Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Complaining to the certification body
My reason for asking is that I have an example of where a company has flouted almost every rule in terms of maybe a dismissal or redundancy. Should this be brought to the attention of the body that appointed them for this standard as clearly, they are not being met.
Answer
Although there is no explicit HR policy, a certified organization must comply with the requirements of HR-related clauses. For example, clause 7.1.4 on the environment for processes operation addresses both physical and human factors. Among the human factors the standard mentions in a note social and psychological factors, which may frame the concerns you expressed.
Anyone who feels that an organization, while certified, is not meeting the requirements of the standard can always formally complain to the certification body that issued the certificate. -
Filling SoA justification
Answer:
In fact entering the whole risks from the risk treatment table in the SoA is not the best way to justify applicable controls. What you can do is to include only the risk ID of the risks related to control A.12.6.1, according to your Risk treatment table. For example, you could write "Risk 001, 003, and 023 ". -
Record of Processing
Answer:
Article 30(5) of the GDPR provides an exemption that allows companies to avoid Article 30 record-keeping obligations provided that the processing is (i) only occasional; (ii) the processing is not considered a risk to the rights and freedoms of the data subjects; and (iii) the processing is not of ‘Special Categories of Data’ (Article 9.1) or personal data relating to criminal convictions and offences.
So unless you fall under the exemptions above you need to create an Inventory of processing activities or ROP as you called them. -
Filling asset inventory
Answer:
First is important to note that both approaches are acceptable, but to keep your inventory less complex we recommend you to list only the highest impact associated to an asset. -
ISO 27001-2019
Answer: First of all, sorry for this situation. In the future if you want to contact us please use this e-mail: support@advisera.com
With this email you can either post a question or schedule a meeting with one of our consultants.
Second, the reason for my inquiry is due to the fact that I just found out about the IS/IEC 27001:2019 version and was wondering how this will affect our current initiative. To be honest, we are still very much at the beginning and I think that it would definitely be best to move forward with the latest version of the standard rather than continue with the 2013 version. I just started reading and am tryi ng to find what differences there may be between the 2 versions, but if you can provide that comparison and tell us your thoughts about how you think we should progress, that would be very much appreciated.
Answer: Please note that ISO 27001:2013 was indeed reviewed in 2019, but it was confirmed as the current standard, so no changes will be required for those organizations already certified, or in process of certification of this version of the standard (the version of the current standard will still be 2013, not 2019). For more information, please access this link: https://www.iso.org/standard/54534.html -
Use of encryption
First it is important to note that this impediment is not absolute. If your organization's Information Classification Policy defines the use of encryption with central key management as a general solution for all information classification levels, than the IT departmen t can implement it as you described.
The use of encryption solutions must be considered wisely because it can have some potentially restrictions or negative consequences, e.g., in some countries the usage of encryption is defined by law; also if an employee leaves the company and all his data is locked on a encrypted disk, then the company cannot access this data.
This article will provide you further explanation about information classification:
- Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/ -
Transferred risks
1 - El propietario del activo debe ademas aplicar controles sobre para mitigar este riesgo, o en l momento de transferir el riesgo, la aplicacion de los controles, desaparece?
2 - Puedo transferir el riesgo a un tercero y a la vez, decidir aplicar controles propios para estos servidores criticos?
(In the risk analysis, if it is decided to transfer the risk of some assets, to a third party, with whom there is a maintenance contract. For example, it is decided to transfer the risk of a very critical set of servers to the maintenance company.
1 - Should the owner of the asset also apply controls over to mitigate this risk, or at the time of transferring the risk, does the application of the controls disappear?
Answer: First it is important to note that if you adopt the option to transfer the risks, the application of controls does not disappear, only the implementation method changes from your own implementation to "implemented by third-party".
Considering that, once risks are transferred to the third-party, the asset owner should also consider the application of controls from section A.15.1 Information security in supplier relationships, to ensure the existence of contracts or agreements to enforce the proper treatment of the transferred risks.
For additional information, please read:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
- Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
2 - Can I transfer the risk to a third party and, at the same time, decide to apply my own controls for these critical servers?)
Answer: In theory you can do that, but it does not make much sense, since you are contracting someone just to protect your servers. Additionally, these paralleled applied controls may interfere with each other and reduce overall server security or performance. -
Integrating ISO 14001 & ISO 45001 into ISO 9001
Answer:
As you have indicated, many of the processes are similar between the three standards, such as internal audit and management review, so creating an integrated management system does not add three times the work. The main processes to add onto the ISO 9001:2015 QMS would be:
For ISO 14001:2015 EMS, environmental aspect and impact assessment (how the company interacts and affects the environment), determining environmental legal requirements and compliance and preparation for emergency response.
For ISO 45001:2018 OHSMS, consultation and participation of workers, hazard identification and assessment, OH&S determining legal requirements and compliance, elimination of hazards, preparation for emergency response and the addition of incident investigation into the corrective action process.
For a better understanding of how to integrate these standards, see the whitepaper: How to integr ate ISO 9001, ISO 14001 and ISO 45001, https://info.advisera.com/9001academy/free-download/how-to-integrate-iso-9001-iso-14001-and-iso-45001 -
ISO 45001: Support, Operation and Performance
Answer:
The first thing to note, is that Iso 45001:2018 does not require an OH&S manual, but you can choose to write one if you find this useful to collect your information. So, it is not a requirement to go through everything in the standard and say how you do it. The three main topics you are asking about cover the following sub-clauses in the standard:
Support – This clause talks about how you identify resources for the OHSMS, define and ensure competence for activities, raise awareness of the OHSMS, communicate both internally and externally and how you manage your documents and records.
Operation – This clause talks about controlling your operations through hazard elimination and reducing risks, managing change and ensuring that necessary OH&S information is part of your procurement activities. Further you need to plan for potential emergencies.
Performance evaluation – This clause talks about how you monitor a nd measure processes, perform internal audit, and conduct management review of the OHSMS.
For a better understanding of the clauses of ISO 45001:2018, see the whitepaper: Clause-by-clause explanation of ISO 45001:2018, https://info.advisera.com/45001academy/free-download/clause-by-clause-explanation-of-iso-45001 -
Risk and asset owner
camara y videograbador de CCTV
propietario del riesgo: el responsable de mantenimiento
propietario del activo: el responsable de IT
Pero: queremos transferir el riesgo a una empresa externa que sera ademas, la responsable del mantenimiento diario y aplicaremos los controles posteriores.
Me puedes confirmar si es posible realizarlo de esta forma con algunos activos?
(Hello, I have a doubt in the risk analysis. Can I have 1 asset, with 1 owner of the risk, other than the owner of the asset and then also transfer the risk of this asset, to a third party? for example:
CCTV camera and video recorder
risk owner: the person responsible for maintenance
asset owner: the IT manager
But: we want to transfer the risk to an external company that will also be responsible for daily maintenance and we will apply the subsequent c ontrols.
Can you confirm if it is possible to do it this way with some assets?)
Answer:
Your assumption is correct. You can have the risk owner as a different person from the asset owner and transfer the risk is an acceptable risk treatment option
These articles will provide you further explanation about asset and risk owner and risk treatment option:
- Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/
- 4 mitigation options in risk treatment according to ISO 27001 https://advisera.com/27001academy/blog/2016/05/16/4-mitigation-options-risk-treatment-according-iso-27001/