Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Separate procedures for contractor and subcontractor
For clarification, we are a telecoms infrastructure provider. We do site build that involves civil and telecom works.”
Answer:
There is nothing in clause 4.2 of ISO 9001:2015 that forbids an organization of doing what you want to do. More, there is no clause in ISO 9001:2015 that goes against that practice.
What I recommend in each procedure is being very clear about the scope of application.
I can think that you r company and its subcontractors want and are concerned with quality control, cost control and time control. I can imagine a situation where your company is OK with quality and time performance but wants to improve cost control performance. At the same time, for your company as long as subcontractor’s quality and time control are OK, cost control is not a problem because your company only pay what was agreed. One can imagine a situation where subcontractors control costs more effectively than your own company and improving cost control is not a priority.
The following material will provide you information about subcontracting:
- ISO 9001 – How to control outsourced processes using ISO 9001 - https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
EU GDPR and scrapping data
We've received an additional question:
> If a crawler like Google is allowed to crawl data from webs, may I crawl Google data with an app? In other words, am I allowed to crawl a crawler?
Answer:
Google, like many others, has Privacy Notices, Privacy Policies as well as other documents and tools to enable users to understand what is happening with their data and to allow them to exercise some of their rights. I am not saying they are perfect, not by a long shot but they at least have something. And an army of well-prepared lawyers. Still, they failed numerous times and have just paid 50 mil euros fine in France.
So, long story short - you can try to act like Google but you need to be ready to face the consequences if you don't comply with the privacy laws especially the EU GDPR. -
ISO 27001 Lead Auditor
Answer: To be qualified as an ISO 27001 Lead Auditor you have to attend an ISO 27001 Lead Auditor course, and for this course there is no previous requirement needed, so you can start you auditor career with ISO.
This article will provide you further explanation about becoming an Iso 27001 Lead Auditor:
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
2 - And I am confused between the ISO Body mail bodies are PECB and IRCA but there are other like GAQM and IGC so are these equally known like the main ones?
Answer: PECB and IRCA are accreditation bodies (organizations that authorize organizations to issue certificates), while GAQM and IGC are accredited certifica tion bodies and training providers (organizations that perform certification audits and provide trainings). Depending on your location, some certification bodies and training providers will be more recognized than others, so you have to check which provider will add more value to your certification.
Advisera also provides accredited ISO 27001 Lead Auditor course, and you can read more information at this link: https://advisera.com/training/iso-27001-lead-auditor-course/
This article will provide you further explanation about accreditation and certification:
- Accreditation vs. certification vs. registration in the ISO world https://advisera.com/articles/accreditation-vs-certification-vs-registration-in-the-iso-world/ -
Toolkit content
We have received futher question:
> The matter is still confused to me. The source of the information for the possibly missing document is this link: https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
> At the above link you can read this line in the paragraph of mandatory document: “Definition of security roles and responsibilities (clauses A.7.1.2 and A.13.2.4)” The Information Security Policy template doesn't mention in its references the clauses A.7.1.2 and A.13.2.4, so it cannot be the template covering these clauses. Clause 5.3 is cited instead, and it is clearly related to the definition of roles and responsibilities. It also appears that clause 5.3 is completely on a different topic that missing clauses A.7.1.2 and A.13.2.4. Can you please clarify the matter?
Answer: I'm sorry about this confusion. Here are the answers:
- Clause A.7.1.2 is covered in documents "Confidentiality statement" (toolkit folder 08 - A.7 Human Resources Security) and "Security Clauses for Suppliers and Partners" (toolkit f older 08 - A.15 Supplier relationships)
- Clause A.13.2.4 is covered in document "Confidentiality statement" (toolkit folder 08 - A.7 Human Resources Security)
The two documents above describe general roles and responsibilities; as my colleague has described above, each of our policies and procedures further enable the definition of detailed roles and responsibilities.
By the way, in the root folder of the toolkit you'll find a document called "List of documents" which specifies which clauses of the standard are covered with which toolkit document. -
Design of processes - applicability
I have one doubt about the exclusion of clause 8.3 Design and development.
In my opinion, nobody can exclude this clause because design and development mean not only design of the product but also the design of the process and the processes are particular for each organization and has to be completed by each organization!”
Answer:
Thank you for your kind words, glad you appreciated!
During the webinar, because time is short, I develop this figure:
During offline training, I develop this one because I have more time:
The green company is a real case that I audited some years ago. They had no own brand, they did not design the products, but they were picked by customers because they were very good at developing finishing processes that made products stand out as different.
Back to your question, imagine that you buy a plastics injection machine, you receive a mold from the client , you buy the raw-materials and start to manufacture plastic parts for the client. There is no real process design or product design. Most of the time organizations truly do not design processes and auditors do not expect them to do it. So, in your shoes I would think openly: do this organization stands out for anything they do differently with their processes? If yes, clause 8.3 is applicable. If not, you can consider clause 8.3 not applicable and justify it.
The following material will provide you with more information about applicable clauses:
- ISO 9001 – What clauses can be excluded in ISO 9001:2015? - https://advisera.com/9001academy/blog/2015/07/07/what-clauses-can-be-excluded-in-iso-90012015/2015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Box Plot in ISO 14001
Answer:
Since the box plot is a process analysis tool and probably one of the most useful and simplest forms of summarizing data it can be used for measuring and monitoring results. The tool can be used alone or complementing an histogram since it shows several simultaneous comparisons.
To learn more about monitoring and measurement you can see these materials:
- Article - How to measure the effectiveness of your EMA according to ISO 14001:2015: https://advisera.com/14001academy/blog/2016/09/05/how-to-measure-the-effectiveness-of-your-ems-according-to-iso140012015/
- Book - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- ISO 14001:2015 Foundations Course: https://advisera.com/training/iso-14001-internal-auditor-course/ -
EU GDPR and its reach
Answer: I think you mean DPA (Data Protection Agreement/Addendum) and not DPIA (Data Protection Impact Assessment) and the answer is no.
2. Does the GDPR supersede with the national "Data Protection Policy" since the company is dealing with individuals in EU?
Answer: If the GDPR is applicable to your company, then you should comply with its requirements at least for the processing activities that are touched by the GDPR. For example, if you also have clusters that are not in the Union, then the processing activities related to them should not necessarily be compliant.
3. If a company has a foundation policy for children, does the responsible party/parent need to give written consent?
Answer: In the case of minors, consent should be obtained from their parents or legal guardians.
If you want out to find out more about the EU GDPR, check out our free EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//). -
Using Data Processors
Answer:
No, you don't need a separate lawful ground to use data processors. You just need to inform the data subject using appropriate privacy notices about the fact that their personal data will be shared with third parties that would act as your data processors. The data subject may object in theory but in this case you can cease to provide the service to the data subject if the service is dependent on a third party processor.
If you want to find out more about data subject rights, check out our free webinar: Data Subject Rights under the EU GDPR (https://advisera.com/eugdpracademy/webinar/data-subject-rights-under-the-eu-gdpr-free-webinar-on-demand/). -
Do US companies need to comply with EU GDPR?
Answer:
To put it bluntly, the answer is yes. You need to be compliant in terms of the processing activities related to your employees in the EU as they are in the EU and for which you are acting as a data controller.
If you want to find out more about the extraterritorial reach of the EU GDPR, check out this free EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//). -
Responsibilities in ISMS implementation
We've received additional question:
>Only development procedure is assigned to me, I should take care about development part. What are the documents are required for this. How do I implement & represent only technical development team?
Answer: If I understood correctly, you are not the project manager responsible for the ISMS implementation, but responsible only for the part regarding the development team.
Considering that, and the previous answer, after performing the risk assessment of your development process, you most probably should consider these documents:
- Secure Development Policy - https://advisera.com/27001academy/documentation/secure-development-policy/
- Specification of Information System Requirement - https://advisera.com/27001academy/documentation/specification-of-information-system-requirements/
The links will show you how these documents look like.
These documents cover how do you ensure development is performed in a secure way and the evidences you need to show to the auditor, considering ISO 27001 requirements.
This article will provide you add itional information:
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/