Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Document management requirements
Answer:
ISO 27000 series do not have a standard providing description about the Document Management setup/workflow. ISO 27001 only defines what must be fulfilled (e.g., documents must be approved, be available to users, etc.). There are other ISO standards that can provide requirements you can use to setup and elaborate the workflow of a DMS (e.g., ISO 15489 Information and documentation – Records management)
If you want to see how a document management system looks like, I suggest you to take a look at our platform Conformio at this link: https://advisera.com/conformio/
Conformio has a set of functionalities for DMS that are fully compliant with ISO 27001, besides other features that can make easier to implement and manage an ISMS.
These articles can provide you further information about Conformio:
- What kind of Document Management System (DMS) do you need for handling ISO documents? https://advisera.com/conformio/blog/2016/11/29/what-kind-of-document-management-system-dms-do-you-need-for-handling-iso-documents/
- Top 5 features of your online ISO document management system https://advisera.com/conformio/blog/2017/06/28/top-5-features-online-iso-document-management-system/
This article will provide you further explanation about document management:
- Document management in ISO 27001 & BS 25999-2 https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/
This material will also help you regarding document management:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/ -
Risk assessment and risk treatment
Answer: All our templates from our ISO 27001 Toolkits, including the templates for risk assessment and risk treatment, are fully compliant with requirements of ISO 27001.
At this link you can see all templates that cover the risks assessment and risk treatment process: https://advisera.com/27001academy/iso-27001-22301-risk-assessment-toolkit/ :
- Risk Assessment and Risk Treatment Methodology
- Risk Assessment Table
- Risk Treatment Table
- Risk Assessment and Treatment Report
- Statement of Applicability
- Risk Treatment Plan
On the links for the individual templates you can see which requirements are covered by each document. For example, the Risk Assessment and Risk Treatment Methodology (https://advisera.com/27001academy/documentation/Risk-Assessment-and-Risk-Treatment-Methodology/) cover the following requirements: ISO/IEC 27001 6.1.2, 6.1.3, 8.2, and 8.3; ISO 22301 8.2.1, 8.2.3.
2. What precautions should be taken to avoid getting Non Conformity on this?
Answer: Key points to pay attention when performing risk assessment and risk treatment are to consider the proper inputs (e.g., legal requirements, scope and policy, etc.), so you do not leave any relevant area of your system uncovered, to cover all the assets in the ISMS scope during the risk assessment (if you decide to use the asset-based approach), and to ensure your risk evaluation and treatment options are aligned with your risk acceptance criteria.
This article will provide you further explanation about risk assessment and risk treatment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
This material will also help you regarding risk assessment and risk treatment:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Transition from ISO 9001:2008 to ISO 9001:2015
Answer:
Let me try to give an itinerary that perhaps you can use. First check this article with a useful infographic about the differences between ISO 9001:2008 and ISO 9001:2015 - Infographic: ISO 9001:2015 vs. 2008 revision – What has changed? - https://advisera.com/9001academy/knowledgebase/infographic-iso-90012015-vs-2008-revision-what-has-changed/
Then, read this White Paper - Twelve-step transition process from ISO 9001:2008 to 2015 revision - https://cdn2.hubspot.net/hubfs/1983423/9001Academy/9001Academy_FreeDownloads/Twelve_step_transition_process_from_ISO_9001_2008_to_2015_revision_EN.pdf (perhaps this step by step approach could be useful). BTW, why not watch this webinar on demand about the subject - Free webinar – ISO 9001:2015 - How to make the transition from ISO 9001:2008 - https://advisera.com/9001academy/webinar/iso-90012015-how-to-make-the-transition-from-iso-90012008-free-webinar-on-demand/
After this I believe you can be more confident about your transition plan. Feel free to test your ideas with me. -
Certifying a specific department within an organization
Answer:
Yes, it is. As long as that department specifies to what interested parties are working and what are their relevant requirements. There is no problem. In my country, several hospitals started their involvement with quality management systems by certifying individual services.
The following material will provide you more information about ISO 9001 and interested parties:
- How to determine interested parties and their requirements according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/11/10/how-to-determine-interested-parties-and-their-requirements-according-to-iso-90012015/
- Understanding needs & expectations of interested parties in ISO 9001:2015 - https://advisera.com/9001academy/blog/2017/10/24/understanding-needs-expectations-of-interested-parties-in-iso-90012015/
- Fre e online training ISO 9001:2015 Lead Implementer Course - https://advisera.com/training/iso-9001-lead-implementer-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 9001 for NGOs
Or if there is specific ISO for non-governmental organization that works in the humanitarian sector specifically?”
Answer:
Yes, ISO 9001 can and is applied in non-governmental organizations. For example, in my country several non-profit organizations that provide services to senior citizens are certified. With this kind of organizations, the focus is on the network of interested parties.
The following material will provide you more information about ISO 9001 for nonprofits:
- How to determine interested parties and their requirements according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/11/10/how-to-determine-interested-parties-and-their-requirements-according-to-iso-90012015/
- Understanding needs & expectations of interested parties in ISO 9001:2015 - https://advi sera.com/9001academy/blog/2017/10/24/understanding-needs-expectations-of-interested-parties-in-iso-90012015/
- free online training ISO 9001:2015 Lead Implementer Course - https://advisera.com/training/iso-9001-lead-implementer-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Major and minor nonconformities
Answer:
Minor nonconformity - a nonconformity that does not affect the capability of the management system to achieve the intended results.
Major nonconformity - a nonconformity that affects the capability of the management system to achieve the intended results. For example, if the company completely failed to fulfill a certain requirement; if a process has completely fallen apart; or if you have several minor nonconformities that are related to the same process or to the same element of your management system.
The following material will provide you information about audits:
- Major vs. minor nonconformities in the certification audit - https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
- Free online training ISO 9001:2015 Internal Auditor Course - https://training.advisera .com/course/iso-9001-internal-auditor-course/
- Book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Toolkit content
Answer:
First of all, sorry for this confusion. In fact you do not have to perform internal audits for ISO 22301/BS 25999-2 if you want to be compliant with ISO 27001 only.
The "Annual Internal Audit Program" template was designed to be compliant with both ISO 27001 and ISO 223001/BS 25999-2 (these standards have the same requirements regarding internal audit), so the text on the template covers all these standards, but in the comments included in the template we show which text you can exclude in case you are using the template for only one of these standards.
This article will provide you further explanation about ISO 27001 internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
These materials will also help you regarding ISO 27001 internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 INTERNAL AUDITOR COURSE https://advisera.com/training/iso-27001-internal-auditor-course/ -
ISO 27001 lead implementer and audit responsibility
Answer: ISO does not issue certificates, only standards. Those who issue certificates to persons are accredited training providers. At the end of an ISO 27001 Lead Implementer course you can take an exam, and if approved, you will receive a certificate of Lead Implementer.
This article will provide you further explanation about the lead implementer course:
- What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
This material will also help you regarding to become a Lead Implementer:
- ISO 27001:2013 LEAD IMPLEMENTER COURSE https://advisera.com/training/iso-27001-lead-implementer-course/
2. Internal audit is responsibility of the security team or other departments?
Answer: ISO 27001 does not prescribe who has to be responsible for the internal audit, so you can define this responsibility according your needs, provid ed that you can evidence the auditors have the proper competence and they have no conflict of interest (i.e., auditor must not audit their own work).
This article will provide further information about internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
This material will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 INTERNAL AUDITOR COURSE https://advisera.com/training/iso-27001-internal-auditor-course/ -
Lead auditor certification
Answer:
Here is the Lead Auditor course from Advisera: https://advisera.com/training/iso-27001-lead-auditor-course/
These articles will provide you further explanation about becoming lead auditor:
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/ -
Controls in ISO 9001
Response:
Depending on the context of the organization, the company will need to define and document specific controls. Also you need to look at the risks related to your products, processes and resources to determine the required controls. Those controls include engineering controls procedures (e.g. procedure for control of non-conforming product), work instructions, plans, etc. You can decide to implement them following a particular hierarchy (e.g. elimination) and also you can consider to use some controls in combination.
You can also see these materials to help you with controls in ISO 9001:2015:
- Article - How to control outsourced proccesses using ISO 9001: https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
- Article - How to identify risk controls i n ISO 9001:2015: https://advisera.com/9001academy/blog/2019/01/21/how-to-identify-risk-controls-in-iso-90012015/
- Article - What does external documents control mean in ISO 9001: https://advisera.com/9001academy/blog/2019/02/04/what-does-external-documents-control-mean-in-iso-9001/
- Book – Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Free on-line training – ISO 9001:2015 Foundations: https://advisera.com/training/iso-9001-foundations-course/