Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Document Set

    The Advisera GDPR toolkit includes all the necessary documents needed for you to complete your GDPR-compliance journey. Since you are processing special categories of personal data (health data), I recommend performing a Data Protection Impact Assessment, per Article 35. As part of the Advisera GDPR Toolkit, there is a DPIA Methodology document that can help you. Also, you need to consider informing the data subjects affected by these transfers. As part of the GDPR Toolkit, there are templates for Privacy Notices.

    As an American company, you need to check whether you are subject to FISA 702 US Regulation. If yes, you need to take additional measures in order to protect EU data, according to Chapter V in GDPR - TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS. The best transfer mechanism to use in this case is the EU Standard Contractual Clauses, per art Article 46 – Transfers subject to appropriate safeguards, but you need to take additional measures such as encryption of data-at-rest and in-transit, with a key stored on a server in EU.

    The risks would be clearly reduced if you have full storage of data on EU servers managed by an EU organization.

    Please also consult these resources:

  • Risks registered is not effectives

    Thanks for the tips and points to enhance risks registered , however 140 risks is huge no to maintained the risks regardless the treatment, i'm expecting something around 20 risks max to be easly maintainted especiallty the main dimensions for security control under CIA , in addition ISO is not need inssist to include asset on risks handling, 

     

     

  • ISMS

    1. Within the document of the scope of the ISMS in point 3.3 Networks and IT infrastructure, should the network segments, IT Infrastructure (routers, switches, etc.) be fully detailed or is it enough to place a graphic of our diagram network?

    A general description of networks and IT infrastructure, like a diagram network, is enough to include in the ISMS scope document.

    For further information, see:

    2. In the ISMS implementation project plan Doc, point 3.1 Project objective, can the date that is set as a limit be changed as the ISMS implementation progresses, or should that date not be changed once? what has been defined?

    The information in the Project Plan document, such as the implementation date deadline, can be changed as the ISMS implementation progresses. You only need to ensure to get proper approvals and communicate with people affected by the changes.

    3. In the ISMS Implementation Project Plan Doc, point 3.4.2 Project Manager, can two or more people be designated as project manager, or can it only be one person?

    For small projects, only a single project manager should be considered as the main alternative (in many cases there won’t be enough work to justify designating more than one project manager). When more than one is designated, you need to make clear their responsibilities and authorities, to avoid overlap.

    For further information, see:

    4. In the ISMS implementation project plan Doc, point 4 Management of saved records, within the table is only the project plan document detailed or should all the documents that are of the ISMS be detailed (e.g. scope document , security policy, etc.)?

    In section 4 of the Project Plan document, you need to include only the documents related to the management of the project, not the project’s deliverables. Project progress reports are examples of records related to this section.

  • Audit questions for purchasing department

    Purchasing name has been changed to ‘’Control of externally provided processes, products, and services’’ in ISO 9001:2015 and IATF 16949:2016 standards.

    Therefore, standard item 8.4 and all 8.4 items show the purchasing process. You should prepare your questions for the purchasing process, including all items of 8.4.

  • ISO 22301 - 4.2.2

    To see a procedure that covers the identification of requirements compliant with ISO 22301, please take a look at this demo: Procedure for Identification of Requirements https://advisera.com/27001academy/documentation/procedure-for-identification-of-requirements/

    The purpose of this document is to define the process of identification of interested parties, as well as statutory, regulatory, contractual, and other requirements related to information security and business continuity, and responsibilities for their fulfillment.

    This article will provide you a further explanation about the identification of requirements (the same concepts apply to ISO 22301):

  • Issue with self-certification process  for class I product according  to MDR

    Thank you so much, so  you don't need to register with each national authority where you are putting your device on the national Market

  • Excluding Clause 7.3 (Design and development) from QMS

    If you do not develop completely new products or new services, then it is possible to exclude requirement 7.3. In other words, any change or adaptation of the product, creation of a new version of the product, or development of a new service means that requirement 7.3 is applicable.   

  • Safety Practice in Mining Sector

    I have a question "an organization is AS9100 Rev D certified but organization has no production since one year from any customer then how can compliance of QMS can be interpreted? How internal audits be conducted? How KPI be translated ? What standard say that if an organization have no customer since long time then how QMS compliance be evaluated?

  • Validity of 17025 accreditation

    You asked Once a lab is accredited to 17025, does this expire?

    ISO 17025 accreditation is awarded for a cycle which could vary between two and five years, depending on the discipline and accreditation body’s policies. Before the end of the cycle, the laboratory needs to reapply for accreditation so that a new certificate will be issued before expiry. At this point the assessment will be as if as per original application,  in other words more thorough.

    You also asked are there defined time frames for external audits, eg ever other year or so?

    Yes these are called surveillance assessments. The frequency depends on the accreditation body, but are typically annual. I suggest you engage with the accreditation body to obtain specific information for your laboratory.

    For more information have a look at the Webinar What are the steps in the ISO 17025 accreditation process? [free webinar on demand] at https://advisera.com/17025academy/webinar/what-are-the-steps-in-the-iso-17025-accreditation-process-free-webinar-on-demand/ or attend the next scheduled webinar on that topic.

  • Control charts and trending and level IV data validation

    ISO 17025 as per clause 7.11 requires a functional validation of the laboratory information management system use for data collection, processing, recording, storage and retrieval. This means to verify the data integrity from all inputs to the final result. Typically the depth is dependent on the sector that the laboratory is supporting. For example, clinical trials and other regulated sectors will have more stringent requirements than ISO 17025.  I cannot tell from your question what Standard or regulatory requirement you are being assessed against and what the level IV data validation is requires specifically. This should be provided to you.

    Basically the validation level of effort depends on the intended use of the data and the data quality objectives. On a risk basis it involves an understanding of how every quality control component affects the validity of the final result. For example, the risk of a false-positive or false-negative result.

    Regarding control charts, I am not clear if you are referring to analytical, environmental or data related. Charting is a one of the quality process control activities /tools. Note that as per clause 7.7.1 Control charts are not mandatory, as long as monitoring the validity of results is planned (have a procedure) and the data is recorded in such a way that trends are detectable. This could be a simple table with the use of flags (e.g excel conditional formatting). ISO 17025 requires that where practical, a laboratory should use statistical techniques to review the results. Either way a control chart can typically be set up in Excel or software packages. From your analytical validation data you need to determine the permitted range of results upfront, you set QC rules and then you plot your ongoing data points to monitor any trends. The purpose is to proactively see if results are shifting from the expected measurements. Then you need to act on a correction. 

    There are three steps 
    1) Obtain QC data - say 30 analysis results obtained over time during your method validation.
    2) Set the QC pass, fail and QC trend rules. These must be fit for purpose based on your required method performance. That is do you take action on a result of mean plus or minus one standard deviation or two or measurement uncertainty (MU) A simple approach uses mean and standard deviation. Depending on your measurement uncertainty (MU) decision rules, it may be more appropriate to use you MU as the limits.

    3) Build the chart to indicate upper and lower limit within each result should fall within. For example, for a specific quality control check with a mean of 10 mg/ml and a Std deviation of 1 mg/ml you could set a warning at 1 SD (i.e. less than 9 and greater than 11 mg/ml and fail at over 2SD (i.e. below 8 and above 12 mg/ml. ) The set or running mean , upper and lower limits are charted on the graph. 

    Then monitor and review upward, downward trends and act according to your preset rules.

    For more information and a link to the Quality Assurance Procedure see https://community.advisera.com/topic/clause-7-7-7-7-1/
Page 107 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +