Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Starting with SOA

    Please note that before you start SoA you have some work to do (e.g., definition of the ISMS scope, Information security policy, risk assessment, and treatment methodology, etc.).

    Considering that, we suggest you follow the order of folders and templates provided in the toolkit, so you minimize the complexity of your implementation and risks of rework.

    Once you have completed the templates needed to support the SoA, you will have a better understanding of how to be filing it. In short, to start documenting the Statement of Applicability you need to perform a risk assessment and risk treatment, to identify the relevant risks and controls (from ISO 27001 Annex A or other sources) you will implement to treat them. Additionally, you need to identify legal requirements (e.g., laws, regulations, and contracts) which require the implementation of specific controls.

    For further information, see:

    Additionally, included in the toolkit you will buy you will have access to a video tutorial that will help you to fill in the Statement of Applicability.

  • Modification planning

    Thank's for your response.

  • Naming audits after upgrading to ISO 45001

    If you are transitioning from OHSAS 18001 to ISO 45001 during this year’s audit, then this is an ISO 45001 certification audit even if you were partially through your 3-year cycle on OHSAS 18001. This audit will confirm all of ISO 45001 implementation, and is therefore not the reduced audit you will see in a surveillance audit.

    You can read a bit more on the certification process in the whitepaper: What to expect at the ISO certification audit: What the auditor can and cannot do, https://info.advisera.com/free-download/what-to-expect-at-the-iso-certification-audit

  • ISO 9001 and financial problems during the pandemic

    No, implementing a QMS according to ISO 9001:2015 is no bullet-proof vest against financial problems during pandemic Covid 19. However, I believe that having a QMS according to ISO 9001:2015 can help organizations in answer to the situation. In extreme situations, if your organization cannot operate due to mandatory shutdown from authorities, it is irrelevant being or not being ISO 9001 certified.

    You can find more information below:

  • Monitoring risk management

    https://www.screencast.com/users/ccruz5284/folders/Default/media/23be2427-2234-4dc4-85d6-2da127f836ba

    To monitor risk management, you want to evaluate how each of the four steps are performed:

    • Determine risks
    • Assess risks
    • Mitigate risks
    • Monitor results 

    You can list all the relevant situations where your organization failed with risk management by considering performance results, for example:

    • Complaints
    • Defects
    • Delays
    • Higher costs
      … 

    Each time any of these situations arrive, it is a signal that somewhere in our risk management methodology we failed. Then comes the need to determine the causes of those failures. For example, last week I worked with an organization that realized that its practice to determine risks during construction had to be improved. The person determining risks had no first-hand construction experience. So, instead of one person, they decided to use a small team.

    You can find more information below:

  • Imparting ISO 9001 implementation benefits

    Show them the pain.

    Normally, people don’t change because of rational explanations; people change through their heart. Can you show them compelling examples of things that go wrong and damage organizational reputation or financial situation? Then, can you show them how a QMS could make a difference in mitigating each of those examples?

    You can find more information below:

  • Auditing methodology differences

    There is no difference in terms of methodology between 1st, 2nd, and 3rd party audits. They all have to be prepared, executed, and reported according to ISO 19011 requirements.

    You can find more information below:

  • Implementation of ISO controls

    Please note that hidden risks can be related to:

    • not considering, in the risk assessment, risks related to already implemented controls (such risks in general already have low values and are not considered for further treatment but need to be identified in the risk assessment).
    • not involving all relevant personnel in the risk assessment (e.g., department manager, process owner, key user, etc.).
    • people involved do not have proper training on how to perform the risk assessment.

    Additionally, note that controls also can be related to legal requirements (laws, regulations, and contracts), and may need to be implemented even if there are no relevant risks.

    If after considering these items you still find not enough controls related to risks or requirements, please note that typically smaller companies find 90 to 110 controls as applicable, whereas larger companies 105 or more, and some of these controls are marked as applicable only because organizations felt this was a logical decision (e.g., backup or passwords), and your organization can do the same. 

    These materials will also help you regarding risk assessment:

  • ISMS responsible and CISM

    Please note that the ISMS responsible is a role an organization can create, or incorporate into an existing role, to cover at least these activities:

    • ensure that the ISMS conforms to the requirements of ISO 27001
    • report on the performance of the ISMS to top management.

    As for CISM (Certified Information Security Manager), it is a certification issued by ISACA which evidences that the certification holder has a certain set of knowledge and experience on information security management, which goes beyond the requirements related to ISO 27001.

    This article will provide you a further explanation about roles for ISO 27001:

    These materials will also help you regarding roles for ISO 27001:

  • 17025 accreditation: cost benefit

    You asked

    What about higher income for 17025 accredited Cal's compared to non-accredited?  Do you happen to have a rough % of additional price that a lab can charge for an accredited calibration, compared to just a straight commercial cal with NIST traceability?

    Pricing all depends on your sector, market (competition) and regulations. I cannot provide an idea of a price increase. What I can offer is some advise on how to proceed towards a decision to implement ISO 17025 and seek accreditation. Typically, to secure more business and a higher price, it will involve “selling” the added benefit to customers - the assurance of consistent, reliable results. If accredited, it is not just the word of the laboratory, but that of the accreditation body that provides the client with additional confidence. Providing a calibration with NIST traceability alone does not provide assurance that only competent personnel perform the calibration, and that all the other technical requirements are met.

    Accreditation is often mandatory for calibration laboratories; however, if it is not; to help make the decision,  I suggest that the laboratory obtain a quote from their accreditation body and estimate the total cost of obtaining and maintaining accreditation each year. Then do a risk /opportunities analysis. Look at the financial risks and benefits. Consider first, the current income and number of calibrations, and what you would need to increase the price by, to just recover your additional costs. Then consider the reputational opportunity (benefit) - whether you may gain (or retain) customers. Another benefit to consider is reduced costs due to improved efficiency and fewer repeats. This may lead, for example, to an opportunity to increase the number of calibrations performed monthly. Then look at the rates charged by competitors.

    Financial management for the organisation should be able to assist with a model to decide whether the additional cost of accreditation could be recovered, from a financial perspective. Then by effectively implementing and maintaining the system, cost savings and further income should be realized.
Page 194-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +