Search results

Giving consent

First of all, consent needs to be clearly expressed by the user. The Supervisory Authorities consider that consent with an opt-out mechanism is not given correctly.

You should add an opt-in checkbox.

Here you can find more information on consent and e-mail marketing.

• Is consent needed? Six legal bases to process data according to GDPR https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/
• Data subject rights according to GDPR https://advisera.com/eugdpracademy/knowledgebase/8-data-subject-rights-according-to-gdpr//
• Email marketing in the era of GDPR – How to ensure compliance? https://advisera.com/eugdpracademy/blog/2019/05/27/gdpr-and-email-marketing-rules-for-compliant-campaigns/

If you need to understand how to process consent under GDPR, you can consider enrolling in our free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

Implementation of applicable controls

Please note that ISO 27002 is a support standard that provides guidelines and recommendations for implementation of ISO 27001 Annex A controls, so it is not mandatory, and you can adapt its contents to your context, provided you fulfill the security objectives and security controls statement provided in the ISO 27001 Annex A.

Regarding the word “shall”, please note that ISO 27002, as a guideline, does not use the word “shall”, but “should”, and that for ISO world means that its content can be implemented or not, according to your needs.

This article will provide you a further explanation about ISO 27002:

• ISO 27001 vs. ISO 27002 https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/

These materials will also help you regarding controls from Annex A:

• ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
• ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

Control A.14.3.1

1) I understand that the CISO performs internal audits in a company, but who should audit the CISO?

Answer: First is important to note that CISO is a very bad choice for the internal auditor because of the obvious conflict of interest (this role is in general responsible for all the ISMS, and auditors cannot audit their own work).

Considering that, you must consider another person to be the internal auditor (e.g., train another employee as internal auditor, or hire an external auditor).

For further information about CISO, see:
- What is the job of Chief Information Security Officer (CISO) in ISO 27001? https://advisera.com/27001academy/knowledgebase/what-is-the-job-of-chief-information-security-officer-ciso-in-iso-27001/
- Chief Information Security Officer (CISO) – where does he belong in an org chart? https://advisera.com/27001academy/blog/2012/09/11/chief-information-security-officer-ciso-where-does-he-belong-in-an-org-chart/
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/

These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/

2) Our company is dedicated to selling ERP in SaaS mode (software as a service), how should control A.14.3.1 (Protection of test data) be implemented? ... it is necessary to obfuscate the information of customers who are in the database?

Answer: The way to implement control A.14.3.1 will depend on the results of risk assessment and identified legal requirements. For example, risk assessment may identify that only strict control to test database is enough, or that creation of randomized dummy customer data may be needed. Additionally, contractual clauses may require the use of specific techniques, or forbid others, and some regulations like GDPR may require anonymization of test data.

This article will provide you a further explanation about the software development life cycle:
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/

This material will also help you regarding ISO 27001 controls:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

EU IVDR 2017/746

Thank you very much!

Mandatory status of a ISO 9001 representative

With ISO 9001:2015 there is no longer a mandatory requirement for a quality management representative (QMR). ISO 9001:2015 makes no mention of a QMR.

You can find more information below:

• What will be the destiny of the management representative in the new ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/what-will-be-the-destiny-of-the-management-representative-in-the-new-iso-90012015/
• Choosing the best person for the job quality management representative: https://advisera.com/9001academy/blog/2014/06/03/choosing-best-person-job-quality-management-representative/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

ISO 9001 customer satisfaction questions

"1.If the assessment of customer satisfaction (according to ISO 9001:2015) by the auditee is still mandatory, even if the related procedure and records are not more mandatory?

Answer:

It is mandatory that an organization determines how to get, monitor and review information about what is commonly called “customer satisfaction”. 

2.Are auditors and certification bodies simply allowed to decide to not take into account as NEEDED the customers' satisfaction assessment by the auditees?"

Answer:

If clause 9.1.2 is included in the scope the audit, auditors should audit the customers' satisfaction assessment by the auditees. They can ask: how do you get and monitor customers’ satisfaction feedback? Did you receive that feedback? Did you analyze that feedback? What were your conclusions and decisions?

You can find more information below:

• Handling customer satisfaction with code of conduct and complaints procedure - https://advisera.com/9001academy/blog/2014/07/15/handling-customer-satisfaction-code-conduct-complaints-procedure/
• How the ISO 9001:2015 standard can help improve relationships with your customers - https://advisera.com/9001academy/blog/2016/02/23/how-the-iso-90012015-standard-can-help-improve-relationships-with-your-customers/
• Main elements of handling customer satisfaction in ISO 9001 - https://advisera.com/9001academy/blog/2014/07/01/main-elements-handling-customer-satisfaction-iso-9001/
• Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
   

Internal audit duration

First, consider the scope of the audit. Will you audit one or more processes? Will you audit one or more departments or teams?

Then, study the audit criteria (ISO 9001:2015 clauses applicable within the scope, procedures, instructions, …). While studying the audit criteria start listing the questions that you want to make to whom, start listing what you want to see and where to think about the sample size that you should consider to later support your audit conclusions.

After this, you should have an idea about the time needed for each stage in your audit, considering the number of questions to ask and to whom, what you want to observe, the sample size, the number of records you want to check. Normally, 20 minutes is the minimum I take for each stage, and 1 hour the maximum.

You can find more information below:

• Article - ISO 9001 internal auditor training: Is it for me? - https://advisera.com/9001academy/blog/2015/06/02/iso-9001-internal-auditor-training-is-it-for-me/
• Webinar - Free webinar on-demand - How to perform an ISO 9001:2015 internal audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/
• Free online training ISO 9001:2015 Internal Auditor Course: https://advisera.com/training/iso-9001-internal-auditor-course/
• Book - ISO internal audit: A plain English guide: https://advisera.com/books/iso-internal-audit-plain-english-guide/

Document ID

ISO 9001:2015, clause 7.5.2 a), invites each organization to determine a document identification methodology, it gives some examples but does mandate a particular solution.

Without seeing the different types of documents and where are they located in document structure as presented in this article - How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/ - it is not very easy. The point is, your organization can design its own way for each kind of documents: a name, a code, a number. Isolated or linked to processes, to departments, to lines of business.

You can find more information about documentation below:

• New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
• Some tips to make Document Control more useful for your QMS - https://advisera.com/9001academy/blog/2014/05/20/tips-make-document-control-useful-qms/
• Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Managing ISO Documentation: A Plain English Guide - https://advisera.com/books/managing-iso-documentation-plain-english-guide/

Record management procedures

Records are the memory of an organization. Organizations without records, or missing records, or not knowing where to find them, are organizations with learning problems.

This is mainly treated in ISO 9001:2015 clause 7.5.3:

In the following diagram, I organize a set of questions to ensure records management.

You can find more information about records below:

• How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
• New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
• Some tips to make Document Control more useful for your QMS - https://advisera.com/9001academy/blog/2014/05/20/tips-make-document-control-useful-qms/
• Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Managing ISO Documentation: A Plain English Guide - https://advisera.com/books/managing-iso-documentation-plain-english-guide/

ISO 9001 Implementation and scope

what department to start the implementation?

Answer:

There is no technical answer to this question.

Normally, I like to start with a process (includes more than one department) that rapidly brings performance improvements. For example, for a manufacturing company, starting with a process like “Supply materials” (evaluate and qualify suppliers, order materials, receive and control materials, store materials, supply materials), may bring more confidence, more control, and show measurable gains.

Sometimes I have the opportunity to start with top management clauses and processes. Normally, when top management is really committed to the management system.

what the scope should cover?

Answer:

There is no technical answer to this question.

Deciding on the scope of a quality management system (QMS) is a management decision. For example, a hotel:

A hotel may develop a QMS just for the hospitality part, and just for travel agencies, not for treating individual guests.

You can find more information below:

• Free webinar on demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
• How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/