Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • A.9.4.4 Use of Privileged Utility Programs

    If I understood you correctly, the perimeter of "Privileged Utility Programs" refers to where, or in which situations, you can use "Privileged Utility Programs" (programs that can change or bypass security features).

    An example would be the use of Windows Update only in IT labs (where) during the hardening process (situation). This restriction will prevent that regular users install patches not homologated by the organization in their machines.

  • Advice on dividing workload

    Please note that the toolkit approach for implementation is to work the documents in the order they are presented in the folders. You should not work documents and clauses separately, neither work some of the documents in parallel (this will only make things more complicated).

    Since you will be working with a partner in the implementation, my suggestion for you is dividing workload only for documents from Annex A.

  • Conformio dashboard

    1. What does " Determine required communication" mean and how do we show compliance

    Answer: ISO 27001, clause 7.4, requires a definition of internal and external communications needs relevant to the ISMS (e.g., what to communicate, to whom, when, by whom, etc.), but since the standard does not prescribe how to implement that, organizations are free to chose the approach that better fits them.

    Depending on the size of the organization and its security objectives, the communication needs may be fully documented as a separate document or simply stated in a few sentences within other policies, procedures, and plans (the last one is the approach adopted in our toolkits).

    This article will provide you further explanation about communication plan:
    - How to create a Communication Plan according to ISO 27001 https://advisera.com/27001academy/blog/2014/10/27/how-to-create-a-communication-plan-according-to-iso-27001/

    2. How do we show compliance to the "introduce no-blame security culture"


    Answer: Please note that "introduce no-blame security culture" is not a standard's requirement, but a good practice to support leadership and commitment  (e.g., to direct and support persons to contribute to the effectiveness of the ISMS); 

    Ways to demonstrate that this culture is implemented is by evidencing nonconformities and security incidents reported by employees, because this will show that employees are not afraid to report those even if they are the once that have caused them.

    This article will provide you further explanation about communication plan:
    - Roles and responsibilities of top management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/06/09/roles-and-responsibilities-of-top-management-in-iso-27001-and-iso-22301/

  • Control A7.1.1

    By your question, it is not clear if the law you are referring to demands screening, or defines restrictions to screening.

    Considering that, in case you identify a need to implement control A.7.1.1, but this implementation has legal limitations, you have to state in the SoA that this control is applicable with limitations, briefly explaining the exceptions. An example of a justification where you have a legal requirement demanding the control (e.g., a customer contract), but you also have another legal requirement defining limitations on its applicability would be "Control required by Customer contract ABC, limited by Brazilian Consolidation of Labor Laws (CLT)".

    This article will provide you further explanation about applying security controls:

  • ISO 22301 planning phase

    I'm assuming you are asking for the elements to be considered when planning the implementation of ISO 22301.

    Broadly speaking, you must consider:

    • obtaining management support
    • identification of legal requirements
    • development of a business continuity policy and objectives
    • development of basic document management system
    • development of business impact analysis and risk assessment and treatment methodologies

    With these implemented, you will have a solid foundation to implement ISO 22301.

    This article will provide you further explanation about ISO 22301 implementation steps:

    This material will also help you regarding ISO 22301 implementation:

  • Internal QMS Audit Checklist for IATF 16949

    Yes, the Quality Management System Internal Audit Checklist in Advisera's link covers both of the ISO 9001: 2015 and IATF 16949: 2016 standards.

    Please visit the address below for detailed information

    Internal audit checklist: https://advisera.com/16949academy/documentation/internal-qms-audit-checklist/

  • ISO 14001 and COVID-19 emergency

    COVID-19 in itself has nothing to do with ISO 14001. COVID-19 affects humans not the environment. What can happen is that due to COVID-19 new kinds of wastes can appear, and new waste segregation rules may be applied.

    For example:

    • Are there any recommendations or changes about rules for disposing existing wastes?
    • How to treat new wastes like used masks and gloves?
    • Use of disposable cups and other single use materials?

    In any of these situations one may have to determine:

    • New environmental aspects and impacts;
    • New or revised procedures for sorting and identifying wastes;
    • New waste operators for contaminated wastes.

    Even if your organization does not provide documented procedures it must provide training in the new practices.

  • Remote auditing criteria

    For the moment we don’t have a video.

    Please consider this, ISO 19011:2018 mentions the possibility of using remote audits and virtual audits. There is an important remark: Performing remote audits can depend on the kind of risk to achieving the audit objectives, the level of confidence between auditor and auditee’s personnel and any regulatory requirements. Please check ISO 19011:2018 Annex A.1 Applying audit methods. See also Annex A.15 Visiting the auditee’s location and Annex A.16 Auditing virtual activities and locations.

    Deciding when and how to use remote auditing techniques depends on the audit objectives, scope and criteria, the available technology, the competency of the auditee and auditor to use the technology, and the type of audit evidence that needs to be gathered. The key question is whether the remote auditing techniques allow you to meet your audit objectives while benefitting from the audit process, or whether the use of remote auditing techniques could be a disadvantage to your audit.

    Some remote audit activities are:

    • ensuring remote access protocols and devices, software, etc.;
    • asking for permission in advance for any screenshots and consider confidentiality and security matters and avoid recording individuals without their permission;
    • using floor plans/diagrams of the remote location for reference;
    • maintaining respect for privacy during audit breaks.

    I invite you to read this article later – What are the benefits and barriers when performing remote audits? - https://advisera.com/articles/what-are-benefits-and-barriers-when-performing-remote-audits/

  • ISO 9001 certification cost

    The cost of certification will depend primarily on the number of employees you’ve got and the number of locations you covered with the quality management system scope. Then, organizations have plenty of alternatives to choose a certification body. Different certification bodies have different prices.

    You can find more information about ISO 9001 below:

  • Clause 8.4. non-conformity

    You must understand that I’m just reading a nonconformity statement, I’m not aware of any more information that could be useful to give an answer. So, just based on the statement, my interpretation is: Let us consider this article - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ . You can verify that one of the mandatory documents is “Criteria for evaluation and selection of suppliers (clause 8.4.1)”. I believe the auditor was expecting to see a document stating the exact criteria to be applied

    You can find more information about ISO 9001 below:
Page 412 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +