Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • A.5 and A.8 elements

    Please note that there is no specific document for control A.7.2.1 because management responsibility is documented across several documents in the toolkit, like the Information Security Policy and Management review minutes.

    For further information see:

    Regarding control A.13.1.3, is important to note that Advisera's ISO 27001 Documentation Toolkit does not have a document for each and every control from ISO 27001 because of the following reasons:
    1) ISO 27001 does not require each and every control to be documented
    2) If the toolkit had a document for each control, there would be too many documents and this would be an overkill for smaller and mid-size companies.

    Since our target are SMEs, we have decided to include an optimum amount of documents for companies of this size - the toolkit includes:

    • All the mandatory documents - e.g. Information Security Policy, Statement of Applicability, Risk Assessment Methodology, Access Control Policy, etc.
    • Documents that are not mandatory, but are commonly used - e.g. BYOD Policy, Classification Policy, Password Policy, Backup Policy, etc.

    Documents that cover the remaining mentioned controls are located as follow:

    • A.8.1.3 - Acceptable use of assets, is covered by document IT Security Policy, located on folder 08 Annex A Security Controls >> A.8 Asset Management
    • A.9.1.1 - Access control policy, is covered by document Access Control Policy, located on folder 08 Annex A Security Controls >> A.9 Access Control
    • A.12.3.1 - Information backup, is covered by documents IT Security Policy, located on folder 08 Annex A Security Controls >> A.8Asset Management, Security Procedures for IT Department, located on folder 08 Annex A Security Controls >> A.12 Operations Security, and Backup Policy, located on folder 08 Annex A Security Controls >> A.12 Operations Security

    Please note that included in your toolkit there is a List of Documents file that can show you which clause and control of the standard are covered by each document.

  • Certification upgrade

    As an auditor you should be able to demonstrate your competence to your customers. As a minimum you should demonstrate certification as lead auditor, and certification that you know the standard. So, I would recommend a training to formalize your knowledge of ISO 9001:2015 followed by several internal audits to gain experience.

    The following material will provide you information about ISO 9001:2015:

  • Chemical lab test

    Before you can determine what measures are required, you need to develop and validate the method. This provides valuable information on what performance to expect from a method, for example limit of detection, accuracy and repeatability. The ruggedness (robustness) studies will indicate what the influencing factors are during normal usage, for example instrument stability and sensitivity of the method to sample matrix changes. You will then know the “method risks” that need to be controlled and monitored to ensure the ongoing validity of results from a method.

    Ensring the validity of a test involves taking measures to monitor and evaluate analytical data; and acting on any trends noted in the performance of a method for specific samples or a batch of samples. Typically you would use statistical techniques and QC charts to plot, and detect trends and nonconforming work to avoid realising suspect results. The data comes from two quality control processes. The first is External Quality Control. Here, through regular participation in an formal proficiency testing scheme or interlaboratory comparison, you will evaluate your laboratory performance for any significant statistical bias against other laboratories performing the same test.

    The second process is Internal Quality Control, where you could include a number of measures, depending on your method and need. It will involve running and analysing a suitable number of quality control materials (samples) in each batch. These could be blanks, certified reference samples, spiked samples, check samples and / or sample replicates to measure an acceptable accuracy or repeatability of your method. The criteria for acceptance of the results must be established. If the criteria is met, then the results can be realised with confidence. For example, a typical QC criteria is that the result for an internal control sample run over a period of time must fall above and below its mean in a random pattern, but within set upper and lower control limits. 

    The ISO 17025 toolkit document template: Quality Assurance Procedure includes the Quality Control requirements to ensure valid results from all testing and calibration activities. It is available, including a free preview at https://advisera.com/17025academy/documentation/quality-assurance-procedure/

    The specific Quality Control methods and frequency must be established by the laboratory, based on risk. This will depend on the method type, and the use of the results.

  • Controlled documentation difference

    Internal documents are issued by your organization. For example, procedures, work instructions, records. Any change in internal documentation is decided and controlled by your organization.

    External documents are documents relevant for your quality management system but issued by an external organization. For example, a standard, or regulation, or legislation. Any change in external documentation is decided by an external organization but your organization must be aware of it.

    You control your data when you control your records.

    You can find more information about document control below:

  • Major vs Minor nonconformity

    Could you please let me know what is the difference between major and minor nonconformity?

    Answer:

    Minor nonconformity - a nonconformity that does not affect the capability of the management system to achieve the intended results. An example might be that you find some people have not undertaken training that the organization has made mandatory (ISO 9001 clause 7.2), but you find that those people are still competent to carry out their tasks.

    Major nonconformity - a nonconformity that affects the capability of the management system to achieve the intended results or in other words, when you have found that the requirement of the standard has not been met. For example, if an organization completely failed to fulfill a certain requirement; if a process has completely fallen apart; or if you have several minor nonconformities that are related to the same process, or to the same element of your management system.

    Could you please provide any practice tests/incidences to rule out any nonconformity present in the scenario?

    Answer

    Whenever a requirement, from the standard, or from regulation, or from internal documents, is not being met you have a nonconformity. To decide if it is major you can follow the criteria in this article - Major vs. minor nonconformities in the certification audit - https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/

    You can find more information about nonconformities at:

  • User Account Responsibilities

    This case still must be listed as an exception, even if the credentials are not shared with other team members, because the control requires unique credentials for each employee who access the device (in this case a computer).

  • Adopting the ISO 27001 standard

    For a presentation platform, you can use any common marketing solution you feel comfortable to use. Our common suggestion is MS PowerPoint.

    Regarding why implementing ISO 27001, you can show these 4 benefits:

    • Enhanced competitive edge
    • Reduction on losses due to security incidents
    • Reduction on fines due to legal or contractual non-conformity
    • Improvement of internal organization

    To see how an ISO 27001 presentation looks like, I suggest you to take a look at this free download material: Project proposal for ISO 27001 implementation (MS PowerPoint) https://info.advisera.com/27001academy/free-download/project-proposal-for-iso-27001-implementation-powerpoint

    These articles will provide you a further explanation about ISO 27001 benefits:

    These materials will also help you regarding ISO 27001 benefits:

  • Business impact analysis

    Please note that although connected, BIA and Risk Assessment are different processes, and this connection does not make obsolete ISO 22317:2015, which defines guidelines for business impact analysis. You can still use this standard to help develop a BIA approach.

    This article will provide you a further explanation about BIA and risk assessment:

  • Clause 8.3. applicability

    Clause 8.3 is not about designing Standard Operating Procedures for use in-house.

    https://www.screencast.com/users/ccruz5284/folders/Default/media/e7d2dce2-14f1-43fc-a3e3-4e957565327f

    Clause 8.3 is about designing a new product or service. Clause 8.3 may be the main job in your scientific research lab.

    Whenever there is a go decision for a new research your lab has to:

    • Set up a project team with resources, responsibilities and authorities. Set up a project plan - (this is about clause 8.3.2)
    • Collect inputs (state of the art data and information, legislation and regulation applicable) - (this is about clause 8.3.3)
    • Following the project plan there is reviewed, final verification and validation controls are - (this is about clause 8.3.4)
    • An output comes out of a successful project plan – a prototype, specifications to manufacture or provide or use, Standard Operating Procedures to manufacture or provide or use, … - (this is about clause 8.3.5)
    • Changes - (this is about clause 8.3.6)
       

    So, it is very difficult to justify that clause 8.3 is not applicable to a scientific research lab implementing a quality management system according to ISO 9001:2015

    The following material will provide you more information about design and development:

  • ISO Standards for HR Policies

     In a general way, the benefits of adopting ISO standards are related to:

    • Enhanced competitive edge
    • Reduction on losses due to errors, failures or incidents
    • Reduction on fines due to legal or contractual non-conformity
    • Improvement of internal organization

    These articles will provide you a further explanation about ISO 27001 benefits:

    These materials will also help you regarding ISO 27001 benefits:
Page 391 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +