Search results

ISO 13485 certification

It is not necessary for all employees to be educated for ISO 13485. There is no such requirement. However, there is a requirement 6.2 Human resources that all personnel performing work affecting product quality must have competencies or must be trained to achieve those competencies. For example, the person who does the programming alone must know the basics of ISO 13485 that are applicable. While, for example, a marketing person does not need to know the requirements of ISO 13485. QA person does need to be educated in ISO 13485:2016. 

Besides ISO 13485:2016, QA person must have knowledge of any other standard that is specifically for certain medical devices. For example, there is a medical software standard IEC 62304:2006 Medical device software — Software life cycle processes https://www.iso.org/standard/38421.html, so QA person must know which requirement from that standard is applicable or not. Also, any medical device that want to be CE marked must be in compliance with the Medical device regulation https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0745-20170505, regardless of the medical device classification.  

HR policy for personnel security

In terms of Human Resources a policy with such details as you stated is not mandatory by ISO 27001, and to keep the number of documents in the toolkit as small as possible we included in the toolkit only the mandatory documents and the most commonly used.

Considering that your organization needs this document for other reasons (normally an HR Security Policy is not recommendable for smaller companies regarding ISO 27001), you can schedule a meeting with one of our experts to help you develop this document (online live consultation is part of your toolkit). You can schedule a meeting at this link: https://advisera.com/27001academy/consultation/

These articles will provide you information about some topics you raised:
- What to consider in case of termination or change of employment according to ISO 27001 https://advisera.com/27001academy/blog/2018/09/03/what-to-consider-in-case-of-termination-or-change-of-employment-according-to-iso-27001/
- Segregation of duties in your ISMS according to ISO 27001 A.6.1.2 https://advisera.com/27001academy/blog/2016/11/21/segregation-of-duties-in-your-isms-according-to-iso-27001-a-6-1-2/
- What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures//

Internal audit

For ISO Management System standards the internal audit can be performed either by own organization's employees or by an external company on the organization's behalf.

Please note that this internal audit performed by an external organisation should not be mixed with certification audit, which is performed by a certification body.. 

This article will provide you further explanation about internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/

Penetration testing frequency

Neither ISO 27001 nor NIST controls define frequency for penetration testing, but a good start to define pen testing periodicity would be these criteria:
- results of previous penetration tests
- importance and related risks to the processes/systems that will be part of the penetration test's scope

This article will provide you further explanation about penetration tests:
- How to use penetration testing for ISO 27001 A.12.6.1 https://advisera.com/27001academy/blog/2016/01/18/how-to-use-penetration-testing-for-iso-27001-a-12-6-1/

Inventory of assets and Risk assessment

1. I am having trouble finding out how these two documents are connected (are both needed?) 11.A.8.1_Inventory_of_Assets_Integrated 07.1_Appendix_1_Risk_Assessment_Table_Integrated In inventory of assets.

The Risk assessment table is a mandatory document if you want to be certified against ISO 27001, while the inventory of assets is needed only if control A.8.1.1 (Inventory of assets) is considered applicable to your ISMS.

The relation between these documents is that all assets identified in the Risk assessment table must be copied to the Inventory of assets provided the control A.8.1.1 is considered applicable.

2. How do we know how to assess "Impact/Consequences"? What do we base that rating on?

The way to perform the assessment of impact is defined in the Risk Assessment and Risk Treatment Methodology, located on folder 10 Risk Assessment and Risk Treatment of your toolkit.

The assessment of Impact/Consequences is based on the impact of the loss of confidentiality, integrity or availability of information.

By the way, included with your toolkit you have access to a video tutorial that can guide you on how to fill in the Risk Assessment table, presenting examples with real data.

This article also can be interesting for you “How to assess consequences and likelihood in ISO 27001 risk analysis”: https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment

3. And how do we transfer that rating to the Risk Assessment table

Once you identify the impact/consequence level, which range is defined in the Risk Assessment and Risk Treatment Methodology, you must input this value in column G of the Risk assessment table.

You also can see how this is performed in the video tutorial mentioned in answer 2.

ISO 9001 exclusions

I am not sure I understand what your external auditor recommends.

ISO 9001:2015 does not allow exclusions period. However, if one particular clause is not applicable within the quality management system scope you do not exclude it, you just state that it is not applicable and explain why. Please check an example in this free webinar - ISO 9001:2015 clause 4 - Context of the organization, interested parties, and scope - https://advisera.com/9001academy/webinar/iso-90012015-clause-4-context-of-the-organization-interested-parties-and-scope-free-webinar-on-demand/

Check also this article - What clauses can be excluded in ISO 9001:2015? - https://advisera.com/9001academy/blog/2015/07/07/what-clauses-can-be-excluded-in-iso-90012015/2015/

GDPR Implementation Duration

The duration would also be influenced by factors like the type and category of personal data processed if the data is shared with third parties processors etc.

My guess this would take around 3 to 6 months provided you are given full support from the management of the company.

Consider also that only publishing some policies and procedures does not mean that an organization is compliant with the EU GDPR you also need the processes to back up the documents.

Corrective Action Reports

I must admit that your previous message made me suspect of that. 

Yes, not all occurring non-conformities require a corrective action.

Yes, all occurring non-conformities need to be recorded. If your quality management system internal rules required that non-conformities be recorded on a corrective action request, you have to do it and copy the corrective action from the first one. 

Consider the possibility of simplifying your quality management system internal rules by separating recording of non-conformities from recording of corrective actions. Please consider this article - ISO 9001 – Difference between correction and corrective action - https://advisera.com/9001academy/blog/2016/02/09/iso-9001-difference-between-correction-and-corrective-action/

Differences between Event, incident and problem management

Event is defined as a change of state. E.g. Port was up, now – it's down / server was alive, now it's not / door were closed, now they are open / etc. Change of state refers to configuration item (CI) or service and it helps to (proactively) maintain services and related CIs. I'm sure you got some kind of alert on your screen -> that's event. Event management process manages events throughout their lifecycle (from when they are raised until they are resolved).

Incident is unplanned interruption (or reduction in quality) of an IT service. Incident management is a process which handles (record, diagnose, resolve) incidents throughout their lifecycle.

Problem is cause of one or more incidents, where root cause of the problem is (usually) not known when problem is raised. Problem management is responsible to find root cause of (one or more) incident.

Here are articles that can help you further:
Incident – „Incident Management in ITIL – solid foundations of operational processes“ https://advisera.com/20000academy/blog/2013/05/21/incident-management-itil-solid-foundations-operational-processes/
Event –  „ITIL Event Management – Entry point of Service Operation“ https://advisera.com/20000academy/blog/2015/03/10/itil-event-management-entry-point-of-service-operation/
Problem – „ITIL and ISO 20000 Problem Management – Organizing for problem resolution“ https://advisera.com/20000academy/blog/2014/07/29/itil-iso-20000-problem-management-organizing-problem-resolution/
And, free webinar „ITIL Incident Management Process Demystified“ https://advisera.com/20000academy/webinar/itil-incident-management-process-demystified-free-webinar-on-demand/

You can see Service Desk as a „window“ to your organization, that's frontline towards your clients and users. Here is more about Service Desk – „Service Desk: Single point of contact“ https://advisera.com/20000academy/knowledgebase/service-desk-single-point-contact/

By infrastructure operation center, I assume you mean IT Operations (at least, according to ITIL). They perform daily activities (contrary to Service Desk who is actively involved in incident resolution).

Learn more in this article „IT Operations Management Function in ITIL“ https://advisera.com/20000academy/knowledgebase/operations-management-function-itil/