Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Reviewing and approving suitability and adequacy documents as an office administrator

    You can answer that during review and before approval you ask opinion of participants in the documented activities about its suitability and adequacy. You can answer that you make sure that while documents are being developed participants are invited to give their contribution. You can also answer that after approval in the first month you monitor suitability and adequacy by following its implementation.

    You can find more information about ISO 9001:2015 below:

  • Isolation of Sensitive Systems

    This question can be answered from two points of view: auditor and pen tester.

    From the auditor's point of view, you need to check the evidence that shows isolation is implemented (e.g., network topology, pentest report, etc.)

    From a pen tester's point of view, to check isolation you need to try to access the systems from outside their defined perimeter of work (i.e., environment).

    For example, if a system stated environment is the companies premises, you should try to access it from outside the companies premises, like:

    • from a side street, trying to find out a hide wireless connection
    • from the company's website, trying to explore a site vulnerability

    In case the system stated environment is a single room int the companies premises, or it is disconnected from the main company's network, you should try to access by:

    • trying to find out a hide wireless connection
    • trying to explore an intranet vulnerability
    • trying to physically access a network device connected to the system
    • trying to get physical access to the room

    This article will provide you a further explanation about exploring vulnerabilities:

  • ISO 9001 Documentation requirements

    There may be more than one interpretation to your question. Let us assume that documentation requirements is another way of saying which are mandatory according to ISO 9001:2015 requirements?

    Please check this article about mandatory documentation - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ Based on that approach I say that the only one is 2-Audit reports (see in the article Results of internal audits (clause 9.2)). 

    It is not mandatory to have a Quality Manual or quality procedures for example.

    You can find more information about ISO 9001:2015 below:

  • ISO 27001 certification for subsidiary companies

    1 - Is it possible to certify the two together or is it necessary to seek certification for each one individually?

    It is possible to have a single certification for your organization and its subsidiary, but please note that implementing a certification in multiple geographic locations is a complex, and more expensive, task and you should go for it only if it is really necessary for business strategies and objectives. Instead, you should consider the prioritization of locations and implementing the certification one location at a time.  

    2 - Similarly would we need a separate ISMS for each?

    ISO 27001 does not prescribe how to manage information security in multiple organizations, so you can manage them using a single platform. But is important to note that you need to ensure that the specifics in the implementation of each organization are clearly identified and separated.

    For example, you may have the same control (e.g., access control) implemented in different ways in several organizations, and your platform needs to help you track this condition, so activities like internal audit and management review can work on the real situation of each organization.

  • MDR labelling

    Yes, the company will be compliant under MDR if the label attached to the medical device is only provided in English

    In MDR Annex II – Technical documents, in subparagraph 2. Information supplied by the manufacturer is stated that the manufacturer needs to set the label and Instruction of use in the languages accepted in the Member States where the device is envisaged to be sold. Of course, you can provide information on English as a universal language. However, as part of your Quality management system, you need to provide a procedure for translation where you will describe how you will manage to provide labels and instruction of use if somebody will ask for it.

    For more information, see:

Page 252-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +