Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Is ISO 13485 required if we manufacture non-medical parts?
Answer:
ISO 13485 applies to all companies dealing with medical devices. Since in your case, you have clarified that the plastic part is not part of the medical device, ISO 13485 will not be applicable to you. However , you will still need to maintain the specifications and technical details about the part that you are manufacturing for the medical device manufacturer. Since you are currently certified to ISO 9001, it will be quite easy for you to adapt to ISO 13485 which will give you more advantage with your medical device clients in the future.
For more information, please refer to :
-Six key benefits of ISO 13485 implementation
https://advisera.com/13485academy/knowledgebase/six-key-benefits-of-iso-13485-implementation/
-How to structure Quality Management System documentation according to ISO 13485
https://advisera.com/13485academy/knowledgebase/how-to-structure-quality-management-system-documentation-according-to-iso-13485/
-Checklist of ISO 13485 implementation and certification steps
https://advisera.com/13485academy/knowledgebase/checklist-of-iso-13485-implementation-and-certification-steps/
- ISO 9001 vs. ISO 13485
https://advisera.com/9001academy/blog/2015/01/21/iso-9001-vs-iso-13485/ -
Toolkit content
1. Regarding Inventory of assets: Which assets must be documented? In the tab "Type of Asset" I see a very long list and I think it's not achievable to document all the risks for all these assets, hence the question.
Answer: First it is important to note that you do not need to use all assets listed on the "Type of Asset" tab, they are only suggestions to help you identify which risks are relevant to your organization (the risks that quickly come to your mind). Considering the asset-threat-vulnerability approach for risk assessment this is quite straightforward (from that list you pick the most common and important assets you have, and from them you identify related threats and vulnerabilities).
These articles can provide you additional information:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
2. Let us say a control is neither relevant for our company or mandatory for ISO 27001, would I be allowed to write at justification for non-selection that it isn't mandatory for us / ISO 27001?
Answer: A more robust justification for excluding a control would be "There are no unacceptable risks, or legal requirements that demand the implementation of this control", because this one makes explicit the main reasons not to implement a control.
This article can provide you additional information:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
3. Regarding the video tutorial 'How to Write Statement of Applicability' at minute +- 13:45: You're speaking about two mandatory documents, are these by default in the Statement of Applicability template? If that's not the case, in which document can I find these?
Answer: I'm understanding that you are referring to approval of residual risks and the approval for the ISMS implementation. As explained in the tutorial the approval of residual risks is included in the SoA. The record of the approval for the ISMS implementation is done through the Risk Assessment and Treatment Report, located on folder 05 Risk Assessment and Risk Treatment Methodology in your toolkit.
4. In case you're a Web hosting company, the Secure Development Policy isn't mandatory, right? If that is the case, is there anything specific that must be written, or is something similar to this alright: "This Policy is mandatory for ISO 27001, however this is not applicable in our business due to not developing software" ?
Answer: First it is important to note that in the Statement of Applicability the justification refers to controls, not documents. Documents are listed on implementation method, if a control is applicable.
Controls from ISO 27001 Annex A are mandatory only if:
- There are risks identified as unacceptable in the risk assessment that require the implementation of such controls
- There are legal requirements (e.g., contracts, laws, and regulations) that require the implementation of such controls
- There is a top management decision requiring the implementation of such controls
If none of these options occur there is no need to implement such controls, or documents which cover them. In you case you can use the same justification from answer 1 ("There are no unacceptable risks, or legal requirements that demands the implementation of this control")
5. Where could I document all the non-employees of the company in the ISMS Scope Document (apparently they have to sign the 'Statement of Acceptance of ISMS Documents'), do I just document them at 5.2 Organizational units?
Answer: The need for them to sign the 'Statement of Acceptance of ISMS Documents' does not mean they have to be part of the ISMS scope, only that they have to be aware of this document.
Non-employees which are related to processes, services, organizational units, locations, or IT infrastructure inside the scope are normally handled through clauses on contracts and service agreements. -
Approaching a case - legal, policy and environmental assessment
QUESTIONS
1. Give the specific legal and policy provisions as per ISO 14000 environmental management framework for this project?”
Answer:
If the proposed location of the construction of the plant is a forest reserve area, then the specific legal provisions have to be directly negotiated with government and/or local authorities because that kind of organization is not easily compatible with a forest reserve area. Due to the planned location, policy should set guidelines around: “scenic areas, water sources, and ecologically sensitive areas within the radius of the project area”
“2. Give a detailed account on how you will carry out an environmental impact assessment?”
Answer:
I cannot give a detailed account of this space. However, I invite you to check these links:
Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business -https://advisera.com/books/the-iso-14001-2015-companion/ -
Updated article
Answer:
This article was already updated considering the 2013 revision of ISO 27001, so these tips are still applicable.
