Search results

Cryptographic tool

By the information you provided:

- in the first column you need to use the original text of the template (Name of the System / Type of information) and be more specific about the situation you are describing because you are referring to information (source code and backup), where it is (laptop), and its state (at rest and in transit). The use of this different elements may cause confusion when defining which tools apply.

For example, will backup and source code stored in any place require HSM or only those stored on corporate servers? As a suggestion, you could use terms like “data at rest in corporate servers” and “data at rest in laptops” to be clearer (since backup and source code shares the same specifications as data at rest, you can exclude them from the list)

- the remaining columns are ok. Specifically, about the Cryptographic Tool column, you correctly defined by which means the encryption algorithm will be implemented (in your case, by the software OSX Filevault, by Hardware security module, and by TLS protocol). 

Questions regarding the template of ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit

First of all, sorry for this confusion.

To avoid further confusion, instead of answer your current questions, I rewrote the first answers sent to you considering the correct template.

1) Which section does “privileges in respect to the abovementioned user profiles” in 3.4. Organization’s privilege management refer to? Is this 3.2 or 3.3?

Section 3.4 refers to privilege management of profiles defined in section 3.2

To make the text clearer, you can change the first paragraph of section 3.4 from “Privileges in respect to the abovementioned user profiles for [organization name] (granting or removing access rights) are allocated in the following way:” to “Privileges in respect to the user profiles mentioned in section 3.2 for [organization name] (granting or removing access rights) are allocated in the following way:”

2) If it’s 3.3 then looks like 3.4 and 3.5 will cover the same thing?

Please note that sections 3.4 and 3.5 have different purposes. Section 3.4 refers to the management of profiles used by the organization (covered by section 3.2) and section 3.5 refers to the management of profiles related to provided cloud services (covered by section 3.3).

3) But, section 3.7 mentions “Organizations’ personal defined in 3.4 as responsible for granting administrative access rights to its public cloud services, platforms, and infrastructure…”. Which makes me wonder 3.4. is for 3.3. Is it correct? Or, this should be “Organizations’ personal defined in 3.5 as responsible for granting administrative access rights to its public cloud services, platforms, and infrastructure…”

Your assumption is correct the reference must be to section 3.5 not to section 3.4. We’ll make this correction ASAP. Thanks for this feedback.

Članak 10. MDR-a

Svaki proizvođač medicinskog proizvoda mora imati implementiran sustav kvalitete, neovisno o tome ima li ili nema zaposlenike. Proizvođač je odgovoran za stavljanje proizvoda na tržište i, prema tome, mora imati implementiran sustav. To što je proizvodnja podugovorena, sa stanovišta tržišta ne igra ulogu. Dakle, kod podugovorene proizvodnje, proizvođač mora imati ugovor o kvaliteti s podizvođačem, mora imati implementiran svoj sustav kvalitete u kojem će biti najvažnije na koji način drži pod kontrolom podizvođača. Ukoliko podizvođač nema sustav kvalitete, proizvođač je dužan pripremiti odgovarajuću dokumentaciju po kojoj će podizvođač provositi proizvodnju. 

Naravno, sustav kvalitete proizvođača  mora biti implementiran tako da bude spreman za certificiranje. To znači da u fazi razvoja sustav kvalitete ne trba još biti implementiran. 

Documents for measurement systems

Laboratories apply for ISO 17025 accreditation once they have implemented the requirements of ISO 17025 into their management system. Because ISO 17025 is a competency standard, the laboratory must show technical competency for all the methods applied for, i.e. methods on the Scope of accreditation to ISO 17025.That means for each test or calibration method, the laboratory must meet the technical requirements including a suitable method to meet the need of the client, method validation, internal quality control, and proficiency testing. Once initial accreditation is obtained, the laboratory can “extend the scope” by adding addition test methods. Note in some cases the test methods may be in a different discipline and accreditation program, for example a labortory may initially only include chemistry and then later add Microbiological methods. for accredition. This may require you to meet other regulatory requirements and specific requirements from the Accreditation Body for that program.

Then note that in some cases a laboratory can apply for a “flexible scope of accreditation”. This means that after initial accreditation and the scope of accreditation is published by the accreditation body (i.e. competency was demonstrated),  the laboratory can add additional activities that are considered to be within scope of accreditation without applying for extension of scope. This mechanism is applicable as a example, to a specific methodology / technique that is accredited for certain analytes and then the laboratory can develop the technique to add further analytes using the same methodology. FO example . The degree of flexibility will vary between technical disciplines and conformity assessment activities, so the laboratory must adhere to the policies of the Accreditation body.

For more information on flexible scopes, guided by ILAC, see ILAC G18:04/2010 Guideline for the Formulation of Scopes of Accreditation for Laboratories (under revision) available from https://ilac.org/publications-and-resources/ilac-guidance-series/. I suggest you then contact your accreditation body for specific requirements.

For more information on ISO 17025 see What is ISO 17025? at https://advisera.com/17025academy/what-is-iso-17025/ and the Free webinar – What are the steps in the ISO 17025 accreditation process? at https://advisera.com/17025academy/webinar/what-are-the-steps-in-the-iso-17025-accreditation-process-free-webinar/

Quality Control Documentation

This is a rather broad topic so I suggest that you can start some of the following readings:

• How to structure quality management system documentation https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
• Some tips to make Document Control more useful for your QMS https://advisera.com/9001academy/blog/2014/05/20/tips-make-document-control-useful-qms/
• Common mistakes with ISO 13485:2016 documentation control and how to avoid them https://advisera.com/13485academy/blog/2018/03/14/common-mistakes-with-iso-134852016-documentation-control-and-how-to-avoid-them/

After you read this, and of course the standard ISO 13485:2016, we are at your disposal for further discussion. In that case, I suggest making an online call to solve all your questions.

Needed Policies

Since these are non-mandatory nor commonly adopted policies for an ISO 27001 ISMS there are no templates available for such policies. In this case, I suggest you schedule a meeting with one of our experts so he can understand your needs and help you to develop such documents.

From an ISO 27001 point of view, it is important to evaluate which controls you want to implement to better understand how to write such policies and to see if existent templates are sufficient for your need.

For example, the Wireless Access Policy can be embedded in the Access Control Policy (located in folder 08 Annex A >> A.9 Access control), since the wireless network is an infrastructure element already covered in the Access Control Policy.

Another example is the Endpoint Security Policy. Elements of endpoint policy, such as configuration and use of software, are already defined in the IT Security Policy (located in folder 08 Annex A >> A.8 Asset Management). The same applies to Anti-virus Policy, also covered in the same IT Security Policy.

Supplier Security Policy

1. Do you have any SUPPLIER SECURITY POLICY questionnaire template ready on the toolkit or your website?

Answer: A questionnaire to support the application of the Supplier Security Policy is not necessary.

Please note that the Supplier Security Policy is based on risk assessment to find out which controls a supplier need to have to provide the security level your organization needs, and for that, you can use the Risk Assessment Table included in your toolkit, in folder 5 Risk Assessment and Risk Treatment.

For further information, see:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/

2. Do you have any SUPPLIER SECURITY MANAGEMENT partner or suggestion that we could consider use?

Answer: I’m assuming the question is about an external software that will handle suppliers.

In this case, it is not very common for smaller companies to use such kind of software (usually the external partners are handled without the use of a software).

For other cases, I'm sorry, but it’s our policy not to suggest specific companies or technologies related to the implementation of controls.

3. In the 3.2. Screening, the policy says “[Job title] decides whether it is necessary to perform background verification checks for individual suppliers and partners, and if yes – which methods must be used.” What method does it mean?

Answer: Methods here means the ways you will use to perform background verification. Please note that these may be limited to local laws or regulations.

Examples of methods for background verification are interviews with previous employers/customers, reference letters, consultation to government agencies. 

ISO 9001 Clause 8.2.3.2

Clause 8.2.3.2 is applicable to any organization. Your organization does not manufacture a product but provides services, storage, and distribution services. Your organization reviews the client’s requirements before presenting a proposal. Your organization must keep records of clients’ requirements, their review, and proposal or contract.

Should trainer be certified with IATF certification body?

If there is no special customer request or expectation in this regard, you can use your own employees who have been trained in 5 core tools before and has experience can provide internal training. It does not necessarily have to be issued by the person appointed by the IATF or by the certification body. 

The important thing is that the trainer can demonstrate these competencies by having received training from a person or organization before and having sufficient experience on the subject in his CV.

Incidente de segurança da informação

A ISO 27001 não prescreve prazos para notificação e tratamento de incidentes, então você precisa identificar os requisitos legais (por exemplo, leis, regulamentos ou contratos) que você precisa cumprir para identificar se há algum prazo exigido e para quais tipos de incidentes.

Este artigo fornecerá mais explicações sobre o gerenciamento de incidentes:

• How to handle incidents according to ISO 27001 A.16 https://advisera.com/27001academy/blog/2015/10/26/how-to-handle-incidents-according-to-iso-27001-a-16/