Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Purchasing and Evaluation of Suppliers

    Section 3.3 Evaluating suppliers and 3.4 Criteria for selecting suppliers are considered to the already approved suppliers. In section 3.2 is described the process of employing the new suppliers.   

  • Toolkit content - A.6.1

    Please note that control A.6.1.1 Information security roles and responsibilities is implemented in all templates of the toolkit (it does not require a separate document). Also, top-level roles and responsibilities are listed in the Information Security Policy.

    Controls A.6.1.2 Segregation of duties, A.6.1.3 Contact with authorities and A.6.1.4 Contact with special interest groups do not require specific documentation, so there is no need to develop a policy or procedure for them.  

    In cases like this, you only need to provide a record showing how it was performed. For example, for control A.6.1.2 you only need to provide a list of which activities were divided. For controls A.6.1.3 and A.6.1.4, you need to provide a list of which authorities / special interest groups need to be contacted. Since the presentation of this information can vary according to the information systems of each organization, it is unfeasible to provide a template for recording this information.  

    About control A.6.1.5 Information security in project management, here's an article that explains the details of its application:
    -How to manage security in project management according to ISO 27001 A.6.1.5 https://advisera.com/27001academy/what-is-iso-27001/ 

  • Context of the Organization, where is this in Conformio?

    Clause 4 (Context of the organization) of ISO 27001:2013 has 4 sub-clauses:
    - 4.1 Understanding the organization and its context – ISO 27001 does not require internal and external issues related to the ISMS to be documented. These internal and external issues need to be taken into account when defining the scope (please see the explanation below).
    - 4.2 Understanding the needs and expectations of interested parties – the evidence for this sub-clause is the list of applicable legislation and contractual requirements, available in the Register of requirements module, an in the List of Legal, Regulatory, and Contractual Requirements report, generated by this module.
    - 4.3 Determining the scope – the evidence of this sub-clause is the ISMS Scope document
    - 4.4 Information security management system – all documents and records created in Conformio are evidence for this sub-clause

    In case the auditor request evidence of clause 4.1, you can use the ISMS scope document and the Risk assessment and Risk Treatment report, because internal and external issues are used as input for their elaboration.

    This article will help you:
    - Explanation of ISO 27001:2013 clause 4.1 (Understanding the organization) https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/

  • Accessories and standalone SaMD

    This is a rather specific situation and I would like to propose the call. But before that, I advise you to go through these guidelines published by EU Commission:  

    Is your software a medical device - https://ec.europa.eu/health/system/files/2021-03/md_mdcg_2021_mdsw_en_0.pdf MDCG 2019-11 Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR  - https://ec.europa.eu/health/system/files/2020-09/md_mdcg_2019_11_guidance_qualification_classification_software_en_0.pdf

    I believe that you will find your answers here. If not, let me know and we will arrange a meeting. 

  • ISO 13485 Effectiveness criteria

    1. if these criteria should be quantitative or qualitative?
    It is up to you. It is always better to have quantitative criteria because it is easier to follow if those criteria are met. For example, you can state that your criteria for production is 1% of scrap. This is something that you can easily measure.

    2. and if we have Procedure for Document Control and Procedure for Control of Quality Records - these procedures have to include effectiveness criteria?
    Of course. For example, you can state that all records must be properly signed and fulfilled. Or All valid documents must be in place (therefore, during the internal audit you must not find any document that is not valid - a procedure that has been withdrawn).

    3. Also, for instance we have described Change Management process and effectiveness criteria for this process are: Timely notification and implementation of changes; Data analysis results. Are these ok?
    Yes, this is OK criteria for Change management.

  • Different between "Supplier" and "Subcontractor"

    A subcontractor is a company that provides for you some process that is crucial for your medical device.  For example, a subcontractor is a company who produce your medical device for you or performs a sterilization process, warehouse, or made some crucial part for your medical device that is specific only for you.

    Suppliers are all other companies that provide you with raw material, packaging material, and so on.  

  • Corporate using of Conformio

    To answer this question properly it is necessary to evaluate how different the implementation of the applicable controls will be on both sites. In case single documents, like policies and procedures, can be used for both Business Units, then only a single license will be enough. In case the differences in implementation may require that two policies covering the same topic are written (e.g., you need to have two different Access Control Policy), then the use of two licenses are recommended.

  • Accreditation duration

    It can realistically take from six to twelve months for the accreditation process to be completed. i.e from application to accreditation.

    Once you have applied for accreditation with an accreditation body (AB) and submitted all the required documents they will do a document review. This could take a few months depending on how busy the AB is. Depending on the extent of laboratory “readiness”(if documents are available and requirements met) it can be another month or more to close any gaps. It may then take another month or two before the initial assessment (audit) of your processes and documents. Finally the laboratory may need another month or more to close any non-conformances,  before accreditation is achieved.

    For more information have a look at the webinar What are the steps in the ISO 17025 accreditation process?  at https://advisera.com/17025academy/webinar/what-are-the-steps-in-the-iso-17025-accreditation-process-free-webinar/

  • SoA - controls

    When only a task is defined as the implementation method of control it means that this control does not require specific documentation, so you do not need to develop your own policy or procedure.  

    In cases like this, you only need to provide a record showing that the task was performed. For example, for control A.6.1.2 you only need to provide a list of which activities were divided. For control A.6.1.3 you need to provide a list of which authorities need to be contacted.

    For further information, see:
Page 118 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +