Search results

Home / Search

Category:
Select
Select

11271 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Does Zoom need to be considered as a processor

    Whenever a call on Zoom is initiated, Zoom Video Communications, Inc. processes personal data. Mp4 of all video, audio, whiteboard, captions and presentations, audio transcript files, attendee information (screen name, join/leave time), etc, they are all personal data according to the definition of personal data that can be found in Article 4 (1) GDPR: “any information relating to an identified or identifiable natural person”. Zoom Video Communications, Inc. processes personal data on behalf of its customers and acts as a Data Processor according to the definition from Article 4 (8). Since Zoom Video Communications, Inc is a US-based company, the new EU Standard Contractual Clauses should be signed. Zoom Video Communications, Inc, offers a Data Processing Agreement which also includes EU Standard Contractual Clauses requirements, at https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf

    You can find more details at these links:

  • Risk assessment Vs SoA

    Please note that the risk assessment, risk treatment, and elaboration of the Statement of Applicability have very different steps, so you do not repeat the same activities. And you cannot go directly to the controls because the standard requires all defined steps for risk assessment and risk treatment to be performed.

    In risk assessment you identify, analyses and evaluate risks. As output you have a prioritized list of risks, and which ones require treatment or not.

    In risk treatment you define treatment options, applicable controls, elaborates the SoA and the risk treatment plan, approves the risk treatment plan and the accept the residual risks.

    Statement of Applicability is different from risk treatment because there you need to take into account (besides the results of the risk assessment) also legal and regulatory requirements, as well as management decisions. On top of this, SoA keeps track of the implementation method and implementation status - these are not mentioned in the risk treatment.

    In Conformio, the Statement of Applicability is created automatically based on the results of the Risk Register module. You only need to add some items up in case of need, like justifications based on legal and contractual requirements, or management decisions, or specific information about implementation methods.

    For further information, see:
    - How to automate the creation of the Statement of Applicability https://advisera.com/conformio/blog/2021/01/20/how-to-automate-the-creation-of-statement-of-applicability/

  • How to set safety objectives

    Setting OH&S objectives in ISO 45001 has not changed much from the OHSAS 18001 OH&S objectives. The objectives are still meant to be objectives for improvement in the system, and are intended to have a target for improvement and a timeline. So, an OH&S objective to “reduce near miss incidents from 10 per month to 5 per month in the next 12 months” is the type of objective that the standard is looking for.

    What is new to ISO 45001 is the requirement to actually have a plan in place for each objective that says who needs to do what, by what time, with what resources, and what method to use to tell the steps are adequate. This change is to try to solve the fact that many companies had OH&S objectives with the previous system, but had never made a plan to achieve them so they were never met.

     

    You can read more on OH&S objectives in the article: How to define ISO 45001 objectives and plans, https://advisera.com/45001academy/blog/2018/12/04/how-to-define-iso-45001-objectives-and-plans/

  • About the IT security Policy and some documents mentioned as "implementation method" in the SOA

    ISO 27001 does not specify roles to handle spam, so organizations can define what better fits them, from creating a new role to designating an already existent role for the task. A common approach is blocking the origin of email identified as spam from reaching the organization, and in this case, some role from the IT staff that can authorize such procedure can be defined as the person responsible (e.g., IT head, system admin, etc.).

  • Content of ISO 27001 & EU GDPR Toolkit

    I’m assuming the information you provided is from the List of documents file from the ISO 27001 toolkit (ISO 27000 is not a certifiable standard).

    Considering that, the Incident Management Procedure document is mandatory only if control A.16.1.5 Response to information security incidents deemed as is applicable.

    Considering the ISO 27001 & EU GDPR Toolkit, the document you should look for is the Data Breach Response and Notification Procedure, which covers the same requirements of the Incident Management Procedure, and also GDPR Articles 4(12), 33, 34. This is document 14.A.16, item 85, in the List of documents file from ISO 27001 & EU GDPR Toolkit.

  • Clean room criteria for ISO 13485

    Thank you for the question. There is a lot of things that need to be taken into consideration when wanting to get an ISO 13485:2016 certificate. For the documentation, you can use our Documentation toolkit which has all necessary and required documentation from the standard. Prices and what is contained in the toolkit at the following link: https://advisera.com/13485academy/iso-13485-documentation-toolkit/

    More information on the ISO1 3485, you can find on the following links:

Page 119-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +