Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Audit report

    I’m assuming this question refers to ISO 27001, but the answer is applicable to any other standard like ISO 9001, 14001, etc. (respected the respective internal audit clause of each standard).

    The Internal Audit Report is an example of a mandatory record related to audit results to fulfill clause ISO 27001 9.2 Internal audit, but please note that it is a different document from the Internal Audit Program. 

    The Internal Audit Program is a mandatory document that plans all audits that must be performed in a period of time, while the Internal Audit Report refers to the results of a single performed Internal Audit.

    See this article for further information about ISO 27001 mandatory documents.

  • Question on risk register and selection of the assets

    You have to include only the assets that are owned by your company that are part of the ISMS scope, i.e., the assets you control.

    For further information, see:

    • Asset management according to ISO 27001: How to handle an asset register/asset inventory https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/

    • Physical Security (A.11)

      Please note that not all controls from ISO 27001 Annex A need to be documented according to the standard (and in our opinion, it would be an overhead to document each and every one of them in a small company). This applies to most of the controls from section A.11 from the 2013 version of the standard.   

      Our toolkit is created specifically for smaller companies that want to implement ISO 27001 in a quick way, without unnecessary paperwork; for larger companies that require more documents, we recommend getting some other solution. 

      Information about how Controls that do not require documentation, such as those from Annex A section A.11, are implemented is included in the Statement of Applicability (which can be found in folder 06 Applicability of Controls). 

    • Implementing Clause 8.4

      First, determine which external processes, products, or services are relevant to your organization's quality management system. These can include suppliers, contractors, outsourced processes, and other external parties. You don’t need to include everything.

      Then, establish a process for selecting and evaluating external providers. This may involve supplier audits, performance assessments, and risk assessments to ensure that external providers meet your quality requirements.

      Clearly define your organization's requirements for externally provided processes, products, or services. Document these requirements and communicate them effectively to external providers (may be in specification sheets, may be in design documents or projects)

      Develop formal contracts, agreements, or purchase orders that clearly specify the quality-related requirements, responsibilities, and expectations between your organization and external providers.

      Implement a system to monitor the performance of external providers. This can involve regular quality checks, inspections, and key performance indicators (KPIs) to measure their compliance with your requirements.

      Assess and manage risks associated with external providers. Identify potential risks that could impact the quality of your products or services and implement mitigation strategies.

      Establish effective communication channels with external providers to ensure that they are aware of your quality requirements and any changes in those requirements

      Maintain documentation related to the control of externally provided processes, products, and services. This includes contracts, records of performance evaluations, and any corrective actions taken.
       

      You can find more information in the following links:

    • Quality Control Processes

      I would start by designing a high level map of the flow of work in each department (mapping each department as a set of interrelated processes).

      Then, I would establish a set of performance targets for each process based on the purpose of each process.

      Then, I would determine and evaluate risks regarding each process and its output. For each critical risk you can now establish a quality control plan:

      • What to control;
      • When to control;
      • Sample size to control;
      • Success criteria;
      • Who is responsible for doing the control;
      • Who has the authority to handle nonconformities;
      • Where to record quality control results.
         

      You can find more information in the following links:

    • ISO 27001 Package of Documents

      Please note that ISO 27001 does not require a Policy on Privacy and Protection, and such a policy is not included in the toolkit to not cause an overhead effort to maintain the ISMS.

      For the Privacy Policy template, I suggest you take a look at these templates to see if they can fulfill your needs:

    • Regulatory Compliance QMS Program

      In our ISO 13485 & MDR toolkit, we have a complete list of documents as well as the project plan for how to implement it. This toolkit is applicable to all classes of medical devices under the MDR. Although this toolkit is not directly applicable to PMA approval, certain documents can be used.

      You can download the complete list of documents on the following link: https://advisera.com/13485academy/iso-13485-eu-mdr-documentation-toolkit/

      More details regarding the differences and similarities between the US and EU markets are discussed in this article:

      • FDA vs. EU MDR Technical Documentation Matrix https://info.advisera.com/13485academy/free-download/fda-vs-eu-mdr-technical-documentation-matrix

      • Initial Risk Assessment Non-conformity

        Please note that, when performing risk assessment, if an assessed risk takes into account controls already in place at the time of the assessment, it is important to document this information so anyone who reads the assessment can have the same understanding (otherwise, other persons will interpret the assessment with incomplete information).

        In Conformio, for each risk entry, you have a comment field where you can add information about which controls were already in place at the time of the assessment. This is the justification for assessing the risk as low.

      • ISO 27001 / ISO 22301 Tools for Consultants in German

        Please note that not all controls from ISO 27001 Annex A need to be documented according to the standard (and in our opinion, it would be an overhead to document each and every one of them in a small company), and some of the controls you mentioned are covered by documents in the toolkit. 

        Our toolkit is created specifically for smaller companies that want to implement ISO 27001 in a quick way, without unnecessary paperwork; for larger companies that require more documents, we recommend getting some other solution. 

        Controls covered by documents in the toolkit:
        A.5.1 Policies for Information Security – This control refers to all policies defined for the ISMS.

        A.5.2 Information security roles and responsibilities - roles and responsibilities are described in all policies and procedures included in the toolkit. 

        Controls that do not require documentation are as follows, and information about how they are implemented is included in the Statement of Applicability (which can be found in folder 07 Applicability of Controls):

        A.5.3 Segregation of duties

        A.5.6 Contact with special interest groups

        A.5.8 Information security in project management

        A.5.34 Privacy and protection of PII

        A.5.36 Compliance with policies, rules and standards for information security

        A.7.1 Physical security perimeters

        A.7.2 Physical entry

        A.7.4 Physical security monitoring

        A.7.5 Protection against physical and environmental threats

        A.7.8 Equipment siting and protection

        A.7.11 Supporting utilities

        A.7.12 Cabling security

        A.7.13 Equipment maintenance

         

      • 22301 certification

        Since ISO 27001 and ISO 22301 share many requirements (e.g., document management, internal audit, management review, etc.), the effort to implement the specifics of ISO 22301 (i.e., mainly clauses 6 and 8) is roughly 30% of the cost of ISO 27001 implementation.
Page 11 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +