Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
SOC 2 and ISO 27001
Answer:
There are many common points between SOC II and ISO 27001:2013: risk management, internal audit, business continuity, access control, etc. If you want to know details about the similarities about both standards, and what resources can be shared, you can see the document “Trust Services Map to ISO 27001” in the official site of American Institute of CPAs. You can find it at this link: https://www.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/othermapping/trust-services-map-to-iso-27001.xlsx -
ITIl and ISO 20000
Answer:
ITIL and ISO 20000 overlap quite a lot. Usage of ITIL processes for ISO 20000 implementation depends also on the detail of the implementation. Ownership of the processes depends on how many employees your ITSM organization have. Ideally, every process would have different owner. But, process owners can be combined.
Here are more details:
ITIL and ISO 20000: A Comparison https://advisera.com/20000academy/knowledgebase/itil-iso-20000-comparison/
Defining roles and responsibilities for ISO 20000-based IT Service Management https://advisera.com/20000academy/blog/2017/10/18/defining-roles-and-responsibilities-for-iso-20000-based-it-service-management/
What ITIL roles can be combined in one person? https://advisera.com/20000academy/knowledgebase/itil-roles-can-combined-one-person/ -
KEDB
Answer:
Best option would be to integrate Known Error Database (KEDB) as part of the ITSM (IT Service Management) tool. In such way, you'll have automation in place meaning that you will integrate KEDB with Incident Management and Problem Management. both of the processes use KEDB to enter Known Errors or use KEDB to resolve incidents i.e. problems.
Here is more about Known Errors (records in scope of KEDB) Known Errors – repetitio est mater studiorum? Not in this case. https://advisera.com/20000academy/blog/2014/02/04/known-errors-repetitio-est-mater-studiorum-case/ -
Residual risk
Answer:
You have to calculate the residual risk after the definition of the risk treatment to be applied. At this point the residual risk is the risk value you expect to achieve with the implementation of the controls. After the implementation of the controls, the risk value you will measure will confirm if the previously calculated residual risk is right or if you need to perform adjustments in the control implementation.
These articles will provide you further explanation about risk assessment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- Why is residual risk so important? https://advisera.com/27001academy/knowledgebase/why-is-residual-risk-so-important/
These materials will also help you regarding risk assessment:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Privacy and Data Protection Notice
Thank you -
Data processing under EU GDPR compliance
Answer:
None of the above. The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant.
For more information about EU GDPR, please check here:
- EU GDPR: What is it and how does it work? https://advisera.com/eugdpracademy/what-is-eugdpr/ -
ISO 45001 Documentation Logistics
Answer:
This is a question that will be different for every organization due to size of the company, industry, hazards present, etc. There are no requirements on the format of managing the documentation. You can keep you documents and records in electronic or hard-copy format as you see fit, or any other format that works for you. Many companies have documents and records that are in a word processor format, stored electronically, and when created, updated or changed they follow rules that meet the requirements of ISO 45001:2018 Clause 7.5.
2. How many Files or folder I need to create or make for documentation?
Answer:
This, again, depends on the company. You need to define for your company, and the processes you use, what procedures you will need for your OHSMS. This will then determine what records you need to keep for each OH&S process. As for folder structure, this is up to you and is not defined in the standard. It is common to create a folder structure that matches the process es you have, but how this is done is up to you.
3. Files record must be according to clauses or according to documents given in series?
Answer:
There is no requirement to use the clauses of the ISO 45001 standard to identify your documents, records or folder structure. It is best to create a folder structure that matches your documentation structure so that you can store documents and records in an order that makes it easy for you as an organization o find them.
4: How many box files do I required for documentation?
Answer:
If you are storing hard copy files, the number of boxes you require will depend greatly on the number of procedures and records your processes require you to keep. Remember, there is not a requirement to have a different storage method for the ISO 45001 documents and records, so if you already have another management system in place (such as ISO 9001) you can use the same documentation process. You may also have many OH&S records in place to meet legal requirements, and this can help you to understand the space needed for records as they will become part of this storage.
To ensure that you have all of the documentation required by ISO 45001:2018, see the whitepaper: Checklist of Mandatory Documentation Required by ISO 45001, https://info.advisera.com/45001academy/free-download/checklist-of-mandatory-documentation-required-by-iso-45001 -
ISO 45001 to OHSAS 18001 table
Answer:
With ISO 45001:2018 they did not put in a comparison table to OHSAS 18001:2007. This is likely because the OHSAS 18001 standard was not issued by the ISO organization (this is a BSI standard), so they were not able to publish a comparison as they would when they update one of their own standards. It may be possible to find one online, but we do not have one.
For some help transitioning from OHSAS 18001 to ISO 45001, which will point out some of the additions in the new standard, you can see the whitepaper: Twelve-step transition process from OHSAS 18001 to ISO 45001, https://info.advisera.com/45001academy/free-download/twelve-step-transition-process-from-ohsas-18001-to-iso-45001 -
Using e-signatures
Answer
Yes, there is nothing in ISO 9001 that does not allow the use of e-signatures. By the way, many people in ISO certified systems fill electronic records and record decisions with their login as identifier.
The following material will provide you more information about document control:
- ISO 9001 – New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- How to set up document approval/withdrawal within your QMS based on ISO 9001:2015 - https://advisera.com/9001academy/blog/2016/04/12/how-to-set-up-document-approvalwithdrawal-within-your-qms-based-on-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
When to develop a corrective action
Answer
Whenever your organization detects a non-conformity a report should be issued. Please check ISO 9001:2015 clause 8.7.2.
Not all non-conformities should generate a corrective action. Please check ISO 9001:2015 clause 10.2.1 b). Evaluate the need for a corrective action, an action that eliminates the cause(s) of a non-conformity. Corrective actions sometimes are difficult, take time and resources, because true causes are hidden. Performing corrective actions whenever a non-conformity occurs can be a bad practice because of what is called tampering a system, constant changes introduce more variability.
When I work with organizations, I recommend two criteria to help in answering to the question in the diagram above:
Is the non-conformity very serious? (Danger for the people (clients or employees), for the brand , for the costs, …)
Is the non-conformity part of a trend? Individually the non-conformity is not very serious, but it is happening frequently.
If the answer is yes to one of the questions, develop a corrective action. All corrective actions should be recorded.
The following material will provide you more information about corrective action:
How to proceed once a QMS corrective action is defined? - https://advisera.com/9001academy/blog/2016/09/20/how-to-proceed-once-qms-corrective-action-is-defined/
Free webinar - Free webinar – Measurement, analysis, and improvement according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/