Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Extra Ue personal data
Answer:
Based on the description you provide of the companies, the companies D seem to be the data controllers as they decide what measurements to take in order to provide a suit to the final customer and although not important on its own, companies D are the ones in contact and collecting the personal data from the final customers.
All the other companies A and B will be acting as processors. Company B will be a processor of companies D and company A will be a sub-processor of company B. -
Risk management in general
Answer:
Risk management has four elements:
Risk Determination – determine risks about the system as a whole, about the processes and about the products or services delivered.
Prioritize Risks - Risks do not all have the same importance. Some will be more serious than others. It is necessary to arrange criteria for classifying and distinguishing the most serious risks from the least serious ones.
Mitigate Risks – Develop actions that minimize the consequences of the risks and or the likelihood of their occurrence.
Measure Effectiveness – Evaluate if the actions were effective in handling the priority risks.
Please check this free webinar on demand where I explain risk scope and risk management with examples. Free webinar – How to implement risk management in ISO 9001:2015 - https://advisera.com/9001academy/webinar/how-to-implement-risk-management-in-iso-90012015-free-webinar-on-demand//
The following material will provide you info rmation about risk management:
- ISO 9001 - How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
GDPR officer
Answer:
Not necessarily although it would be useful. The EU GDPR does not require a specific background for the DPO.
You can check out this webinar for more information "The role of the DPO according to the EU GDPR" (https://advisera.com/eugdpracademy/webinar/role-of-the-dpo-according-to-eu-gdpr-free-webinar-on-demand/) -
SoA information
1 - In your video, which is accessible in video tutorials, in examples you mentioned in “Justification for selection/ non-selection” the risks. Does it means that in “Justification for selection/ non-selection” should be only risks from the risk assessment document? If not, what else can/should be there?
Answer: As “Justification for selection/ non-selection” you can use the results of risk assessment, compliance with legal requirements (e.g., laws, contracts and regulations), and top management decision (e.g., the Top management considers that the adoption of the control will bring advantages to the organization).
2 - And one other question. Can I fill in that field only for non-selection case?
Answer: ISO 27001 clause 6.1.3 d) requires justification not only for control inclusions, but also for exclusions of controls from Annex A.
This article will provide you further explanation a bout SoA content:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/ -
Competencies for ISO 27001
Answer:
It is not mandatory by the standard to have any personal certifications to be an implementer of ISO 27001, but with no doubt the knowledge related to them can help you during the implementation process.
These articles will provide you further explanation about personal certifications and ISMS:
- How personal certificates can help your company’s ISMS https://advisera.com/27001academy/blog/2014/10/06/how-personal-certificates-can-help-companys-isms/
- What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
This material will also help you regarding ISO 27001 implementer:
- ISO 27001:2013 Lead Implementer course https://advisera.com/training/iso-27001-lead-implementer-course/ -
Integrating multiple systems
Answer:
Since you are already implementing ISO 9001 and GDPR, and they are business requirements, you left the implementation of specific requirements of ISO 27001 for later.
ISO 9001 and ISO 27001 share many requirements in common (e.g., document control, internal audit, management review, etc.), so you can speed up your ISO 27001 implementation by considering these common requirements in your ongoing ISO 9001 implementation.
- Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
- ISO 27001 implementation: How to make it easier using ISO 9001 [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/
Regarding integration of GDPR wit h ISO 27001, I suggest you to take a look at the "Lst of documents" file of our EU GDPR & ISO 27001 Integrated Documentation Toolkit at this link: https://advisera.com/eugdpracademy/eu-gdpr-iso-27001-integrated-documentation-toolkit/
Since you already have bought the ISO 27001 and the GDPR toolkits separately, this file will help you identify which documents from the GDPR Toolkit you can use for covering ISO 27001 requirements.
This article will provide you further explanation about implementing integrated systems:
- How to implement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/ -
Control A.8.3.2 and commercial shredders
I know the ISO Standard doesn’t specify anything about that but we don’t want to buy a shredder and afterwards the shredder doesn’t fulfill the requirements of the ISO standard. Maybe you as an expert can share some experience with us.
Answer:
Commercial shredders are normally classified in security levels that can range from a low-security P-1 up to a maximum-security P-7, the higher the value, the smaller the pieces produced.
P-4 shredder is the minimum security level for sensitive information, while a high security shredder is either a Micro-Cut (P-5), Super Micro-Cut (P-6), or a High Security-Cut shredder (P-7). P-6 and P-7 are most used by security firms and government agencies.
So, you have to evaluate which types of information you will use on the shredder to define the proper specification.
This article can provide you further information:
- 5 practical tips for media dis posal according to ISO 27001 https://advisera.com/27001academy/blog/2018/10/22/5-practical-tips-for-media-disposal-according-to-iso-27001/ -
GDPR & Brexit
Answer:
Depends on whether it will be a hard Brexit or not. In case of an agreement, the GDPR will most likely still be applicable in the UK together with the Data Protection Act 2018, as currently. However, in case of a hard Brexit most likely the UK will be considered a third country like all others outside the EEA and safeguards would be needed to transfer data to the UK.
To find out more about data transfers, check out our webinar: How to make personal data transfers to other countries compliant with GDPR (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/). -
Data transfer from EU to US
Answer:
The EU GDPR does not impose any transfer protocols when sending personal data outside the EU. The only requirement is to have certain safeguards in place such as Privacy Shield, Standard Contractual Clauses, etc.
If you want to find out more about these safeguards, check out this webinar: How to make personal data transfers to other countries compliant with GDPR (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/). -
Privacy Shield and EU
Answer:
Currently, Privacy Shield is considered a valid safeguard to be used when transferring data to the US. There is, nevertheless, an action against the Privacy Shield at the European Court of Justice so let's see the ruling first.
If you want to find out more about cross border data transfers, check out our webinar: How to make personal data transfers to other countries compliant with GDPR (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/).