Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Asset inventory content
Answer:
Sorry, but I think there is a misunderstanding here. The comment on column F of the asset inventory mentions the Risk Assessment Table, not the Risk Treatment, and on the Risk Assessment Table you have all assets considered in your ISMS scope.
As a last note, listing the consequences in the Asset inventory is not mandatory (it is only a best practice so you can quickly verify the impacts related to an asset without having to open another document. -
GDPR and data processing
Answer:
I would advise against using consent as a lawful basis for the processing of personal data especially considering the latest fine issued by the Greek Supervisory Authority. As a general rule, you should be avoiding consent when processing employee data.
2. Is processing of bank details for payments allowed by GDPR?
Answer:
Yes, it is. The GDPR does not forbid certain data to be processed however you would need to set up additional security measures to protect bank details. You should also check if you need to be PCI compliant as well.
3. As a real estate company do I need to have a Data Protection Officer?
Answer:
It is quite unlikely unless (a) the company has more than 250 employees, or (b) the processing the company carries out is likely to result in a risk to the rights and freedoms of data subjects; or (c) the processing is not occasional; or (d) the processing includes special categories of data (personal data revealing racial o r ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation);or (e) the processing includes personal data relating to criminal convictions and offenses.
4. Can I ask clients for a declaration that they are not alowed to contact the owner directly ?
Answer:
This is not necessarily related to the GDPR so you should check this with a lawyer that knows your local laws.
If you want to find out more about consent and other lawful grounds for processing check out this webinar: Privacy Notices under the EU GDPR https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/ -
ISO 20k risk management process for BCMS
Am I able to use this same risk document for BCMS?
Answer:
If you consider a BCMS based on ISO 22301 you can use the same risk document based on ISO 20k. You only have to make adjustments to fulfill specific requirements from ISO 22301. For example for a BCMS you have to consider risks that can cause disruption on business services and process in a general manner (i.e., not only related to IT related services)
This article is a little bit off-topic, but can provide you a view of the concept: https://advisera.com/27001academy/blog/2013/03/11/can-iso-27001-risk-assessment-be-used-for-iso-22301/ -
System/App Retirement & Decommissioning
Great answer; thanks. -
What is the role of the process owner?
Answer:
A Process Owner is a person who is given the responsibility and authority for managing a particular process. A process owner is responsible for the design of the process, how it is carried out, how it interacts with other processes, and how it is measured. Process owner identifies process documentation and training requirements, identifies risks and opportunities with the current process. Of course, this responsibility is an ongoing task.
For more information on the process approach, you can see the following article. This article is written for ISO 9001, but the process approach described is also fully applicable for ISO 13485.
ISO 9001: The importance of the process approach https://advisera.com/9001academy/blog/2015/12/01/iso-9001-the-importance-of-the-process-approach/ -
IATF 16949 implementation guideline
Answer:
First, you can read our article that will provide you with the basic information on IATF 16949:
What is IATF 16949
https://advisera.com/16949academy/what-is-iatf-16949/
Then, you can check what you have already implemented in your organization. Here is an article that will help you with that:
Checklist of IATF 16949:2016 Implementation Steps
https://advisera.com/16949academy/knowledgebase/checklist-of-iatf-16949-2016-implementation-steps/
Next step would be getting familiar with IATF Core tools. You can do that by reading the following article: What are the five core tools of IATF 16949
https://advisera.com/16949academy/blog/2017/08/23/what-are-the-five-core-tools-of-iatf-16949/
For more about IATF 16949, I would recommend reading our blog posts on our IATF 16949 Blog that seem interesting to you and your business case in the production department:
https://advisera.com/16949academy/blog/
In out IATF 16949:2016 Documentation Toolkit you can find all the required document templates: https://advisera.com/16949academy/iatf-16949-2016-documentation-toolkit/ -
Product recall requirements and Drinking water standard in Cambodia
Answer:
There is an ASEAN medical device directive where, in Article 12 and Annex 5, is described product recall process. You can find this directive on the following link: https://asean.org/book/asean-medical-device-directive/
I have found that there is Drinking water standard in Cambodia on the following links:
Drinking Water Quality Standards https://rdic.org/wp-content/uploads/2014/12/MIME-Drinking-Water-Quality-Standards-2004-en.pdf, Drinking Water Standard https://www.wepa-db.net/policies/law/cambodia/07.htm -
AS9100 Transfer of work
Is it a viable statement to say that “Control of Work Transfers” is not applicable to our situation?"
Answer:
Transfer of work, as mentioned in clause 8.1, is referring to moving a process which is normally done in one place to another. As per the note it can be from your facility to a supplier, from one supplier to another, etc. In other words, it is in changing the original plan of where work will be done, and the requirements are that when you do this you have a process in place to ensure that the original conformity of the products or services is not maintained and risks are managed. When you are talking about sending a product out to be heat treated or plated as a regular function, this would fall under clause 8.4, Control of externally provided processes, products and services.
From your explanation it could be argued that this transfer of work is not applicable to you, but if you do choose to do this in the future you would need to plan the transfer and not just move work without assessing the risks.
Since the reason for this requirement is to ensure process validation is maintained when work is transferred, you can learn more on process validation in this article: What is process validation in AS9100 Rev D?, https://advisera.com/9100academy/blog/2017/10/02/what-is-process-validation-in-as9100-rev-d/ -
Statement of Applicability
We've received additional question:
>While I am waiting for your reply, I looked at the 27000 standard and para 6.1.3 C, D specifically requires to review all 114 control and include justification if we didn't use one. So does that mean that the declaration will include all the controls and for each ?
Answer:
Your assumption is correct. The Statement of Applicability must include all controls from Annex A, including justification for those considered applicable, their implementation status and the justification for those considered not applicable. -
Risk assessment approach
I’m ready to purchase the BCMS templates, but since the RA Toolkit is a separate product, I want to make sure that I find the right RA solution before I move forward with the ISO 22301 Toolkit.
Could you please let me know if your experts have any suggestions on alternative RA solutions? Or if they think the RA Toolkit can be edited to focus on processes rather than assets?
Answer:
The Risk Assessment Table and the Risk Treatment Table from our Risk Assessment Toolkit are based on the asset-vulnerability-threat methodology, but the columns related to assets, vulnerabilities and threats can be changed by a single column describing the risks in a process based approach. All other elements can be kept.
Please note that risk management documents are included in the ISO 22301 Toolkit , and you can take a look how this change would look like by seeing the free demo of our ISO 22301 Toolkit at this link: https://advisera.com/27001academy/iso22301-documentation-toolkit/
This article will provide you further explanation about alternative risk assessment approaches:
- ISO 31010: What to use instead of the asset-based approach for ISO 27001 risk identification https://advisera.com/27001academy/blog/2016/04/04/iso-31010-what-to-use-instead-of-the-asset-based-approach-for-iso-27001-risk-identification/