Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Scope definition

    For companies of your size, our recommendation is to include all the organization in the Information Security Management System (ISMS) scope (i.e., you need to include all the systems you listed in the scope) because the effort to separate what is and what is not part of the scope is not worth it.

    For further information, see:

    This material can also help you:

    • Tool for defining the ISO 27001 ISMS scope https://advisera.com/insight/chatbot-tool-iso-27001-scope/

    • Integrated checklist for ISO 9001:2015 and ISO 14001:2015

      First, I can only help you develop a checklist based on the standards, you should not forget that auditing compliance against internal procedures and effectiveness against management systems objectives is very important.

      Start by determining which ISO clauses are related with the quality department. For example:

      • 9001 – 8.6, 8.7, 9.1, 9.2, 10.2, 10.3
      • 14001 – 6.1.2, 8.1, 8.2, 9.1, 9.2, 10.2, 10.3
      • Some organizations may include also clauses 6.2 and 9.3.

      Now, think about what you want to know regarding those clauses. For example:

      • Are quality control activities being performed according to plan?
      • Is nonconforming product segregated, treated and recorded? Are corrective actions developed?
      • Is process monitoring, analysis and evaluation performed according to plan?
      • Is the audit program executed? Are audit results available?
      • What environmental aspects are related with the quality department?
      • Are environmental operational controls in place at the quality department?
      • And what about preparedness and emergency situations in the quality department? Are prevention measures in place? Are response measures in place?
      • Any simulation done? Any emergency happened? What was learned? 

      Please check in this Free webinar - How To Perform an ISO 9001:2015 Internal Audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/an example about how to develop an audit checklist from a document.

    • Consultants considered processors?

      We have a couple of consultants at our company, most of them working full time. Some of them are hired through a consultacy firm and some of them are self employed. The consultants work according to our policies and processes as any other employee. Some of them work from home and some of them work mainly in the office. Would you consider these cosultants (or the consultancy firm) to be a data processor? I would say that they are not but we have different opinions at my company so just seeking advise. 

    • Request for guidance

      To be compliant with the 2022 revision of ISO 27001, you need to make a new Statement of Applicability with 93 controls.

      From your question, it is not clear if your Information Security Management System (ISMS) is certified or not. In case you are searching for certification, you can certify your ISMS against ISO 27001:2013 until October 31, 2023, and there is no need to change your SoA. For certifying after October 31, 2023, you need to be compliant with ISO 27001:2022, and for that, you will need to update your SoA to the 93 control version. 

      For further information, see:

      This material can also help you:

      • How to Make the Transition From 2013 to 2022 Revision of ISO 27001 https://advisera.com/27001academy/webinar/transition-iso-27001-2013-to-iso-27001-2022-free-webinar-on-demand/
      • ISO 27001:2022 Transition Course https://advisera.com/training/iso-27001-transition-course/

      • TIA/TRA assessment tools

        There are not so many TIA/TRA tools in the market, as the term became popular after Schrems II decision, however a well-known Transfer Impact Assessment model is David Rosenthal’s TIA template, shared under Creative Commons license. The model has examples related to personal data transfers to several countries outside EU, but not all of them.

        When an international transfer of personal data occur, if the risks are high, a DPIA should be performed, and you have a DPIA Methodology in the EU GDPR Documentation Toolkit that you already purchased, in Directory 06 – Data Protection Impact Assessment.

        Please consult these links:

      • ISO 27001:2013 VS ISO 27001:2022

        My question was to get free upgrade to 2022 version

         

      • ISO 9001 - Control Chart in Monitoring Variation

        If you monitor quality or process control through laboratory analysis results you can use a control chart to check if variability is normal or if special causes are present. If special causes are present, it makes sense to investigate to discover and eliminate them. If only random causes are present, and performance is not adequate, the system must be modified.

        Moreover, the use of control charts makes the analysis and evaluation of the results much more objective because it does not depend on opinions or states of mind, it follows clear rules of interpretation.

        If your question is not about quality or process control, but about the quality of laboratory results I do not use control charts, but Repeatability and Reproducibility (R&R) studies.

      • No budget to implement control A.8.12 Data Leak Prevention

        A way to implement control A.8.12 Data leakage prevention is by implementing the following documents (the mentioned sections specifically cover the requirements of control A.8.12):

        For further information, see:

      • Important parameters when analyzing samples in ISO accredited laboratory

        The parameters all depend on the purpose of the test. You must meet the requirements of ISO 17025:2017 Clause 7.2.  A laboratory needs to understand the client’s requirement, i.e. the purpose of the test and if there are any self-imposed or regulatory specifications for a pass or fail. For example, a specific measurement should be below a particular threshold. When these conformity statements are made, the laboratory must specify the decision rule and get agreement from the client. This addresses whether measurement uncertainty is considered in the decision of a pass or failed result. When deeming the actual test method as suitable (fit for purpose) the laboratory needs to follow regulatory or sector guidelines and any mandatory requirements from the accreditation body. For example which method performance parameters such as limit of detection are evaluated. It usually starts by proving the method is specific, sensitive enough, and accurate (from assessing trueness and precision).

        If you are interested, view the ISO 17025 toolkit procedure for validation and verification of methods, named Test and Calibration Method Procedure, along with two supporting documents Test Method Development, Verification and Validation Register and Test Method Development, Verification, and Validation Record. The procedure is also available separately at https://advisera.com/17025academy/documentation/test-and-calibration-method-procedure/

      • Medical Molecular Lab certification

        Always confirm with the relevant regulatory bodies. However, if the results of the tests are being used for medical diagnostic purposes then ISO 15189:2022 Medical Laboratories - Requirements for quality and competence is the standard to be accredited to. If the testing is for non-medical purposes (for example forensics or in some cases for trial purposes only), then ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories is the appropriate standard to be accredited.

        For more information on ISO 17025, have a look at https://advisera.com/17025academy/what-is-iso-17025/
Page 22 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +