Search results

Double Option

Is double option mandatory In Europe and if yes where I can see in what countries it is?

I assume you are referring to double option in consent forms for different purposes. Well, if your organization is under GDPR, whether is based in EU or processes EU individual’s personal data, you will need to comply with GDPR worldwide.

You can find more information in the following article:
What is the EU GDPR and why is it applicable to the whole world? https://advisera.com/eugdpracademy/knowledgebase/what-is-the-eu-gdpr-and-why-is-it-applicable-to-the-whole-world/  

If you have a question about to which countries is GDPR applicable, then please use this article instead: Is the GDPR applicable to our company? https://advisera.com/eugdpracademy/knowledgebase/who-needs-to-be-gdpr-compliant-an-easy-explanation/

You can also consider enrolling in this free EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

To fulfill a form is always and in all the countries obligated to add the checkbox for marketing activities?

Yes, unless the marketing activity is the main purpose of data processing. I.e. in a subscription form to be informed about promotions. The purpose of processing is clearly marketing, and the user is giving consent for it. On the contrary, if the user is purchasing anything on the website or requiring general information if you want to use email for marketing purposes, you need to add the checkbox, because the user must be aware of what are you going to do with his/her e-mail.

You can find more information here:
How does GDPR impact marketing activities? https://advisera.com/eugdpracademy/blog/2018/02/08/how-does-gdpr-impact-marketing-activities/
How does GDPR affect digital marketing? https://advisera.com/eugdpracademy/blog/2019/02/20/how-does-gdpr-affect-digital-marketing/
Email marketing in the era of GDPR – How to ensure compliance? https://advisera.com/eugdpracademy/blog/2019/05/27/gdpr-and-email-marketing-rules-for-compliant-campaigns/

Is consent needed? Six legal bases to process data according to GDPR: https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/

Environmental performance report

First, let us consider the elements of an environmental performance report.

You can consider adapting based on these elements:

• Introduction – a top management statement (includes a greeting, a list of actions and commitment)
• Organization’s Profile – main business areas, facilities being operated and managed as well as their locations and activities
• Intentions versus results - Summary of Policies, Targets, and Achievements in Environmental Efforts. Include environmental policies regarding environmental activities, summary of objectives, plans of environmental activities and achievements in environmental efforts. May also include material and energy balances.
• State of the environmental management system – describes how the organization is to manage its operations and services to achieve its environmental objectives and targets
• State of activities for improving relationship with the environment – presentation and analysis of the key environmental indicators and measurements against the corresponding policy, objectives, targets/milestones as benchmarks.
• Environmental actions requiring special attention - top management, might wish to give the organization’s views on how well the organization has performed in the current year and which specific areas they would focus their efforts on in the coming year. In this part of the report, it might be worthwhile for the top management to consider the possible challenges likely to be faced by the organization.

About the evaluation mechanisms consider developing a monitoring plan, a dashboard including each environmental indicator and the state of each action plan. Define monitoring and analysis responsibilities and frequency.

Please consider the following information:

• Environmental performance evaluation - https://advisera.com/14001academy/blog/2015/07/06/environmental-performance-evaluation/
• How to perform communication related to the EMS - https://advisera.com/14001academy/blog/2015/08/31/how-to-perform-communication-related-to-the-ems/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

ISO 14001 in Human Resources

That will depend from organization to organization.

For example, if you consider a small medium company with Human Resources basically doing office work, you can ask: How does an office interacts with the environment?

• Energy consumption
• Paper waste
• Electric and electronic waste

Another example might be the Human Resources of a corporation, or a company with multiple units. In this case you might add:

• Carbon emissions due to travel between units

Another example is an organization where Human Resources is also responsible for general organizational behaviors such as:

• Waste of energy, waste of water and paper. Waste management similar to urban waste. Policies for recycling paper and ink and toners

I recommend doing this exercise, as a brainstorm, fill the remaining spaces:

Please consider these sources of information:

• Article - 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
• Article - Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
• Article - How to identify environmental aspects in your office using ISO 14001 - https://advisera.com/14001academy/blog/2015/05/18/how-to-identify-environmental-aspects-in-your-office-using-iso-14001/
• Free webinar - ISO 14001: Identification and evaluation of environmental aspects - https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/
   

Question about non-compliance

The consequences may vary depending on the type of the non-compliance, but broadly speaking, ISO 27001 related non-compliances can be related to:

• Information compromise (i.e., loss of confidentiality, integrity and/or availability)
• Loss of customer trust
• Violation of legal requirements (e.g., law, regulation or contract) that can lead to fines and/or legal actions

Regarding non-compliances identified during ISO 27001 certification/surveillance audit, they can lead to problems with the certification process.

These articles will provide you a further explanation about the impacts of non-compliances:

• Major vs. minor nonconformities in the certification audit https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
• Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/

These materials will also help you regarding the impacts of non-compliances:

• Preparing for ISO Certification Audit: A Plain English Guide https://advisera.com/books/preparing-for-iso-certification-audit-plain-english-guide/
• ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
• Free online training ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/

ISO Lead Auditor certification/recertification

The need for recertification/refresher courses is defined by the certification issuer (e.g., Hightrust Alliance, CISSP and ISACA for their certifications), and what normally happens regarding ISO Auditor certifications is that recertification/refresher courses are necessary only when there is a change in the related management system standard (e.g., ISO 9001, ISO 27001, ISO 14001, etc), or in the audit standard (ISO 19011), so people can keep the necessary competences for audit, and such changes do not occur annually (it takes at least 5 years for a standard to be reviewed).

External and environmental threats

ISO 27001 does not prescribe ways to implement controls, only the objective to be achieved. For guidance on implementing this control, you should consider ISO 27002, a supporting standard that provides guidelines for implementation of controls from ISO 27001 Annex A.

Common solutions to implement this control are:

• Construction hardening (e.g., reinforcement of walls, doors, and windows, possibility to access multiple providers of the same service, etc.)
• Crime Prevention Through Environmental Design (CPTED) (e.g., natural surveillance/access control)

This article will provide you a further explanation about the application of control A.11.1.4:

• How to protect against external and environmental threats according to ISO 27001 A.11.1.4 https://advisera.com/27001academy/blog/2016/01/25/how-to-protect-against-external-and-environmental-threats-according-to-iso-27001-a-11-1-4/

Annex controls in SOA

Please note that there is no need for a folder A.5 in the toolkit because the policies needed to fulfill the controls from section A.5 from ISO 27001 Annex A are included in all other folders that make part of the folder 08 Annex A. In short, controls from section A.5 are not documents by themselves, but refer to other documents (A.5.1.1), and practices to be performed on them (A.5.1.2).

Regarding controls from section A.6.1, please note that roles and responsibilities are defined in each policy and procedure, so there is no need for a specific document to cover control A.6.1.1.

According to our experience, the BYOD and Mobile Device and Telework policies are sufficient to cover the controls of section A.6.

Additionally, is important to understand that ISO 27001 does not require every applicable control to be a separate document. In some cases, you only need to make a brief description of how it is implemented, and you can do that in our SoA template, in the column "Implementation Method".

This article will provide you a further explanation about the Statement of Applicability:

• The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/

Physical access audit records

ISO 27001 does not prescribe records to be generated while managing physical access, but common records you should consider are:

• access rights granted to personnel
• access logs
• changes in access rights
• access review reports

This way you cover the main steps of access management: the definition of access rights, when they are used and changed, and when they are reviewed.

This article will provide you a further explanation about physical security:

• How to handle access control according to ISO 27001 https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/

This material will also help you regarding physical security:

• Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

Key Universal Principles of Segregation of Duties

The most common criteria to be considered for segregation of duties of critical activities are:

• the person who elaborates something does not approve it
• the person how performs a task does not review it

Considering that, for example, the internal auditor/security tester should not be the same person as the service manager. The service manager defines and handles changes/incidents, while internal auditor/security tester verifies if these are effective. So, you should verify exactly which activities will be performed by each role to identify potential conflicts of interest.

For further information, see:

• Segregation of duties in your ISMS according to ISO 27001 A.6.1.2 https://advisera.com/27001academy/blog/2016/11/21/segregation-of-duties-in-your-isms-according-to-iso-27001-a-6-1-2/

These materials will also help you regarding segregation of duties:

• ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
• ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

ISO 27001 Internal Auditor or Lead Auditor

This depends on your career objectives:
- The ISO 27001 Internal Auditor certification recognizes people capable of ISMS against ISO 27001. This allows them to perform audits in their own organizations.
- The ISO 27001 Lead Auditor certification recognizes people who have competency on auditing an ISMS against ISO 27001 requirements and qualifies them to audit other organizations on behalf of a customer, or to start the process to become a certification auditor.

These articles will provide you a further explanation about personal certifications:
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
- ISO 27001 Internal Auditor training – Is it good for my career?  https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/  

These materials will also help you regarding audit training:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
- ISO 27001:2013 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/