Search results

Personal data definition

Personal data is defined by the GDPR as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

Assuming that by EMI you refer to “equated monthly installment” the EMI is not personal data as it is not unique to a specific person and the same EMI would be applicable to multiple borrowers.

If you want to find out more about personal data check out this EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//)

Inquiries on Transition to ISO 45001

1. We are currently in the process of assessing our documentation in preparation for our transition to ISO 45001 from OHSAS 18001. What other documentation do we need to produce?

If you are transitioning over from OHSAS 18001, much of the OHSMS is fully transferable, with only a few additions to the requirements such as consultation and participation of workers. As for documentation, there is not much additional documentation required by the new ISO standard.

For more on the documentation necessary or ISO 45001, see the whitepaper; Checklist of Mandatory Documentation Required by ISO 45001, https://info.advisera.com/45001academy/free-download/checklist-of-mandatory-documentation-required-by-iso-45001

2. Are Risk and Opportunity associated with OH&S the same with Hazard and Risk?

Risk and opportunity are not the same as OH&S hazards and risks. Risks and opportunities are considering he top level risks for the OHSMS, and are captured in clause 6.1.2.2 and 6.1.2.3, whereas, the OH&S hazards are in 6.1.2.1.

For more on the new risks and opportunities requirements, see the article; What are the new requirements for risks and opportunities according to ISO 45001?, https://advisera.com/45001academy/blog/2018/04/25/what-are-the-new-requirements-for-risks-and-opportunities-according-to-iso-45001/

Carrying out activities and specific training

Do the requirements in ISO 9001:2015 focus on how activities are carried out?

Answer:

No, ISO 9001:2015 has no requirements about “how activities are carried out”. ISO 9001:2015 only has requirements about the what not the how. For example, clause 8.2.2 a) 1) states that when determining the requirements for the products to be offered to customers, the

organization shall ensure that the requirements for the products are defined, including any applicable statutory and regulatory requirements. There is no clue about how to do it. The how is up to each organization to decide.

Does the training clause also include training about the specific process to enhance the competence of employees?

Answer:

That is not mandatory, according to ISO 9001:2015. However, if that process is complex, or has a track record of failures, perhaps your organization should consider including that kind of training. If you consider clause 7.2 content you will see that the point is acting to solve competency gaps.

The following material will provide you more information about training and competence:

- Article - How to ensure competence and awareness in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-ensure-competence-and-awareness-in-iso-90012015/
- Enroll for free - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Free webinar on demand – please check the relationship between processes and competencies - The Process Approach - What it is, why it is important, and how to do it - https://advisera.com/9001academy/webinar/iso-9001-process-approach-free-webinar-on-demand/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

How to Implement Information Classification in a Dept.

Since you already have an information classification procedure, you first should review the document to see if it:
Considering ISO 27001, to implement the operational steps of a document (e.g., policies and procedures), you need to:
- properly covers legal and contractual requirements your organization must fulfill(e.g., laws, regulations, contracts which demand information classification)
- properly covers the results of your risk assessment
- is optimized and aligned with your other document(s)

Once you ensure the document is properly structured and written, and approved, you should consider developing some examples and training material to explain to your employees why such a policy or procedure is necessary and how to classify information. As an example on how to explain this process, please see: Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/

For further information, please see:
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures//

This material will also help you regarding elaborating documents:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/

How to establish new ISMS Objectives

1. How should I proceed in this case? New ISMS objectives will depend upon which factors? How can I make new objectives?

The answer to these three questions is that you can use the same process and factors you used for the creation of the first ISMS objectives to create the new ones. Regarding factors to be considered, you can add factors that are now relevant, or exclude factors that are not relevant. Examples to be considered are:

Internal factors: you need to make sure that your information security objectives are aligned with the business strategy, perform the risk assessment, determine resources, information security roles, and responsibilities, capabilities, etc.
External issues: you simply need to identify interested parties and their requirements (interested parties can be employees, clients, suppliers, and partners, etc)

For further information, see:
- ISO 27001 control objectives – Why are they important? https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/
- Key performance indicators for an ISO 27001 ISMS https://advisera.com/27001academy/blog/2016/02/01/key-performance-indicators-for-an-iso-27001-isms/

2. What will happen to my objectives which have been completed?

You can exclude them from your current objectives if after a management review your organization defined there is no need to pursue them anymore.

3. Do I need to keep a record for them for management review in the future?

ISO 27001 requires the results of management review to be documented (e.g. the decision of which objectives were defined, and the achieved results), but is also a good practice to keep the history of previous objectives to be used as input for future organizational planning.

For further information, see:
- Records management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/11/24/records-management-in-iso-27001-and-iso-22301/

4. Do I need to make any implementation plan for the new objectives and how they will be achieved?

You have to procedure the same way you did for the first cycle of your ISMS, so you also need to define how objectives will be achieved.

Implementing EMS

Implementing an EMS for a CNC company is no different from a typical manufacturing enterprise.
I recommend starting with a Gap Analysis and then developing an implementation plan. Determining your significant environmental aspects is another important step. Implement your EMS, perform an internal audit and a management review before addressing the decision to go for certification.

The following material will provide you more information about implementing an EMS:
- ISO 14001:2015 Gap Analysis Tool - https://advisera.com/14001academy/iso-14001-gap-analysis-tool/
- Is a gap analysis desirable for ISO 14001 implementation? - https://advisera.com/14001academy/blog/2016/11/14/is-a-gap-analysis-desirable-for-iso-14001-implementation/
- List of ISO 14001 implementation steps - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/list-of-iso-14001-implementation-steps/
- 5 elements of a successful ISO 14001 project - https://advisera.com/14001academy/blog/2015/03/23/5-elements-of-a-successful-iso-14001-project/
- ISO 14001:2015 Implementation diagram - https://info.advisera.com/14001academy/free-download/iso-14001-2015-implementation-diagram
- How long does it take to implement ISO 14001:2015? - https://advisera.com/14001academy/blog/2016/04/04/how-long-does-it-take-to-implement-iso-140012015/
- Free webinar on demand - Free webinar - ISO 14001: Identification and evaluation of environmental aspects - https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
- Enroll for free in this course ISO 14001:2015 Lead Implementer Course - https://advisera.com/training/iso-14001-lead-implementer-course/
- Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

Technical File

Integrating the ISO 14001:2015 & ISO 45001:2018

BecauseISO 45001:2018 and ISO 14001:2015 both follow the Annex SL format, they aremuch easier to integrate than previous standards have been as they have many commonprocesses. Even though it also includes ISO 9001 the information is still everyuseful, so I would suggest reading our whitepaper; How to integrate ISO 9001,ISO 14001 and ISO 45001, https://info.advisera.com/9001academy/free-download/how-to-integrate-iso-9001-iso-14001-and-iso-45001

Calculating audit days

The main criteria are a number of employees and an audit complexity.

Without more detailed information we cannot provide a precise answer, but this document can give you a good insight if the defined day are fair considering your context:

IAF MD 5:2015 "Determination of Audit Time of Quality and Environmental Management Systems" https://www.iaf.nu/upFiles/IAFMD5QMSEMSAuditDurationIssue311062015.pdf

Although its title refers to QMS and EMS it also can be applied to estimate audit days for an ISMS certification audit.

Additionally, should consider asking for quotes from a couple of certification bodies, so that you can compare the numbers they offer.

This article will provide you further explanation about certification audit:
- Which questions will the ISO 27001 certification auditor ask? https://advisera.com/27001academy/blog/2015/07/20/which-questions-will-the-iso-27001-certification-auditor-ask/

Risk & Opportunity Management

Short and straight answer: No!

Let us support our answer. First go to clause 6.1.1 and note that the standard focuses attention only on the risks and opportunities that deserve to be addressed. So, your classification of risk severity low means that they don’t need to be addressed. ISO 9001:2015 does not mandates a register with all the risks and opportunities determined. Nevertheless, that is a good practice. Recording all risks and opportunities and acting only on those that you consider significant.

The following material will provide you information about the risk-based approach:

- ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Risk-based thinking replacing preventive action in ISO 9001:2015 – The benefits - https://advisera.com/9001academy/knowledgebase/risk-based-thinking-replacing-preventive-action-in-iso-90012015-the-benefits/
- ISO 9001:2015 Risk Management Toolkit - https://advisera.com/9001academy/iso-90012015-risk-management-toolkit/  
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/