Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Project Plan in ISO 14001 toolkit
Response:
We do have included in our ISO 14001 toolkit a Project Plan. You can check it here and download a free preview: https://advisera.com/14001academy/iso-14001-documentation-toolkit/
You can also download for free a Project Plan for ISO 14001 here: https://info.advisera.com/14001academy/free-download/project-plan-for-iso-14001-implementation-ms-word This template help companies to manage all aspects of the project of ISO 14001 implementation, although this is a non mandatory document, we recommend to write it.
For more information about the Project Plan in ISO 14001:2015, see the following materials:
- Book - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- Free on-line training – ISO 14001:2015 Foundations: https://advisera.com/training/iso-14001-internal-auditor-course/ -
Acciones susceptibles de producir impactos
Respuesta:
No existe tal definición de "acciones susceptibles de producir impactos" dentro de la ISO 14001. Se trata de un concepto mayormente empleado en las evaluaciones de impacto ambiental y son las actividades, operaciones, procedimientos, aspectos, elementos, etc. de un proyecto que se relacionan de alguna forma con el medio ambiente, y que por lo tanto, producirán de manera directa o indirecta, cambios (impactos) en el entorno.
Dentro de los requisitos de ISO 14001:2015 la organización debe de determinar los aspectos ambientales significativos, es decir aquellos que generan un mayor IMPACTO en el medio ambiente conforme a unos criterios establecidos por la propia organización (por ejemplo frecuencia de ocurrencia de un aspecto ambiental, etc) . Este impacto es el cambio que se produce en el medio ambiente, ya sea adverso o beneficioso, y resulta del aspecto ambiental asociado a una actividad o proceso.
Para más información sobre los aspectos ambientales y los impactos en ISO 14001:2015, puede ver los siguientes materiales:
- Artículo - Environmental aspect identification
and classification: https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
- Artículo - Catalogue of environmental aspects: https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/catalogue-of-environmental-aspects/
- Libro - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- Curso gratuito en línea - Curso fundamentos ISO 14001:2015: https://advisera.com/training/es/course/curso-fundamentos-iso-14001/ -
ISO 17025 and ISO 9001
Answer
You cannot say that one is superior than the other, because they are different. ISO 9001:2015 is applicable to all types of companies in all industries, whereas ISO 17025:2015 is only applicable to testing and calibration laboratories. If your organization is a testing and calibration laboratory ISO 17025 is a requirement.
The following material will provide you more information about the difference between both standards:
ISO 17025 vs. ISO 9001 – Main differences and similarities - https://advisera.com/17025academy/blog/2019/07/11/iso-17025-vs-iso-9001-main-differences-and-similarities//
What is ISO 17025? - https://advisera.com/17025academy/what-is-iso-17025/
Diagram of ISO 17025 Implementation Process - https://info.advisera.com/17025academy/free-download/diagram-of-iso-17025-implementation-process
Free webinar on demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/ ementation-steps-free-webinar-on-demand/
You can minimize implementation time with our ISO 9001:2015 Documentation Toolkit - https://advisera.com/9001academy/iso-9001-documentation-toolkit/
You can enroll for free in this course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
You can enroll for free in this course - ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Preparing for a QMS implementation
Thank you so much for the best recommendation. Currently I'm on going with the Foundation Course. -
Spreading a set of internal audits all over the year
Answer
Yes, the whole system can be audited through a set of internal audits spread all over the year. And for internal auditors with lack of experience that is a great help because they can focus their preparation, performance and reporting on a focused audit scope.
The following material will provide you more information about internal audits:
What is the ISO 9001 audit program, and how does it work? - https://advisera.com/9001academy/blog/2017/01/24/what-is-the-iso-9001-audit-program-and-how-does-it-work/
Enroll for free in the course - ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
Free webinar on demand - How to perform an ISO 9001:2015 internal audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/
- book – Discover ISO 90 01:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Scope definition
Is it true that a company can be certified in ISO 27001 only in a part of the organization? That is, for example, only the Systems area?
Answer:
Your understanding is correct. The ISMS scope can cover all organization, or only specific locations, processes or information.
The main point when considering this approach is the effort required to keep the ISMS scope separated from the rest of the organization's elements (for small and mid-sized organizations many times the effort is not worthy, and it is better to include all the organization in the ISMS scope)
These articles will provide you further explanation about scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
- How to s et the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/ -
ISO 27001 systems audit
Answer:
For a better understanding of ISO 27001 controls and how to perform an ISO 27001 system audit, I suggest you to attend this free course:
- ISO 27001 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Implementing ISO 27001
Answer:
ISO 27001 is a standard focused on protection of information, so possible applications of ISO 27001 for this organization (if I understood correctly, it provides physical security services) are:
- protection of sensitive information known by physical security guards about facilities, processes or people from their clients (e.g. through which route will the money be delivered, how it will be protected, and who will be driving), by means of training and employment contract clauses.
- provision of proper physical protection of information of their clients (e.g., equipment and methods for protection of their premises, or during assets transportation, etc.).
These articles will provide you further explanation about potential controls:
- Physical security in ISO 27001: How to protect the secure areas https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-27001-how-to-protect-the-secure-areas/
- What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/
For a overview about ISO 27001 Implementation, I suggest you these materials:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- ISO 27001: An overview of the ISMS implementation process [free webinar] https://advisera.com/27001academy/webinar/iso-27001-overview-isms-implementation-process-free-webinar-demand/ -
Audit questions
1. Does the internal auditor has to have a FORMAL training (should be formally certified of some sort) in order to conduct the internal audits? I found no evidence for that in any of the 9.2 clause.
Answer:
According to ISO 27001 (clause 7.2) competence can be demonstrated by means of education, training or experience. Considering that, an internal auditor does not need to have a formal training if he can demonstrate his competence by other means (e.g., an degree which includes education on auditing topics, or previous experience on auditing ISO 27001 management systems).
For additional information, see:
- What to look for when hiring a security professional https://advisera.com/27001academy/blog/2016/02/15/what-to-look-for-when-hiring-a-security-professional/
2. Should the information security policy be signed by CEO? Again I found no evidence for that – only "Top Management".
Answer:
By top management you must consider the highest level of the organization related to the ISMS scope. If the organization is included in the ISMS scope this person would be the CEO, however if only part of the organization is included in the ISMS scope this person may be someone else. Please note that for small and mid-sized organizations, due to their size, the most common is that the CEO signs the information security policy, no matter if the scope of the ISMS is the whole" organization or not. -
Employee private devices
Answer:
By including private devices in your asset register would mean that all information on them (both company and private) would have to be treated according company security rules, and this will add unnecessary effort and complexity to your ISMS (because users' private data).
A better approach would be not include the private devices in your asset register and identify the risk that business data can be accessed by private devices. This way you can focus on protecting only the business data, and this can be done by means of implementing a BYOD policy.
This article will provide you further explanation about managing private devices:
- How to write an easy-to-use BYOD policy compliant with ISO 27001 https://advisera.com/27001academy/blog/2015/09/07/how-to-write-an-easy-to-use-byod-policy-compliant-with-iso-27001/