Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Difference between clauses 4.4 and 8.1
Have consulted 'clause by clause' and 'what to do' publications too and yet find it difficult to comply for the documentation and record keeping of our QMS.
Answer:
The main difference is that clause 4.4 is much broader, covering planning for the entire Quality Management System, meanwhile clause 8.1 covers planning for all of operations aspects of the QMS, i.e. design, customer requirements, , purchasing, etc.
You can see these materials to help you understanding clauses 4.4 and 8.1:
- Book – Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Free on-line training – ISO 9001:2015 Foundations: https://advisera.com/training/iso-9001-foundations-course/ -
AS9100 Rev D Document Review
Answers:
The AS9100 Rev D standard does not talk specifically about this issue, and only states in clause 7.5.2c (creating and updating) that documented information is reviewed and approved for suitability and adequacy, and leaves the decision on how to do this appropriately to the organization. In fact, with a small organization you may have only one expert in a certain process so that there is not an adequate review person available (AS9100 is written for all types of organizations). That being said it is difficult to see how one person could review their own work, and a second person review can be very helpful to highlight potential issues in a document.
It is important to remember that this clause only talks about QMS documented information, and not the information covered by clause 8.1.2 for configuration management which deal with control of physical and function attributes of the products or services which often include drawing, specifications, etc. In the end it also comes down to what customer and legal requirements are imposed on you for approval of certain documentation, so make sure you consult these requirements also.
For more information on understanding the AS9100 documented information clause, see this article: A new approach to document and record control in AS9100, https://advisera.com/9100academy/knowledgebase/new-approach-to-document-and-record-control-in-as9100/ -
What does ISO 45001 add to SAMTRAC
2. Do I need to do it or is Samtrac and Safety management enough?
Answers:
1. The ISO 45001:2018 standard is an internationally recognized standard that includes all of the processes which are agreed to be necessary for a comprehensive system to manage and improve OH&S performance in the workplace. The standard goes beyond simply meeting legal requirements and managing risk, but also includes the need to improve the processes and OH&S performance over time. This improvement focus, along with the need to integrate OH&S processes into the business processes, is an addition to the ISO 45001 standard which goes beyond just managing safety and OH&S risk. This being said, ISO 45001:2018 is a document which contains the requirements for an organization to implement, and is not something that an individual is certified to. An individual can only understand how to implement the standard, and be trained to implement and audit the requirements.
2. This depends on what you wish to do. SAMTRAC deals with occupational risk management, and fits in very well with the overall safety management processes. Using the ISO 45001:2018 standard to understand all of the requirements of a world-recognized OH&S management system can help you to understand how safety and risk management integrate into the processes of the company, which could be very useful for anyone you are going to consult.
For more information on understanding the ISO 45001 clauses, see this whitepaper: Clause-by-clause explanation of ISO 45001:2018, https://info.advisera.com/45001academy/free-download/clause-by-clause-explanation-of-iso-45001 -
ISO 45001 Risk and opportunity process
Answer:
The ISO 45001:2018 standard does not require any specific method for identifying and assessing risks and opportunities. Many companies will do this by brainstorming the risks and opportunities that they know exist for the OHSMS, and then determining if they need to do something, and if so what those actions will be. For most companies this will be the easiest and most effective process to start with, and they may adapt their risk and opportunity assessment as they find improvements.
For more information on the risk & opportunity requirements, see this article: What are the new requirements for risks and opportunities according to ISO 45001?, https://advisera.com/45001academy/blog/2018/04/25/what-are-the-new-requirements-for-risks-and-opportunities-according-to-iso-45001/ -
Academe's suppliers
Answer:
Yes, criteria for evaluation and selection of suppliers (clause 8.4.1) is a mandatory document. If you consider graduated students as your school products, we can see your system as
We can ask what products or services the school use as inputs to perform its services. Once I helped a school at implementing its quality management system and I remember that they considered as suppliers:
* Transportation services;
* Canteen services;
* Cleaning services;
* Accommodation services;
* Maintenance services;
…
Perhaps you can find these examples as an inspiration to your case.
The following material will provide you more information:
- List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- Should unive rsities implement ISO 9001? - https://advisera.com/9001academy/blog/2015/04/21/should-universities-implement-iso-9001/
- ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Application of control A.17.2.1
Answer:
Reference to Recovery strategy for IT infrastructure in the Statement of Applicability is needed only for companies that want to be compliant with ISO 22301 together with ISO 27001. If you are going for ISO 27001 only, we do not recommend you to do the Recovery strategy for IT infrastructure because it will complicate the whole process - instead, for the control A.17.2.1 we recommend that you refer to Disaster Recovery Plan - you can find it in your toolkit in the folder 08 Annex A - A.17 Business continuity..
If you decide to go for Recovery strategy for IT infrastructure, you can find the template here: https://advisera.com/27001academy/documentation/business-continuity-strategy/ -
Risk management
Answer: Risk management means polices, procedures, and practices for identifying, analyzing, evaluating, and treating risks, and this can be done through different approaches (e.g., ISO 27005 - a supporting standard for ISO 27001, ISO 31000, NIST Cyber Security Framework, etc.). Considering that, you should evaluate the approaches used on what you call usual Risk management and third party risk management to see if they are in fact different.
For example, if usual Risk management is based on ISO 27005 and third party risk management is based on ISO 31000 then they are very similar. In the other hand, if usual Risk management is based on ISO 27005 and third party risk management is based on NIST CSF, they have considerable differences.
These articles will provide you more information:
- ISO 31000 and ISO 27001 – How are they related? https://advisera.com/27001academy/blog/2014/03/31/iso-31000-and-iso-27001-how-are-they-related/
- Which one to go with – Cybersecurity Framework or ISO 27001? https://advisera.com/27001academy/blog/2014/02/24/which-one-to-go-with-cybersecurity-framework-or-iso-27001/
2 - And how about taking a job in Risk management and taking a job of being an IT auditor, when you have these two offers in hand, what do you think which one to go with as per your advise?
About me -- I have 4 years experience in ITGC and SOX implementation and monitoring. Currently looking for better opportunities which help me in exploring myself into Cyber security domain.
Answer: Your choice will depend on your professional objectives. If you want to work establishing a secure environment, you should consider the risk management offer. On the other hand, if you want to work to ensure implemented controls are properly implemented and bringing expected results, then you should consider the IT auditor offer. Your background allows you to choose both ways.
This article will provide you further explanation about becoming an auditor:
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
This material will also help you regarding becoming an auditor:
- ISO 27001:2013 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/ -
ISO 27001 in software development
Answer:
First it is important to note that ISO 27001 requirements and controls are not intended for products, but for the processes involved in their development. Considering that, you can apply ISO 27001 to your software development and maintenance processes, in the following way:
- Identification of security requirements and specifications your software must fulfill
- Definition of general and specific rules for secure software development and testing
- Change control
- Proper use of outsourced development
- Protection of testing data
These materials will provide you further explanation about securing software development:
- How to integrate ISO 27001 A.14 c ontrols into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/
- How to set security requirements and test systems according to ISO 27001 https://advisera.com/27001academy/blog/2016/01/11/how-to-set-security-requirements-and-test-systems-according-to-iso-27001/
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
List of Legal, Regulatory, Contractual and Other Requirements
Answer:
The "List of Legal, Regulatory, Contractual and Other Requirements" template is a form where you can fill in the legal, regulatory, contractual and other requirements that are relevant to your ISMS, so it does not contain any information about specific requirements.
In the following article you can find a list of some laws and regulations required on United Kingdom:
- Laws and regulations on information security and business continuity https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
Unfortunately, this list is not fully up-to-date because it depends on voluntary contributions from our readers – therefore, it is likely that not all regulations related to United Kingdom are listed (most of the mentioned ones are not sector-related, and those which are sector-related cover electroni cs and communication sectors). To make sure you have the latest list of laws and regulations, it would be best to hire a local legal adviser. -
ISO 20000:2011 -> ISO 20000:2018 transition
Answer:
First of all, investment made in ISO 20000 (according to 2011 revision of the standard) is not vested effort. Many elements are "recyclable". There are some parts that are simplified but there are also some new requirements.
First of all - new revision follows High Level Structure (HLS), so if you have any other management system in place, it will be very usable in ISO 20000 transition.
Documentation requirements are less than in 2011 revision. But, most of the documents can be reused although not directly required (e.g. Capacity Plan - it's not required to document it but you need to plan it).
Few new requirements (e.g. Context of the organization or Knowledge Management) will need to be addressed but experience with other management systems helps.
Process requirements - many of the m are simplified. That leaves more space for the implementation according to your own organizational setup (or some see it as - lowering bureaucracy).
Note that there are some items that are renamed, like CMDB - focus is on Configuration information.
You will also need to split some processes, like Incident and Service Request Management.
So, yes there are changes but nothing you that invincible.