Search results

Documents necessary for audit

Besides mandatory documents required by the standard (e.g., ISMS scope, Information Security Policy, etc.), and documents related to controls implemented to treat relevant risks and applicable legal requirements, only documents deemed relevant by the own organization need to be presented to an Audit for ISO 27001 Certification, and these will depend on business needs, strategies, and objectives.

For example, an organization may identify that projects’ specifications are relevant for the ISMS scope, then these will need to be presented to the auditor. The same applies to processes maps.

Regarding an ISMS manual, in fact, ISO 27001 requirements have never prescribed the development of an ISMS Manual, and for good reasons. If you put all the policies and procedures into a single document, this will make the reading of such a document very difficult. Additionally, the standard already has a requirement for a document that describes how a company will implement its information security – it is called Statement of Applicability.

Included in your toolkit there is a List of documents file which identifies which documents are mandatory and those most often used because they are considered good practice.

These articles will provide you  further explanation about ISMS Manual and mandatory documents:
- Is the ISO 27001 Manual really necessary? https://advisera.com/27001academy/blog/2014/02/03/is-the-iso-27001-manual-really-necessary/
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/ 

These materials will also help you regarding ISMS documentation:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

ISO 9001 Auditor path requirements

Glad to hear that you enjoyed the experience and want to go deeper. Being an electrical engineer may provide you with an advantage while auditing organizations where that is a plus and will not harm you while auditing other kinds of organizations.

So, after developing your experience as an internal auditor you can think about becoming a lead auditor and start thinking about working for a certification body. Consider our ISO 9001:2015 Lead Auditor Training Course - https://advisera.com/training/iso-9001-lead-auditor-course/

You can find more information below:

• Article - ISO 9001 internal auditor training: Is it for me? - https://advisera.com/9001academy/blog/2015/06/02/iso-9001-internal-auditor-training-is-it-for-me/
• Webinar - Free webinar on-demand - How to perform an ISO 9001:2015 internal audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/
• Book - ISO internal audit: A plain English guide: https://advisera.com/books/iso-internal-audit-plain-english-guide/

Control of documents

Dear Carlos, thank you the feedback. It is helpful

Dealing with business processes experience

ISO 27001 allows you the flexibility to define what will be included in the scope - it is recommended to include the processes. locations or departments that include the most sensitive information. You cannot define the scope only for an information system.

These articles will provide you further explanation about scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/

These materials will also help you regarding scope definition:
- How to set the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

Understanding the requirements of clause 8.4 of the ISO 9001:2015

8.4.1 is about:

What processes (subcontracting), what products and services are relevant to the operation of your organization and are acquired from an external provider? Relevant in the sense: They help to make a difference; or avoid flaws that the customer recognizes and negatively values. In other words, you do not need to apply the requirements of the standard to everything you buy.

So 8.4.1 is about qualifying a potential supplier, is about selecting a supplier to satisfy a particular need:

And periodically evaluate supplier performance based on delivery results.

About 8.4.2 it better specifies the part of the control mentioned above: what to control during delivery, how to evaluate, who does what, what specifications, what records are used.

8.4.3 is about the information that goes on orders or contracts: The description of the product, service or process (1) Methods, processes or equipment to be used or to be followed in the provision of services (2) Relevant quality control criteria (3) In cases where there is a requirement of competence, mention it (c) It can sometimes make sense to describe means of contact, contact persons, authorities (d) It may make sense to define quality control rules during the provision of the service (e). It is to clarify that the company can go to the supplier's premises to carry out an audit or a quality control (f)

The following material will provide you more information:

• Purchasing in QMS – The Process & the Information Needed to Make it Work - https://advisera.com/9001academy/blog/2014/03/18/purchasing-qms-process-information-needed-make-work/
• ISO 9001 document template: Procedure for Purchasing and Evaluation of Suppliers - https://advisera.com/9001academy/documentation/procedure-purchasing-evaluation-suppliers/
• Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
   

Policy statement

A policy statement is a short version of a policy, often used for general public display. Some policies, like the Information Security Policy, have several pages, and for easiness of understanding of the general public, a one-page version is developed, covering the main aspects an organization wants to highlight. A policy statement needs to have a disclaimer informing that it is not the full version of the policy, where you can find the full version, and that this version does not deviate from the content from the full version.  

We do not recommend the use of a policy statement as an ISMS policy document because there is a risk of a one-page document do not fulfill standard's requirements  

This article will provide you a further explanation about the Information Security Policy:

• What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/  

These materials will also help you regarding the Information Security Policy:

• Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
• ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

ISO 27001 - Context of Organization

ISO 27001 clause 4.3 (Determining the scope of the information security management system) requires an organization to consider the following when defining the ISMS scope:

• relevant internal and external issues to the organization’s purpose and which can impact, or be impacted, by the ISMS intended results
• requirements of interested parties
• interfaces and dependencies between activities that are and are not considered for the ISMS scope

For considering something you need to understand that thing, but the standard does not define when this information needs to be gathered and understood, but as soon as it is available, the faster you will be able to define an ISMS scope that is relevant and integrated to organizations operations.

These articles will provide you a further explanation about scope definition:

• How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
• Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
• How to set the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/

These materials will also help you regarding scope definition:

• Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
• ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

ISO 9001 Project task implementation

According to ISO 9000:2015, a project is a unique set of coordinated and controlled activities developed to achieve an objective conforming to specific requirements. A project task is a name given to each of those coordinated and controlled activities. If a project is what needs to be done, by whom, and until when a project task is each of the “what”.

You can find more information below:

• Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/
• How to budget an ISO 9001 implementation project - https://info.advisera.com/9001academy/free-download/how-to-budget-an-iso-9001-implementation-project?utm_source=script-for-iso-9001-lead-implementer-course&utm_medium=downloaded-content&utm_content=lang-en&utm_campaign=free-downloads-9001
• Free webinar on-demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Monitoring project objectives

First of all, let me state that management system objectives are of paramount importance. Just remember the management system definition, something like. A system to establish a policy (a general orientation), translate that into objectives, and work, and change to meet those objectives.

So, clause 6.2.1 is about establishing management system objectives. Something to stretch your management system performance. You want your management system performance in the future will be better than today. What happens is that performance is not an accident, does not happen by chance, performance is the output of the present system. If you want a different performance in the future, you need to have a different organization, a different management system in the future

Clause 6.2.2 is about planning what needs to be done to change the organization in order to meet those objectives. That is, what needs to be done to create the organization of the future.

An action plan is about what needs to be done, when and by whom and can include things like: Improve current practices; Introduce new practices; Invest in infrastructure; Train people; How to measure progress and results; …

After 6.2.1 and 6.2.2 you have a plan to meet your management system objectives. The problem is that there is uncertainty. The plan may be incomplete or wrong, the plan may not be implemented in some way, or the world may change during the journey into the future, making the plan obsolete in some way.

So, after defining what to do we need to include some sort of monitoring and control to check if context assumptions are still valid, a kind of situational awareness, and to check if activities included in the plan were implemented, and also to check if already implemented activities are contributing to a convergence in performance to the desired results.

During the journey for the future what can happen?

You can see the free preview of our ISO 14001 document template: Environmental Objectives and Plans for Achieving Them - https://advisera.com/14001academy/documentation/environmental-objectives-targets-and-programs/ as an example about how to monitor project objectives.

For example, considering ISO 14001:2015, check clause 6.2.2 e). What indicators can you use to measure progress during the journey and the success at the end? When will be appropriate to check progress against those indicators? Then, include checking the progress of the implementation of activities.

You can find more information below:

• How to Use Good Environmental Objectives - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/how-to-use-good-environmental-objectives/
• Examples of ISO 14001 objectives based on the different company sizes - https://advisera.com/14001academy/blog/2019/10/22/iso-14001-objectives-examples-for-different-company-sizes/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

Question about training

Please note that the Security Awareness training is a series of videos that cover various topics related to security aimed at non-information security personnel. They are not intended to prepare people for information security activities. 

If your intent is to apply for ISO 27001 information security-related jobs, you should consider these courses:

• ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ if you want to work on auditing your own organization
• ISO 27001 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/ if you want to work on auditing for a certification body
• ISO 27001:2013 Lead Implementer Course https://advisera.com/training/iso-27001-lead-implementer-course/ if you want to work on implementing ISO 2700 on organizations

As for when start looking for a job after the course, you can do that immediately after the course, but without previous experience, you need to apply for roles like junior or trainee.

These articles will provide you a further explanation about ISO 27001 personnel certifications:

• ISO 27001 Internal Auditor training – Is it good for my career?  https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/  
• What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
• What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
• Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/