Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Risk register

    Possible threats to this scenario related to employees are:

    • Conflict of interest - in case the project objective may not be beneficial for one of the departments
    • Unauthorized access to information - access rights granted to evaluate the project data may grant access to information not related to the project
    • Leakage/disclosure of information - people from the departments nor directly related to the project may have access to the project data

    This article will provide you a further explanation about security in projects:

  • GDPR and Data Subject Request flow

    Article 12 GDPR contains most of the data subject request flow. It requires that data controller to:

    • Make easy exercising the rights for data subjects (authomatic setting in user's page on a website can be an example, or unsubscribe bottom);
    • Provide on a request as soon as possible and within one month from the request.
    • Allow electronic means as form of exercise data subjects rights instead of other means (i.e. postmail)
    • Remember to illustrate in your privacy notice how to exercise data subjects right. 

    The responsibility for complying with data subject rights is on the data controller and note that fines for noncompliance are the highest (up to 20 million Euro or 4% annual turnover if higher). Therefore, you must ensure that your staff is trained in complying with data subject rights.

    You should set rules in your internal procedures on data subject rights. Here you can find some useful templates:

    GDPR Consent & Data Subject Rights Toolkit: https://advisera.com/eugdpracademy/eu-gdpr-consent-data-subject-rights-toolkit/ 

    Here you can find the free EU GDPR Data Subject Access Request Flowchart: https://info.advisera.com/eugdpracademy/free-download/eu-gdpr-data-subject-access-request-flowchart 

    Here is the text of the Article 12 from GDPR: https://advisera.com/eugdpracademy/gdpr/transparent-information-communication-and-modalities-for-the-exercise-of-the-rights-of-the-data-subject/  

    You can also consider enrolling in this free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

     

  • Scope for ISO 27001

    The ISMS scope can cover all organization, or only specific locations, processes, or information.

    The main point when considering this approach is the effort required to keep the ISMS scope separated from the rest of the organization's elements (for small and mid-sized organizations many times the effort is not worthy, and it is better to include all the organization in the ISMS scope)

    These articles will provide you a further explanation about the scope definition:

  • Controls A.6.1.3 and A.6.1.4

    1. How can the Organization be compliant with these Controls?

    A.6.1.3:  Contact with Authorities:      Does it mean contact with the Superior Authority who is also the supreme body for GDPR?

    In case your organization has to answer to this authority, then this is one way to fulfill this control. Other examples are law enforcement agencies and emergency services.

    2. A.6.1.4:  Contact with Special Interest Groups:  Does having ISACA Memberships of some other Interest Groups are taken into consideration?

    In case these groups can help you support your ISMS you can consider them to fulfill this control.

    This article will provide you a further explanation about interested groups:

  • Control A.14.2.7

    I'm assuming that by "customization without using any code" you mean parameterization of available options or setting up workflows.

    Considering that, please note that controls from section A.14 cover not only system development, but also acquisition and maintenance, and "customization without using any code" can be understood as security in the support process, so the controls you mentioned may be applicable if you have relevant risks that can be treated by them, or legal requirements (e.g., laws, regulations or contracts), demanding the implementation of such controls.

    For example, requests for configuration of a new parameter may need to be formally defined, and after that its implementation must be planned and test to be sure it won't have a negative impact on the current implementation.

    This article will provide you a further explanation about selecting controls:

    These materials will also help you regarding selecting controls:

  • Corrective action

    Corrective action is about identifying the cause(s) of a nonconformity and eliminate them.

     

    Cause(s) are normally hidden and have to be investigated. So, developing a corrective action requires:

    • Analyzing the symptoms – collect information, facts, numbers, about the problem. For example, you can start with a problem called “Reduce customers complaints” and after this symptoms analysis you realize that you should concentrate on “broken bags” the main motive of complaints
    • Develop hypothesis – develop a list of potential causes behind broken bags. Select the most promising hypothesis. Find a way to test the validity of the most promising hypothesis. For example, complaints about broken bags are mostly about bags kept at the warehouse for long time
    • Develop a solution that will remove the confirmed hypothesis. For example, introducing First In, First Out rule at the warehouse. For example, improving production planning to avoid long stays at the warehouse.
    • Implement the solution and monitor its effectiveness.
       

    We can find more information below:

  • Quality culture

    Each retail clothing company has its own strategic orientation. Different techniques and methodologies may be used as a function of a particular strategic orientation. For example, for a company that is betting on the relationship with the customer, many studies conclude that everything starts with satisfied and happy employees, they will the corner stone for making customers return. Second topic is to model the target-customer. Include as much as possible every people of the company answering to these questions:

    • Who is our target customer?
    • What is that she or he is looking for and values more?
    • How can we improve what we offer in our stores?
    • How can we improve how we display what we offer in our stores?
    • How can we improve how we interact with consumers in our stores?
       

    Quality is about managing and leading an organization focused on consistently meeting customer requirements and enhancing their satisfaction.

    The following material will provide you information about culture:

  • Indicators for a process

    According to ISO 9001:2015 you must have at least one indicator per process. When one think about process indicators, one can think of three types:

    • Effectiveness indicators;
    • Efficiency indicators;
    • Quantity indicators.

    For me, the most important are the effectiveness indicators, they measure if the purpose of the process is being met.

    For example, for a company that has a strategic direction around innovation and has a process called “Develop new products” one can ask:

    - What is the purpose of such process?
    - Quickly develop new products that are market hits.

    Effectiveness indicators will measure “Quickly” and “hits”. For example:

    • Average time to market
    • Revenue from new products
    • Average price of new products

    Efficiency indicators are the classic QCD indicators:

    • Quality
    • Cost
    • Delivery

    For example, for a company that installs wireless networks for telecom companies, with a process called “Install network”, efficiency indicators can be:

    • Number of daily nonconformities raised by the customer
    • Actual network installation costs versus budgeted costs
    • On-time delivery percentage

    Quantity indicators give information about the need to manage resources accordingly. For example, number of incoming calls at a call center is a way of evaluating the need to contract more people to handle more calls without raising waiting time.

    Please consider our free webinar on demand - Measurement, analysis, and improvement according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/ There you can find the rationale for developing effectiveness indicators and a monitoring plan.

    On our free webinar on demand – The Process Approach - What it is, why it is important, and how to do it - https://advisera.com/9001academy/webinar/iso-9001-process-approach-free-webinar-on-demand/ you can find an example of a flowchart that describes the flow of activities, very useful to define efficiency indicators.

    The following material will provide you information about indicators:

  • ISO 13485 Manufacturing

    ISO 13485, Manufacturing of Thermometer, Ventilator, BP Measurement apparatus - what are the applicable regulatory requirements?

  • Determination of OH&S objectives

    While Iso 45001 does not use the term standard operating procedure (SOP), OH&S objectives and plans is often its own process in the OHSMS. In fact, clause 6.2 does not require that you document the process for OH&S objectives at all, only that you have documented the objectives and plans to achieve them. As long as you have written objectives and plans, how you determine them can be determined by top management without documentation.

    To find out more on the OH&S objectives, see the article: How to define ISO 45001 objectives and plans, https://advisera.com/45001academy/blog/2018/12/04/how-to-define-iso-45001-objectives-and-plans/

    While Iso 45001 does not use the term standard operating procedure (SOP), OH&S objectives and plans is often its own process in the OHSMS. In fact, clause 6.2 does not require that you document the process for OH&S objectives at all, only that you have documented the objectives and plans to achieve them. As long as you have written objectives and plans, how you determine them can be determined by top management without documentation.

    To find out more on the OH&S objectives, see the article: How to define ISO 45001 objectives and plans, https://advisera.com/45001academy/blog/2018/12/04/how-to-define-iso-45001-objectives-and-plans/
Page 402 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +