Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Statement of Applicability in Conformio

    The information about the interest groups to be contacted and how to contact them can be documented in a simple spreadsheet. ISO 27001 does not define the information to be documented, so you can add any information you mean relevant.

    As for where to store it, you can use the Documents module in Conformio.

    https://i.imgur.com/f8cXOiG.png

    This article will provide you with a further explanation about special interest groups:

  • Writing Emergency Management Guide

    There is no one right format for the emergency preparedness and response procedures required in ISO 45001, but there are certain things that should be considered. After identifying what potential emergencies you may face, your plan should include the actions to take to respond to the situation, the training necessary for the planned response, the communication for workers or other relevant stakeholders, and periodic testing and evaluation of the plans for improvement.

     

    You can read a bit more in the articles: How to ensure effective emergency preparedness and response in ISO 45001, https://advisera.com/45001academy/blog/2015/10/21/how-to-ensure-effective-emergency-preparedness-and-response-in-iso-45001/ and 5 elements to consider when testing your organization’s health & safety emergency response procedure, https://advisera.com/45001academy/blog/2017/02/22/5-elements-to-consider-when-testing-your-organizations-health-safety-emergency-response-procedure/

  • Binding Corporate rules

    If a company is based in non-European country wants to transfer European data to non-European country, what are GDPR requirements?


    GDPR requirements for the transfer of data outside the EU are listed in Chapter V GDPR and require to the data controller to ensure that the level of data protection offered by the GDPR is not undermined. The steps are the following:
    1. Verify if the destination country benefits from an adequate decision of the EU Commission. If so, you can proceed with the data transfer. Here you can find the countries with adequacy decisions: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
    2. If the country importing EU data is not included you need to assess the security of the country and select another transfer mechanism like the Standard Contractual Clauses (SCC) which incorporates the requirements of the EU GDPR.  https://info.advisera.com/eugdpracademy/free-download/standard-contractual-clauses-annexes
     

    Does a company need to create binding corporate rules if it has only one branch?


    No, the mechanism of approval of Binding corporate rules is long and complex and requires approval from the Supervisory Authority or the European Commission. Usually, large multinational company groups require the approval of Binding Corporate Rules (BCR), while many companies (included large tech companies, like Google) prefer the Standard Contractual Clauses.

    Is there any available approved binding corporate rules approved by authorities to be followed


    Yes, I believe you can find it on the web, but the BCR adapts to the structure of the company, is tailored to the processing and transfers.

    Here you can find more information about data transfer:
    3 steps for data transfers according to GDPR https://advisera.com/articles/3-steps-for-data-transfers-according-to-gdpr/
    EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/

  • Stage-1 Audit

    1. What do auditor look for in Stage- 1 audit?

    According to IATF 16949:2016 rules 5; the documents, I mentioned below should be ready for Stage -1 audit. In other words, the quality management system should be established, an internal audit should be done, and a management review should be completed before the stage 1 audit.

    Documents and subjects should be ready before Stage 1 audit:

      a) Description of the remote location and the support they provide.

      b) Description of processes showing the sequence and interactions, including the identification of remote supporting functions and outsourced processes.

      c) Key indicators and performance trends for the previous twelve (12) months, minimum.

      d) Evidence that all the requirements of IATF 16949 are addressed by the client's processes.

      e) Quality manual, including the interactions with support functions on-site or remote.

      f) Evidence of one full cycle of internal audits to IATF 16949 followed by a management review.

      g) List of qualified internal auditors and the criteria for qualification.

      h) List of automotive customers and their customer-specific requirements, if applicable.

      i) Customer complaint summary and responses, scorecards, and special status, if applicable.

    2. Is it mandatory that MRM & Internal audit is conducted before a stage-1 audit?

    As you can see as listed above, the completion of the management review and internal audits are mandatory matters.

  • Lead Auditor vs Lead implementer courses

    A lead implementer can work as lead auditor if he or she does not audit her own work, that can happen if the lead implementer is also a member of the audited organization.

    About course adequacy this is my recommendation:

    https://www.screencast.com/users/ccruz5284/folders/Default/media/7fc00ef0-54be-4e9b-a220-7e6bfd7d7835

  • Question about software

    The hash is a random set of characters that can be used to uniquely identify a file, and it is provided so you can verify if a downloaded file is a valid copy of the one you wanted to download (i.e., you can verify if the downloaded file was not tampered with).

    The process is simple:

    • you download the file
    • you use the file with a hash generator (you can easily find free hash generators on the Internet) and check the generated sequence against the hash provided by the site. If the values are equal the file is ok (i.e., it is a copy of the file provided by the site).

  • What does it mean to have security classification in a document?

    To have a security classification in a document means that this document requires to be protected according to a set of rules, depending on the security classification level.

    For example, considering the confidentiality point of view, top-secret documents need to be protected against loss of confidentiality, while public documents do not require such protection.

    This article will provide you with a further explanation about information classification:

    This material will also help you regarding information classification:

  • Conformio - Justification in SoA

    ISO 27001 requires a justification for all applicable controls (clause 6.1.3 “d”), so if you are adding controls in the Statement of Applicability you need to fill in the ‘justification’ field to be compliant with the standard.  

    This article will provide you a further explanation about the Statement of Applicability:

  • Environmental Standard Maintenance

    No. A new version makes previous versions obsolete.

    So, if you are about to start working with ISO 14001:2015 perhaps the following information may be useful for you.
Page 125 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +