Search results

State of validation

We just yesterday have published new version of our Toolkit for ISO 13485:2016 where documentation for risk assesment is in accordance with the new ISO 14971:2019. 

On this link you can see the preview of documents in our toolkit ISO 13485 & MDR Integrated Documentation Toolkit. In this toolkit, risk assesment is prepared according to the ISO 14971:2019. You can check by yourself how does documents from risk assesment are adaot to ISO 14971:2019: https://advisera.com/13485academy/iso-13485-eu-mdr-documentation-toolkit/

 List of notified bodies that are that are in compliance with Medica device regulation (MDR 2017/745) are on the following link: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=34

You can send us questions for anything you do not understand and we will answer. Also you can schedule a phone call with our expert.

Article 12 (3) general data protection

I would like to inquire the reasons why a time extension is required so that I can have access to my information for 3 months. I requested to view my records as a matter of urgency and understood this would take a month. Now it will take until 17th May 2020. Thank you for your help

You should not wait for three months unless the data controller explained the reasons for such a time frame.

In fact, the GDPR in the preamble at paragraph 59 states that: "The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests."

The regulation requires that the rights of access and/or erasure must be guaranteed "without undue delay", which means as soon as possible and at the least within one month.

You can find more information here:

Article 15 GDPR: https://advisera.com/eugdpracademy/gdpr/right-of-access-by-the-data-subject/

Everything you need to know about the GDPR Privacy Notice: https://advisera.com/articles/gdpr-privacy-notice-6-key-elements-to-include/

This course can also be of help:

EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

ISO 13485 planning related query

Yes, you can do this records now, but please implement also PQ (performance qualification).

For more detailes how to manage process validation in the medical device manufacturing industry, please read article in the following link: https://advisera.com/13485academy/blog/2017/09/07/using-iso-13485-to-manage-process-validation-in-the-medical-device-manufacturing-industry/

ISMS performance indicators

I am looking for some references to prepare a document where it will be used as a guide for managing performance indicators, but with an information security bias. They would be indicators for:
Availability: links, servers, services, etc ...
Confidentiality: Theft, Fraud, etc ...
Integrity: Bkp, viruses, etc ...

If you have material that can support me in the creation of this standard, thank you, also if you have more practical examples of these indicators it helps a lot.

To build information security indicators I suggest you to see these materials:

• Key performance indicators for an ISO 27001 ISMS https://advisera.com/27001academy/blog/2016/02/01/key-performance-indicators-for-an-iso-27001-isms/
• Measurement Report https://advisera.com/27001academy/documentation/measurement-report/

These articles will also help you:

• How to perform monitoring and measurement in ISO 27001 https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
• ISO 27001 control objectives – Why are they important? https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/

Business Continuity Plan for ISO 27001

ISO 27001 aspects on business continuity process (section A.17 from ISO 27001 Annex A) are related to ensuring the availability of information and information systems during either crisis or disaster situations, so a full Business Continuity Plan is not mandatory for this standard, and you will only need the DRP template included in your toolkit.

This article will provide you a further explanation about DRP and BCP:

• Disaster recovery vs Business continuity https://advisera.com/27001academy/blog/2010/11/04/disaster-recovery-vs-business-continuity/

Becoming an ISO 27001 auditor

If your purpose is to perform internal audits in your company, or audits in other organizations on behalf of your company, then the ISO 27001 Lead Auditor certificate is enough. On the other hand, if your purpose is to perform certification audits, the ISO 27001 Lead Auditor certificate is only one of the mandatory elements you need to be qualified as a certification auditor.

These articles will provide you a further explanation about lead auditor:

• What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
• How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/

ISMS and SaaS solutions

1. How shall I deal with SaaS solutions such as Office365 and Gitlab.com when it comes to controls related to backups and business continuity. I don't think it is feasible to build an on-premise DR site for such a solution.

ISO 27001 controls identified as applicable to a SaaS provider must be handled by means of contractual clauses in your service agreement with the provider, where you establish that such controls must be implemented by the provider. If you are a small user of such SaaS service, then instead of service agreement you will agree with their terms and conditions which should state which kind of backup they are using.

Normally SaaS providers have multiple sites and they implement backups and business continuity by mirroring data and operation on these sites (of course, you have to verify which solutions your provider can offer).

A simple way of backing up smaller amounts of data is to save them on local computers - this is feasible for e.g. MS Office documents produced on individual PCs.

For more information, see:

• 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
• Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/

2. Also, do we have to keep a backup of our emails or does it depend on the risk assessment and whether we accept such risk?

If you had accepted the risks for which backup of your e-mails would be the treatment, then you do not need to implement the backup.

Please note that backup is a control, and considering ISO 27001, you need first perform risk assessment, which helps you identify which risks need treatment, before deciding if you are going to implement a control or not.

For more information, see:

• The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/

EU GDPR Data

First of all, you must consider that GDPR is a regulation technology-neutral, which means that all obligations apply to any data processing no matter what technology you decide to use. Regarding the topic you asked, I will split my answers.

Usage, Collection, Processing, and Storage of CCTV Data  

CCTV is mostly ruled by Member States legislation, so you need to verify the internal requirement in order to comply with it. Many Member States require to avoid workers’ video surveillance, to explicit the security reasons to adopt CCTV and to not shot the public path unless authorized by public authorities. 

You must ensure that monitor displaying the images of CCTV are not accessible and viewed only by authorized staff, that data retention periods are clearly established with automatic cancellation of previous videos.

Collection, Processing, and Storage of Biometric Data

Biometric Data are considered a special category of data under article 9 GDPR (the so-called sensitive data), like health, sex, ethnics, politics or religious orientation, because they can constitute a threat to freedom of individuals. Therefore, some additional precautions are required.

Article 9 GDPR requires consent of individuals as a legal ground to process biometric data along with the other cases listed in letters from "b" to "j" in article 9 GDPR. GDPR also explains that “Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.”

 A Data Protection Impact Assessment (DPIA) and a Data Protection Officer (DPO) are required if biometric data are processed on a large scale.

You should make sure you determine 

• the purposes of biometric data processing (why you are collecting those data)

• the legal ground (consent or other cases listed in article 9 GDPR)

• data retention policy

• DPIA in order to identify the risks the processing presents to data subjects and implementing measures tailored to mitigate those risks.

• Hiring a DPO

• Check for additional requirements from the Member States.

Here you can find some information: 

Article 9 GDPR: https://advisera.com/eugdpracademy/gdpr/processing-of-special-categories-of-personal-data/

5 phases of the EU GDPR Data Protection Impact Assessment: https://advisera.com/eugdpracademy/knowledgebase/5-phases-of-the-eu-gdpr-data-protection-impact-assessment/

The role of the DPO in light of the General Data Protection Regulation: https://advisera.com/eugdpracademy/knowledgebase/the-role-of-the-dpo-in-light-of-the-general-data-protection-regulation/

How to hire the right DPO:

https://advisera.com/eugdpracademy/blog/2018/08/27/how-to-hire-the-right-dpo/

Checklist of Mandatory Documentation Required by EU GDPR:

https://info.advisera.com/eugdpracademy/free-download/checklist-of-mandatory-documentation-required-by-eu-gdpr/

This course can also be of help:

EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

Template content - DRP

These are examples to consider for these fields:

• Minimum required capacity: 50% of users will have full access to the service right after plan activation; 30% of normal Internet bandwidth will be available right after plan activation.
• Restoration period: Normal operations must be resumed 48 hours after the plan was activated.

This article will provide you a further explanation about elaborating a DRP:

• Business continuity plan: How to structure it according to ISO 22301 https://advisera.com/27001academy/knowledgebase/business-continuity-plan-how-to-structure-it-according-to-iso-22301/

ISO 9001 and hospitality

ISO 9001:2015 clause 9.3.2 is very detailed about preparing the inputs for a management review. We do not have any hospitality example to give you, but you can follow ISO 9001:2015. For example, a hospitality organization in Europe or Asia may be considering in its context analysis the impact and consequences of the coronavirus situation on the tourism industry. For example, a hospitality organization can use customer ratings from travel metasearch engine for lodging reservations as inputs about customer satisfaction and opportunities for improvement.

You can find more information about management review in the following links:

- How to make Management Review more useful in the QMS - https://advisera.com/9001academy/blog/2014/01/21/make-management-review-useful-qms/
- How to Make Management Review More Practical - https://advisera.com/9001academy/blog/2013/12/10/make-management-review-practical/
- Free webinar – How to perform management review according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/how-to-perform-management-review-according-to-iso-9001-2015-free-webinar-on-demand/
- ISO 9001 document template: Procedure for Management Review - https://advisera.com/9001academy/documentation/procedure-management-review/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/