These articles will provide you further explanation about risk assessment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- How to write ISO 27001 risk assessment methodology https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
These materials will also help you regarding risk assessment:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
Controls information
Answer:
For domains A.5 (Information security policies) I suggest you these articles:
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
- One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/
- Why is management review important for ISO 27001 and ISO 22301? https://advisera.com/27001academy/blog/2014/03/03/why-is-management-review-important-for-iso-27001-and-iso-22301/
For domains A.13 (Communications security) I suggest you these articles:
- How to manage network security according to ISO 27001 A.13.1 https://advisera.com/27001academy/blog/2016/06/27/how-to-manage-network-security-according-to-iso-27001-a-13-1/
- Using Intrusion Detection Systems and Honeypots to comply with ISO 27001 A.13.1.1 network controls https ://advisera.com/27001academy/blog/2016/07/04/using-intrusion-detection-systems-and-honeypots-to-comply-with-iso-27001-a-13-1-1-network-controls/
- How to manage the security of network services according to ISO 27001 A.13.1.2 https://advisera.com/27001academy/blog/2017/02/13/how-to-manage-the-security-of-network-services-according-to-iso-27001-a-13-1-2/
- Requirements to implement network segregation according to ISO 27001 control A.13.1.3 https://advisera.com/27001academy/blog/2015/11/02/requirements-to-implement-network-segregation-according-to-iso-27001-control-a-13-1-3/ -
ISO 27001 2017 review
Answer:
This 2017 version refers to the British version of ISO 27001 (the BS EN ISO/IEC 27001:2017), which does not include any change that impacts requirements defined by the ISO 27001:2013.
Considering that, Conformio set of documents is also compliant with this British version of ISO 27001.
This article will provide you further information:
- European 2017 Revision of ISO/IEC 27001: What has changed? https://advisera.com/27001academy/blog/2017/10/25/european-2017-revision-of-isoiec-27001-what-has-changed/ -
Documenting controls
Answer:
First lets understand the differences between these documents. Normally policies define general guidelines (what must be done), while procedures are more specific (defining how to perform an activity), but it is not mandatory that your documentation is divided in such way.
Considering that, if your "policy" fulfills requirements from Annex A control A.9.4.2 this is compliant with ISO 27001 and will be acceptable for certification audit.
These articles will provide you further explanation about documenting controls:
- How to structure the documents for ISO 27001 Annex A controls https://advisera.com/27001academy/blog/2014/11/03/how-to-structure-the-documents-for-iso-27001-annex-a-controls/
- How detailed should the ISO 27001 documents be? https://advisera.com/27001academy/blog/2014/09/ 22/detailed-iso-27001-documents/
These materials will also help you regarding documentation:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/ -
Certification in multiple geographic locations
Answer:
First of all, implementing a certification in multiple geographic locations is a complex task and you should go for it only if it is really necessary for business strategies and objectives. Instead you should consider the prioritization of locations and implementing the certification one location at a time.
Regarding project steps to become certified, they are practically the same for single and multiple locations. Broadly speaking, to implement ISO 27001 an organization has to:
- Obtain top management support
- Define and document a scope based on the needs and expectations of interested parties relevant to information security. At this point, for a multiple location project, you have to identify common needs and handle conflicting issues regarding the multiple locations (e.g. conflicting laws and regulations).
- Define, document and communicate an information security policy and responsibi lities relevant to operation and management of information security. For a multiple location project you should consider an organization wide-policy defining common requirements and defining that local issues are to be considered for specific topics (e.g., common issue may be top management commitment to ISMS, and a specific issue are the definition of security objectives for each location.
- Define a risk assessment and treatment methodology
- Define and allocate competencies and resources for the operation and management of information security
- Implement risk assessment and risk treatment
- Operate the security controls and generate the necessary records. This another point where implementation can differ according the location
- Measure, monitor and evaluate the information security performance
- Implement corrections and improvements
Regarding support required, to increase chances of success, it is important that persons involved have experience in project management and knowledge of the standard, and that you consider hiring expert legal advise to map legal requirements and handle conflicting issues.
A last, but not least, the point is that you have to consider a certification body that can cover all locations you wish to include in your certification.
These articles will provide you further explanation about ISO 27001:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- Who should be your project manager for ISO 27001/ISO 22301? https://advisera.com/27001academy/blog/2014/12/01/who-should-be-your-project-manager-for-iso-27001-iso-22301/ -
Using the context of the organization
Answer:
Although ISO 9001:2015 does not require a documented context of the organization when working with organizations, help them develop a document, a report for example, that acts as an input to the management review. Organizations should determine the context and use it to inform decision making. That way, we also ensure that for the next management review the context information is updated.
You can find more information in the following links:
- ISO 9001:2015 Case study: Context of the organization as a success factor in manufacturing company - https://advisera.com/9001academy/blog/2016/10/11/iso-90012015-case-study-context-of-the-organization-as-a-success-factor-in-manufacturing-company/
- How to identify the context of the organization in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-identify-the-context-of-the-organization-in-iso-90012015/
- Free online ISO 9001:2015 Foundations Course - https://tr aining.advisera.com/course/iso-90012015-foundations-course/
- Free webinar – ISO 9001:2015 clause 4 - Context of the organization, interested parties, and scope - https://advisera.com/9001academy/webinar/iso-90012015-clause-4-context-of-the-organization-interested-parties-and-scope-free-webinar-on-demand/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
BCP/BIA templates
Answer:
For BIA toolkit I suggest you to take a look at this free demo: https://advisera.com/27001academy/iso22301-business-impact-analysis-documentation-toolkit/
Or if you want to implement whole ISO 22301 (including BIA and BCP), you can upgrade to this ISO 27001 & ISO 22301 Premium Documentation Toolkit: https://advisera.com/27001academy/iso-27001-22301-premium-documentation-toolkit/
Also, I’m looking at Conformio, but also need to attach incident, risks, action, etc. Our organization (an agency for UN) is not really big, so budget is a constraint. I would prefer not to go with Eramba (bad experience). Would you have plan for Conformio to add more features ? Or could you suggest a system / platform that can be helpful for us ?
In the second half of 2019 we plan to launch a new version of Conformio which will have a Risk register that will relate assets, threats, vulnerabilities, impact, likelihood, controls, and activities to implement them.