Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Risk assessment and treatment plan

    1 - Am I right in saying that the severity is based on the worst-case scenario that could occur based on the threat? For example, the threat that antivirus is not installed on a laptop. The worst-case scenario is someone gets our cloud admin permissions. However, this has never happened before as we do have antivirus in place just not the documented procedures. So it has the severity of the highest and occurrence of low. Due to the nature of our business, we want to have documented controls and mitigation in place for all our threats.

    Answer: Your understanding is partially correct. While you do need to consider the worst-case scenario for the impact, in most cases any existing controls will reduce the likelihood.

    For additional information, see:
    - How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment

     2 - This leads me to the treatment plan. We will put in place controls to treat this threat which I gave as an example. We will recalculate the risk evaluation after mitigation. Am I correct in saying that the severity and occurrence will not change in this case? Am I correct in saying the severity of the risk will never change just the likelihood of occurrence? Thank you

    Answer: Please note that in the case you mentioned you already have a mitigation implemented (i.e., antivirus in place), and you only have to evaluate if by documenting the antivirus procedures the likelihood will change (clear available procedures reduce risk of antivirus misconfiguration).

    Additionally, antivirus is a preventive control, and this kind of control indeed only affects the likelihood of occurrence, not risk consequence.

    An example where a control will also reduce the impact is a fire suppression system. It will reduce both the likelihood (it will prevent most of the fires) and the impact (if the fire goes out, it will be put out much sooner), but please note that these cases where a single control affects both likelihood and impact are rare.

  • Intellectual Property Rights

    Your understanding is correct. The protection of Intellectual Property Rights must be applied not only to property rights of your own organization, but the rights of all interested parties included in the ISMS.

    While for your own organization some implementation examples would be by means of legal clauses in contracts you have with others, and registering patents, the protection of third parties would also consider controls to avoid unauthorized use of patents, and software licenses of other parties.

  • Laws and regulations

    The list in the article you've mentioned cover laws and regulations related to information security and business continuity, but does not cover all countries nor is fully up-to-date because it depends on voluntary contributions from our readers. To make sure you have the latest list of laws and regulations related to these issues,  it would be best to hire a local legal adviser.

  • Exteranl standards for calibration lab equipment

    Regarding minimum requirements for external laboratory in IATF 16949, the organization shall have a defined laboratory scope that includes the capability to perform the required inspection, test, or calibration, by clause 7.1.5.3.2

    Also, external laboratories have to be accredited to ISO/IEC 17025 or national equivalent.

    Please consider reading our article “What is ISO 17025”: https://advisera.com/17025academy/what-is-iso-17025/

    Also, have in mind that calibration services may be performed by the equipment manufacturer when a qualified laboratory is not available for a given piece of equipment.

    In our IATF 16494 Toolkit, you can find documentation in folder 16.Equipment: https://advisera.com/16949academy/iatf-16949-2016-documentation-toolkit/

  • Environmental Management System Representative vs Internal Auditor

    Yes.

    Please check ISO 9000:2015 definition of auditor. As long as the EMS Representative has the required competence and skills, he or she can be the Internal Auditor. Previous versions of ISO 9000 required auditors to be independent. 

    More information about here:

    - What competences should an ISO 14001 internal auditor have? - https://advisera.com/14001academy/blog/2016/07/04/what-competences-should-an-iso-14001-internal-auditor-have/
    - Enroll for free in ISO 14001:2015 Internal Auditor Course - https://advisera.com/training/iso-14001-internal-auditor-course/
    - Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
    - Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

  • ISO 9001 & IATF 16949 management review meetings

    I have no experience of working with IATF 16949 but I have experience of management review meetings for integrated quality and environmental management systems. I recommend you put side by side clause 9.3 of both standards. For example, with a yellow color highlight topics that are specific of ISO 9001, with a green color highlight topics that are specific of IATF 16949, with an orange color highlight topics that are common to both standards. Now, considering your particular organization, draw a logical path to treat each topic from each of the above groups in one or more meetings. When one meeting alone is impossible or ineffective, I recommend one meeting to look into the past performance, context and risks, and another to look into the future and determine objectives and make decisions.

    You can find more information about management review in the following links:

    - How to make Management Review more useful in the QMS - https://advisera.com/9001academy/blog/2014/01/21/make-management-review-useful-qms/
    - How to Make Management Review More Practical - https://advisera.com/9001academy/blog/2013/12/10/make-management-review-practical/
    - Free webinar – How to perform management review according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/how-to-perform-management-review-according-to-iso-9001-2015-free-webinar-on-demand/
    - ISO 9001 document template: Procedure for Management Review - https://advisera.com/9001academy/documentation/procedure-management-review/
    - Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
    - Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
     

  • ISO 45001 and calibration of equipment

    In clause 9.1.1 when ISO 45001 discusses the general requirements for monitoring, measurement, analysis and performance evaluation, they make the statement that “the organization shall ensure that monitoring and measurement equipment is calibrated or verified as applicable, and is used and maintained as appropriate.”. This has to do with all measuring equipment for the determined OH&S monitoring and measurement.

    For more information on monitoring and measurement in the OHSMS, see that article: How monitoring, measuring, evaluation, and analysis in DIS/ISO 45001 works, https://advisera.com/45001academy/blog/2016/03/09/how-monitoring-measuring-evaluation-and-analysis-in-disiso-45001-works/

  • Determining priority

    It's SLA that defines priority. But,it's not always the case that users (meaning end-users of the service) are aware of the SLA content. So, they should determnine priority while opening an incident and Service Desk should correct it (according to SLA), if needed.

    Here are some more details about prioritization: All about Incident Classification https://advisera.com/20000academy/knowledgebase/incident-classification/

  • Quality Manger and Head of Department

    To answer your question, let’s look at what ISO 17025 requires and the intent behind the requirement. A laboratory needs to actively identify and act on opportunities for improvement in order to increase the effectiveness of the management system, its activities, service to customers and the consistent validity of results. The drive for improvement should be integrated with existing management system activities such as trend analysis of primary quality indicators to support policies, internal and external quality control; as well as the review of processes, customer satisfaction, internal audit results, documents and records, corrective actions and risk assessments.

    To address the need for improvement effectively, a laboratory should

    1. Establish measurable quality objectives (targets)  which are aligned to the strategic direction and policies of the laboratory or organisation. Examples are a) to achieve a 90% percentage customer satisfaction based on the annual survey (minimum 60% response required) and b) to achieve a turnaround time (time from sample submission to reporting) of not more than 3 days, 90% of the time.
    2. Monitor activities that support the strategic direction, policies and quality objectives of the laboratory. Examples are Proficiency testing performance over time; changes in customer satisfaction.
    3. Create a mechanism to identify opportunities for improvement, for example by applying the PDCA (Plan-Do-Check-Act) Cycle for each activity 
    4. Use an Registry of Key Risks and Opportunities to: 
       a) list proposed opportunities for improvement
       b) perform and record a risk-to-benefit measurement (matrix) to determine the best or most suitable opportunities
           to act on
       c) choose appropriate actions to be taken, and review the progress.

    The following articles will provide more guidance:

    The relevant ISO 17025 document templates and their related documents are available stand-alone, or part of the toolkit :

  • ISO 13485 & EU MDR Integrated Documentation Toolkit

    In my opinion, our ISO 13485 & EU MDR Integrated Documentation Toolkit is beneficial when compared to CEN/TR 17223 because in it we have already prepared procedures and templates for all documented requirements from the MDR 2017/745. We have focused on the general obligations of the manufacturer (Article 10) and the conformity assessment requirements (Annexes IX and XI), the same as in CEN/TR 17223. 

    For the preview on the toolkit, please use the following link: 

    ISO 13485 & MDR Integrated Documentation Toolkit https://advisera.com/13485academy/iso-13485-eu-mdr-documentation-toolkit/
Page 440 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +