Search results

Home / Search

Category:
Select
Select

11275 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • ISMS audit

    I will keep it as my guidance in after audit programs, thank you.

  • ISO 13485 for trading of medical devices

    If you only make export and import of medical devices, It is not a regulatory requirement to be ISO 13485 certified. What is expected from the importer and distributor of medical devices is stated in Article 13 and Article 14.

    For more information, see:

    • EU MDR Article 13 - General obligations of importers https://advisera.com/13485academy/mdr/general-obligations-of-importers/
    • EU MDR Article 14 - General obligation of distributors https://advisera.com/13485academy/mdr/general-obligations-of-distributors/

    • Planned implementation of changes to ISMS

      Please note that ISO 27001 clause 6.3 does not require a specific document to be developed to manage changes in the ISMS.

      Considering that, you can use one of these documents to manage changes:

      • Risk Treatment Plan, located in folder 08 Implementation Plan - through this document you plan for each new security control, process, or activity
      • Change Management Policy, located in folder 09 Annex A Security Controls
      • Security Procedures for IT Department, located in folder 09 Annex A Security Controls

      For further information, see:

      • How to manage changes in an ISMS according to ISO 27001 A.12.1.2 https://advisera.com/27001academy/blog/2015/09/14/how-to-manage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/

      • Toolkit documentation

        Please note that ISO 27001 does not require documents to be developed to implement controls A.7.5 and A.7.8, so a brief description of their implementation can be included in the Statement of Applicability, and this template can be found in folder 06 Applicability of Controls (in this template a suggested text on how to document this information is included).

      • DR distance

        Please note that there is no definitive answer about how far apart a disaster recovery site should be.

        Main ISO standards covering this topic (ISO 27001, for information security, and ISO 22301 for business continuity), as well as most regulations and industry practices, do not define any specific distance to recovery sites, because many factors can affect what would be considered a “safe” distance (e.g., type of disaster, access to public services, risk level, etc.). From our experience, we suggest you start a discussion suggesting a distance between 30 miles (50 kilometers) and 100 miles (160 kilometers) away from your primary location, and from that analyze your organization's context (a geographic situation, available resources, required investment, etc.).  

        This article will provide you with a further explanation of the distance of the recovery site:

      • Lead Auditor certification

        Please note that accreditation only applies to organizations that certify other organizations' management systems (e.g., ISO 27001, ISO 9001, etc.), or certifies people that are approved on their training (e.g., Lead Auditor, internal auditor, etc.).

        Considering that, once you have passed the Lead Auditor exam from an accredited training provider there is no need to submit your certification for accreditation. The fact that the provider is accredited already validates your certification.

        For further information, see:

      • Documentation hierarchy

        ISO 27001 does not prescribe documentation hierarchy, so organizations can adopt the framework that best suits their needs.

        Considering that, using ISO 10013 as a reference for documentation hierarchy is an acceptable approach.

        Regarding the fact that ISO 10013:2001 is a withdrawn standard, unless you have specific requirements to adopt this version (e.g., customer requirement or law), you should consider using the 2021 version of the standard, because its requirements are better aligned with current versions of ISO management systems standards.

        For further information, see:

Page 41-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +