Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Purchasing process in branch office
Thank you so much for the clarification, that helps. Yes, the branch office actually has its own QMS so we will just define its own internal purchasing process but only for their office supplies because all the products they sell are coming from head office. -
ISO 14001 vs ISO 9001 challenges in the transition
•Documenting the QMS (what is new about this?)
•Auditing according to the new version (what are main points to include?)
Answer:
If we compare transition processes for ISO 9001 and ISO 14001 there is no much difference between them. The key changes are pretty much the same. The requirements for documents and records are now changed into requirements for documented information and in that sense the ISO 9001 suffered more changes because there are no longer mandatory procedures and quality manual, so in that sense the ISO 9001 will suffer more changes than ISO 14001 management system. For more information, see:
- New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- List of mandatory documents required by ISO 140 01:2015 https://advisera.com/14001academy/blog/2015/10/12/list-of-mandatory-documents-required-by-iso-140012015/ -
THIN CLIENTS VS. DESKTOPS
From the point of view of security, an environment with thin-clients can be equal to an environment with desktops, because basically, both are composed by devices that you use to access to information (locally o remotely), and the key is : how to protect the information and how to access to the information?
With thin-clients you can access to the information remotely, so in this case, it will be important to protect the channel of communication. With desktops, if you access to information remotely, it is also important to protect the channel of communication in the same way.
So, from my point of view the most important thing should be how to protect and how to access the information, independently of the devices or the environment. Keep also in mind that for the protection of the information – in accordance with ISO 27001- you need to perform a risk assessment & treatment, so maybe this article can be interesting for you - “ISO 27001 risk assessment & treatment – 6 basic steps” : https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/ c-steps/
And our online course can be also interesting for you, because we give more information about the risk assessment & treatment “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Replication of site A
Our goal is to get ISO27001 certification for Site A including the core systems and the supporting IT infrastructure ( the AD domain controllers and e-mail servers, network devices ). Could you please tell me how to deal with the replication servers of core system, AD domain controllers and backup server for e-mail services in Site B and C ?
Answer:
I am not sure if I have understood your question, but you can implement and certify ISO 27001 in your site A without problems, where core systems are. Regarding the backup systems, you can use them for the Disaster Recovery Plan, I mean, if the core systems of the Site A fails, systems of site B and/or C can continue providing all services related to domain controller and email.
So, for this scenario you can use the security controls o f A.17 Information security aspects of business continuity management, of the Annex A of ISO 27001:2013, and for this, our template can be useful for you “Disaster Recovery Plan” (you can see a free version clicking on “Free Demo” tab) : https://advisera.com/27001academy/documentation/disaster-recovery-plan/
By the way, this article about the distance between sites can be also interesting for you “Disaster Recovery site – What is the ideal distance from primary site?” : https://advisera.com/27001academy/knowledgebase/disaster-recovery-site-what-is-the-ideal-distance-from-primary-site/
Finally, our free online course can be also interesting for you, because we talk more in detail about the business continuity “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
How to make ISO 9001:2015 procedures
Answer:
There is no predefined style or form for withing procedures that you need to follow in order to be compliant with ISO 9001:2015. This gives you the freedom to develop the procedures in a way that suits the best to your organization and the employees who will be executing them.
Keep in mind the purpose of the procedure and that is to provide enough information so the activity or the process will be carried out as planned. However, you don't have to write information that employees are supposed to know,, for example you wouldn't write a procedure on how to drive a car to a taxi driver, he already proved that he is competent by having driving licence. You only need to document activites that are specific for the process and where is a chance that nonconformities can emerge.
Of course, it is good to develop some structure that every procedure will have to some extent. Our usual structure contains the purpose, scope and users, reference documents, the pro cess explanation and at the end the records kept according the procedure.
For more information, see:
- 7 steps in writing QMS policies and procedures for ISO 9001 https://advisera.com/9001academy/blog/2015/03/10/7-steps-in-writing-qms-policies-and-procedures-for-iso-9001/
- ISO 9001:2015 process vs. procedure – Some practical examples https://advisera.com/9001academy/blog/2016/01/19/iso-90012015-process-vs-procedure-some-practical-examples/ -
QMS Core Team Performance Measuring
Answer:
The best way to decide how to measure performance of the QMS Core Team or any other part or roles in the QMS is to set up the criteria or performance indicator that is directly related to the responsibilities of the team. For instance, if the team responsibility is to plan, develop and maintain documentation, the KPI would be the number of outdated documents in use. Or if they are in charge of performing QMS awareness sessions, the KPI would be the
percentage of the employees who attended the awareness sessions during one year.
For more information, see:
- How to implement the Check phase (performance evaluation) in the QMS according to ISO 9001:2015 https://advisera.com/9001academy/blog/2015/11/17/how-to-implement-the-check-phase-performance-evaluation-in-the-qms-according-to-iso-90012015/ -
Asset based or process based?
Answer:
I am not sure if I have understood your question, but in the new ISO 27001:2013 it is not established that the risk assessment needs to be based on assets or process, we are free to select the best methodology for the organization, although our recommendation is to use the risk assessment asset based, because generally this approach is easier.
Maybe this article about how to write your own methodology can be interesting for you “How to write ISO 27001 risk assessment methodology” : https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
This article can be also interesting for you “ISO 27001 risk assessment & treatment – 6 basic steps” : https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
And this article can be also interesting “What has changed in risk assessment in ISO 27001:2013 ” : https://advisera.com/27001academy/knowledgebase/what-has-changed-in-risk-assessment-in-iso-270012013/
And our online course can be also interesting for you because we give more detailed information about the risk assessment & treatment “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
ISO 9001-2015 and AS 9110 B
Answer:
The AS 9110 B had its last revision in 2012 and it includes ISO 9001:2008 quality management system requirements and specifies additional aviation maintenance industry requirements, so it is not, by default, compliant with ISO 9001:2015.
There is no other reason for having two separate certificates, unless there is a customer requirements or by some other interested party. -
Nonconformity in expended scope of QMS
Answer:
The certification audit is conducted according to previously defined scope and criteria. If the nonconformity was identified within the new scope, the auditor can not change the audit scope after the audit and issue you the certificate. The only way to get the certificate is to resolve the nonconformity and notify your CB.
For more information, see:
- How to deal with nonconformities in an ISO 9001 certification audit https://advisera.com/9001academy/blog/2015/06/09/how-to-deal-with-nonconformities-in-an-iso-9001-certification-audit/ -
How to calculate confidentiality, integrity and availability values of people
Answer:
I will give you an easy example (considering a scale of values from 0 to 2, being 2 the greater):
Asset: system administrator
Threat 1: Unavailability of the person (related to the availability); vulnerability: no replacement for the position of this person.
Consequences (based on the lack of availability of this person) = 1
Likelihood = 1
Risk = 1 + 1 = 2
Threat 2: Frequent errors (related to the integrity); vulnerability: lack of training.
Consequences (based on the lack of integrity of this person) = 1
Likelihood = 2
Risk = 1 + 2 = 3
Threat 3: Illegal processing of data (related to the confidentiality); vulnerability: lack of monitoring mechanisms.
Consequences (based on the lack of confidentiality of this person) = 2
Likelihood = 0
Risk = 2 + 0 = 2