Search results

Information security policy in contracts

ISO 27001 does not prescribe how to document your information security policies, so organizations are free to document them as they see fit.

The general practice is to have information security policies as internal operational documents, and including only references to them in contracts, as contractual clauses.

This article will provide you a further explanation about documenting policies and developing employment contracts:

• One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/
• What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/

Managing warranty claim department as an automobile dealership

After the warranty complaints are received by the dealer if the problem is part of the warranty scope and is not related to end-user (driver/passenger) error; the subject and the faulty part should be forwarded to the relevant automotive OEM company. Especially if it is an issue related to faulty part driver and vehicle safety than much faster reaction must be shown.

Depending on the situation, either a part replacement or temporary vehicle supply is provided. According to the investigation result of the OEM company, the customer must be answered in writing. 

Generally, this process is carried out by departments such as after-sales services, etc

Prepare the IATF 16949 certification

IATF 16949 rules have no defined time frame for the transition from ISO 9001:2015 to IATF 16949:2016. When the organization is ready according to IATF 16949:2016, it must take the stage 1 audit and, if the result is ‘’ready’’ then to start stage 2 audit, which is the main audit within 90 days after stage 1 audit. In my experience, a firm that effectively implements ISO 9001: 2015 says it will be ready for the IATF 16949: 2016 audit, with 6 months of work.

For more information, this article might be useful:

• What are the main differences between IATF 16949 and ISO 9001? https://advisera.com/16949academy/blog/2019/11/19/iso-9001-vs-iatf-16949-what-is-the-difference/

• Control of documents

  According to the IATF 16949: 2016 standard, any documented information should be under control. As you know, the documented information, all kinds of records such as procedure, instruction, control plan, processes, training records, job descriptions, etc.

  My advice is, create a form number, revision number for the to-do list so that everyone in the organization can use the same to-do list.

  Thus, the to-do list becomes a controlled document.

• Feedback on Cloud Computing

  SO 27001 does not provide specific controls for cloud computing, but you can adopt and adapt some of its controls for cloud computing.

  For example, you can use control A.8.3.2 Disposal of media (which states that media must be disposed in a secure and formal way when no longer required), considering that virtual machine as a "media".

  For specific recommendations about cloud computing, you can consult ISO 27017 and ISO 27018, which provides specifics applicable to cloud computing regarding controls from ISO 27001 Annex A.

  These articles can provide you more details on data disposal in ISO 27001:

  • 5 practical tips for media disposal according to ISO 27001 https://advisera.com/27001academy/blog/2018/10/22/5-practical-tips-for-media-disposal-according-to-iso-27001/
  • Secure equipment and media disposal according to ISO 27001 https://advisera.com/27001academy/blog/2015/12/07/secure-equipmentand-media-disposal-according-to-iso-27001/

  These articles will provide you a further explanation about ISO 27017 and ISO 27018:

  • ISO 27001 vs. ISO 27017 – Information security controls for cloud services https://advisera.com/27001academy/blog/2015/11/30/iso-27001-vs-iso-27017-information-security-controls-for-cloud-services/
  • ISO 27001 vs. ISO 27018 – Standard for protecting privacy in the cloud https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/

• Training on ITIL

  Training on ITIL covers some topics related to information security that can provide evidence of competence that can help achieve ISO 27001 compliance.

  These articles will provide you a further explanation about competences, ITIL, and ISO 27001:

  • How to perform training & awareness for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/05/19/how-to-perform-training-awareness-for-iso-27001-and-iso-22301/
  • ISO 27001 vs. ITIL: Similarities and differences https://advisera.com/27001academy/blog/2016/03/07/iso-27001-vs-itil-similarities-and-differences/
  • Using ITIL to implement ISO 27001 incident management https://advisera.com/27001academy/blog/2015/11/10/using-itil-to-implement-iso-27001-incident-management/t/

  This material will also help you regarding competences on information security:

  • Free Security Awareness Training: https://advisera.com/training/awareness-session/security-awareness-training/ - this is a series of 25 videos that cover various topics related to security.

• Table Top Exercise /Drill Validity in meeting ISMS Certification

  ISO 27001 does not prescribe how to test a Disaster Recovery Plan, so organizations are free to use the approach that better suits them, provided they can show evidence that the plan is fit for purpose.

  This article will provide you a further explanation about testing a DRP (although it is about ISO 22301, the same concepts apply to ISO 27001):

  • How to perform business continuity exercising and testing according to ISO 22301 https://advisera.com/27001academy/blog/2015/02/02/how-to-perform-business-continuity-exercising-and-testing-according-to-iso-22301/

  This material will also help you regarding a DRP:

  • Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/

• ISO Environment

  Thank you for your answer.

• ISO 9001 Quality Analyst

  ISO 9001 can be useful for a Quality Analyst to develop a management view about how an organization works, that way it can be useful for evolving for other positions in an organization. It can be a way of moving from a technical to a management position.

  The following material will provide you more information:

  • What is ISO 9001? - https://advisera.com/9001academy/what-is-iso-9001/
  • The history and future of the ISO 9000 series of standards - https://advisera.com/9001academy/blog/2019/04/15/history-of-the-iso-9000-series-of-standards-and-what-to-expect-next/
  • Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
  • Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/