Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Becoming a quality manager
Answer:
I try to put myself in the shoes of someone wanting to find someone competent to be a quality manager. I would do questions to try to find if a person has the right attitude and experience because, before the job interview, I would already have sort candidates by their knowledge and a cademic background (knowledge of standards, of auditing, of statistics).
I would like to find a candidate that is good at:
Communication – communication with colleagues, with top management, with regulators, with customers, with auditors, with suppliers (includes reporting skills)
Project management skills – more and more work is done through projects involving people from inside and outside the organization
Problem-solving – use and help others use quality tools for problem-solving, for root cause analysis
Practical thinking – someone that avoids bureaucracy and is focused on sustainable results
Customer focus – someone that can work as an inside ambassador of the customers, those that support the existence of the organization
The following material will provide you information about being a quality manager:
- ISO 9001 – What is the job of the Quality Manager according to ISO 9001? - https://advisera.com/9001academy/blog/2016/08/23/what-is-the-job-of-the-quality-manager-according-to-iso9001/
- What is the job of the quality management representative? - https://advisera.com/9001academy/knowledgebase/what-is-the-job-of-the-quality-management-representative/
- Free online ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Protecting against external and environmental threats
Do you have a template that covers A11.1.1-4? If not, would you recommend that I create a new doc for those or append them to the Working in Secure Areas doc? We’re a small company (45 people) and I’m trying to keep the count down.
Answer:
Controls A.11.1.1 (Physical security perimeter) to A.11.1.4 (Protecting against external and environmental threats) are not commonly applicable on small companies, neither a policy to cover them is mandatory for ISO 27001, that's why a document covering them is not included in the toolkit.
Since you identified these controls are applicable to your context, and it refers to physical protection, we recommend you to create a new document, since the information on Procedures for Working in Secure Areas is not much related to it.
If you understand you need support to develop such document, you can schedule a meeting w ith one of our experts through this link: https://advisera.com/27001academy/consultation/
These articles will provide you further explanation about Protecting against external and environmental threats:
- How to protect against external and environmental threats according to ISO 27001 A.11.1.4 https://advisera.com/27001academy/blog/2016/01/25/how-to-protect-against-external-and-environmental-threats-according-to-iso-27001-a-11-1-4/ -
Information Security Management course for non IT professionals
Answer:
Information Security Management courses based on ISO 27001 standard do not require previous IT knowledge, so these courses also can be, and should be, attended by non IT professionals, so they can also be aware on how to protect information properly.
This article will provide you further explanation about ISMS based on ISO 27001:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
This material will also help you regarding ISO 27001:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Scope definition
1 . With regards to the scope, please could you help me understand what we need to include and how to complete part 3 of the scope document. We have an office which is leased and is on the ground floor of the building and our two servers are on the 3rd floor in the server room (this room is shared by all the different companies in the building). We also occasionally work from home using the business laptops.
Answer: Considering your stated scenario, you should include in the ISMS scope the office you work in, your two servers and, of course, the processes/services and information you want to protect. The information about the situation of the server room and the homeworking should be considered on the risk assessment and treatment process.
These articles will provide further information:
- How to define the ISMS scope https://ad visera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
2 . Also, you have a laws and regulations list on your website for the different countries? Do we just need to comply with all the ones listed for the UK or how do we identify the laws and regulations that apply to our company?
Answer: In the following article you can find a list of some laws and regulations required on United Kingdom:
- Laws and regulations on information security and business continuity https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
Unfortunately, this list is not fully up-to-date because it depends on voluntary contributions from our readers – therefore, it is likely that not all regulations related to United Kingdom are listed.
Regarding compliance with them, you need to identify which ones are applicable to your industry and to the specifics of you business, and for this we recommend you to hire a local legal adviser, to make sure you have identified all relevant laws and regulations. -
Gap Analysis and planning audits
1. Scope of ISMS audit/Gap Analysis, assuming that an organization is not yet implemented ISMS.
Answer: Considering you stated that the organization has not yet implemented the ISMS, then you must consider a Gap Analysis, not an audit, to identify how much of required criteria the organization has already implemented. Considering that, I suggest you to take a look at this free ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
It has a simple question-and-answer format to help you visualize which specific elements of information security management system based on ISO 27001 standard are already implemented, and what still has to be done.
2. Estimate the audit effort
Answer: The main criteria to estimate the audit effort are number of employees and audit complexity. The document you must consider is the IAF MD 5:2015 "Determination of Audit Time of Quality and Environmental Management Systems" and you can find it at this link: https://www.iaf.nu/upFiles/IAFMD5QMSEMSAuditDurationIssue311062015.pdf
Although it's title refers to QMS and EMS it also can be applied to estimate audit days for an ISMS certification audit.
These articles will provide you further explanation about certification audit:
- Becoming ISO 27001 certified – How to prepare for certification audit https://advisera.com/27001academy/iso-27001-certification/
- Which questions will the ISO 27001 certification auditor ask? https://advisera.com/27001academy/blog/2015/07/20/which-questions-will-the-iso-27001-certification-auditor-ask/
These materials will also help you regarding certification audit:
- ISO 27001/ISO 22301: The certification process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001iso-22301-certification-process-free-webinar-demand/
- Preparing for ISO Certification Audit: A Plain English Guide https://advisera.com/books/preparing-for-iso-certification-audit-plain-english-guide/ -
Risk Assessment responsibilities
Answer: ISO 27001 does not prescribe who must perform risk assessment, but common practice is that people who have the most knowledge and understanding of related processes should perform the risks assessment. So, in case of IT or Cybersecurity Risk Assessment, you should consider someone from your IT staff.
This article will provide you further explanation about risk assessment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
These materials will also help you regarding risk assessment:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
2 - Do you have a sample Risk M anagement and Risk Assessment RACI chart ?
Answer: ISO 27001 does not require such chart to be developed, and to make documentation simpler to small business, our templates document roles and responsibilities as part of policies and procedures.
If you want to know how the documentation of a risk assessment and treatment process looks like, I suggest you to take a look at the free demo of our ISO 27001/ISO 22301 Risk Assessment Toolkit at this link: https://advisera.com/27001academy/iso-27001-22301-risk-assessment-toolkit/ -
Risk Assessment
Is it a common practice? Since according to the general understanding of ISMS development I assume that risk assessment should go first.
Answer:
Developing policies and procedures before risk assessment is performed is not a common practice and it is not recommended, because this increase the risks of rework. Even if it seems obvious that some policies are mandatory and you know what should be defined in those policies, if during the risk assessment you identify unacceptable risks you have not thought about earlier, you will have to work on the document again, perhaps needing to make big changes.
Another problem is that if you include in the policy something to treat a risk you think is unacceptable, but in reality the risk is acceptable if you follow the right order and perform risk assessment first, then you are making your policy unnecessary complex and wasting resources.
This article will provide you further explanation about risk assessment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
These materials will also help you regarding risk assessment:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
Templates content
Answer: First it is important to note that SoA is about applicability of controls. Policies and procedures are examples of methods to be used to implement controls, considered applicable because of unacceptable risks, legal requirements or top management decisions. It is also true that you can simply use one phrase on SoA to explain how a control will be implemented, and not develop a more complex document.
Considering that, if a control is considered not applicable, an example of good justification is "there are no unacceptable risks or legal requirements which require the implementation of this cont rol".
This article will provide you further information:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
2. Measurement Report: evaluation frequency (which evaluation frequency is recommended?)
Answer: There is no "standard" evaluation frequency that can be defined, because there are many many variables to be considered: level of risk involved, measurement complexity, time to process data, etc. This definition should be made on a case by case basis.
This article will provide you further information:
- How to perform monitoring and measurement in ISO 27001 https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
3. A.11.2.5: Do employees really need written permission?
Answer: The proper term here would be "recorded" permission, which could be either written or included on a computerized information system. The point here is that you must preserve evidences that an authorization was given, so it can be traceable for operational or audit purposes in case of need.
See this article for further information:
- Records management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/11/24/records-management-in-iso-27001-and-iso-22301/
4. A.14: Does a webhosting company (which isn't developing software) have to comply with any of the controls in this chapter at all? I'm really stuck here.
Answer: If an organization does not have a software development process, the only other reason to consider some of controls from section A.14 is when performing system acquisition (e.g. buying a third-party CRM), mainly those related tor definition of security requirements and system acceptance. -
ISO 27001 Toolkit content
Answer:
Some templates include comments with suggestions on how to implement some controls, but these are not detailed technical specifications. ISO 27001 does not focus on technical specifications, but you can rely on other sources like ISO 27002 and NIST SP series.
For more information please read:
- ISO 27001 vs. ISO 27002 https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/
- How to use the NIST SP800 series of standards for ISO 27001 implementation https://advisera.com/27001academy/blog/2016/05/02/how-to-use-the-nist-sp800-series-of-standards-for-iso-27001-implementation/
- How to use NIST SP 800-53 for the implementation of ISO 27001 controls https://advisera.com/27001academy/blog/2016/05/10/how-to-use-nist-sp-800-53-for-the-implementation-of-iso-27001-controls/
2. Is it included in the ISO 27001 Document Package any template in order to compare the progress made with respect to the starting point?
Answer:
The Project Plan template that is included in the toolkit, on folder 01 Project Plan, can enable you to track the main milestones and the progress of the project.
You also can use this free ISO 27001 Gap Analysis Tool to evaluate how much of ISO 27001 you have implemented: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/ -
Management review policy
Answer:
ISO 27001 does not require a specific management review policy to be documented. The requirement for top management to review the ISMS can be found on the Information Security Policy, section 4.5. This template can be found on folder 04 Information Security Policy.
It is important to note that in large majority of cases smaller companies do not write separate Management Review Policy, this is why we didn’t include it into the toolkit.
This article will provide you further explanation about mandatory documents for ISO 27001:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/