Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Scope

    For organizations with up to 50 employees, the best approach is to include all the organizations in the ISMS scope, because in this situation in the majority of cases the effort to separate elements in the scope from those out of it is not worthy.

    When the organization uses a third-party Platform-as-a-Service, the data and all application software should be included in the ISMS scope, while everything else is out, including all system software.

    These articles will provide you a further explanation about scope definition:

    These materials will also help you regarding scope definition:

  • ISMS implementation

    1. Processes and services. Should I write about each service and each process specifically as part of the whole business model. Example : Managed Service Provider Service and all its processes Software Development Service and all its processes Software Support Service and all its processes Cloud Infrastructure Consulting Service and all its processes OR May I just put something more general that points to the idea that all the organizational business and processes are in the scope. A broader definition might be open to interpretation, but we really want the whole organization to be covered by the security benefits of having an ISMS in place. Example : Every service and process that is a part of the organization and its business is included in the scope.

    Since your whole organization is part of the ISMS scope, you can use a text identifying your core business and including business management and supporting processes. Something like: Software development processes and their related supporting processes, and business administrative processes.

    2. Organizational units May I just get away with putting down that the whole organization and all organizational units are included in the scope. Do I need to define organizational units if I am not going to leave any of them out of the scope ? Would an auditor be OK with that definition and would he/she understand that the whole organization is covered by the ISMS ? The problem is that the organization is fairly fluid and ever-moving and changing in regards to units and departments. This doesn't mean that people that are responsible for certain things are not appointed. Everything is logged, double checked and audited, but it would be a bit difficult to channelize every organizational aspect into a department or a unit.

    Since your whole organization is part of the ISMS scope, then you can only state that the whole organization is in the scope.

    3. Network and IT infrastructure This one seems really tricky for me. A lot of our IT infrastructure is ever-changing so to speak of - networks, devices, services are constantly added, removed, migrated, changed. If I need to list every piece of IT infrastructure and network that would be an Inventory of Assets of its own. So the question is - when I've actually done the work to mark every piece of data in the Inventory of Assets do I need to relist everything under the "Networks and IT infrastructure" as well ? May I just put in something showing the general concept of ISMS coverage ( i.e everything ). Would a definition like "All networks and IT infrastructure that are located in the ( and here I would just specify the location )" is a part of the scope. Our IT infrastructure is only in one physical location and also the cloud. We are using the IaaS model and sometimes PaaS as a model. In this regard I would list those in the supplier policies and not in the scope.

    Considering your context, the proper definition here is the one you thought “All networks and IT infrastructure that are located in the <location>”.

    This article will provide you a further explanation about defining scope:

    This material can also help with defining scope:

  • Are employees of 17025 certified labs required to have transcripts on file?

    In terms of ISO 17025 requirements, education and training records and evidence of competence are essential. Typically the diploma without a transcript will be suitable. Laboratories should, however, have recruitment criteria and minimum education requirements documented. If necessary, to verify a specific educational achievement for a particular position, a transcript would be required. This could, for example, be a result (e.g.,>70%) for a specific course; or diploma. Furthermore, depending on the sector, employees may need their transcripts to join a professional body mandated by legislation, for example, a veterinary association or professional scientists association.

    To assist you, have a look at the Competence, Training and Awareness Procedure and the four related appendices, available as part of the toolkit, at https://advisera.com/17025academy/iso-17025-documentation-toolkit/ 

    See too, the article How to manage competence in a laboratory according to ISO 17025  at https://advisera.com/17025academy/blog/2021/05/26/how-to-manage-competence-in-a-laboratory-according-to-iso-17025/

  • IATF 16949:2016 for Application software by companies supplying to OEMs

    Companies that write and develop software embedded in the vehicle; should work on software design, verification, validation, configuration verification, etc., and document the details. These issues are related to the 8.3 and sub-clauses of the IATF 16949:2016 standard.

  • Level of implementation in a country’s companies

    You can find information about ISO certification by country in the ISO Survey, which can be accessed through this link: https://www.iso.org/the-iso-survey.html

  • Nivel de implementación en las empresas de un país

    Puede encontrar información sobre la certificación ISO por país en la Encuesta ISO, a la que se puede acceder a través de este enlace: https://www.iso.org/the-iso-survey.html

  • Certification for IATF 16949 Section 8.3 (Design and Development of Products)

    Since you will also design products for automotive, you are responsible for all clause 8.3 of the IATF 16949:2016 standard. There is no special list, but; you should prepare for all "shall" requirements written between 8.3-8.3.6.1 in the IATF 16949:2016 standard. 

  • Filling out documents in integrated toolkit

    In the toolkit folder, you will find the file named "List of Documents" where you can find the reference to the EU GDPR or the ISO standard, I suggest you follow the order of the folders and fill documents with EUGDPR reference.

    For example, you can begin with Folder 1 "Preparation for the project" and file 01.1 EU GDPR Readiness Assessment in order to verify what is your current status and the preparation for the project at file 01.2. The next step is folder 4 with General policies and document 04.2 Personal Data Protection Policy and keeps following the EU GDPR relevant documents.

  • Recurring task in Conformio

    The Information Security Policy requires in section 3.3 (Secure engineering principles) that responsible person issues “procedures for secure information system engineering, both for the development of new systems and for the maintenance of the existing systems, as well as set the minimum security standards which must be complied with.” Please note that the mentioned procedures are not included in the policy but need to be developed because of it.

    Considering that, the recurrent task refers to the publication of these required procedures, i.e., you only can set this task as completed when all needed procedures are published. This task is not related to the publication of the Information Security Policy itself.

    Consider this example: when developing this policy, you identify you have a financial system, a production monitoring system, and a mobile app, all developed with different technologies. When the Information Security Policy is implemented, this recurrent task will remember you every 10 days after Information Security Policy implementation date that you need to publish these needed procedures.

    Once these related procedures and standards are published you can mark this task as completed, and the review cycle of these documents will be performed as defined in the document control procedure (e.g., at least annually).
Page 164 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +