Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Software Development Security

    1. Why ISO 27001 documentation toolkit from Advisera does not have a template for “Secure Development Environment Guidelines”?

    Answer: Please note that ISO 27001 does not require a Secure Development Environment to be documented, and not many companies are asking for such a document, so we decided not to develop this template. You can document these guidelines as part of the Secure Development Policy, located in folder 08 Annex A Security Controls >> A.14 System Acquisition Development and Maintenance.

    If you have access to ISO 27002 you can find guidance on how to Secure Development Environment. If you do  ot have access to this standard, I suggest you this link for some insight: https://advisera.com/27001academy/blog/2018/04/24/how-to-use-open-web-application-security-project-owasp-for-iso-27001/

     

    2. We are a medium organization where we do limited development particularly customization of COTS software (Web Content Management {CMS} and Student Information Management {SIMS}). In this case how to analyze which A 14 controls will be applicable to our organization?

    Answer: The applicability of controls is defined by performing the risk assessment and risk treatment processes, and by the identification of any legal requirement (e.g., laws, and contracts) applicable to your organization.

    The templates for performing the risk assessment and risk treatment processes are located on folder 05 Risk Assessment and Risk Treatment, and templates for performing identification of legal requirements are located on folder 02 Identification of Requirements.

    This article will provide you further explanation about selecting controls:
    - The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/

    These materials will also help you regarding risk assessment and risk treatment:
    - The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/

     

     

     

     

  • Identification of environmental aspects vs Environmental risks & Opportunities

    Let us start with ISO 14001:2015, clause 6.1.1. Organizations determine risks based on its environmental aspects, compliance obligations, and context and interested parties.

    Determining risks and opportunities based on context and interested parties is straightforward. For example, an organization that manufactures plastic packaging can realize that consumers (an interested party) are pressuring governments to issue legislation (an external issue) about single use plastics. So, part of that company’s products will face a dark future. That’s a risk.

    Please check risk definition (3.2.10) on ISO 14001:2015 (effect of uncertainty). With environmental aspects and impacts we are considering normal, expected situations, like startup and closing down operations, but also abnormal and emergency situations. Whenever there is uncertainty there is risk or opportunities, there is a potential deviation from the expected.

    About determining risks based on environmental aspects and compliance obligations I see that different organizations follow different approaches:

    1. There are organizations that determine their environmental aspects and use a risk and opportunities assessment to determine its significant environmental aspects. (Please see the end of the second paragraph of Annex A.6.1.1 of ISO 14001:2015)

    2. There are organizations that determine their environmental aspects evaluate them and determine the significant ones and use a risk and opportunities assessment to determine which ones need an action plan, and which ones need only to be monitored.

    3. There are organizations that only apply the risk-based approach to the context part. In a certain way they are following the same approach as 1 without explicitly mentioning it.

    Let us present another example:

    https://www.screencast.com/users/ccruz5284/folders/Default/media/be180b68-ea2f-4ca1-84a5-7cd4abf08150

    In this example the risk of not complying with wastewater discharging permit can be considered very low for normal situation, for normal operation, but very high for and emergency situation.

    In the example above one of the risks, one of the possibilities, is an emergency due to a wastewater treatment unit malfunction. That malfunction can generate a negative deviation from the expected, can generate a discharge exceeding permit limits, increase river pollution, and generating more environmental aspects and impacts like neighborhood complaints.

  • Business continuity in EU

    Sorry to not be able to help you, but we are experts on the implementation of ISO management standards on small and mid-sized businesses, not on legal advice about countries laws and regulations or on BC of critical infrastructure of big organizations.

    Maybe you can find the information you are looking for on these sites:

  • Business continuity procedures

    To cover ISO 27001 requirements for business continuity, it is sufficient to use the Disaster Recovery Plan template, located on folder 08 Annex A >> A.17 Business Continuity >> 04 Business Continuity Plan

    In the list of documents file included in your toolkit, you can identify which documents are related to each clause of each standard.

  • ISO 27001 / ISO 22301 Disaster Recovery Plan

    For use in a combined ISO27k/22301/GDPR implementation, you should consider using the 11.A.17_Disaster_Recovery_Plan_Integrated document. In case your environment has specific requirements for cloud environments (e.g., laws or contracts you must be compliant with)  you should consider the A.17_Disaster_Recovery_Plan_Cloud.

  • Risk treatment

    I'm assuming you are referring to the "How to implement risk treatment video".

    Considering that, the example shown in the video starts approximately in minute 2, and if you note it is said, approximately at minute 2:50, that mentioned controls (physical, technical, and organizational) have an impact on risk, but it does not mention impact and probability at this moment, so it is not possible to conclude that mentioned controls have affect on both elements.

    If you understand you need  more clarification, you can schedule a meeting with one of our experts at this link: https://advisera.com/27001academy/consultation/

     

  • Excel Template Programming

    Please note that we do not use programming in our templates, only the most basic features of the programs, so the templates become accessible for most users.

    Regarding the Risk Treatment template, we use the only "Data validation" feature (accessible through the Data tab) in columns J and K. With this feature you can define warning messages in case wrong data is entered.

    For changing the color of a cell you should use the "Conditional Formatting" feature (accessible through the Home tab).

    For more information on these features, please see:

    • https://support.office.com/en-us/article/apply-data-validation-to-cells-29fecbcc-d1b9-42c1-9d76-eff3ce5f7249
    • https://support.office.com/en-us/article/use-conditional-formatting-to-highlight-information-fed60dfa-1d3f-4e13-9ecb-f1951ff89d7f

  • Consistent operation of the Laboratory

    As an international standard, compliance to ISO 17025 promotes confidence in laboratory operations, demonstrating they have the ability to produce valid results. “Consistent operation of the Laboratory” means that the laboratory maintains the requirements of ISO 17025 and produces valid results over time, i.e. consistently. To achieve this, processes inputs and outputs should be known and risks to disrupting the desired outcome must be identified through monitoring activities. All the risks that could impact quality objectives (such as turnaround time) and the quality of results must be controlled.

    ISO 17025 assists by specifying the requirements to facilitate consistent operation. An example would be requirements for document and record control to ensure consistency of access and use between personnel. Another example would be the requirement Ensuring the validity of results, were the laboratory is required to monitor the consistency of method performance through internal and external quality control checks and act on significant variations.

    The effective implementation of a ISO 17025 provides the grounding to achieve consistency. Have a look at the
    ISO 17025 toolkit https://advisera.com/17025academy/iso-17025-documentation-toolkit/ and
    free Diagram of ISO 17025 Implementation Process https://info.advisera.com/17025academy/free-download/diagram-of-iso-17025-implementation-process

  • Masks effectiveness

    I assume that you refer to list published in the article EU standards for protective equipment – available now for free https://advisera.com/13485academy/blog/2020/04/14/free-access-to-iso-13485/

    On that standard list, there are two standards for masks: one for classic surgical masks and one for respiratory masks FFP. According to the guidelines from the World health organization on the day April 5th, 2020, regular surgical masks are effective protection against COVID-19: https://www.who.int/emergencies/diseases/novel-coronavirus-2019/advice-for-public/when-and-how-to-use-masks. 

    For that surgical masks is applicable standard EN 14683:2019 + AC:2019 Medical face masks – Requirements and test method. For respiratory masks applicable standard is N 149 + A1:2009 Respiratory protective devices – Filtering half masks to protect against particles – Requirements, testing, marking (commonly referred to as ‘FFP masks’).

  • DPIA for COVID-19 Remote Work Environment

    During this period Data Protection Authorities (DPA) are establishing guidelines for organizations on how to organize homework. You should check your country DPA in order to check for specific guidelines.European Data Protection Board released on 19th March 2020 a statement on the processing of personal data in COVID-19 pandemic. You can download the statement here: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf

    Most of DPA stated that the pandemic outbreak does not derogate to normal rules on data protection, yet the emergency requires to balance and mitigate risks. So, in order to perform a Data Protection Impact Assessment, you will need to follow the usual procedure in order to estimate risks.Some of the risks arising from homeworking relate to:• unauthorized access (i.e. family members of the workers),• data breaches because of accidental loss of data,• insufficient security measures (due to the use of workers’ personal devices).

    In order to mitigate risks, you can have a look at our template on teleworking and Bring Your Own Device Policy in order to establish a policy for homeworkers that suits to your needs. Remember to consider DPA guidelines and additional internal rules (i.e. on workers' surveillance).

    Here you can find some useful information:Useful links to Data Protection Authorities website: https://advisera.com/eugdpracademy/knowledgebase/useful-links/How to write an easy-to-use BYOD policy compliant with ISO 27001: https://advisera.com/27001academy/blog/2015/09/07/how-to-write-an-easy-to-use-byod-policy-compliant-with-iso-27001/

    Bring Your Own Device (BYOD) Policy: https://advisera.com/eugdpracademy/documentation/bring-your-own-device-byod-policy/Mobile Device and Teleworking Policy: https://advisera.com/eugdpracademy/documentation/mobile-device-and-teleworking-policy/ 
Page 422 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +