Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
EU GDPR and Supervisory Authority
Answer: Where the extra-territorial provisions of the EU GDPR apply, the controller or processor must appoint a representative. That representative must be based in a Member State in which the relevant individuals are based. There is a limited exemption to the obligation to appoint a representative where the processing is occasional, where it is unlikely to be a risk to individuals and it does not involve large scale processing of sensitive personal data.
2. The regulation appears rather vague on the data subjects, is it EU CITIZENS or EU residents?
Answer: The regulation is crystal clear and it refers to data subjects “in the Union”. The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual resi dence of those individuals is irrelevant. If you want to find out more about the EU GDPR, check out our free EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//). -
Controls selection
Another concern is CIS20 does not have (HR and physical security), whereas 27002 does. The proposed scope of XXXXXX ISMS will not include (HR and physical security), it would include only relevant CIS20 controls. (I understand I ca n add others, but due to scope do not want to add). So my question is … Can XXXXXX have a certified 27001 ISMS using CIS20 controls only?
Answer:
First it is important to note that all controls from ISO 27001 Annex (those controls are the same as the ones in ISO 27002) must be considered during an ISMS implementation complaint with ISO 27001. For all controls from Annex A you have to identify if they are applicable or not, and justify why they are applicable or not.
Second thing is, most of CIS 20 controls can be related to ISO 27001 Annex A controls (e.g., CIS control “Inventory and Control of Hardware Assets” can be related to ISO 27001 controls “A.8.1.1 Inventory of assets” and “A.8.1.2 Ownership of assets”), so in a sense when you implement CIS 20 controls you are considering particular controls from Annex A as applicable.
However you will need to list all the ISO 27001 controls that are not covered by CIS 20 and decide whether they are applicable or not.
This article will provide you further explanation about selecting controls:
- The basic logic of ISO 27001: https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
This material will also help you regarding ISO 27001:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- Overview of ISO 27001:2013 Annex A https://advisera.com/27001academy/iso-27001-controls/ -
Retaining time for internal audit records
Answer:
Unless your organization belongs to a sector with particular requirements from customers or regulators, there is no “officially” suggested time to retain records of internal audits. 10 years seems to be demanding without any particular return of investment. In my work with organizations I recommend 4 years. With this time frame organizations ensure that they keep internal audit records during the three year cycle of certification.
The following material will provide you information about document and record control:
- ISO 9001 – New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
SOC 2 Audit Compliance
Answer:
We're not experts in this field, but in general SOC 2 reports on various organizational controls related to security, availability, processing integrity, confidentiality or privacy, and to perform this audit you can consider an ISO 27001 internal audit approach:
- Identification of compliance requirements
- Elaboration of an audit checklist
- Performing the audit to gather compliance evidences
- Elaborate report
These articles will provide you further explanation about performing audits:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com /books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor course https://advisera.com/training/iso-27001-internal-auditor-course/ -
ISO 27001 Toolkit content
Answer: I'm assuming that by data classification you mean information classification. Considering that, the template that covers information classification is the "Information Classification Policy", which is located in folder 08 Annex A ==A.8 Asset management
2 - And in addition - vulnerability ,management process? Can't find these docs in the package.
Answer: The vulnerability management is not a mandatory document according to ISO 27001, nor is it a document commonly adopted by organizations (most of them rely on outsourced services for this purpose), so it is not included in the toolkit, to avoid unnecessary effort to manage the ISMS. If you understand that this document is important to your organization, you can schedule a meeting with one of our experts so he can help you to develop such document.
These articles will provide you further explanation about vulnerability management:
- How to manage technical vulnerabilities according to ISO 27001 control A.12.6.1 https://advisera.com/27001academy/blog/2015/10/12/how-to-manage-technical-vulnerabilities-according-to-iso-27001-control-a-12-6-1/
- How to use penetration testing for ISO 27001 A.12.6.1 https://advisera.com/27001academy/blog/2016/01/18/how-to-use-penetration-testing-for-iso-27001-a-12-6-1/
- Implementing restrictions on software installation using ISO 27001 control A.12.6.2 https://advisera.com/27001academy/blog/2016/02/08/implementing-restrictions-on-software-installation-using-iso-27001-control-a-12-6-2/ -
Internal Audit in ISO 45001
Answer:
Just like other management systems, the ISO 45001 internal audit is based on the process audit. This means that you prepare for the audit by reviewing the OHS requirements for the process, then assess the process using interviews, observation and review of records to compare what is actually happening meets with the planned requirements for the process. Your audit plan will need to be as detailed as necessary to inform those involved of what you intend to look at during your audit, such as an email or a standard form that identifies all the necessary information.
For more information on audits in the OHSMS, see this article, “How to perform internal audits in ISO 45001”; https://advisera.com/45001academy/blog/2015/09/23/how-to-perform-internal-audits-in-iso-45001/ -
How to implement GDPR in big companies?
Answer
This is mostly up to you. You can have a set of documents for each of the subsidiaries if there are differences between them. For example, the employee privacy notice will be relevant only for the employees in the EU.
If everything is the same, you can have a set of documents applicable to all companies within your group. In this case, you will need to add a paragraph to mention the applicability across the whole group. -
Manual for company with subsidiary
Answer:
ISO 9001:2015 no longer requires a quality manual. Being so, there is nothing in ISO 9001:2015 that forbids doing what your company want to do. Your quality manual can even be a symbol or a tool to reinforce the relationship between the two parts of a whole.
The following material will provide you information about quality manuals:
- ISO 9001 – Writing a short Quality Manual - https://advisera.com/9001academy/knowledgebase/writing-a-short-quality-manual/
- The future of the Quality Manual in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/the-future-of-the-quality-manual-in-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://training.adviser a.com/course/iso-90012015-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Risk assessment and treatment for ISO 27001 and ISO 22301
I was looking through the list of documents that are mandatory for ISO 27001 and ISO 22301; and I can see that the Risk Assessment and Risk Treatment Methodology document is mandatory for both ISO 27001 and ISO 22301. My question is can I use her Risk Assessment and Risk Treatment Methodology document to cover both ISO 27001 and ISO 22301 or do we need to produce separate Risk Assessment and Risk Treatment Methodology documents (One to focus on information security and one to focus on business continuity and disaster recovery)?
Answer: You can use the Risk Assessment and Risk Treatment Methodology document to cover both ISO 27001 and ISO 22301 requirements with no problem.
These articles will provide you further explanation about Risk Assessment for ISO 27001 and ISO 22301:
- How to organize initial risk assessment according to ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/04/29/how-to-organize-initial-risk-assessment-according-to-iso-27001-and-iso-22301/
- Can ISO 27001 risk assessment be used for ISO 22301? https://advisera.com/27001academy/blog/2013/03/11/can-iso-27001-risk-assessment-be-used-for-iso-22301/ -
Enrollment Process in Elementary School
Answer:
First, consider the difference between process and procedure. A process is a set of activities that transform inputs into intended outputs. A procedure is the description of a process, if documented it is a documented procedure.
Look into the Enrollment in Elementary School as a flow of activities. Where does it start?
* Present school; (perhaps your school organizes an open day to show the school to prospective fathers for them to get a glimpse into a class and meet and talk to professors and staff, see children, question school administration)
* Receive parents; (perhaps there is a time frame for enrollment, perhaps there is a special room to receive parents and help them do the paperwork)
* Receive documentation; (perhaps there is documentation that government or other organization requires parents to provide, that then must be checked)
* Check specials needs and requirements;
* Fill records;
* Deliver enrollment documentation.
This is a very generic description of what can be an enrollment process in a school.
Does your school need, or feel that need documented procedures to explain in detail one or more activities?
How will your school evaluate enrollment process performance? For example, is open day activities useful and effective? How many problems with documentation are found after the process ends?
What kind of records are required by law or by the school administration? For how long they will be kept?
These are examples of the topics to consider when thinking about an enrollment process in school with a quality management system.
The following material will provide you information about process vs procedure:
- ISO 9001 – Watch Your Language! Don’t confuse processes with procedures - https://advisera.com/9001academy/blog/2014/11/04/watch-language-dont-confuse-processes-procedures/
- Should universities implement ISO 9001? - https://advisera.com/9001academy/blog/2015/04/21/should-universities-implement-iso-9001/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/