Search results

MDR Deadline

For class I, you do not need the Notified body. What you need is to implement ISO 13485:2016, and then certification body will audit your Quality Management System according to ISO 13485. 

For medical device class Ir, you need to certify it under the MDR by May 2024. There is no postponement for these device classes. 

Identifying gaps between ISO 13485 and ISO 9001

We do not have as part of our documentation toolkit any GAP analysis template. But you can look at this article for details:

• Similarities and differences between ISO 9001:2015 and ISO 13485:2016 https://advisera.com/9001academy/blog/2015/01/21/iso-9001-vs-iso-13485/

Also, you can check the Annexes in ISO 13485:2016, where you have a cross-reference table between ISO 9001:2015 and ISO 13485:2016.

Specific pharma industry question

Here are four detailed examples of risk management practices:

Microbiological Contamination Control risk:

• Management Approach: Implementing environmental monitoring programs, aseptic processing techniques, and robust sanitation practices to prevent microbial contamination. Conduct risk assessments to identify critical control points, establish microbial limits, and implement effective disinfection procedures, air filtration systems, and personnel training to mitigate the risk of microbial contamination during manufacturing.

Raw Material Quality Control risk:

• Management Approach: Implementing supplier qualification programs, quality agreements, and rigorous testing protocols to ensure the quality, purity, and identity of raw materials. Conduct risk assessments to evaluate the impact of raw material variability on the final product and establish appropriate specifications and controls to mitigate risks associated with raw material quality variations.

Process Robustness and Variability risk:

• Management Approach: Employing Quality by Design principles to design and optimize manufacturing processes, identifying critical process parameters, establishing control strategies, conducting risk assessments to understand and mitigate potential process variability, and implementing Process Analytical Technology (PAT) tools and continuous process monitoring to ensure consistency and robustness in manufacturing operations.

Packaging Integrity and Stability risk:

• Management Approach: Implement comprehensive packaging material qualification, stability testing, and integrity checks to ensure the packaging system maintains product integrity throughout its shelf-life. Conduct risk assessments to identify vulnerabilities in packaging processes and implement protective packaging, barrier systems, and appropriate storage conditions to mitigate packaging integrity and stability risks.

BIA Questionaire Assistance

Becoming third-party certification body

First, you need to get certificates that you are lead auditors for certain standards. Then you need to prepare all necessary documentation stated in standard ISO 17021-1 Conformity assessment - Requirements for bodies providing auditing and certification of management systems, Part 1: Requirements. When you prepare it, you need to pass the accreditation audit conducted by some Competent authority or National accreditation body. Each country has its own Competent authority or National accreditation body.

Only when you receive an Accreditation certificate from a Competent authority or Accreditation body, you can market yourself as a Certification body.

Here are some more information regarding certification body.

Risk Management

This is a good approach. The point is that these similar devices should have a similar intended purpose and be produced by similar technological processes. 

Will ISO 9001:2015 be updated until 2030?

ISO 9001:2015, most likely will not remain valid until the year 2030.

Currently, Technical Committee 176, Sub Committee 2, (TC 176/SC2) is already working on ISO 9001 revision.

Last July 29th the result of an ISO ballot was announced, and the majority of the National Standards Bodies comprising TC 176/SC2 voted in favor of starting the revision of ISO 9001. It will be a limited revision.

ITSCM and BCM

ITSCM and BCM should be integrated. BCM is driving ITSCM in a way that BCM defines objectives (from the business point of view). Since all business activities are usually supported by IT services – defined BCM targets directly influence ITSCM targets.

In practice, ITSCM people should talk to BCM and get inputs for their TSCM objectives. If BCM doesn't exist, ITSCM should speak directly with the business.

Read this article to get more info: IT Service Continuity Management – waiting for the big one https://advisera.com/20000academy/blog/2013/09/24/service-continuity-management-waiting-big-one/

Guidance on Missing ISMS Documentation and Implementation Drafts

1. We have the initial audit with external agencies to get the accreditation, and an agenda for the one-day assessment on November 21st has been sent to us. Please find the attached image which details the ISMS Document review. However, we are missing documents for Compliance, Operational Security, Communication, Development Security, Incident Processes, and Business Continuity Management. Could you please confirm if there are drafts available or advise on how to proceed, as I'm unable to locate them in the Conformio tool? Your guidance on this matter would be greatly appreciated.

Please note that a Compliance document is not required by the standard. In case control A.5.36, Compliance with policies, rules, and standards for information security is stated as Applicable in your SoA, the implementation method for this control is defined in the SoA document itself. If this control is not applicable to your organization, no document or activities related to compliance are required to be compliant with the standard. 

Business Continuity Management is not required by the standard. In case control A.5.29, A.5.30, or A.8.14 is stated as Applicable in your SoA, it is sufficient to implement the Disaster Recovery Plan to be compliant with the standard.   

A communication document is not required by the standard. Communication is an activity that is performed by many processes in information security according to ISO 27001, with different purposes. So, to have a centralized communication document would create an overhead for people responsible for communication with activities that may not be a part of their regular tasks.

That’s the reason there isn’t a specific template for clause 7.4.

The main documents in Conformio that define how communication needs to be done are:

• the Information Security Policy
• the Training Module
• the Incident Management Procedure
• the Disaster Recovery Plan

Additionally, most of the communication an organization performs is already registered through emails, Slack messages, etc. - so those can act as “registers.”

If you do want to create a separate Communication plan, then this article will provide you with further explanation about communication plan:

• How to create a Communication Plan according to ISO 27001 https://advisera.com/27001academy/blog/2014/10/27/how-to-create-a-communication-plan-according-to-iso-27001/

The remaining documents you mentioned are the ones as follow:

• Operational Security: Security Procedures for IT Department
• Development Security: Secure Development Policy
• Incident Processes: Incident Management Procedure

Please note that these documents will be available only if the controls that require their implementation are defined as applicable in the Statement of Applicability.

2. Additionally, for ISMS Implementation, there is a requirement for Design, Development & Test, and Facility and Asset Management. I have checked the documents, as well as the Conformio tool, but I couldn't find any drafts pertaining to these areas. Can you please advise on this?

The definition of Design, Development & Test activities are included in the Secure Development Policy.

Facilities and asset management are not commonly used documents for ISO 27001, so there aren’t specific drafts for them. In this case, you can use the blank template located in the Documents folder to create your documents.

In case you need assistance, you can schedule a meeting with one of our experts, who will help develop the documents. You can schedule a meeting here: https://advisera.com/consultations/