Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
DPO role
Answer:
You can but you may find yourself in a potential conflict of interest as you as a CISO are in charge of keeping data assets safe and while doing that you will need to take some measures that may be intrusive. On the other hand, as a DPO you will need to ensure that those measures are not infringing the rights and freedoms of the data subjects.
If you want to find out more about the role of the DPO, check out our webinar “Role of the DPO according to EU GDPR” (https://advisera.com/eugdpracademy/webinar/role-of-the-dpo-according-to-eu-gdpr-free-webinar-on-demand/) -
Acciones que surgen de la identificación de riesgos
Respuesta:
No existe ningún nombre específico para esas acciones, sino que se suelen denominar acciones para abordar los riesgos y las oportunidades.
Dentro de las acciones tomadas la organización puede decidir entre varias opciones:
- Evitar riesgos
- Asumir riesgos
- Eliminar la fuente de riesgo, cambiando por ejemplo procesos, materias primas, etc
- Cambiar la probabilidad de que ocurra el riesgo o las consecuencias del mismo
- Compartir el riesgo, por ejemplo con los proveedores
- Mantener el riesgo asumiéndolo ya que su eliminación o mitigación no compensa a la organización.
Para más información sobre acciones para abordar riesgos y oportunidades puede ver estos materiales:
- Artículo - How to address risks and opportunities in ISO 9001: https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Libro - Discover ISO 9001:2015 through practical examples: https://advisera.com/ ooks/discover-iso-9001-2015-through-practical-examples/
- Curso gratuito en línea - Fundamentos de ISO 9001:2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ -
Operational controls in ISO 14001:2015
Response:
An organization must decide how to develop processes to make sure that operational control of its environmental aspects is achieved. Among these controls could be included:
- building processes to get consistent outcomes
- analysing the life cycle of a product when putting controls in place
- using technology to ensure results
- ensuring employees are properly trained
- performing processes in a certain way
- monitoring and measuring of results
It is crucial that the organization also considers what parts of your operational control process are required to record as documented information. Controls can include engineering procedures and procedures.
You can see these materials to help you with the operational controls in ISO 14001:2015:
- Article - Defining and implementing operational control in ISO 14001:2015: https://advisera.com/14001academy/blog/2016/04/11/defining-and-implementing-operational-control-in-iso-140012015/140012015/
- Book – The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- Free on-line training – ISO 14001:2015 Foundations: https://advisera.com/training/iso-14001-internal-auditor-course/ -
How to control documented information
Response:
You can create a procedure to ensure the control over the the creation, approval, distribution, usage and updates of documented information (documents and records ) used in your Quality Management System. Here is an example of a procedure, you can download a free preview of it - Procedure for Document and Record Control: https://advisera.com/9001academy/documentation/procedure-document-record-control/
To learn more about the contrl of documented information in the QMS, see:
- Article - New approach to document and record control in ISO 9001:2015: https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- Book – Managing ISO documentation: a plain English guide: https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Free on-line training – ISO 9001:2015 Foundations: https://advisera.com/training/iso-9001-foundations-course/ -
Physical security
Answer: First is important understand that for ISO 27001 a "need" is based on results of risk assessment. Considering that, you only have to physically separate your scope if there are unacceptable risks related to keeping a single environment.
2. Our staff always have meetings and they always need to sit and discuss and collaborate on certain tasks and projects that happen between different departments. Shutting down the entrances and closing all the doors between the departments and limiting access will hinder the workflow and coherence of the company. Is there another way about that? Or is the policy very clear and very strict in terms of physical isolation of the departments that are in the scope from the rest of the company? In case it was very strict and isolation measures need to be implemented, would magnetic see throug h doors with swipe cards to isolate the departments who are in scope from the external of scope be sufficient enough? I found this article on your website:
https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-27001-how-to-protect-the-secure-areas/
Answer: The same previous answer applies here, you only need to limit access to the scope if there are unacceptable risks that must be treated. In case you indeed have to limit access, you can use the alternative you mentioned (i.e., swipe cards) if it does lead to unacceptable risks.
3. But I would greatly appreciate it if there are more detailed articles about physical security that you might be able to share with me, especially for organizations that are only certifying part of their services.
Answer: First of all thanks for this feedback. In fact this answer may be a good idea for an article. If you kindly provide additional examples of what you would like to see we can verify this possibility. For other articles about physical security, please see:
- The most common physical and network controls when implementing ISO 27001 in a data center https://advisera.com/27001academy/blog/2019/02/26/the-most-common-physical-and-network-controls-when-implementing-iso-27001-in-a-data-center/
- How to implement equipment physical protection according to ISO 27001 A.11.2 – Part 1 https://advisera.com/27001academy/blog/2016/04/18/how-to-implement-equipment-physical-protection-according-to-iso-27001-a-11-2-part-1/
- How to implement equipment physical protection according to ISO 27001 A.11.2 – Part 2 https://advisera.com/27001academy/blog/2016/04/26/how-to-implement-equipment-physical-protection-according-to-iso-27001-a-11-2-part-2/
- How to protect against external and environmental threats according to ISO 27001 A.11.1.4 https://advisera.com/27001academy/blog/2016/01/25/how-to-protect-against-external-and-environmental-threats-according-to-iso-27001-a-11-1-4/ -
Internal Auditor
Answer:
If you need to do activities related to internal audit (e.g. plan/prepare for/conduct) or you want to work and develop your career in this area – YES. Find out more in the article (although ISO 27001 – it's applicable on ISO 20000 too) “ISO 27001 Internal Auditor training – Is it good for my career?” https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/
2- Market value and if I complete that, would I be certified straight away after passing the exam?
