Search results

Home / Search

Category:
Select
Select

11270 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • ISO 9001 Continuous Improvement Process

    I can give you my experience. I answer your question in three layers:

    • The performance layer. The three most common errors in presenting performance data are: using tables instead of graphics, showing just the last result, and presenting no performance benchmark or target. So, I leave the tables with numbers for annexes, and I use graphics. Not graphics simulating car dashboards, but what is called sparklines or micro charts, where you can see the trend and compare with the target. One last warning. You have to present all the graphics in one page or in one screen. The first commandment of a good dashboard is to present all indicators in a way that you can see them all at the same time. This picture https://www.screencast.com/users/ccruz5284/folders/Default/media/8d18014d-5ed3-4e11-9998-3d866cf9ef29 presents an example and also includes another kind of graphic, the bullet chart useful to compare current performance with target or benchmark. You can find this picture in our free webinar on-demand - Measurement, analysis, and improvement according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/
    • The context layer. Add to the previous layer a picture of the model of how the organization works, based on the process approach, and coloring each process with the semaphore colors (Since 10% of men and 1% of women have color identification issues, the semaphore colors may be shades of a color. For example, if OK no color, if with concerns rose if bad red). You can find this picture in our free webinar on-demand - The Process Approach - What it is, why it is important, and how to do it - https://advisera.com/9001academy/webinar/iso-9001-process-approach-free-webinar-on-demand/ - the advantage of this approach helps people realize how they can influence or contribute to performance because they can situate themselves in the processes and their interaction. Everybody is an internal supplier and customer.
    • The strategic layer. Even better than the previous one is to present the same technique but over a strategy map of the organization
       

  • ISO 9001 implementation

    A possible approach to implement a quality management system can be:

    • Setup a project sponsor, a project manager, and a project team. Ensure top management support, get training about the standard. Designing and implementing a quality management system implies being knowledgeable about ISO 9001:2015.
    • As a first step perform a Gap analysis, to determine the amount of work to be done - comparing what your organization already has in place versus ISO 9001:2015 requirements. From that GAP Analysis, you can develop your Project Plan, listing what needs to be done, by whom, until when.
    • Then, an important step is to design a model of how your organization works as a set of interrelated processes. For example:

    https://www.screencast.com/users/ccruz5284/folders/Default/media/1935f850-848f-49a9-afd0-b9009018cd92

    • Decide how to describe and monitor those processes.
    • From there it is implementation in order to close the gaps found. Then, perform an internal audit and the management review. There you can decide if your organization is ready for a certification audit.

    To speed up the process you can use our Documentation Toolkit for the implementation of ISO 9001:2015 here - https://advisera.com/9001academy/iso-9001-documentation-toolkit/ and check the free previews. You can also watch this free webinar on demand - How to use a Documentation Toolkit for the implementation of ISO 9001 - https://advisera.com/9001academy/webinar/how-to-use-a-documentation-toolkit-for-the-implementation-of-iso-9001-free-webinar-on-demand/

    This is a very short description of the journey but below you can find more detailed information:

    You can find more information below:

  • Consultant performance review

    I understand that you are receiving information from performance review done by a client. Is that client important? Is that client part of the segment of target clients? For example, low cost airlines receive a lot of complaints, but most of those complaints are not about errors or “defects”, but about decisions made according to its strategy of keeping costs down. In the case you are receiving performance feedback from a target-client, you can start to acknowledge and thank the information received. Then, analyze and understand if it makes sense, if the company can frame and incorporate it. And communicate the decision to the customer. If the decision is to frame it, it may make sense to communicate the timing for its implementation.

    You can find more information below:

  • Difference between EU manufacturer's distributor and (transport) service provider

    There is no special difference. Every distributor can be a transport provider also. The distributor does not have to make installation of the medical devices, this depends on the agreement between manufacturer and distributor.

  • How to calculate RTO and RPO

    First is important to note that RTO and RPO are most often defined based on a scenario evaluation, instead of calculated, because calculating them can become very complex and time-consuming.

    Considering that, RTO (Recovery Time Objective) is defined based on how fast you want to resume your operations after a disruption, while RPO (Recovery Point Objective) is defined based on how much data you can afford to lose due to a disruption.

    For example, if an application has an RTO of 1 day and an RPO of 4 hours, it means that this application can be recovered (resume normal operation) in one day, but the information from the last 4 hours before the interruption occurred will be lost.

    This article will provide you a further explanation about RPO and RTO:

    These materials will also help you regarding RPO and RTO:

  • Questions about ISO 27001 implementation

    1 - It’s not yet clear to me what we must do exactly if a risk from the treatment table is not acceptable and requires some implementations.

    What is the accepted time frame for risks mitigation?
    For an unacceptable risk which requires new controls for treatment, what if we plan the implementation – say – 1 or 2 years later?
    Is it allowed by the standard and/or auditor?
    Will it be visible in SoA’s residual risks?
    In other words, does it have to be addressed before the next assessment, or the next audit, or freely?

    ISO 27001 does not prescribe a time frame to implement controls, so organizations are free to define the time frame that best suits them, but a time frame of 1 or 2 years is not recommended, because by the time you finish the implementation the risks may have changed (due to changes in business conditions or changes in threats and vulnerabilities), and the previously planned controls may not be effective or needed anymore.

    Now, considering certification purposes, at least the controls related to the most relevant risks must be implemented, with proper evidence of implementation and operation, by the time of the certification audit, because risk treatment is a mandatory clause, and the certification auditor will check this. Risks with controls not implemented should be accepted by the organization, and these must be included as defined in the Statement of Applicability template (included in the toolkit you bought, you have access to a video tutorial that can help you fill the SoA document).

    For further information, see:

    2 - If the risks must be absolutely mitigated “quickly” when not accepted, then we may need to relax the acceptance criteria to encompass them. Can we say:

    Based on a yearly budget, state that i.e. high risks can be accepted only if there is no room left for the implementations in the running assessment… (or financial year… somehow)
    The risk mitigation may therefore be postponed to the next assessment (hopefully not indefinitely..) or “whenever possible”
    Would that kind of acceptance criteria fit with the standards and pose no issue with auditors?
    I suppose that such accepted risks will again appear in the SoA (but it makes sense)

    ISO 27001 does not prescribe risk acceptance criteria, only that they must be defined. Considering that, your organization can establish any criteria it sees fit (your criteria example is acceptable). You only have to be careful to not postpone relevant risks indefinitely, because this can be seen as a lack of commitment to information security, and this can compromise certification. About SOA, your assumption is correct, the accepted risks will appear in the SOA.

    Included in your toolkit, also there is a video tutorial that can help you with risk assessment and treatment.

    This material can also help you:

    3 - Concerning the risk assessment:

    Will our estimations of impact or likelihood be strongly challenged by the auditor? (sometimes there is room for debate..)
    Do we have to prepare evidence for each asset assessment or risk, to assist in the verification?
    Clearly, doing so, in advance, and for many risks/assets is not feasible for us
    I guess the focus will be on the SoA instead and how the controls are implemented? (or to explain why they are not)

    The auditor will check if your estimations make sense considering your organizational context and ISMS scope and will only make additional questions if something is too far away from normally expected results (for example, the impact of datacenter down to fire valued as 1 on a scale from 1 to 5, where 5 is the highest impact).

    For audit purposes, the Risk Assessment Table and The Risk Treatment Table are sufficient for the auditor. 

    The SoA is the initial guide for the auditor to understand your information security context, but during the audit, he will check how the controls are implemented.

    This article will provide you a further explanation about estimating risks:

  • ISO 27000 and ISO 31000

    Please note that neither standard of ISO 27000 group, or from ISO 31000 group prescribes that the owner of information assets must be the owner of the information risk, nor that informational risk is an operational risk.

    ISO 27001 requires, and ISO 31000 suggests, the definition of risk owner, but neither prescribes a framework to organize risks, so organizations are free to organize them as they see fit.

    These articles will provide you a further explanation about risk owner and asset owner:

    This material will also help you:

  • ISO 27001 certification for a group of companies

    It is possible to have a single certification for your organization and its subsidiaries, but please note that implementing a certification in multiple geographic locations is a complex, and more expensive, task and you should go for it only if it is really necessary for business strategies and objectives. Instead, you should consider the prioritization of locations and implementing the certification one location at a time. Additionally, with multiple certifications, in case one location has some problem with fulfilling requirements, this will not affect the certification of other sites.   

    These articles will provide you a further explanation about scope definition:

    This article will provide an additional explanation about single certification for multiples entities (although it is about ISO 9001, the same concept applies to ISO 27001):

    This material may also help:

  • Ensuring proper resources are on board

    It refers to all persons/expertise/budget resources needed to implement the project. It depends on the dimension of the company, of course. 

    For example, to implement the project and verify all risks it can be the DPO, the IT Manager, and the Head of the Legal Department, but of course, if you need to implement a Teleworking policy you may also need the HR manager. Or to mitigate the risks you need to buy new software/hardware. 

    When implementing the GDPR project you need to take into account all these elements before starting.

    To know more about how to start implementing GDPR, here you can find a 9 step procedure:

    You can consider enrolling in our free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

  • EU GDPR representative

    Yes, your company needs an EU Representative in order to be contacted by Data Subjects or from the Surveillance Authority in case of needs. It can be a person (i.e a GDPR expert) or a company.The EU Representative shall be appointed in the country where the services are offered (Article 27 GDPR), so if your company will have an Italian Client, it will be better to appoint an Italian EU Representative. 

    If you need to know more about EU Representatives and Cross-border data transfer under the EU GDPR, you can consider enrolling in our free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

     
Page 222-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +