Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Guest
First of all, thanks for the compliment to our material.
With regards to the material on LGPD and ISO 27001, I suggest that you seek the Brazilian version of the ISO 27701 standard, because the last annex of this standard makes a correlation between LGPD clauses and controls in Annex A of ISO 27001.
This article will provide you a further explanation about ISO 27701:
Primeramente, obrigado pelo elogio ao nosso material.
Com relação a material sobre LGPD e ISO 27001, eu sugiro que você busque a versão brasileira da norma ISO 27701, porque o último anexo desta norma faz uma correlação entre cláusulas da LGPD e controles do Anexo A da ISO 27001.
Este artigo fornecerá mais explicações sobre a ISO 27701:
As you know, PSCR means is Product Safety & Conformity Representative.
Every organization within the automotive supply chain is obliged to ensure the safety and conformity of its products. To this end, in the respective countries and regions, current legal statutes on product integrity must be observed, also the justifiable safety expectations of the public must be fulfilled. With products conspicuously “ unsafe “ in the market, or whose conformity to legal requirements is questionable, those responsible are obliged to initiate the necessary actions. In order to be aware of and to understand the many demands addressed to a product safety representative, comprehensive information and qualification are necessary.
The central topics of product integrity are explored, and competence as product safety representative is developed in the scope of these five modules including integrity tasks in the product life cycle, delegation guidelines, and non-conformity management. Therefore, the following topics are important issues for PSCR audit.
For more information, please see the following article:
https://advisera.com/16949academy/blog/2017/09/20/ensuring-product-safety-according-to-iatf-16949/
A coding system in our toolkit is just a suggestion. It means that you can use your own system however it suits you and how you feel you and your employees will do better. It is just necessary to ensure that current revision status of and changes to documentation are identified; that relevant versions of applicable documents are available at the point of use, and to that documents remain legible and readily identifiable.
If you would like to differentiate stated documents and records, you can use the system from your previous company. So, you can code your documents with SOP, WI, FORM, and REP and just add a number, or you can also add a department code. Here are some examples:
SOP-01 can be procedure for Document management, SOP-02 can be Internal audit procedure.SOP-Q-01 can be code for the first standard operating procedure for Quality department; SOP-SAL-01 can be first standard operating procedure in the Sales department.
This is only the suggestion.
For more details please see the following article:
You are right, there is no procedure for translation labels and instruction of use. We concentrated on this toolkit on documentation related to ISO 13485 and documented requirements from MDR. Nowhere in the MDR is it stated that it is necessary to document the translation procedure. Your labels and Instruction for use must have proper symbols according to harmonized standards, and you need to ensure that translation is correct and professional. Usually, medical device manufacturers use certified translation companies for this.
For more details on mandatory documentation from MDR, please see the following white paper:
I am looking for the needs and expectations of interested parties as per the ISO 9001:2015 standard.
ISO 27001:2013 does not have requirements for preventive actions, however, preventive actions are in fact included in the risk assessment and treatment because the essence of risk management is to recognize a potential problem before it happens, and by treating it to prevent such an incident from happening.
Your assumption is correct. Even for organizations of the same size and industry there may be different relevant requirements because each organization has its own view of the business and market, so they develop different strategies, and also may have different approaches toward risks
This article will provide you a further explanation about the identification of requirements:
These materials will also help you regarding the identification of requirements:
One initial question I have is whether there is a “required” number of controls that need to be audited for a certification? I was thinking that an auditor would check 15-20 randomly selected controls?
For a certification audit, all controls identified as applicable in the Statement of Applicability will be audited, and this number will vary depending on the results of risk assessment and legal requirements you have to comply to. A reduced number of controls will be audited only during surveillance audits, where the auditor will focus on the controls applicable in the scope of the audit.
For further information, see:
Any thoughts or recommendations for how best to approach this would be helpful and appreciated!
The best way to approach this situation is to prepare a proper internal audit checklist for your internal audit (performing at least one internal audit is also mandatory for certification). This way you will have a good understanding of the status of your ISMS before the certification audit
This article will provide you a further explanation about internal audit:
These materials will also help you regarding internal audit: