Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Normative reference
Answer:
According to ISO Technical Committee 207, a normative reference is a reference to another document that is indispensable for the application of the standard. If a document is normatively referenced, an organization must conform to it in order to conform with the standard. In the case of ISO 14001:2015 it is a standalone document that can be applied without reference to any other documents.
The following material will provide you information about the assessment of environmental interactions:
- ISO 14001 – 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- List of ISO 14001 implementation steps - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/list-of-iso-14001-implementation-steps/
- Free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- Book - THE I SO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Templates content
Answer: ISO 2701 clause 9.1 Monitoring, measurement, analysis and evaluation requires documented information as evidence of the monitoring and measurement results, and one way to ensure that is by using the Measurement Report. Of, course, if your organization already has another records you can use to fulfill this clause, this report is not needed.
For further information, please read:
- How to perform monitoring and measurement in ISO 27001 https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
2. Unauthorized use of printers, photocopiers, scanners and other shared equipment for copying Dell S2825CDN in the office at the headquarters is prevented by [specify how – e.g. by locking the facility, use of PIN numbers, access cards, etc.]. All the employees are authorized to use the printer/photocopier/scanner. Is it okay to wri te it like that?
Answer: First it is important to note that any ISO 27001 control must be implemented only if you have unacceptable risks, legal requirements, or top management decisions demanding a control to be implemented.
Considering that, if at least one of the previous circumstances applies to employees, you have to evaluate if this implementation will decrease risks to acceptable levels, or fulfill legal requirements. On the other hand, if you do not have any of the previous circumstances, you do not need to implement access control.
Second, unauthorized use refers not only to employees, but to all people that can have access to the equipment (e.g., visitors, contractors, etc.). So, you also have to consider these personnel regarding risks, legal requirements, and top management decisions, to define if any control is needed regarding them.
This article will provide you further explanation about selecting controls:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
3. The IT Security Policy and Security Procedures for IT Department document have a section at the end which is called "Managing records kept on the basis of this document". I could not find any templates for these records, but I do have an idea what I could write at some of these documents but it wouldn't be that much, ex. I hereby state that ______________ may take organizational assets off-site. The employee is fully responsible to take the necessary care while the assets are off-site. (at the bottom of the document a place where employer and employee both could sign). However for records such as "Security features and level of expected service for network services" I wouldn't know what to write. Do you possibly have examples for the records or something else so I can get a better picture of what I exactly have to write?
Answer: A good example for "Security features and level of expected service for network services" would be a Specification of Information System Requirements, and you can find this template on folder 08 Annex A Security Controls = =A.14 System Acquisition Development and Maintenance
For other records, in many cases organizations already have versions of them on their own operation, in paper form (corrective action record) or in information systems ( e.g. the logs of your backup system. ), that's why we do not provide them (it would be infeasible to create a template to cover all possible possibilities). In these cases we recommend customers to evaluate if their current records already comply with information required by policies and procedures. If yes, you can use them. If not, you can make a list of needed records and schedule a meeting with one of our experts, so he can guide you on how to develop such records.
You can schedule a meeting at this link: https://advisera.com/27001academy/consultation/ -
3rd party risk management
Answer:
Considering ISO 27001 requirements, 3rd party risk management is not much different from performing risk management on your own environment:
- Define risk assessment methodology
- Perform risk assessment
- Perform risk treatment
- Elaborate ISMS Risk Assessment Report
- Elaborate Statement of Applicability
- Define Risk Treatment Plan
The main difference is that you have to formally define the risk assessment and treatment methodology with the third-party, e.g., by means of a contract, and define clear roles and responsibilities for each part (e.g., the third party will identify and analyze risks while your organization will evaluate them during the risk assessment implementation).
These articles will provide you further explanation about risk assessment and treatment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- How to w rite ISO 27001 risk assessment methodology https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
These materials will also help you regarding risk assessment and treatment:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
Documentation requirements
>1 - One of the mandatory documents in the list in the toolkit is “Operating Procedures for IT Management”, is this not the same as an SOP?
Answer: I'm assuming you are referring to the "Security Procedures for IT Department" template, located on folder 08 Annex A Security Controls ==> A.12 Operations Security
Considering that, you can call this document a SOP, because it defines activities and responsibilities to ensure correct and secure functioning of information and communication technology.
>2 - Sorry if I may have missed your point but does this mean that an Operating Procedure is only required for specific controls within our ISMS, such as backup procedures and SIEM tools etc?
Answer: Your understanding is correct. Documents such as policies and procedures are required only when related controls identified as applicable in your Statement of Applicability demand documentation. Examples are controls A.9.1.1 Access control policy, and A.12.1.1 Documented operating procedures. Regarding backup, control A.12.3.1 Information backup does not require procedures to be documented, only that backup copies are taken and tested regularly (in this case documentation is more a question of good practice). -
ISO 27001 for datacenters
Answer:
ISO 27001 can be used to certify organizations of any industry or size regarding how they protect information (by using a risk management approach to identify and treat relevant risks), so you can use it to certify a data center.
We are not experts on countries local regulations or practices, so we cannot inform you if other countries or organizations apply the same approach as you described for the Australia Federal Government, but what we can say is that, in the case of Australia Federal Government, ISO 27001 can help you identify the requirements you need to fulfill for the classification level you want to apply to, and select, implement and manage the proper controls to h andle relevant risks.
For example, if for T4 level cryptographic controls are required, ISO 27001 can provide guidance on this by means of controls A.10.1.1 Policy on the use of cryptographic controls and A.10.1.2 Key management.
These articles will provide you further explanation about ISO 27001:
- ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
- ISO 27001 Case study for data centers: An interview with Goran Djoreski https://advisera.com/27001academy/blog/2013/10/29/iso-27001-case-study-for-data-centers-an-interview-with-goran-djoreski/
These materials will also help you regarding ISO 27001:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
ISO 27017 certification
We've received additional question:
>Thanks for the answer, but I still have not received a response to the question, are there any documents that can only be used for 27017 assuming that I already have prepared documents for 27001?
Answer:
First of all, sorry for this confusion.
Most of the adjustments to include ISO 27017 recommendations can be made on existent ISO 27001 documents. The only documents you should create specifically for ISO 27017 are a Cloud Security Policy and a Policy for Data Privacy in the Cloud.
To see an example on how ISO 27017 recommendations relate to ISO 27001 documents, please take a look at the List of documents file of our ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit at this link: https://advisera.com/wp-content/uploads//sites/5/2019/03/List_of_documents_ISO_27001_ISO_27017_ISO_27018_Cloud_Documentation_Toolkit_EN.pdf -
Integrating Quality and Environment in a Management System
1. How is ISO 9001 to my industry?
Answer:
Look into clause 4.2 of ISO 9001:2015. Determine the relevant interested parties, the stakeholders, and determine their requirements and expectations. Quality in most organizations is about satisfying requirements and expectations of interested parties, quality is about having hydropower availability when expected, quality is about minimizing costs. Model the functioning of your organization as a set of processes that want to deliver satisfied interested parties, availability, and efficiency.
“2. How do I easily integrate both management systems since they are both being manned by one person?”
Answer:
You can compare both standards and realize that there is a lot in common. When I implement integrated management systems, I describe the organization as a set of processes that deliver the purpose, the mission of the organization. Then, after an initial environmental assessment, I determine what processes or activities must be improved or standardized in order to eliminate or minimize significant environmental impacts. That translates into making changes in some of the processes. Concerning top management, the policy, objectives, context, interested parties and part of the risks are common.
The following material may help you with that challenge:
- How to integrate ISO 14001 and ISO 9001 - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/how-to-integrate-iso-14001-and-iso-9001/
- How to implement integrated management systems - https://advisera.com/articles/how-to-implement-integrated-management-systems/
- ISO 9001 Implementation diagram - https://info.advisera.com/9001academy/free-download/iso-9001-implementation-diagram
- Free ISO 9001:2015 Gap Analysis Tool - https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
- Free webinar on demand – How to integrate ISO 9001:2015 and ISO 14001:2015 - https://advisera.com/9001academy/webinar/how-to-integrate-iso-90012015-and-iso-140012015-free-webinar-on-demand/
- Free online ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Free online ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-lead-implementer-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Requirements to become consultant
Do I need to be certified, in some way, to help them design and implement a Quality management policy that will eventually be audited by an ISO auditor?”
Answer:
No, you do not need to be certified in any way. As long as you have project management skills, as long as you have communication skills and as long as you know the management system standard.
The following material may help you with that challenge:
- ISO 9001 – Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/
- ISO 9001 Implementation diagram - https://info.advisera.com/9001academy/free-download/iso-9001-implementation-diagram
- Free ISO 9001:2015 Gap Analysis Tool - https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
- Free course - ISO 9001:2015 Found ations Course - https://advisera.com/training/iso-9001-foundations-course/
- Free course - ISO 9001:2015 Lead Implementer Course - https://advisera.com/training/iso-9001-lead-implementer-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 9001 and Construction
1. Where should we start?
Answer:
When implementing a QMS I see it as a project with two work fronts A and B.
A is about modeling how the organization works based on what is called the process approach. Describing an organization as a set of interacting projects.
See this generic example:
Then, for each process look for what can go wrong and should be improved, look for opportunities to take advantage, and see if ISO 9001:2015 requirements are already being met. Describe those processes in order to standardize your work.
B is about where is the organization going to. It is about strategic orientation, objectives, and plans to meet them.
2. Is it beneficial that we already have SOP in place?
Answer: It is very beneficial. That means that there is a culture of organizing the work, there is already experience of having internal standards.
3. As a construction company, what part of physical construction work needs to be outlined and documented within the QMS?
Answer: One of the first activities in B, mentioned above, is defining the QMS scope. Your organization can do a lot of construction work and define that will be only about bridge construction, for example.
4. How is remove and replace construction work defined? Product or service?
Answer: Trust me that is not important. For example, there is a marketing approach called service-dominant logic that defends that everything is the service. When a customer contracts your organization they do not care about construction. They want the outcome of your organization's work
5. How do most construction companies define their organizations?
Answer: List a number of construction companies that you know and are certified and search the internet for their certificate and check what is their scope.
The following material will provide you information about implementing a QMS:
- ISO 9001 – How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- Would construction companies benefit from ISO 9001? - https://advisera.com/9001academy/blog/2016/06/07/would-construction-companies-benefit-from-iso-9001/
- Case study for ISO 9001:2015 transition in a construction company - https://info.advisera.com/9001academy/free-download/case-study-for-iso-9001-2015-transition-in-a-construction-company
- Free online ISO 9001:2015 Lead Implementer Course - https://advisera.com/training/iso-9001-lead-implementer-course/
- Free webinar on demand – Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Does the medicinal product licence holder need to comply with ISO 13485 ?
Answer:
As a product license holder (with no manufacturing responsibilities including primary assembly of products), you are not required to comply with ISO 13485 however your contract manufacturer has to comply with ISO 13485.
For further information, please look at the following article:
-What are the consequences of noncompliance with ISO 13485 for manufacturers of medical devices? https://advisera.com/13485academy/blog/2017/11/02/what-are-the-consequences-of-noncompliance-with-iso-13485-for-manufacturers-of-medical-devices/