Answer: Yes, you get your certificate right after the exam.
3- Would my certificate have an expiry or renewal requirement?
Answer: No, they don't. I would recommend renewing certificate once the new revision is published.
4- Do I have to look for some specific organization with some specific accreditation to take that training?
Answer: No, no specific company.
5- If a company says they don't have A PMG accreditation, instead for ISO courses they've global recognition to accredit themselves – what would that mean?
Answer: That depends also on market you cover (local vs. global)Read the article to learn more “Qualifications for an ISO 27001 Internal Auditor” https://advisera.com/27001academy/blog/2015/03/30/qualifications-for-an-iso-27001-internal-auditor/ -
Performing audits
Answer: Certification audits are conducted according these stages:
- Documentation review: at this stage the auditor checks if all mandatory policies, procedures, plans and records are in place.
- Main audit: at this stage the auditor, by means of techniques such as observation, interviews and log review, checks if processes and personnel are performing according what is documented. It is at the end of this stage that any identified non compliance is raised.
- Surveillance visits: once you get certified, you have to keep the system working during the three-years certification period. To ensure that, an auditor will come periodically to check if the system is in place and ask for adjustments when needed.
These articles will provide further information:
- Becoming ISO 27001 certified – How to prepare for certification audit https://advisera.com/27001academy/iso-27001-certification/
- ISO 27001/ISO 22301: The certification process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001iso-22301-certification-process-free-webinar-demand/
- Major vs. minor nonconformities in the certification audit https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
- ISO 27001 Certification: What’s next after receiving the audit report? https://advisera.com/27001academy/blog/2015/05/18/iso-27001-certification-whats-next-after-receiving-the-audit-report/
- Surveillance visits vs. certification audits https://advisera.com/27001academy/knowledgebase/surveillance-visits-vs-certification-audits/
2. What does one take into account when planning for the audit as an auditor?
Answer: The certification auditor has to develop the audit plan to making sure that all documents are compliant with the standard's requirements and that everyone is complying with all the implemented documents. The auditor can do that by means of developing a checklist to help him to ask for the necessary documents and records, as well as to which process to observe and people to interview.
This article will provide you further information:
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/ -
Inventory of assets
If these tools are used to process information you want to protect they have to be included in you inventory of assets.
This article will provide you further explanation about inventory of assets:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/ -
Defining scope
Answer:
The most important criteria you have to adopt for defining the ISMS scope are:
- which information you want to protect.
- by where this information flows, and where they are processed and stored.
- the effort to keep the environment you want to protect separated from the rest of the environment.
For example, for organizations up to 50 employees normally it is easier to define the wholly organization inside the ISMS scope. In your case, if the information is contained in specific departments, may be easier to define only these departments in the scope (if not then you should define the wholly organization inside the ISMS scope).
Regarding the remote workers, normally you do not control the environment where they are, so the se are kept out of the scope, and you treat remote access as a risk in your assessment.
These articles will provide you further explanation about defining scope:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
If you believe you still need support for defining the scope, you an schedule a meeting with one of our experts at this link: https://advisera.com/27001academy/consultation/ -
Implementing ISMS and BCMS
Answer: The order of implementation will depend on your needs. If your priority is information protection, then you should go first for an ISMS. On the other hand, if your priority is to ensure processes and services delivery under disruptive conditions, then you should go first for a BCMS. It is important to note that if you use as basis for these systems the standards ISO 27001 (for information security) and ISO 22301(for business continuity), you can implement parts of these systems simultaneously, because the have many requirements in common.
These materials will provide further information:
- What to implement first: ISO 22301 or ISO 27001? https://advisera.com/27001academy/blog/2017/04/03/what-to-implement-first-iso-22301-or-iso-27001/
- How to implement integrated management system https://advisera.com/blog/2015/10/05/how-to-implement-integrated-management-systems/
- Free webinar – ISO 27001 & ISO 22301: Why is it better to implement them together? https://advisera.com/27001academy/webinar/iso-27001-iso-22301-better-implement-together-free-webinar-on-demand/
2 . What is Step by step guidelines if I need to implement both?
Answer: In a general manner, you have these steps:
- Obtain management support
- Develop a project plan
- Define scope (related to each standard)
- Define top level policies (related to each standard)
- Define basic management system procedures (common to both standard)
- Develop specific policies and procedures (related to each standard)
- Implement policies and procedures and train personnel
- Perform internal audit
- Perform management review
- Proceed with corrective actions
The following articles will provide you explanation of the steps to implement both standards:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- 17 steps for implementing ISO 22301 https://advisera.com/27001academy/knowledgebase/17-steps-for-implementing-iso-22301/