Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11269 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Estimation of timeline for ISO 13485 certification
Answer:
The implementation process will usually take between 3 months to 18 months depending on the size of the company. You can utilize this link to calculate the time that might be needed: https://advisera.com/9001academy/iso-9001-duration-calculator/ For the certificate stage, you should give yourself around 2 months to prepare.
For more information, please read article:
Checklist of ISO 13485 implementation and certification steps
https://advisera.com/13485academy/knowledgebase/checklist-of-iso-13485-implementation-and-certification-steps/ -
Technology Risk Assessment
Answer:
To conduct Technology Risk Assessment aligned with ISO 27001 I suggest you to take a look at the free demo of our ISO 27001/ISO 22301 Risk Assessment Toolkit at this link: https://advisera.com/27001academy/iso-27001-22301-risk-assessment-toolkit/
It has the templates you need to define your risk assessment and treatment methodology and implement it according ISO 27001
These materials will provide you further explanation about risk assessment and treament:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- How to write ISO 27001 risk assessment methodology https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Is medical device file require for a supplier ?
Answer:
Since the plastic injected molded clips are a part of the medical device components, you have to maintain a medical device file in order to be compliant with ISO 13485.
For more information, please read article:
How to meet ISO 13485:2016 requirements for medical device files
https://advisera.com/13485academy/blog/2017/06/28/how-to-meet-iso-13485-requirements-for-medical-device-files/ -
Elaborating documents
Answer:
ISO 27001 does not prescribe how documents should be developed, so you can chose the approach that best fits your needs.
The main criteria to decide to merge documents or not are if they have similar purposes and if by merging them they would not become a document too big to understand or read. So, in this case, if your single document does not become to big to use and manage it may be best to merge them, so you have one less document to manage in your ISMS.
These articles will provide you further explanation about developing policies:
- One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/ -
Software assessment
Answer:
Points to be considered are:
- Business needs
- License type (even for open source software)
- Know vulnerabilities (you can search on NIST vulnerability database)
- Software reputation on market
- Existence of periodic release of security patches
- Software private policy
This article can provide further information about risk assessment:
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/ -
Non-risk related reasons for undertake work
Answer:
In a general manner, security related actions can be driven by these reasons:
- the existence of unacceptable risks (as you already mentioned)
- the existence of legal requirements (e.g., contracts, laws and regulations), demanding a security action
- a top management decision, based on a business need or on a market best practice
The last two bullets do not have to be initially related to risks (but at some point you can identify some), neither do ISO auditors will require every action to be related to risks. -
Disaster recovery plan
Answer:
Your toolkit includes an template for Disaster Recovery Plan on folder 8 Annex A controls A.17 Business Continuity
It is important to note that to ISO 27001 a DRP aims to the recovery of IT infrastructure, and since your question refers to a cloud provider, you must align which activities you must to document in your plan, since most is the activities will be responsibility of the provider. -
Use of ISO 27001 standard
Answer:
ISO 27001 is an intellectual property of ISO, and it is necessary to buy the standard to use it, otherwise you would incur on intellectual property infringement. Depending on buying conditions you may share a limited number of copies of the standard you bought. -
Retraining requirements
Answer
There is no ISO 9001 requirement making that mandatory. Unless there is some important client, or contract, or legislation/regulation making that a requirement it is not mandatory.
The following material will provide you information about competence:
- Article – How to ensure competence and awareness in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-ensure-competence-and-awareness-in-iso-90012015/
- Free course – ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Data processing and transferring
Answer:
The personal data can be provided to another third party located in the EU provided that there is a Data Processing Agreement in place.
If you want to find out more about the transfer of Personal Data check out this free EU GDPR Foundation Course: https://advisera.com/training/eu-gdpr-foundations-course//