Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Does ISO 19011:2018 align or integrate with ISO 27001?

    ISO 19011 is a management system audit standard and can be used to help fulfill ISO 27001 requirements from clause 9.2 – Internal audit (e.g., provides guidelines for audit program planning, auditor selection, audit report documentation, etc.).

     This article will provide you a further explanation about internal audit:

    These materials will also help you regarding internal audit:

  • Infosec procedures

    Control A.10.1.2 is covered in our template Policy on the Use of Encryption. You can take a look at its demo at this link: https://advisera.com/27001academy/documentation/policy-on-the-use-of-encryption/

    A vulnerability procedure is not mandatory for ISO 27001 and is not a common document adopted by organizations, so there is no template covering the specific clause of the standard related to it (control A.12.6.1 - Management of technical vulnerabilities).

    Control A.12.6.1 does not prescribe how many scans are necessary for each classification asset. You should define these based on the results of risk assessment and applicable legal requirements.

     This article will provide you with a further explanation about key management:

    This article will provide you with a further explanation about vulnerability management:

    For detailed processes and more technical reference you should consider NIST Special Publications:

  • Quantity of risks

    Considering that you will still receive inputs from your technical people, as a starting point, ~200 risks, with ~15% of them to be treated is a good scenario.

    Please note that the auditor will be more concerned about the quality of the identified risks (i.e., how relevant they are for the organizations) than their quantity. The single point you need to pay attention to is to not overlook obvious risks, i.e., risks that someone with proper competence in the process or asset would easily identify. To mitigate this risk, you need to include in the risk assessment the personnel involved with the process or asset.

    An additional thing to note is that risks for which you already have implemented controls (and you will only accept the risk) also count for your relevant risks.

  • ISMS metrics related to Scope

     Regardless of the perspective, the development of metrics follows some general rules:

    • Business relevant: the indicator should be aligned to clear business objectives or legal requirements.
    • Process integrated: activities to collect the necessary data for a KPI should add the least amount of work possible.
    • Assertive: the indicator should be capable of pinpointing relevant issues (e.g., process steps, organizational areas, resources, etc.) that need attention.

    Considering Product development, some examples are:

    • Percent of products of the portfolio supported by the ISMS
    • Number of product development incidents related to information compromise
    • Incident resolution time
    • Percent of controls assessment performed
    • Number of improvement initiatives

    For further information, see:

  • ISMS metrics, from Product development perspective

    Regardless of the perspective, the development of metrics follows some general rules:

    • Business relevant: the indicator should be aligned to clear business objectives or legal requirements.
    • Process integrated: activities to collect the necessary data for a KPI should add the least amount of work possible.
    • Assertive: the indicator should be capable of pinpointing relevant issues (e.g., process steps, organizational areas, resources, etc.) that need attention.

    Considering Product development, some examples are:

    • Percent of products of the portfolio supported by the ISMS
    • Number of product development incidents related to information compromise
    • Incident resolution time
    • Percent of controls assessment performed
    • Number of improvement initiatives

    For further information, see:

  • Calibration vs verification

    You said you don't do outside calibrations. As a testing laboratory however, you need external calibration by competent parties to ensure metrological traceability. For example, the analytical balances.

    You asked why the adjustment of instruments is not included in clause 7.4. Note that clause 7.4 deals with handling of test or calibration item (after the sampling step) and is applicable for laboratories handling items to be tested (testing laboratories) or calibrated (calibration laboratories).

    It is clause 6.4 which deals with the requirements for equipment, including calibration of any equipment which can influence the validity or results generated (whether a test or calibration result). Here clause 6.4 requirements must be met for all equipment in the process, which in includes for example the components of the ICP, the standard used for the calibration curve and volumetric measuring devices used.

    For more information and links to resources, see my reply to the question Equipment qualification at https://community.advisera.com/topic/equipment-qualification/

  • Addressing Impact Assessment (DPIA) requirement

    According to article 35 in GDPR, “Data protection impact assessment”, DPIA is performed for personal data processing operations “likely to result in a high risk to the rights and freedoms of natural persons”. In the case of ISO, the risks that are documented and treated are related to the organizational information,while in the case of DPIA the risks are related to the rights and freedoms of natural persons. There are really good templates that can help you address these risk assessments in our EU GDPR & ISO 27001 INTEGRATED DOCUMENTATION TOOLKIT.

    Please find more details here:

  • Right to Erasure

    As a cloud hosting provider, according to article 28 GDPR, Processor, you should act as a Data Processor. In this case, the data subjects who have personal data on your servers on behalf of your customers must exercise their right to delete to the data controllers, (your customers), per Art 17 (Right to erasure) para 1: "The data subject shall have the right to obtain from the controller the erasure of personal data". You, as a Data Processor, if you receive a deletion request from a data subject, you should either forward the request to the right customer or inform the data subject that they should exercise their right towards the respective data controller. 

    However, if one of your business customers request you to delete the personal data they are accountable for, you should comply with this request, because they act as a data controller, per Art 28 para 3 (e): "taking into account the nature of the processing, assists the controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to requests for exercising the data subject's rights". Regarding data from the backups, that data is deleted anyway after a while.  

    We are preparing a Live Virtual Training around How to handle a Data Subject Request according to GDPR, stay tuned for the announcements!

    Please explore the following links to find more details:
Page 110 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +