Search results

Home / Search

Category:
Select
Select

11272 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Segregation of duties

    1. Regarding Segregation of duties I believe some jobs can’t be combined (like the SO can’t be the DPO?)

    I'm assuming that by SO you mean Security Officer. Considering that, and ISO 27001 and EU GDPR, there are no requirements in these references preventing a single person to be both SO and DPO. Of course, you should also consider other laws, regulations or contracts you have to comply with to define if these jobs can be performed by a single person.

    GDPR requires an independent DPO who needs to relate with the data controller, data subjects and surveillance authorities.
    For larger companies it is a good practice to have these two positions separated; for smaller companies, this is not feasible.  

    GDPR requires also to have a close look at dimensions of the company so that in SMEs if the circumstances do not create risk of conflicts Security Officer and DPO can be the same person. Of course, the reasons for such choices and policies to avoid conflicts must be set in order to comply with the accountability principle.  

    2. Are there specific combinations that are not done? We have these roles in the company? To divide under 4 people:
    Security officer (is also Risk manager & Authorization officer)
    Internal auditor (external consultant)
    Service manager (is also Change manager & Incident manager)
    Security tester (outsourced)
    Compliance officer
    Solutions Director
    DPO

    The most common criteria to be considered for segregation of duties of critical activities are:

    • the person who elaborates something does not approve it
    • the person how performs a task does not review it

    Considering that, for example, the internal auditor/security tester should not be the same person as the service manager. The service manager defines and handles changes/incidents, while internal auditor/security tester verifies if these are effective. So, you should verify exactly which activities will be performed by each role to identify potential conflicts of interest.

    For further information, see:

    3. Do you also have standard lists of the Responsibilities & Requirements of these roles?

    ISO 27001 does not prescribe the security officer role, only that relevant information security responsibilities are defined and designated.

    Articles 37 to 39 GDPR describe the designation, the position and the tasks of DPO according to the GDPR. Article 39 GDPR lists the tasks of DPO stating that DPO shall ensure:

    • to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions
    • to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits
    • to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35
    • to cooperate with the supervisory authority
    • to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter

    These articles will provide you further explanation about responsibilities for information security:

    You can also find some useful information on our free training online course The role of DPO according to GDPR: https://advisera.com/eugdpracademy/webinar/role-of-the-dpo-according-to-eu-gdpr-free-webinar-on-demand/ 

  • Overlapping between ISO 27001 and ISO 9001

    Since 2012 all ISO management systems have a similar framework, so integrating them is a lot easier today.

    You can find a comparison between ISO 27001 and ISO 9001 in this material:

    The matrix shows relationships between clauses of ISO 27001 and ISO 9001 and gives an overview of common requirements of these two standards with tips on how to fulfill them with as little documentation as possible.

    Regarding which one adds more value, ISO 9001 or SOC2, you have to evaluate which objective your organization wants to achieve, legal requirements (e.g., laws, regulations, and contracts) you must comply with, and which framework will bring them more clients.

    This article will provide you further explanation about integrating management systems:

  • Environmental report

    I want to know how to conduct and compile a report on environmental, design, structural and amenities deficiency

  • Internal auditor qualification

    Assessor qualification for CQI-9 Heat Treatment process audit are;

  • Be an experinced quality management system internal auditor (IATF 16949:2016 and ISO 9001:2015)
  • Assessor shall have a heat treatment process knowledge. Minimum 5 years experince' in heat treatment or combination of normal metallurgical education and heat treating experince totalling a minmum 5 years.
  • Assessor shall have a process knowledge and be famillar of automotivge core tools including APQP,PPAP,FMEA,SPC,MSA 

Fore more information, please read the following article

  • Requirements of competence of IATF 16949:2016 internal auditors https://advisera.com/16949academy/blog/2017/10/19/requirements-for-competence-of-iatf-16949-internal-auditors/

  • ISO 9001 procedures for forwarding and organizational context

    I want to ask about what procedures that i need for forwarding (logistic and transportation) should fill for the certification?

    Answer:

    ISO 9001:2015 does not require any procedure as mandatory. Please check clause 4.4.2, it is up to each organization to decide what procedures are needed based on complexity and competence of people, for example. 

    and how about the organizational context?

    Answer:

    Again it is not mandatory. I, as a consultant recommend developing a procedure for the context, interested parties and risk.

    You can find more information about mandatory documents below:

    - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
    - Remember, procedures and processes are not the same thing - ISO 9001:2015 process vs. procedure – Some practical examples - https://advisera.com/9001academy/blog/2016/01/19/iso-90012015-process-vs-procedure-some-practical-examples/
    - How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
    - Free on-line training – ISO 9001:2015 Foundations: https://advisera.com/training/iso-9001-foundations-course/
    - Book - Managing ISO Documentation: A Plain English Guide - https://advisera.com/books/managing-iso-documentation-plain-english-guide/
     

  • ISO/IEC 27001:2013 ISMS Document Implementation

    I need to write up a draft an ISMS document that meets the ISO 27001 requirement for an SME. Could someone please guide me on where I can find a template of one? Otherwise, can someone provide the headings that I should include in the document, please.

  • ISO 45001 procedures

    There are many procedures within the ISO 45001 OHSMS, and although the ISO 45001 standard gives requirements of what needs to be included, each company or organization needs to tailor the procedures they create to their unique situation. The ISO 45001 standard give descriptive requirements of what needs to be included in processes, but not prescriptive requirements that tell you how you must apply the requirements or write procedures as these differ from company to company and country to country.

    You can find out more about the required documentation of ISO 45001, including explanation of each, in the whitepaper: Checklist of Mandatory Documentation Required by ISO 45001, https://info.advisera.com/45001academy/free-download/checklist-of-mandatory-documentation-required-by-iso-45001

  • ISO 9001 implementation time

    2 people with 50 hours each is the same as saying 2 people full time on the project. There are several variables to consider in determining the duration of an implementation project. Please test our – ISO 9001 Implementation Duration Calculator - https://advisera.com/9001academy/iso-9001-duration-calculator/

    As a rule of thumb consider that small organizations up to 50 employees could implement ISO 9001:2015 in 6-8 months.

    You can find more information about ISO 9001 implementation below:

    - How long does it take to implement an ISO 9001-based QMS? - https://advisera.com/9001academy/blog/2016/07/05/how-long-does-it-take-to-implement-an-iso-9001-based-qms/
    - Free webinar on demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
    - Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
    - Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
     

  • Assets of Threats Diagram

    If I understood correctly, you want a diagram to show the relationship between assets and threats.

    Considering that, first is important to note that for certification purposes ISO 27001 does not require such a diagram. By including it in the toolkit, it would only make it unnecessarily complex.

    If you need this diagram for other purposes, you can find an example on how to build such a diagram in this link: https://info.advisera.com/27001academy/free-download/diagram-of-iso-270012013-risk-assessment-and-treatment-process

    This diagram shows the ISO 27001 Risk Assessment and Treatment process, considering an asset – threat – vulnerability approach.

  • Risk treatment plan

    Good evening, I am drafting a security plan for the information assurance of an institution's computer platform. I would like to know the correct way to generate the necessary studies and the reports of recommendation and applicability for the respective assurance.

    I'm assuming you are elaborating a risk treatment plan. Considering ISO 27001, the process to create a risk treatment plan is:

    • develop a risk assessment and risk treatment methodology
    •  perform risk assessment
    • perform risk treatment
    • develop the risk assessment and risk treatment report
    • develop the statement of applicability
    • develop the risk treatment plan

    These articles will provide you further explanation about Risk assessment and treatment:

    To see how documents used in a risk assessment and risk treatment process look like, I suggest you take a look at the free demo of our ISO 27001/ISO 22301 Risk Assessment Toolkit at this link: https://advisera.com/27001academy/iso-27001-22301-risk-assessment-toolkit/

    These materials will also help you regarding Risk assessment and treatment:
    • Page 434-vs-13485 of 1128 pages

    Didn’t find an answer?

    Start a new topic and get direct answers from the Expert Advice Community.

    CREATE NEW TOPIC +