Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Internal audit frequency
Answer:
ISO 27001 does not prescribes frequency to perform internal audits, but requires that audits mus be planned considering the importance of the processes involved and the results of previous audits. For a certified ISO 27001 ISMS you have to ensure all elements in the scope are internally audited at least once during the certification period (three years).
This article will provide you further explanation about planning internal audits:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
These materials will also help you regarding internal audits:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
ISO 45001:2018 Opportunities
Answer:
OH&S opportunities and other opportunities as per clause 6.1.2.3 is asking you to have a process to assess both of these types of opportunities. OH&S opportunities (clause 6.1.2.3 a) are any opportunities that may exist to improve your OH&S performance within your organization. This could include adapting work to make it safer, organizing work in way that reduces workplace injury or eliminating hazards that may exist in the workplace. An example would be replacing a cleaning chemical that is a known carcinogen with a safer chemical to clean parts in your facility.
Other opportunities (clause 6.1.2.3 b) come from outside of your organization such as changing legal compliance obligations or changes in external issues. An example of one of these other opportunities could be: if you find out that a supplier will not be able to provide you with a chemical that is critical for your product, and you can’t find the chemical anywhere else. This could be an opportunity to find a safer chemical to replace the chemical that is being made obsolete.
In both cases, you assess these opportunities to decide which need to be addressed with planning actions (clause 6.1.4).
For a more thorough discussion of opportunities in ISO 45001:2018, see the article: What are the new requirements for risks and opportunities according to ISO 45001?, https://advisera.com/45001academy/blog/2018/04/25/what-are-the-new-requirements-for-risks-and-opportunities-according-to-iso-45001/ -
How to get started with the documentation?
Answer:
We have a free webinar on how to get started with the documentation: How to use a Documentation Toolkit for the implementation of ISO 13485: https://advisera.com/13485academy/webinar/how-to-use-a-documentation-toolkit-for-the-implementation-of-iso-13485-free-webinar/
The next step would be to gather all your internal documents and information and start to create a quality manual followed by the relevant standard operating procedure (SOP) required by the Standard. -
Applicability of ISO 13485 for medical device store
Answer:
In the context of a medical device store, Good Distribution Practice (country specific regulation) would be more applicable in your case . ISO 13485 is an international standard and guideline to provide medical device companies a framework to establish their Quality Management System (QMS). For the context of a medical device store, your role would be more involved in ensuring that product that does not conform to requirements are identified, segregated, stored appropriately to prevent their unintended use or delivery. -
Toolkit content
1. Information Security Policy: Can we summarize a couple of aspects in the concepts of Annex A, such as Organization, HR Security, Asset Management, Access Control, Cryptography, ...
Answer: The Information Security Policy is a top level document, created before the identification of controls, so we do not recommend such summarize because:
- It will make the document overly complex and difficult to understand
- The risk of rework, if after risk assessment you identify there are not relevant risks the can justify the text included in the Information Security Policy like you are proposing
For further information please read:
- What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/
2. Inventory of assets: Description of asset: What do we have to write here? Are we supposed to write what this asset is being used for?
Answer: If ISO 27001 control A.8.1.1 (Inventory of assets) is applicable to your organization you should consider at least the name of the asset, its owner and its classification level. Of course you can add more information to fulfill additional needs from other requirements you have, or you understand it will help you manage the ISMS (e.g., what the asset is being used for).
This article will provide you further explanation about Inventory of assets:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
3. Inventory of assets: Impact: Which impact do we have to list here in case there are more risks which are related to the specific asset?
Answer: You have to consider the highest impact identified among the list of risks related to a specific asset.
For further information, please read:
- How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment
4. Risk Treatment Table: What if there is more than one control which could be bound to a specific risk? Let us say: losing your work laptop is the risk, controls: regarding Mobile Device & Teleworking (A.6) and Business Continuity (A.17), so there is more than one option.
Answer: ISO 27001 does not prescribe how many controls you need to adopt to treat a risk, so you can adopt as many controls as you see necessary to reduce risks to acceptable levels in a cost effective way.
This article will provide you further explanation about selecting controls:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
5. We must be certified by June, is there any advice that you could give me on how to get this sorted out as soon as possible?
Answer: Without details about your context (e.g., company size, ISMS scope, business objectives, etc.) it is not possible to provide detailed guidance, but in general you should work to maintain top management commitment on the project (to prioritize tasks and resources), and keep controls and documents as simple as possible (you should worry about refinements at a later stage).
By the way, included in your toolkit you have access to several tutorials that can help you with tasks like filling the risk assessment and risk treatment tables, developing the information security policy, etc. -
Policy for sharing files externally
Answer:
ISO 27001 controls which can be related to protect file exchange, including exchanges with external parties, belongs to section A.13.2 Information transfer, and the following templates from ISO 27001 toolkit cover these controls:
- Bring Your Own Device (BYOD) Policy, covering control A.13.2.1, located on folder 08 Annex A Security Controls ==A.6 Organization of Information Security
- Confidentiality Statement, covering control A.13.2.4, located on folder 08 Annex A Security Controls ==A.7 Human Resource Security
- IT Security Policy, covering control A.13.2.3, located on folder 08 Annex A Security Controls ==A.8 Asset Management
- Information Classification Policy, covering control A.13.2.3, located on folder 08 Annex A Security Controls ==A.8 Asset Management
- Security Procedures for IT Department, covering control A.13.2.1 and A.13.2.2, located on folder 08 Annex A Security Controls ==A.12 Operations Security
- Information Tra nsfer Policy, covering control A.13.2.1 and A.13.2.2, located on folder 08 Annex A Security Controls ==A.13 Communications Security -
Training records
Answer:
There is no specific requirement for training records, however, the clause that refers to this question is 7.2 Competence.
We suggest that there should be a responsible person who is in charge of managing all training records and doing a competency check for an employee according to the attended training.
For more information please read the following article:
-How to ensure the competence of your employees according to IATF 16949: https://advisera.com/16949academy/blog/2017/10/04/how-to-ensure-competence-of-your-employees-according-to-iatf-16949/ -
Management review - how long?
Answer: I do not know the dimension of your organization, but at least half a day seems to be the minimum time to perform an acceptable management review. If attendants study the documentation in advance, the management review timing can be focused on the discussion of topics and making conclusions and decisions.
The following material will provide you information about management review:
- How to make Management Review more useful in the QMS - https://advisera.com/9001academy/blog/2014/01/21/make-management-review-useful-qms/
- How to Make Management Review More Practical - https://advisera.com/9001academy/blog/2013/12/10/make-management-review-practical/
- Free online ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book - Discover ISO 9001:2 015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Auditing the Plant Manager
Answer:
I would concentrate on the interactions of the Plant with the environment:
What are the significant environmental impacts?
What is planned to control or improve those impacts?
Are those action plans being followed?
Are those action plans being effective?
Are procedures and or practices being followed?
Are potential emergency situations being prevented? Are there procedures for answering to those emergency situations? Were those procedures tested?
Is environmental performance improving?
The following material will provide you information about the assessment of environmental interactions:
- Defining and implementing operational control in ISO 14001:2015 - https://advisera.com/14001academy/blog/2016/04/11/defining-and-implementing-operational-control-in-iso-140012015/140012015/
- Internal Audits in the EMS: Five Main Steps - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/internal-audits-in-the-ems-five-main-steps/
- Free online training ISO 14 001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- Book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Scope of clauses
Of courses these clauses are not requirement, but they are still clauses which need accurate information such as operation's address, provision/exclusion and scope of standard.”
Answer:
These clauses are not subjected to audit. If you check the templates that certification bodies use to report an overview of the audit, a number of observations and non-conformities per clause, you will see that clauses 1 to 3 are not included.
The following material will provide you information about ISO 9001:2015:
- Article - ISO 9001 – How to prepare for an internal audit - https://advisera.com/9001academy/blog/2017/09/26/iso-9001-how-to-prepare-for-an-internal-audit/
- Free online ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/