Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Naming of ISO 27001 Annex

    ISO 27001 Annex A is directly related in numbering to ISO 27002 (a non-mandatory standard which provides guidance for implementation of Annex A controls), and sections 1 to 4 in ISO 27002 do not cover controls:

    0 Introduction

    1 Scope

    2 Normative references

    3 Terms and definitions

    4 Structure of this standard

    From section 5 onwards, the section title is the same from the respective ISO 27001 Annex A section. For example, both ISO 27001 Annex A.5 section and ISO 27002 section 5 are titled A.5 “Information security policies”

    This article will provide you a further explanation about ISO 27001 and ISO 27002:

    - ISO 27001 vs. ISO 27002 https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/

  • GDPR and drones

    Yes, GDPR applies to drones usage when drones record images of people. If this recording is for scientific research, according to article 89 (2) GDPR you might qualify for a derogation from GDPR requirements, related to processing for scientific research. However, recital 156 requires you to make sure you implemented the necessary controls to ensure data minimization and data pseudonymization or even anonymization of personal data once the purpose of processing is fulfilled.

    Find more details about GDPR requirements at the following links:

  • Question regarding ISO 27001 Lead Auditor training & Certification

    Hi, I also want to know which training provider holds good market value is it EXEMPLAR GLOBAL, IRCA or any other training centre from where one can get honest review and feedback for the same.

  • Lead Auditor Exam

    The ISO 27001 Lead Auditor Course provided by Advisera is accredited by Exemplar Global, and it is all you need to be able to take the Lead Auditor Exam to obtain the Certificate.

    For further information, see:

  • Instruction on how to revise a manual

    In this article - List of mandatory documents required by ISO 9001:2015 – https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ - you can see the mandatory documents and records according to ISO 9001:2015

  • Question-MDR

    Yes, you are right, we did not have in our documentation toolkit GSPR list. We are just preparing it and it will be issued by the end of this year. So, if you have given this one, feel free to use it. 

  • Controls A.17.1

    1 - How to define the information security controls within the activities of the continuity plan? I do not understand if it is necessary to define in each activity how the security of the information would be ensured or have a general section the continuity plan where I mentioned that the information security controls established in the production environments are applied in all activities.

    The easiest way to comply with A.17.1 is to list all security processes within your company, and ensure these processes are covered through the Disaster Recovery Plan. In other words, do not focus on security controls, but focus on security processes.

    To see how a Disaster Recovery Plan compliant with ISO 27001 looks like, please take a look at this template: https://advisera.com/27001academy/documentation/disaster-recovery-plan/

    For further information, see:
    - Disaster recovery vs Business continuity https://advisera.com/27001academy/blog/2010/11/04/disaster-recovery-vs-business-continuity/


    2 - Additionally, how is it proven that there are information security controls in the continuity plan?

    Answer: The easiest way is to include references to controls described in ISO 27001 Annex A into the Disaster Recovery Plan document. For example, in the abovementioned template, you can add a section to include the controls covered by the actions defined in the plan.

    For example, in case your plan includes activities for recovery of access control, then you can include the reference “Controls from ISO 27001 Annex A.9” 

  • Internal Context and Safety Management System

    In the ISO 45001 OHSMS the internal context includes your internal issues that can affect your OH&S management system, along with the needs of employees and other internal interested parties. These internal issues can include such things as the stability of your workforce since a large employee turnover means that you will be re-training people all the time which can affect safety knowledge, and understanding employee needs for OH&S will help to identify where specific controls are needed to safeguard your specific employees for your specific hazards.

    Implementing an OHSMS is more than just using the requirements of ISO 45001, you need to incorporate any other requirements that are applicable, such as legal requirements or employee safety needs. Understanding all of this context will help you to know the requirements that need to included on top of ISO 45001 to make your OHSMS work for your unique organization.

     

    You can learn more on the context requirements for the OHSMS in the article: Defining the context of the organization according to ISO 45001, https://advisera.com/45001academy/blog/2016/02/03/defining-the-context-of-the-organization-according-to-iso-45001/

  • Transfer impact assessment

    Appreciate your support to answer below questions related to transfer impact assessmentWho should create the data transfer impact assessment the controller or the processor

    The data transfer impact assessment should be created by the controller who is the subject in charge of GDPR compliance towards the Authority and data subject. However, in some cases, if the data processor exports data to a sub-processor, the processor can assess the transfer impact in order to demonstrate compliance to GDPR to the data controller.

    Is there any available Transfer impact assessment template for the processor

    No, currently we have the template for the Cross Border Personal Data Transfer Procedure which can be tailored on transfers as controller or processor.

    https://advisera.com/eugdpracademy/documentation/cross-border-personal-data-transfer-procedure/

    Where can I find the updated version of the controller-processor SCCs"

    You can find it on the website of the EU Commission: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

    Here you can find more information about data transfer:

    If you want to learn how to implement GDPR compliance in your organization, you may consider enrolling in our EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/
Page 124 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +