Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Conditions to issue a valide certificate
Answer
A valid certificate is issued by a certification body, accredited under International Accreditation Forum, after performing a two-stage audit to evaluate compliance with ISO 9001 requirements.
The following material will provide you more information about certification audits:
- ISO 9001 – How to prepare your company for the ISO 9001 certification audit - https://advisera.com/9001academy/03/how-to-prepare-your-company-for-the-iso-9001-certification-audit/
- Surveillance visits vs. certification audits - https://advisera.com/27001academy/knowledgebase/surveillance-visits-vs-certification-audits/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2 015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Monitoring resources
Where in the standard supports that tool design should verify tooling and record results prior to providing tooling to production?
Answer
ISO 9001:2015 clause 7.1.5 is about monitoring and measurement resources used to ensure valid and reliable results about the conformity of products and services to requirements. So, all monitoring and measurement resources used to make a decision about the final products or services should be controlled. All other monitoring and measurement resources control should be based on management decision. If your tool design department works to supply tools to production your current practice is acceptable. If your tool design department works to supply tools to outside customers, then their monitoring and measurement resources should be controlled.
The following material will provide you more information about the monitoring and measurement resources:
- Monitoring and Measurement: The basis for evidence-based decisions - https://advisera.com/9001academy/blog/2020/09/21/how-to-perform-monitoring-and-measurement-according-to-iso-9001/
- [free course] ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- [free course] ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Information security on managed offices
Answer:
If I understood correctly, this managed office is the main premise of your customer, so it can not be excluded from the scope.
If your client does not have much control over the managed office to demand implementation of physical controls related on section A.11, then he should focus on protecting the assets on workstations he uses, and for this he must consider defining a clear desk and clear screen policy to ensure unattended information or equipment is removed from desk and screen when not in use or the user is absent.
Specifically for notebooks you can recommend the use of screen filters that reduce the angle of view from which other personnel can see what is in the screen (with these filters people have to be exactly in front of the screen to see something.)
If want to see how this policy looks like, I suggest you to take a look at the free demo of our Clear desk and clear screen policy at this link: https://advisera.com/27001academy/documentation/clear-desk-and-clear-screen-policy/
This article will provide you further explanation about clear desk and clear screen policy:
- Clear desk and clear screen policy – What does ISO 27001 require? https://advisera.com/27001academy/blog/2016/03/14/clear-desk-and-clear-screen-policy-what-does-iso-27001-require/ -
AS9100 Rev D: Auditing of monitoring software
Answer:
Clause 9.1.1 talks about monitoring and measurement, and in particular discusses the need for ensuring methods give valid results. If the method of monitoring and measurement is to use software, then this needs to be audited to ensure that it is giving valid results, and that the monitoring and measurement is maintained.
In addition, clause 8.5.1.1 discusses control of equipment, tools and software used to automate, control, monitor or measure production processes. This requirements discussed that these items need to be validated prior to release and maintained. This would also require auditing.
For a better understanding of the AS9100 Rev D standard, see the whitepaper: Clause-by-clause explanation of AS9100 Rev D, https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
ISO 22301 clause 4.4
Answer:
The identification of BCMS process and their interactions is evidenced through the BCMS scope document. In this document you have to ensure it is identified:
- which parts of the organization are in the BCMS (clause 4.3.2 c))
- products, services and activities related to the parts in the BCMS (clause 4.3.2 d))
This article will provide you further explanation about defining scope (the article is related to ISO 27001, but the same concept is applicable to ISO 22301):
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
Templates for software development
Do you any that would be of use for us ?
Answer:
Included in the toolkit you bought you have the following templates that cover software development:
- Secure development policy
- Specification of information system requirements
Both are located in folder 08 Annex A Security Controls, sub folder A.14 System Acquisition Development and Maintenance
In case you find these are not enough to fulfill your needs you can edit them to include the information you want or create a new document using the blank template included in the root folder of your toolkit. In both cases you can contact us to support you.
This article will provide you further explanation about security on software development:
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/ -
Questions about certification
Answer: ISO 27001 does not require the implementation of Business Continuity Management. A Disaster Recovery Plan will be enough to cover 27001 requirements.
For more information, see:
- How to use ISO 22301 for the implementation of business continuity in ISO 27001 https://advisera.com/27001academy/blog/2015/06/15/how-to-use-iso-22301-for-the-implementation-of-business-continuity-in-iso-27001/
2. May personal employees laptops and smartphones be excluded from the ISMS scope ?
Answer: Personal assets from employees must not be included in the organization's ISMS scope (after all they do not belong to the organization). The point with such assets is that if they process or store information included in the ISMS scope you have to assess the involved risks in such access, and if the risks are identified as unacceptable you have to consider how to treat them (e.g., forbid such assets to access the organization's information, or regulate their use thr ough controls such acceptable use of assets or mobile and teleworking policy).
For more information, see:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
3. In the template of Risk Assessment and Treatment report, can you explain me more in details what is expected for the section « Time period » ?
Answer: In the "time period" section you must document:
- When the risk assessment activity presented in the report has started and ended
- When the risk treatment activity presented in the report has started and ended
- When the elaboration of final report has started and ended
With this information it can be evaluated if risk assessment took enough time considering the complexity of scope assessment, if risk treatment was performed in due time, and if the report presents current or old information, which helps to support decision making.
This article will provide you further explanation about risk management:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/ -
Scope and certificate
Answer:
Any ISO certificate has a description of the scope of the management system. Please check if the scope of the QMS of the main campus includes your facilities. Sometimes management decides that certification is just for one part of the activities (like a hotel that does not include the restaurant and the pool), sometimes the same certificate is applicable to one organization with different sites.
The following material will provide you more information about the scope:
- How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- [free course] ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- [free course] ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Toolkit content and SoA
method of identification of the other party
authorizations to access information
ensuring non-repudiation
technical standards for data transfer
incident response
labeling and handling sensitive information
copyright
Answer: These items aim to ensure specific clauses in information exchange agreements are included to protect information sent to other parties. General examples of clauses related to these bullets are:
- method of identification of the other party: "representative of organization's partner authorized to receive information must present as identification functional badge with his name and job title"
- authorizations to access information: "only personnel authorized by partner's -
Rules for identification, collection and preservation of evidence
In which part of the document: Validity and document management;
What is my question: What criteria must be considered for the effectiveness and appropriateness of the document?
Answer:
Regarding the rules for identification, collection and preservation of evidence, the criterion to be considered, among those included in this section of the template, is the "number of incidents for which evidence for legal action was inadequate", where the target number of incident must take into account the incident history of your organization, or a number considered a reference by your industry.