Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Creating right road map to reach goals in optimal way

    Broadly speaking, after getting support for your project (through approval of the ISMS project plan) and approval of the Procedure for Document and Record Control, you should consider these steps:

    1. defining ISMS basic framework (e.g., scope, objectives, organizational structure), by understanding the organizational context and requirements of interested parties;
    2. development of risk assessment and treatment methodology;
    3. perform a risk assessment and define the risk treatment plan;
    4. controls implementation (e.g., policies and procedures documentation, acquisitions, etc.);
    5. people training and awareness;
    6. controls operation;
    7. performance monitoring and measurement;
    8. perform an internal audit;
    9. perform management critical review; and
    10. address nonconformities, corrective actions, and opportunities for improvement.

    To see how documents compliant with ISO 27001 look like, I suggest you take a look at the free demo of our ISO 27001 Documentation Toolkit at this link: https://advisera.com/27001academy/iso-27001-documentation-toolkit/

    This article will provide you a further explanation about ISMS implementation:

    These materials will also help you regarding ISO 27001 implementation:

    To see how documents compliant with ISO 27001 looks like, please take a look at our ISO 27001 Documentation Toolkit [https://advisera.com/27001academy/iso-27001-documentation-toolkit/] - it will provide you with a step-by-step explanation of all activities you need to perform to become compliant, and it will give you all the documents you need for the certification audit.

  • ISO 27001/Conformio questions

    1. The Risk Register flow seems to be inverted. Can you explain why vulnerability comes before the threat? We were under the impression that we would first need to evaluate the threats related to assets, and then the vulnerabilities.

    Please note that threats are relevant only if there are vulnerabilities to be explored by them (for example, it does not make sense to think about controls to protect paper documents if you only handle digital media).

    Considering that, by identifying vulnerabilities first you reduce the scope of threats that you need to consider, reducing effort and speeding up the risk assessment and treatment process.

    2. Regarding the inventory of assets - in Conformio we have a list of general assets, like computers, but we would like to have a separate document with a list of all the assets within our company, such as which types of computers we use. Is this needed for the successful implementation?

    ISO 27001 does not prescribe the level of detail of the register of assets, so organizations can define the detail level that fulfills their needs.

    The list of assets provided by Conformio is sufficient for certification purposes, but you can add your own assets in the Conformation asset list or create and include in the documentation your won list of assets.

    This article will provide you with further explanation about the asset register:

  • ISO 27001 Scope

    Your understanding is correct. In sections 3.2 to 3.5 of the ISMS scope document, you will identify how the elements of the scope are separated from the other elements.

  • ISO 27001 Internal Audit practice and tips

    I’m assuming you are referring to an internal audit.

    Considering that, to perform an internal audit you should consider these steps:

    • Develop an internal audit procedure
    • Plan your audits, considering dates, criteria, and scope
    • Develop checklists to help you not forget something during the audit
    • Elaborate on the audit report which will include the non-compliances and other findings

    These articles will provide you a further explanation about internal audit:

    These materials will also help you regarding internal audit:

  • What to do with legacy documents & materials

    1 - I am looking at our options in regards to planning a roll out of an information classification and retention policies and tools to withing our organization to help users identify, classify, and protect sensitive data and assets for ISO 27001.

    Currently we have been filing all our information haphazardly in Dropbox. No standards. No management of the Dropbox folders ... so it's a mess. With 27001 we plan to setup a new structure in Dropbox and migrate/convert the Company documents/assets into the ring-fenced folders, and then freeze the existing Dropbox folders, with a long term objective of sun-setting the content.

    Is there a tried and tested method for this task. We have limited resources so it will take time to do.

    To build a structure that is sound for your business you can consider at least these approaches:

    • organize documents by organizational units (i.e., which areas need access to which documents)
    • organize documents by processes (i.e., which documents need to be accessed to cover related steps to deliver a defined result – e.g., documents related to payroll)
    • organize documents by roles (i.e., which people needs access to which documents)

    Considering that, you should follow these steps:  

    1. list all documents that need to be accessed
    2. identify the documents according to defined criteria
    3. create specific folders to group documents that have similar criteria

    The toolkits you’ve bought are an example of the organization by process (from document management to corrective actions). You can use them to organize your documents, or as a template to build your own structure.

    2 - My other question is, will the auditors want to look at the legacy materials. Our aim is to put an ISO stake in the ground and have all relevant / supporting PowerX docs filed in the new folder structure. For ISO 27001 we will use Dropbox as the DMS, but will most likely migrate to alternative Apps/Software, such as Conformio in 2023.

    Auditors will be looking for legacy materials only if they are previous versions of documents being used by the time of the audit, to check if document management criteria related to change control are being fulfilled (e.g., document review, change control, etc.).

    For example, if your current Access control policy is an update of a legacy Access control policy, the auditor may want to see this document. On the other hand, if the legacy documents include a Backup policy related to a technology that was discontinued by the time the implementation of the ISMS started, there is no need to access this document.

  • QMS, Quality Manual, Quality Procedures and Quality Management Plan

    A QMS, as ISO 9000:2015 defines, is part of a management system related to quality. While implementing a QMS an organization may develop non-mandatory documents like a Quality Manual, a kind of the QMS’s identity card, Quality procedures, documents that set rules about how organizations should act in certain circumstances. Concerning what is a Quality Management Plan, that terminology is not very common with ISO 9001:2015. So, different people may mean different things. For example, a QMP may mean how the QMS is applied in a particular project.

    Companies that work on a project basis, like construction companies, normally have to develop a QMP for each project. Many times it is a client request.

    You can find more information about documentation below:

  • QMS Manager Rights

    According to clause 5.3 of IS 9001:2015, for each organizational role relevant to the QMS, organizations must determine authorities and responsibilities. Each organization may determine different documents and ways of compiling those authorities and responsibilities. For example, some organizations use job descriptions to do that.

    Now, what those authorities and responsibilities are, for each role and organization is defined by each organization and approved by top management.

    You can find more information below:

  • Risk Assessments in Conformio

    1. Can assets be put in a hierarchy, so that filing cabinets can be seen as part of an office building, or firewall as part of a server? I think this would have benefits for overview and determining potentially assets affected by incidents related to other assets below or above in the hierarchy. I'm not sure whether this makes sense from a Risk Management perspective.

    While this functionality would be interesting, it is not currently available in Conformio because it is not required by the standard (even the guidelines from ISO 27002 for ISO 27001 Annex A control A.8.1.1 Inventory of assets do not mention this), and the building of such hierarchy would mean a whole module by itself (it is a whole discipline of ITIL and ISO 20000 - Service Asset and Configuration Management).

    For further information, see:

    2. I see the same vulnerabilities for different assets, like inadequate change control for laws, regulations, etc but also for policies, procedures and work instructions. Is there a way to optimize this and to reduce the number of vulnerabilities?

    Please note that a single vulnerability may impact different assets like in the example you provided, but it is not mandatory to associate that vulnerability for all listed assets. These relations are only suggestions provided to help you perform risk assessment, so you can decide to not select the vulnerability for some assets.

    For further information, see:

  • Question ISO 27001 implementation

    Certifying only the small company is possible, provided it is legally separated from the bigger company, and you can include in the Information Security Management scope only the elements the small company controls (you do not need to separate everything).

    For example, in physical terms, this means that this small company should be located on a floor of its own, not shared with employees of the bigger company.  

    In terms of policies and procedures, they should be divided in a way that you can control all the elements of your documentation, i.e., even if you need to follow the guidelines of the bigger company, you can do that in your own way. For example, you can implement access control in different ways.

    Please note that if you find out that implementing such separation is too complex or costly, then an alternative would be to certify both companies, keeping the bigger company scope as small as possible (e.g., including only the processes that directly interact with the small company).  

    These materials will help you regarding scope definition:

  • Questions Regarding Clinical Evaluation

    We have noticed that our current clinical evaluation report does not meet the MDR requirements due to unsatisfactory documentation. Eventhough all clinical tests and results are good enough for proofing the product usage  the consultant company did not properly documented as regulatory requested format and contents .So we need to reorganize CER report  and need a new company/individual  to assist us. Our intention is to work with a competent and reliable agent. In addition to CER work we also need to rework on some tests(Biocompatibility). So I need your guidance and recommendation for selecting a test center and CER process.Do you know any source for recommending us?
Page 109 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +