Search results

Performance Evaluation

The most common way is to define process KPI in Turtle diagram. Also, you can use some strategy approach as Balanced Scorecard. 

In the document where you have defined process, also, you can set KPI for each of them.

For each process, you can set the quality objective and KPI should be aligned with it.

For more information, please read our article: „How to write IATF 16949 Quality objectives“ https://advisera.com/16949academy/knowledgebase/how-to-write-iatf-16949-quality-objectives/

GDPR and impact assessment on data protection

So we have this software where people make recommendation for friends to buy goods, and in the process of buying with credit card's etc customer information is disclosed. how can we make sure people don't use those info; to hack or etc other customers?

If credit card data is processed you need to ensure that you are PCI compliant or that you use a third party that it is PCI compliant.

Regarding the use of other personal data besides credit card data, you need to follow the GDPR principles and apply adequate security measures as per art. 32.

In summary: like how do we protect customer data when a project went live.?

Another thing you need to consider is having adequate Terms and Conditions so the users have a clear view of what they can do and what is forbidden.

I would advise you to perform a Data Protection Impact Assessment before going live.

You can find out more about Data Protection Impact Assessment from thus fee webinar Seven steps of Data Protection Impact Assessment (DPIA) according to EU GDPR: https://advisera.com/eugdpracademy/webinar/seven-steps-of-data-protection-impact-assessment-dpia-according-to-eu-gdpr-free-webinar-on-demand/

SOA Documentation

Here are the answers:

Do we have to prepare the Documentation for each and every Control mentioned in SOA or prepare only mandatory Documents (the Ones mentioned in the List of Docs attached)? Since ISO does not says to document each and every Control.

Answer: As you mentioned, ISO 27001 does not require you to create a document for each control. You should prepare only the documents that are mandatory (e.g. Access control policy) + the documents that you think will be useful for you (for example, you might decide that BYOD Policy will be useful because lots of your employees are bringing their own devices). Bear in mind that if you declared a control as not applicable in your Statement of Applicability, then you do not have to write any document for it (even if it is marked as mandatory). 

See also this article: 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/

If need to prepare only mandatory Docs, then will other docs also be checked during the Stage 1 Audit of ISO 27001.

Answer: The certification auditor will check all the ISMS documents you have written, it does not matter if they are mandatory or not. 

See also: What to expect at the ISO certification audit: What the auditor can and cannot do https://info.advisera.com/free-download/what-to-expect-at-the-iso-certification-audit 

While preparing SOA, can we only prepare the Docs which are relevant to the Organization and exclude the ones which are not organization relevant?

Answer: As mentioned in the first answer, you need to write the documents that are mandatory + those that you consider useful for your company. You should exclude the documents that you did not find useful, but also the documents that are related to controls that you declared as not applicable in your Statement of Applicability. 

Backup continuous policy

You can find a more detailed explanation here: Backup policy – How to determine backup frequency https://advisera.com/27001academy/blog/2013/05/07/backup-policy-how-to-determine-backup-frequency/

Here you can find a template for the Backup Policy, you can also see a free preview: https://advisera.com/27001academy/documentation/backup-policy/ 

These materials will also help you regarding backup:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/

15.2.2 managing changes to supplier services

It is difficult to provide an advice without knowing what exactly was your nonconformity - in general, when you make changes to the existing contracts with your suppliers you need to take into account the results of risk assessment, and how critical is the data they have access to. 

See also these articles:

• 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/ 
• Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/

If you can provide more details on your nonconformity, I can give you a more precise guideline. 

QMS benefit

Let me first recommend two articles about the benefits for organizations: 

• Benefits of ISO 9001 implementation for small businesses - https://advisera.com/9001academy/blog/2018/09/17/benefits-of-iso-9001-implementation-for-small-businesses/ 
• Six Key Benefits of ISO 9001 Implementation - https://advisera.com/9001academy/knowledgebase/six-key-benefits-of-iso-9001-implementation/

A well designed and implemented QMS reduces firefighting and promotes a culture of making decisions based on facts. Organizing the different processes of an organization reduces variability by defining internal best practices to be followed by each employee/function.

The following material will provide you information about implementing a QMS:

• - Free webinar on demand - Overview of ISO 9001 implementation steps  - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/ 
• - Free course - ISO 9001:2015 Foundations Course: https://advisera.com/training/iso-9001-foundations-course/ 
• - Free online training ISO 9001:2015 Internal Auditor Course –https://advisera.com/training/iso-9001-internal-auditor-course/  
• - Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
   

Inventory management process

I'm sorry, but in order to answer your question, could you please explain what do you mean by "opportunity audit", and "inventory management model"? Such phrases are not used in ISO standards. 

Mandatory financial & HR documents

Let us focus our attention on the mandatory documents required by ISO 9001:2015. Please check this article, “List of mandatory documents required by ISO 9001:2015” - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ - there are no requirements about financial documents and the only mandatory documents about Human Resources are about “Records of training, skills, experience and qualifications (clause 7.2)”
 

The following material will provide you information about implementing a quality management system:

- Free webinar on demand – Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
- ISO 9001 Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/
- ISO 9001 Implementation diagram - https://info.advisera.com/9001academy/free-download/iso-9001-implementation-diagram
- ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book - Discover ISO 9001:2015 - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Subsequent provision of products and services

Clause 8.3.2 is about design and development planning. It includes both the project phase and the after the project phase, the after the successful verification and validation. 

After the project comes the provision of products and services: What raw materials to use? What drawings to follow? What equipment to use? What process control plan? What specifications to use? What acceptance criteria to use? What quality control plan to use? What packaging to use? What post delivery service to provide?

Clause 8.3.2 h) is about preparing 8.5.1 – including both downstream processes and post-delivery services.

The following material will provide you information about Design and development:

- ISO 9001 – The ISO 9001 Design Process Explained - https://advisera.com/9001academy/blog/2013/11/05/iso-9001-design-process-explained/
- ISO 9001 - Understanding Product & Service Provision in ISO 9001 - https://advisera.com/9001academy/blog/2014/10/07/understanding-product-service-provision-iso-9001/
Book – Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- free online training ISO 9001:2015 Internal Auditor Course - –https://advisera.com/training/iso-9001-internal-auditor-course/  

Supplier Policy for Suppliers and Partners

First is important to note that, for a more productive audit, besides the Supplier Security Policy, you also should use an audit checklist, and for that, you have an audit checklist included in your toolkit (on folder 10 Internal Audit).

Considering that, if you do not have any legal obligation (e.g., laws or contracts), or risks, demanding specific cloud controls to be implemented by your cloud suppliers, then the internal audit checklist included in your toolkit will be sufficient.