Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Combination of ISMS and BCMS

    Considering ISO 27001 and ISO 22301, which have a lot of requirements in common, it is perfectly possible to go for the simultaneous implementation of the ISMS and BCMA. In fact, this can bring many benefits, like decreased costs in implementation and internal audits, but first, you have to consider the organization's situation in terms of available resources, knowledge, and personnel.

    This article will provide you further explanation about integrated implementation:
    - How to implement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/

    This material will provide further information:
    - Free webinar – ISO 27001 & ISO 22301: Why is it better to implement them together? https://advisera.com/27001academy/webinar/iso-27001iso-22301-certification-process-free-webinar-demand/

    Regarding step by step guidelines to implement both systems, in a general manner, you have these steps:
    - Obtain management support
    - Develop a project plan
    - Define scope (related to each standard)
    - Define top-level policies (related to each standard)
    - Define basic management system procedures (common to both standard)
    - Develop specific policies and procedures (related to each standard)
    - Implement policies and procedures and train personnel
    - Perform internal audit
    - Perform management review
    - Proceed with corrective actions

    The following articles will provide you explanation of the steps to implement both standards:
    - ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
    - 17 steps for implementing ISO 22301 https://advisera.com/27001academy/knowledgebase/17-steps-for-implementing-iso-22301/22301/iso-22301/

  • Context document

    ISO 22301 and ISO 27001 do not require you to write a document for context of the organization, this is why we didn't include such document in the toolkit - most of our clients are smaller companies, and they appreciate if they can avoid an overhead. 

    However, you will collect all the crucial information for the context of your organization by filling out the following documents that are included in the toolkit:

    • "List of legal, regulatory, contractual and other requirements" (you'll find it in the folder "Identification of requirements") -you will get all external issues important for the context of your organization. 
    • "Risk assessment table" (you'll find it in the folder "Risk assessment and treatment" - you'll get all internal issues important for the context of your organization

    This article can also help you (it is also relevant for ISO 22301): How to define context of the organization according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/

  • ISO 27001 and ISO 27799

    Yes, it is possible to comply with ISO 27799 using ISO 27001 as a "basic" standard, however you will need to introduce some extra documents/activities that do not exist in ISO 27001. 

    There articles will help you:

  • Business impact analysis

    I assume you're asking this question in the context of ISO 22301, the business continuity standard. 

    Both risk assessment and business impact analysis are mandatory according to ISO 22301, however they do not depend on each other - in practice, they are independent analysis.  

    These articles will help you with details: 

  • Data subject & DSAR

    Note that the controller is entitled to identify the data subject (requestor) and thus, he/she can ask for additional information to be able to validate the identity of the data subject.

  • EU GDPR Policies and procedures

    What is mandatory to have public are the Privacy Notices that need to be available to the regarding data subjects. Regarding making available the Policies and procedures to other companies my view is that only you should comply only when the requestor acts as a data controller.

  • SPC

    When you are doing GR&R analysis you are taking the same sample/same lot for every operator or machine you are testing for.

  • Data gathering for kindergartens and schools parties

    1. Are there any specific things that I need to include in the contract?

    Yes, as long as you are processing personal data you should have some specific wording in the contract to cover the part where you are processing personal data. Usually, this is a separate addendum to the commercial contract called a Data Processing Agreement

    2. According to the GDPR what is my company a controller or a processor?

    Based on your description you seem to be acting as a data processor as you do not determine the means and purposes of the processing but rather the entities that contract you. If you want to find out more about controllers and processors check out this article EU GDPR controller vs. processor – What are the differences? (https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/)

    3. Do I need to register somewhere if I process personal data?

    The registration to local Supervisory Authorities is not required under the GDPR however, this can be regulated by local legislation. I would advise you to check the website of the Supervisory Authority where your company is registered.

    4. Are there any specific requirements for handling data of children?

    There are some specifics that involve the permission of the parents or legal guardians. However, since you are acting as a processor as long as you process the data on the instructions of the controllers you should not be concerned.

    5. During the events sometimes my crew takes pictures and posts it on social media. Are there any restrictions?

    I would advise blurring the faces of the children when posting pictures on social media. Alternatively, you could obtain consent from the parents of the children in the photo.

    6. How much time do I need to keep the lists whit the children`s names and age?

    I would delete the data right after using it during the show. You do not need it afterwards and keeping it would expose you to unnecessary risks.
     

    If you want to find out more about the EU GDPR check out this EU GDPR Foundation Course (https://advisera.com/training/eu-gdpr-foundations-course//)

  • Getting ISO 13485

    If I have understand it correctly, you are supplier of critical parts to other medical device companies. Therefore, there is no strict regulation that you need to be certified according to the ISO 13485:2016, and from quality management system perspective norm for a manufacturer can be ISO 9001.

    Can you explain what you meant by „with an emphasis on ISO 13485“?

    However, I would like to point out the following. According to the ISO 13485:2016 in requirement 4.1 is stated that when the organization chooses to outsource any process that affects product conformity to requirements, it shall monitor and ensure control over such processes. Then, in requirement 4.1.6 is stated that organization that subcontracts the activity remains responsible for it.  

    With MDR, from May 2020, the notified bodies will take more attention to critical suppliers and there is a possibility that notified bodies will audit certain critical suppliers, according to their risk assessment.  Therefore, you must be prepared that there is a chance that the notified bodie will audit your manufacturing process as part of the medical device manufacturer's audit.

  • External documents

    External documents are any documents not owned or controlled by an organization that are required to its operation, either mandatory or voluntarily adopted. Examples of external documents to be controlled are Laws (e.g., SOX and EU GDPR), standards and regulations (e.g., the ISO 27001 itself), and documents and records from customers, suppliers, and partners (e.g., contracts, service agreements, product/service specification, operation manuals, etc.)

    These materials will also help you regarding control of documents:
    - Free video tutorial that you received as part of your toolkit: How to Write ISO 27001/ISO 22301 Document Control Procedure
Page 471 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +