Search results

Home / Search

Category:
Select
Select

11293 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Reconciling Incident SLA vs RTO

    First is important to note that higher disruption levels do not necessarily lead to higher Recovery Time Objectives (RTOs), or to lower incident response times/SLAs. These times are mostly defined by business continuity strategies, processes interdependencies, and available resources. For example, an organization may decide:

    • to have the same RTO and incident response time/SLA, regardless of the disruption level (this basically means to have an alternative site mirroring the main site in real time at a distance that cannot be affected by the same disruption).
    • to increase RTO to keep the incident response time/SLA, provided the RTO does not become greater than the Maximum Acceptable Outage (MAO). The difference between RTO and MAO is that, once MAO is defined, when MAO threshold is breached, recovering the business is not worthy anymore, while the RTO can be changed for any value from 0 to any value smaller than MAO.
    • to decrease the incident response time/SLA to keep RTO, but you need to note that how much you can decrease the incident response time/SLA will depend on the complexity of processes interdependencies (i.e., some recovery activities can only be performed in sequence, not in parallel, so the sequence with the shortest time will define the minimum incident response time/SLA).

    Considering that, you need to find a balance between needed activities, available resources, and business objectives and strategies to define proper values for RTO and incident response time/SLA.

    These articles will provide you a further explanation about business continuity concepts:

    This material will also help you regarding business continuity concepts:

  • Medical devices vs. AI and software driven medical devices

    For medical devices that are software and AI, the following requirements are not applicable:

    6.4 Work environment and contamination control
    7.5.5 Particular requirements for sterile medical devices
    7.5.7 Particular requirements for validation of processes for sterilization and sterile barrier systems
    7.5.9.2 Particular requirements for implantable medical devices
    It means that you do not need to prepare documentation from these requirements. In your Quality manual, it is necessary to state which requirements are not applicable and why. For example, for requirement 7.5.5 justification can be: This requirement is not applicable because our product is not sterile, and does not need to be sterile to perform its intended use.  

    The following requirements need to be seen whether they are applicable or not:

    7.5.3 Installation activities
    7.5.4 Service activities

  • Data obtained from partners

    "I would like to know more about what it looks like when a partner company obtains personal data for its own company.I am initially assuming that the partner will then be responsible for data protection?

    It depends on the role of the partner in the data processing.

    If both parties are equals in determining the purposes and means of data processing (both companies offer a part of the service to customers, i.e. the device and the software) they are considered joint controllers under Article 26 GDPR.

    If the partner provides a service on the behalf of the other company (i.e. a marketing agency using data of the Client’s customers) it will be considered a data processor under Article 28 GDPR.

    The difference is that while joint controllers define in their legal agreement the shares of liabilities (referred to the service/good offered) and each one has its own responsibility towards data subject (though data subject may exercise its rights in respect of and against each one controller), the data processor must follow the instruction received by the data controller who will always be liable for processor infringements of GDPR.

    And or how exactly does this have to be contractually clarified or formulated?I would be very happy to receive feedback.

    Again, the structure depends on the kind of relationship, even if the transfer of data in third countries is involved. In our Toolkit, you can find the template that helps you to draft the joint controllers’ agreement and the controller-processor agreement from the perspective you are a controller either a processor. You can also purchase templates individually.

    Here you can find more information about the controller and processor obligation:

    If you need to understand how controllers need to comply with GDPR, you can consider enrolling in our free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

  • Becoming an ISO 45001 Lead Auditor

    The process of becoming a lead auditor involves taking the ISO 45001 lead auditor training program, and then putting this knowledge in place with a certification body. You can read more about this process in the article below. When it comes to being a “good” lead auditor, this comes from using and refining your audit skills, and being open to continuing to learn and improve as you audit. As with many skills in life, you don’t become good at auditing unless you use the auditing skill and get better over time.

     

    You can read more on becoming a lead auditor in the article: How to become an ISO 45001 lead auditor, https://advisera.com/45001academy/blog/2019/12/11/iso-45001-lead-auditor-how-to-get-certified/

  • Stage 1 audit

    Stage 1 is usually called „Documentation audit“ because auditors what will check are all documentation requirements from the standard fulfilled. SO, you need to prepare all documents from the requirements that are applicable for your company and within the scope. If some of the major documents are missing, it is not possible to access the next step, the initial audit or so-called Stage 2 audit.

    For more information regarding the certification process, please see the following articles:

Page 218-vs-13485 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +

This website stores cookies on your computer. These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information in order to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, see our Privacy Policy.

If you decline, your information won't be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked.