Search results

Home / Search

Category:
Select
Select

11275 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Information Security Risk Assessment and Risk Treatment

    1. Are the risk treatment options limited to the four discussed in your publication?

    I'm assuming you are referring to the book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

    Considering that, risk acceptance, risk avoidance, risk mitigation, and risk transfer are the most common and used treatments, but regarding ISO 27001 you can use other approaches you may find useful.

    2. Is there conventional risk acceptance criteria, based on likelihood and consequence?

    Common types of risk acceptance criteria involve financial, brand, and legal aspects, but there are no conventional details, like the range of financial values, because these details will depend on the business objectives and its tolerance to risks (e.g., for organizations with low tolerance to risk, the acceptable financial impact of risk will be lower than for organizations with high tolerance to risk)

    For further information, see:

    3. Is treatment options generated from risk acceptance criteria?

    No. Treatment options are based on the identified risk and your available resources. The risk criteria will give you an idea about how much resources you should consider, but they do not define them.

    For further information, see:

    4. How can I join your community...to review issues relating to 27001...tried to sign in but it's impossible...can only comment as a guest?

    In order to post comments on our Expert Advice Community, you need to create an account at this link: https://community.advisera.com/sign-up/
    After that, you will be able to log in and post questions and search for other topics you are interested in.

  • Scope of legal and contractual requirements

    Please note that ISO 27001 requires only requirements relevant to information security, not all the regulations in a country.

    Additionally, please note that the list in the article you mentioned is not fully up-to-date because it depends on voluntary contributions from our readers – therefore, it is likely that not all regulations for each country are listed (some even may have been withdrawn). To make sure you have the latest list of laws and regulations, it would be best to hire a local legal adviser.

    For further information, see:

  • Preparing site for first-time ISO 13485 audit

    This depends on the type of your medical device. It is expected that, if the medical device is sterile, those necessary premises are properly clean. Also, there should be no cross-contamination between warehouse and production, that pathways for raw material and final goods are not crossed over each other. It is also expected that everything will be properly labeled. For example, cabinets, tables, drawers if they can be used for different purposes (eg clean/unclean) that it is so marked; if there is a defined place to dispose of something then that too should be properly marked; in the warehouse to see exactly where the non-compliant products are disposed of, and to see the paths of forklifts and people. If separate work clothes are required, then the place from which one can only move in it should be marked.

    Following article regarding infrastructure can be helpful:

Page 291-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +