Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Encryption for Backup/Restore

    1 - Do we need to encrypt all data during the backup/Restore process or not?

    According to ISO 27001, the need for encryption of backup tapes will depend on the results of risk assessment and identified legal requirements.

    If you do not have risks, or legal requirements, that justify the implementation of encryption, you do not need to implement it.

    This article will provide you with a further explanation about controls selection:

    2 - If yes , do we need to encrypt all the data or we need to classify the data?

    In case you have risks or legal requirements that justify implementing encryption, the data to be encrypted will depend on the rules defined by the organization, usually defined in the Information Classification Policy.

    So, before defining which data will be classified, you will need to classify it first.

    For further information, see:

    3 - Who will decide what data should be encrypted?

    The person who will decide if data should be encrypted or not is the person responsible for the data (also called in ISO 27001 as information owner). The decision will be related to the classification level attributed to the data.

  • Disaster Recovery Plan

    1 - May I ask, is the Disaster Recovery Plan a good control to start with, and the most important one. Also, it consists of many other controls that would then be covered at the same time?

    In fact, the Disaster Recovery Plan is one of the last controls to work on. The purpose of the Disaster Recovery Plan is to allow the quick resume of information security and information technology activities in case of a disruption, so you need to understand first which information security controls are in place to start developing your plan.

    For further information, see:

    2 - I suppose our Head Software Developer who also is in charge of Server Maintenance, would that be the person to document these steps.  As it is much more complex than just “copy-paste install backup.

    The person to be involved in the development of a Disaster Recovery Plan will depend on the defined disruptive scenario.

    For example, if the disruptive scenario involves only the loss of a server, then your Head Software Developer will be the person to be responsible for the plan. On the other hand, if the disaster involves not only the loss of the server, but also the loss of the server room, or an entire building, then you will need to involve more people, like the facility manager.

    This article will provide you with further explanation about developing a plan:

    These materials will also help you regarding developing a plan:

  • Calibration program

    You asked

    How the lab select the verification method "

    This depends on the type of test method and its purpose. I assume as you refer to verification, your laboratory is using a Standard Method. If not, you need to perform a more detailed validation.

    Have a look at my explanation to the question “Which parameters will be verified for standard methods?” Methods verification at https://community.advisera.com/topic/methods-verification/

    If you need more information on Validation, see my reply to Procedures for validation and verification of methods at https://community.advisera.com/topic/procedures-for-validation-and-verification-of-methods/

    You also asked

    How the lab measure the uncertainty ?"

    For information on the use of the toolkit and additional technical expertise required to evaluate measurement uncertainty, have a look my reply to a previous question Measurement uncertainty in chemical process at https://community.advisera.com/topic/measurement-uncertainty-in-chemical-process/

  • Enquiries on Project Plan and review

    On the inputs, you can state if there is already any documented procedure, record, contract with the supplier, so any documentation that you already have and use in your company.

    Deliverables mean what will be the output of certain requirements. And resources means whether it is necessary to provide any resources for each phase. For example, people who will spend a certain phase, finances (like these finances that you spent when buying this toolkit).

    For more information on the implementation process, please see the following:

    • Checklist of ISO 13485 implementation and certification steps https://advisera.com/13485academy/knowledgebase/checklist-of-iso-13485-implementation-and-certification-steps/

    • Performing IATF 16949 audits

      I think you are asking this question for internal auditor competency. According to article 7.2.3 of IATF 16949:2016 standard, system auditors should have the following information.

      • understanding of the automotive process approach for auditing, including risk-based thinking;
      • understanding of applicable customer-specific requirements;
      • understanding of applicable ISO 9001 and lATF 16949 requirements related to the scope of the audit;
      • understanding of applicable core tool requirements related to the scope of the audit;
      •  understanding how to plan, conduct, report, and closeout audit findings.

       

      As you know, the basic tools are APQP, PPAP, FMEA, SPC, MSA. In these subjects, it may be necessary to show either the training record or the experience records on the CV.

      In addition, Control Plan, FMEA, and related manufacturing process experience are required within manufacturing process auditors.

      If your ISO 9001 certified internal auditors can demonstrate the above-mentioned competencies, they can carry out inspections. Apart from these, if there is an additional requirement from the customer's special request, it may be necessary to provide evidence on that subject.

       

       

    • ISO 14001 certification in mixed-use projects

      Yes, you can have one certification applicable to more than one site. You will have common documents, like the same policy, like common overall goals, like same procedure for corrective actions, internal audits or document control. You may have common processes for collecting and verifying compliance obligations and for determining environmental aspects and impacts.
      Then, you will have specific procedures and work instructions a applicable to just one site

    • Vulnerability Assessment & Penetration Testing policy

      The vulnerability management and penetration test are not mandatory documents according to ISO 27001, nor are they documents commonly adopted by organizations (most of them rely on outsourced services for this purpose), so it is not included in the toolkit, to avoid unnecessary effort to manage the ISMS. If you understand that this document is important to your organization, you can schedule a meeting with one of our experts so he can help you to develop such a document.

      These articles will provide you a further explanation about vulnerability management:

    • Amount of staff ISO 13485

      No, ISO 13485: 2016 nowhere defines how many employees a company must have in order to be in compliance with it.

      If you continue to reduce your staff, this will be reflected on your processes, so you need to adjust them, to create a new job schedule, new job responsibilities descriptions, and the like.

      Nothing will change drastically if the number of your employees is reduced from 5 to 3. The biggest risk that may arise is whether you now have enough staff to continue to ensure quality when delivering your product or service.

    • Info packaging

      You can purchase this product from the manufacturer under the MDD only if there is a valid MDD certificate. If the manufacturer's MDD certificate is expired, according to the Article 120 Transitional provisions, no matter that the manufacturer's MDD certificate is expired, you can sell MDD products until the expiry date on the device.

      You cannot purchase this product more from the manufacturer if it has not received an MDR certificate.

      General safety and performance requirements – Annex 1- is applicable for MDR medical devices. All MDR medical devices must be in compliance with applicable requirements from section 23 of Annex 1.

      For more information, see:

      • EU MDR Article 120 Transitional provisions https://advisera.com/13485academy/mdr/transitional-provisions/
      • EU MDR Annex 1 – General safety and performance requirements https://advisera.com/13485academy/mdr/general-requirements/

      • Is ISO 17025 accreditation needed?

        You asked

        I would like to ask if an OEM company is ISO9001:2015 certified is it mandatory that they will get certification for ISO IEC 17025:2017 accreditation?

        The answer is no, IATF does not have a mandatory requirement for ISO 17025 accreditation. To clarify this let us start with mentioning that ISO 17025 is a testing and calibration standard to which laboratories are accredited, where ISO 9001 and IATF 16949 are Quality Management standards, to which organizations are certified. IATF 16949 is implemented in conjunction and as a supplement to ISO 9001 with a number of extra requirements for automotive suppliers on top of the requirements of ISO 9001.

        An OEM (original equipment manufacturer) that supplies components is not a laboratory, so ISO 17025 is not directly applicable. IATF 16949 however requires that specific laboratory requirements are met and the process for the management and calibration or verification records and internal calibrations is documented. Because of these requirements and the need for statements of conformity to a specification after calibration/verification, IATF 16949 includes an explanatory note that ISO/IEC 17025 accreditation is useful to demonstrate the organization's in-house laboratory conformance to the IATF 16949 requirements. This means that although not mandatory, testing of components and calibrations will typically be be performed by an accredited ISO 17025 laboratory. This is irrespective of  whether it is an inhouse laboratory (owned by or a department of the OEM) or subcontracted to an external provider.

        Note that while accreditation is not mandatory; as a minimum, it is advisable that the laboratory implements ISO 17025 and works in accordance to ISO 17025 to ensure requirements are met.

        You also asked 

         if answer is No, does it affects company's accreditation to  IATF 16949?

        Please note as said above, a company is certified to IATF 16949, not accredited. As long as the specific laboratory requirements are met, accreditation to ISO 17025 will not affect company's certification to IATF 16949

        For more information on IATF 16949, see the IATF 16949 Advisera Academy at https://advisera.com/16949academy/
        For more information on ISO 17025 see ISO 17025 – Main guidelines at https://advisera.com/17025academy/what-is-iso-17025/
Page 142 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +