Change Programs

  • Deliver role-specific training for supervisors on identifying early signs of cyber bullying in team communications.
  • Incorporate simulated phishing exercises that include social manipulation tactics used in workplace harassment.
  • Require annual attestation of acceptable use policies covering digital conduct, linked to access renewal.
  • Train IT staff to recognize and escalate potential cyber bullying incidents detected during routine monitoring.
  • Develop case studies based on anonymized internal incidents to illustrate policy violations and consequences.
  • Integrate bystander intervention techniques into security awareness programs for clinical and administrative staff.
  • Measure training effectiveness through changes in reporting rates and reduction in repeat incidents.
  • Customize content for high-risk departments such as emergency medicine or IT, where stress and access converge.

Module 8: Legal and Regulatory Compliance Considerations

  • Document how cyber bullying policies support compliance with occupational health and safety regulations.
  • Ensure investigation procedures comply with data subject rights under GDPR when collecting employee communications.
  • Coordinate with legal counsel to assess liability for failing to act on reported digital harassment incidents.
  • Retain audit logs for minimum statutory periods required by jurisdiction for employment-related claims.
  • Classify cyber bullying incidents in breach reports to regulators when personal data is disclosed as part of retaliation.
  • Validate that monitoring practices adhere to the Electronic Communications Privacy Act (ECPA) in the U.S.
  • Obtain informed consent from employees regarding the scope and purpose of digital communication monitoring.
  • Align disciplinary actions with labor laws to avoid claims of unfair dismissal or retaliation.

Module 9: Metrics, Audit, and Continuous Improvement

  • Track mean time to detect and resolve cyber bullying incidents as a KPI for security operations.
  • Conduct annual audits of access logs to verify compliance with segregation of duties in high-risk systems.
  • Measure policy adherence through random sampling of messaging platform usage against acceptable use criteria.
  • Use employee surveys to assess perceived safety in digital work environments, correlated with incident reports.
  • Review false positive rates in monitoring systems to optimize detection rules without eroding trust.
  • Report cyber bullying metrics to the information security steering committee as part of risk dashboarding.
  • Validate that training completion rates are higher in departments with documented prior incidents.
  • Update control effectiveness ratings in the Statement of Applicability (SoA) to reflect changes in behavioral risk.
!