Search results

Internal audit

1. Must first internal audit be executed before certificate audit?

Internal audit is a mandatory requirement of ISO 27001 (clause 9.2), so at least one audit cycle, covering all ISO 27001 requirements must be performed before going for a certification audit.

For further information, see:

• How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/

This material can also help you:

• ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
• ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/

2.  If so, must it cover every area or is it ok to audit some areas after certification audit?

For certification purposes, the internal audit must cover the whole ISMS scope before the certification audit.

ISO 9001 KPIs

Please consider our free webinar on demand - Measurement, analysis, and improvement according to ISO 9001:2015 -

 https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/ There you can find the rationale for developing KPIs both for processes and quality objectives.

The following material will provide you information about indicators:

• Analysis of measuring and monitoring requirements in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/analysis-of-measuring-and-monitoring-requirements-in-iso-90012015/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Differences between Opportunities and Objectives

Objective is a result to be achieved, while an opportunity is a situation, or set of circumstances, that makes it possible to do something.

For example, decrease information security incidents by 10% in the next quarter is an objective. Using the internal newsletter to raise awareness about preventing security incidents is an example of opportunity.

This article will provide you further explanation about information security objectives:

• ISO 27001 control objectives – Why are they important? https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/

Incident response training

Broadly speaking, you should consider the following trainings:

• training related to the incident management process adopted by your organization, or on which your own process is based to (e.g., based on ISO 27035, based on ITIL framework, based on ENISA good practices, etc.)
• training related to process and technologies your team hat to support to (e.g., Microsoft solutions, Linux solutions, Apple solutions)

The point is, there is no definitive answer, so you have to consider training on the methodology to manage incidents and in the technologies and process you will have to recover in case of an incident.

This article will provide you further explanation about managing incidents:

• How to handle incidents according to ISO 27001 A.16 https://advisera.com/27001academy/blog/2015/10/26/how-to-handle-incidents-according-to-iso-27001-a-16/

Toolkit content

The scope for the BCMS can be found in the Business Continuity Policy template, section 3.4, located on folder 08 Annex A >> A.17 Business Continuity >> 01 Business Continuity Policy.

Controls for Acceptable Use Policy and awareness

Thanks so much. Very revealing 

GDPR and the relation whit CCPA

CCPA and GDPR have a similar approach to data protection yet with different perspectives. While GDPR is focused on consent and information to the user, CCPA is focused on transparency and the consumer's right to opt-out. Most of GDPR rules make you compliant with CCPA.

First of all, you should check if you are a business under CCPA, also remember that it refers to California residing consumers. 

Businesses, under CCPA, require:

AS9100D, Section 8.4.1

Identifying and managing the risks of externally provided processes, products and services is really a function of the purchasing department, as they are the ones working with these providers to ensure that they deliver on time, give good products and services, meet the requirements, etc. In fact, your purchasing process likely already has this included in one way or another when purchasers are assessing which supplier to buy from. I would suggest this goes into your purchasing process, possibly as training for purchasers.

You can find out more on this procurement requirements in the article: Purchasing in QMS – The Process & the Information Needed to Make it Work, https://advisera.com/9001academy/blog/2014/03/18/purchasing-qms-process-information-needed-make-work/

Employment matter

According to the article 15 GDPR you have the right to access your personal data processed by the data controller. Therefore, if you had a wage increase you should have access to those data referring to you.Consider that if the wage increase is due to renegotiation of the service agreement between the local authority and your agency, data may not directly refer to you and it may be outside the GDPR, such agreement may be also under a confidentiality clause. You could send an access request to your data under article 15 GDPR demanding a reason in case of denial of access (article 23 GDPR has some restriction to data subjects rights) and check with your local labor lawyer or worker's Union representative what right of access to company registers workers have in your country. 

You can also find here some information about how employers deal with employees data under GDPRHow the GDPR could impact your HR department: https://advisera.com/eugdpracademy/blog/2018/02/22/how-the-gdpr-could-impact-your-hr-department/

If you want to know more about EU GDPR you can also take our free Foundation course

EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

ISO 9001 Certification before or after breakeven point

Implementing a quality management system according to ISO 9001 has in itself several benefits. Please check this article - Six Key Benefits of ISO 9001 Implementation - https://advisera.com/9001academy/knowledgebase/six-key-benefits-of-iso-9001-implementation/ Certification is the next step.

What could be the benefits of certification? Can certification help your organization win new customers or enter new market segments? Can certification improve your image and credibility among customers or other relevant interested parties?

If the answer is yes, perhaps your organization can invest in a certification to be able to get a return from that move.

Please check this article about the main steps to implement a QMS according to ISO 9001:2015 requirements - Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/ - Step 3 is where you define the borders of the QMS

The following material will provide you information about implementation:

• Article -  ISO 9001: The importance of the process approach - https://advisera.com/9001academy/blog/2015/12/01/iso-9001-the-importance-of-the-process-approach/
• Free webinar on-demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
• Enroll for a free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/"