Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Can certified ISO 27001 Lead Auditor train and certify other people?

    1. I was told a certified ISO 27001 LA can train and certify other people?

    For ISO 27001 compliance purposes, a certified ISO 27001 Lead Auditor has recognized knowledge and skills that allow him to train other people.

    Regarding certification, in theory, everyone can issue a certificate, but for the certificate to be recognized it should be issued by a trustworthy organization. 

    A certification issued by a certified ISO 27001 Lead Auditor has limited recognition (normally it is recognized only by the organization he works for).

    On the other hand, a certificate issued by an accredited training provider is often worldwide recognized.

    In short, if your need for certification is only for internal purposes, a certified ISO 27001 Lead Auditor can issue that for you. In case you need a certification wildly recognized, you should look for an accredited training provider.

    2. If true? is there a special certificate/training to be able to do this?

    To become a certified ISO 27001 Lead Auditor you need to attend an ISO 27001 Lead Auditor course from an accredited training provider and be approved in its final exam.

    In the link below, you can access the information about such a course:

    These articles will provide you a further explanation about lead auditors:

  • Applicability of employee data

    It depends. Referring to your employees data you act as a Controller, who is the legal entity which defines means and purposes of processing of personal data. That imeans that the Company is free to determine how data will be processed.

    If you are an EU Controller you have to apply GDPR for all your personal data processing no matter where data subjects are located. If you are not an EU Controller, and your employees are not located in the EU, then, you don't have to comply with GDPR.

    Here you can find more information about the EU GDPR applicability:

    If you want to understand how to comply with the EU GDPR, you may consider enrolling in our EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/

  • Changing risk scale in Conformio

    ISO 27001 does not prescribe which scale to be adopted, so we adopted a 1-3 scale to make risk assessment simpler and practical (a 1-5 scale will involve more values and alternatives).

    These articles will help you:

    By the way, the risk assessment process is also explained in this free online training:

  • Management Representative Role

    While AS9100 clause 5.3 does not dictate exactly who is to be appointed the management representative, it does require that it shall be a specific member of the organization’s management, so appointing a non-management person does not meet this requirement. As for Pro’s and Con’s of using a someone who is very low-level management to this position I can’t think of any Pro’s, and the biggest risk is the ability to have the “organizational freedom and unrestricted access to top management to resolve quality management issues” as required by the standard. This would occur if the low-level manager did not have the organizational clout to ensure that managers who are senior to the representative will resolve quality issues to the satisfaction of the quality representative.

    You can read more on the quality management representative in the article: Is the management representative still required in AS9100 Rev D?, https://advisera.com/9100academy/blog/2017/05/22/is-the-management-representative-still-required-in-as9100-rev-d/

  • QA Manual format changes

    Thank you Mark. That's helped clarify the situation completely. Very helpful to understand the context of the QA Manual need outside the framework of the standard

  • Implementation ISO 13485 on making medical materials for medical laboratories

    Yes, clinical chemistry reagents are considered to be in vitro diagnostic medical devices, therefore ISO 13485:2016 is apllicable as quality management standard.  

  • IT Assets Disposal/ Write-Off

    First of all, congratulations on your company’s achievement.

    Regarding the IT assets disposal, you need to evidence that the applied data deletion method has made the previously stored information unrecoverable and that its application was verified and approved by the data owner.

    For example, for a laptop, you can perform full disk encryption two or three times in a row, and at each time encryption is performed you must destroy the related encryption key.

    As a proof for auditors you can develop a "Destructio/Deletion Record" containing the information about the asset, the deletion method aplied, date when the procedure was performed, and the signature of the person responsible for the deleted data, as a confirmation that the procedure was successfull.

    For technical guidance, you should consider these references:
    - ISO/IEC 27040 Information technology — Security techniques — Storage security - https://www.iso.org/obp/ui/#iso:std:iso-iec:27040:ed-1:v1:en
    - NIST 800-88 - Guidelines for Media Sanitization https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final

  • Risk managment plan

    No, these non-medical devices do not require risk assessment. Of course, you have under the ISO 9001:2015 risk analysis and you can cover any specific risks for these there. 

    More about risk management within ISO 9001 you can find on the following links:

Page 147-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +