Search results

Documents for measurement systems

Laboratories apply for ISO 17025 accreditation once they have implemented the requirements of ISO 17025 into their management system. Because ISO 17025 is a competency standard, the laboratory must show technical competency for all the methods applied for, i.e. methods on the Scope of accreditation to ISO 17025.That means for each test or calibration method, the laboratory must meet the technical requirements including a suitable method to meet the need of the client, method validation, internal quality control, and proficiency testing. Once initial accreditation is obtained, the laboratory can “extend the scope” by adding addition test methods. Note in some cases the test methods may be in a different discipline and accreditation program, for example a labortory may initially only include chemistry and then later add Microbiological methods. for accredition. This may require you to meet other regulatory requirements and specific requirements from the Accreditation Body for that program.

Then note that in some cases a laboratory can apply for a “flexible scope of accreditation”. This means that after initial accreditation and the scope of accreditation is published by the accreditation body (i.e. competency was demonstrated),  the laboratory can add additional activities that are considered to be within scope of accreditation without applying for extension of scope. This mechanism is applicable as a example, to a specific methodology / technique that is accredited for certain analytes and then the laboratory can develop the technique to add further analytes using the same methodology. FO example . The degree of flexibility will vary between technical disciplines and conformity assessment activities, so the laboratory must adhere to the policies of the Accreditation body.

For more information on flexible scopes, guided by ILAC, see ILAC G18:04/2010 Guideline for the Formulation of Scopes of Accreditation for Laboratories (under revision) available from https://ilac.org/publications-and-resources/ilac-guidance-series/. I suggest you then contact your accreditation body for specific requirements.

For more information on ISO 17025 see What is ISO 17025? at https://advisera.com/17025academy/what-is-iso-17025/ and the Free webinar – What are the steps in the ISO 17025 accreditation process? at https://advisera.com/17025academy/webinar/what-are-the-steps-in-the-iso-17025-accreditation-process-free-webinar/

Quality Control Documentation

This is a rather broad topic so I suggest that you can start some of the following readings:

• How to structure quality management system documentation https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
• Some tips to make Document Control more useful for your QMS https://advisera.com/9001academy/blog/2014/05/20/tips-make-document-control-useful-qms/
• Common mistakes with ISO 13485:2016 documentation control and how to avoid them https://advisera.com/13485academy/blog/2018/03/14/common-mistakes-with-iso-134852016-documentation-control-and-how-to-avoid-them/

After you read this, and of course the standard ISO 13485:2016, we are at your disposal for further discussion. In that case, I suggest making an online call to solve all your questions.

Needed Policies

Since these are non-mandatory nor commonly adopted policies for an ISO 27001 ISMS there are no templates available for such policies. In this case, I suggest you schedule a meeting with one of our experts so he can understand your needs and help you to develop such documents.

From an ISO 27001 point of view, it is important to evaluate which controls you want to implement to better understand how to write such policies and to see if existent templates are sufficient for your need.

For example, the Wireless Access Policy can be embedded in the Access Control Policy (located in folder 08 Annex A >> A.9 Access control), since the wireless network is an infrastructure element already covered in the Access Control Policy.

Another example is the Endpoint Security Policy. Elements of endpoint policy, such as configuration and use of software, are already defined in the IT Security Policy (located in folder 08 Annex A >> A.8 Asset Management). The same applies to Anti-virus Policy, also covered in the same IT Security Policy.

Supplier Security Policy

1. Do you have any SUPPLIER SECURITY POLICY questionnaire template ready on the toolkit or your website?

Answer: A questionnaire to support the application of the Supplier Security Policy is not necessary.

Please note that the Supplier Security Policy is based on risk assessment to find out which controls a supplier need to have to provide the security level your organization needs, and for that, you can use the Risk Assessment Table included in your toolkit, in folder 5 Risk Assessment and Risk Treatment.

For further information, see:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/

2. Do you have any SUPPLIER SECURITY MANAGEMENT partner or suggestion that we could consider use?

Answer: I’m assuming the question is about an external software that will handle suppliers.

In this case, it is not very common for smaller companies to use such kind of software (usually the external partners are handled without the use of a software).

For other cases, I'm sorry, but it’s our policy not to suggest specific companies or technologies related to the implementation of controls.

3. In the 3.2. Screening, the policy says “[Job title] decides whether it is necessary to perform background verification checks for individual suppliers and partners, and if yes – which methods must be used.” What method does it mean?

Answer: Methods here means the ways you will use to perform background verification. Please note that these may be limited to local laws or regulations.

Examples of methods for background verification are interviews with previous employers/customers, reference letters, consultation to government agencies. 

ISO 9001 Clause 8.2.3.2

Clause 8.2.3.2 is applicable to any organization. Your organization does not manufacture a product but provides services, storage, and distribution services. Your organization reviews the client’s requirements before presenting a proposal. Your organization must keep records of clients’ requirements, their review, and proposal or contract.

Should trainer be certified with IATF certification body?

If there is no special customer request or expectation in this regard, you can use your own employees who have been trained in 5 core tools before and has experience can provide internal training. It does not necessarily have to be issued by the person appointed by the IATF or by the certification body. 

The important thing is that the trainer can demonstrate these competencies by having received training from a person or organization before and having sufficient experience on the subject in his CV.

Incidente de segurança da informação

A ISO 27001 não prescreve prazos para notificação e tratamento de incidentes, então você precisa identificar os requisitos legais (por exemplo, leis, regulamentos ou contratos) que você precisa cumprir para identificar se há algum prazo exigido e para quais tipos de incidentes.

Este artigo fornecerá mais explicações sobre o gerenciamento de incidentes:

• How to handle incidents according to ISO 27001 A.16 https://advisera.com/27001academy/blog/2015/10/26/how-to-handle-incidents-according-to-iso-27001-a-16/

ISO 14001 communication procedure lacking in ISO 13485

In ISO 13485:2016 there are no requirements that communication within the company must have documented procedure. In requirement 5.5.3 Internal communication is stated that top management must ensure that appropriate communication within the company must be established.

In our toolkit, internal communication is mentioned in the Quality Manual, chapter 5.5.3 Internal communication. In the comment, you can see that we put “Adapt to organization practice”. Here you can describe whether you have bulletin boards, what information is placed and communicated on these powerful boards, whether you have a policy until when emails may be sent during the day, how quickly you need to respond to an e-mail, how important paper information travel around the company etc.

Removing approved risks in Conformio

From your question I’m assuming you want to remove some threats and vulnerabilities associated with an asset once the risk assessment and treatment process is concluded.

It is not possible to remove threats or vulnerabilities, but it is possible to make the risk not relevant any more - for that purpose  you have to enter the Risk Register, find the risk and decrease its likelihood and/or impact so that it becomes acceptable. Please note that this change will initiate changes in the Statement of Applicability and the Risk Treatment Plan, i.e. you will start a whole cycle of risk management. Therefore, we recommend these changes are made every 6 months.

In case the risk management process is not concluded, you can simply roll back the steps to eliminate/alter the risk.

Vendor/third party risk management/assessment

Yes, for vendor/third party risk management you should use the templates for risk assessment and risk treatment included in your toolkit, in folder 5 Risk assessment and risk treatment - these are the same templates as for assessing the risks for your own company, since the assessment process is the same.

This article will provide you with further explanation about supplier security:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/