Search results

File storage of embedded software source code

IATF does not prescribe how to store source code files or any other type of information, and at this point, there are some semi-regulatory quasi-technical documents that can be considered:

• https://www.gov.uk/government/publications/principles-of-cyber-security-for-connected-and-automated-vehicles/the-key-principles-of-vehicle-cyber-security-for-connected-and-automated-vehicles
• https://www.enisa.europa.eu/publications/cyber-security-and-resilience-of-smart-cars
• https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/812333_cybersecurityformodernvehicles.pdf
• https://unece.org/fileadmin/DAM/trans/doc/2018/wp29grva/GRVA-01-17.pdf

Basically, they do not define as good practice using external web-based storage sites such as GIT, which provides you implement security measures to ensure only authorized personnel can have access to the code, like access control, cryptography, etc. Considering ISO 27001, the leading ISO standard for information security, you should perform a risk assessment to identify if these controls are enough to provide the security you want in this scenario (for example, for basic applications, such controls may be enough, but for more sensitive applications you should be considering not using this approach).  

For further information, see:

• How to handle access control according to ISO 27001 https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/
• How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/
• ISO 27001/ISO 27005 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/

Gap analysis and key performance indicators

1. How to conduct gap analysis for ISO 13485?

You did not specify in your question what kind of GAP analysis you need. Gap analysis is about comparing the current situation of a company with standard requirements. 

So please check the following link about performing gap analysis regarding the ISO 13485: https://advisera.com/13485academy/iso-13485-gap-analysis-tool/

You can make also a GAP analysis between ISO 9001 and ISO 13485 if you have implemented a quality management system according to the ISO 9001:2015 and you need now to implement ISO 13485:2016. The best way to conduct this GAP analysis is to take a cross-references table at the end of the ISO 13485:2016 standard (Annex B).

2. How to determine key performance indicators?

The term Key Performance Indicator refers to measurements you used to determine the performance and effectiveness of the QMS. This is completely up to you, but the main question you need to ask yourself is "What do I need to measure to know that my QMS processes are performing as expected and that they are effective?". KPIs also depend on what is a company’s strategy and competitive advantage. KPIs for a manufacturer of commodities are different from a manufacturer of innovative or differentiated stuff.

For more information regarding the KPI, please see the following article, regardless of what is their mention of the ISO 9001 standard:

• How to define Key Performance Indicators for a QMS based on ISO 9001 https://advisera.com/9001academy/blog/2016/05/24/define-key-performance-indicators-qms-based-iso-9001/

• CMMC guidance

  For information about becoming a certified CMC registrar or auditor, please access these sites:

  • https://cmmcab.org/
  • https://pecb.com/en/education-and-certification-for-individuals/cybersecurity-maturity-model-certification/cmmc-ab-certified-professional

• Operational Security Objectives

  I’m assuming you are referring to the Information Security Policy document.

  Considering that, ISO 27001 is pretty flexible when it comes to defining your security objectives. In this case, when you didn’t have incidents in the year, you can set as an objective 0 incidents, or focus on other objectives.

  This absence of incidents can in fact help to acquire new customers and increase revenue (potential customers will have more confidence to work with you), but please note that keep an objective of 0 incidents is a pretty hard one. 

  Normally 3 to 4 objectives allow an ISMS to support properly the business, for example:

  • one operational objective: system uptime
  • one financial objective: increased revenue
  • one business objective: entering a new market
  • one compliance objective: fulfillment of GDPR

  This article will provide you a further explanation about information security objectives:

  • ISO 27001 control objectives – Why are they important? https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/

  In this free online training, you'll find detailed guidance on setting the objectives:

  • ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

• Advisory

  My personal advice, to begin with, you can get a 2-day quality management system and ISO 9001:2015 standard training. If you are going to implement the IATF 16949:2016 system, this training can be 3-4 days. After that, you can review your work with the help of a consultant, and I think this will help you improve. You can get an online consultancy service, like 2 days a month.

  Advisera tool kit helps you with reference documents in the documentation structure, but in my personal opinion, consultant assistance may be needed for a while.

  For more information, see:

  • How to define roles and responsibilities within an IATF 16949-based QMS https://advisera.com/16949academy/blog/2017/11/29/how-to-define-roles-and-responsibilities-within-an-iatf-16949-based-qms/
  • How to establish QMS Statistical Process Control according to IATF 16949 https://advisera.com/16949academy/blog/2017/08/30/how-to-establish-qms-statistical-process-control-according-to-iatf-16949/
  • How to define the scope of the QMS according to IATF 16949:2016 https://advisera.com/16949academy/blog/2017/06/28/how-to-define-scope-of-the-qms-according-to-iatf-16949/
  • IATF 16949:2016 Documentation Toolkit  https://advisera.com/16949academy/iatf-16949-2016-documentation-toolkit/

• Register of Legal, Contractual, and Other Requirements

  The content of this register is defined by the interested parties (e.g., top management, customers, suppliers, employees, government agencies, etc.) which are relevant to your information security management system (ISMS), and are usually documented as laws, regulations, contracts, agreements, and other similar documents, which are identified in this document.

  For example, you can have a service contract with your main customers where they require backup to be performed in a certain way and use a defined technology. In this template, you will identify the requirements (backup method and technology to be used), where they can be found (service contract ***), who defined them (customer), and who is responsible for it (e.g., IT manager), and the implementation deadline (e.g., end of October 2021).

  Regarding contracts, you need to consider not only contracts with customers but also with employees and suppliers, i.e., with all parts that are relevant to information security.

  You do not need to list all your customers. You can list only the more relevant ones (e.g., those with the highest values, the strategic ones, etc.), which can be identified by codes to protect privacy.

  If you have signed the same agreements with e.g. customers, you do not need to list each party separately - you can only list them together, e.g. "customers" and specify the security requirements from those standardized agreements.
  
  

  This article will provide you a further explanation about requirements identification:
  - How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/

• Basic question on GDPR

  No, there is no international standard that certifies GDPR requirements, although some standards can help you to implement GDPR principles and design correctly policies. I.e,  ISO27001 on information security or ISO17000 on conformity. Therefore, there is no expiration date and you will apply GDPR as soon as it will be enforceable. The previous EU directive had been enforceable for more than 10 years, so the time frame is long.

  In order to verify the requirements to pass the CIPM certification, you should consult the IAPP website.

  Here you can find more information about ISO standards:

  • What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
  • Where to start from with ISO 27001 https://advisera.com/27001academy/knowledgebase/iso-27001-where-to-start-most-important-materials/
  • 9 steps for implementing GDPR https://advisera.com/articles/9-steps-for-implementing-gdpr/
  • Is the GDPR applicable to our company? https://advisera.com/eugdpracademy/knowledgebase/who-needs-to-be-gdpr-compliant-an-easy-explanation/

  If you want to know how to implement ISO 27001 standards or the EU GDPR, you may consider enrolling in our free online foundations courses:

  • Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
  • EU GDPR Foundations course: https://advisera.com/training/eu-gdpr-foundations-course/

     

  • CISSP

    ISO certification of persons works in a different way.

    Accredited ISO training providers comply with ISO 17024 – which provides general requirements for bodies operating certification of persons.

    Provided they fulfill this standard’s requirements, each training provider can have their own sets of questions to use in their exams.

    These articles will provide you a further explanation about ISO 27001 personnel certifications:

    • What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
    • What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
    • Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/

    These materials will also help you regarding ISO 27001 personnel certifications:

    • Free online training ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
    • Free online training ISO 27001 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/
    • Free online training ISO 27001:2013 Lead Implementer Course https://advisera.com/training/iso-27001-lead-implementer-course/

  • Cyber security certificates that guarantee entry-level work

    Please note that the answer to this question depends on the type of work you are considering (e.g., database security, network security, cloud security, security management, etc.).

    For ISO 27001, the lead ISO standard for information security management, the entry-level certifications would be:

    • ISO 27001 Foundations
    • ISO 27001 Internal Auditor

    More advanced certifications are:

    • ISO 27001 Implementer
    • ISO 27001 Lead Auditor

    These articles will provide you a further explanation about ISO 27001 personnel certifications:

    • What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
    • What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
    • Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/

    These materials will also help you regarding ISO 27001 personnel certifications:

    • ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
    • Free online training ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
    • Free online training ISO 27001 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/
    • Free online training ISO 27001:2013 Lead Implementer Course https://advisera.com/training/iso-27001-lead-implementer-course/

  • Error proofing

    I don't think there is a standard for Error-proof devices. But according to article 10.2.4 of the IATF 16949.2016 standard; Both production and product verification methods of error-proof devices must be specified in the control plan. For example, let's assume that there is 100% control of the product on the production line with a camera. You verify this camera with the "NOK" master sample per shift. Here in the control plan, you need to enter the verification of each shift with the "NOK" master sample.