Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Support on NIST SP 800-171
Answer:
From NIST site you can have access to their Cyber Security Resource Center (https://csrc.nist.gov/), where you can access additional material and find courses related to their documentation. Another useful site is SANS (https://www.sans.org/courses/niceframework/).
These articles can provide you additional information about ISO 27001 and NIST integration:
- How to use the NIST SP800 series of standards for ISO 27001 implementation https://advisera.com/27001academy/blog/2016/05/02/how-to-use-the-nist-sp800-series-of-standards-for-iso-27001-implementation/
- How to use NIST SP 800-53 for the implementation of ISO 27001 controls https://advisera.com/27001academy/blog/2016/05/10/how-to-use-nist-sp-800-53-for-the-implementation-of-iso-27001-controls/ -
Certification bodies
Answer:
I'm assuming you are referring to accredited certification bodies, the organizations which can certificate an ISMS against ISO 27001 standard. Considering that, the main certification bodies for ISO 27001 are:
- BSI: https://www.bsigroup.com
- Bureau Veritas: https://www.bureauveritas.com
- DNV: https://www.dnvgl.com/
- SGS: https://www.sgs.com/
- TUV: https://www.tuv.com
You also can find a proper certification body from this link: https://advisera.com/ -
Implementation alternatives
Answer:
From a business point of view, you should first finish the implementation that will bring your organization the biggest benefits, then go for the other implementation. You should avoid implement standards together if you understand this can increase the difficulties without bringing proportional benefits.
These article will provide you further explanation about benefits and implementation:
- Six Key Benefits of ISO 9001 Implementation https://advisera.com/9001academy/knowledgebase/six-key-benefits-of-iso-9001-implementation/
- Four key benefits of ISO 27001 implementation https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/ -
Risk management frameworks
Dear Sir,
Many thanks for your response and explain.
Regards, -
Life cycle consideration
I am wondering to what extent we are expected to control/influence these outsourced processes. We ensure any relevant products are CE complaint etc, are transported correctly, and do not contain any banned substances. But what we don't do is control/monitor the processes within their factories to ensure they are environmentally friendly.
I am worried when we get audited the auditor will find some non-conformances because of this. Do you have any advice as to what is expected by this clause for a small business like ourselves? In this scenario would a simple statement be sufficient to explain this and state that we have asked the supplier to consider all environmental impacts it is causing? I would much appreciate any advice?”
Answer:
The life cycle perspective implies consideration of the material life cycle associated with the products and services and does not require a detailed evaluation. Check this ISO text - Life cycle perspective - what ISO 14001 includes - https://committee.iso.org/sites/tc207sc1/home/projects/published/iso-14001---environmental-manage/life-cycle.html
According to your organization’s particular context, you should determine which stages of the lifecycle you can control or influence. Remember that the word used by ISO 14001:2015 is “consideration” not a very strong requirement. Therefore, it is necessary to realistically assess what is actually controllable and what can be influenced and act accordingly.
The following material will provide you with information about the life cycle perspective:
- ISO 14001 – Lifecycle perspective in ISO 14001:2015 – What does it mean? - https://advisera.com/14001academy/blog/2017/02/20/lifecycle-perspective-in-iso-140012015-what-does-it-mean/
- How does product life cycle influence environmental aspects according to ISO 14001:2015? - https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
IATF Internal audit competency
Answer:
Internal audit can be done with internal audit certificate, that certificate is proof of competence for a person to conduct an internal audit.
2. Where could I find info on this matter?
Answer:
Internal audit against requirements of IATF 16949 must be performed by a competent person as defined in chapter 7, 7.2.3 Internal auditor competency. Based on it organization shall retain documented information to demonstrate the trainer's competency with these requirements.
Maintenance and improvement must be verified by:
• Minimum number of audits per year – as defined by the organization
• Maintaining knowledge of the relevant requirements (technology, standards, methods, customer-specific requirements)
So, if internal auditor left the company and wants to do the internal audit as an external party, he can do it if he can prove that he has the minimum number of audits and maintaining knowledge of relevant requirements (especially customer-specific requirements)
Please look at our article on this topic: Requirements for the competence of IATF 16949 internal auditors: https://advisera.com/16949academy/blog/2017/10/19/requirements-for-competence-of-iatf-16949-internal-auditors/
In -
Questions to top management
Or the types of questions to direct to CISO, CIO, or CTO to identify the types of technologies they have implemented to mitigate future cyberattacks.
Answer:
First it is important to understand that in general the C-level will not think directly about risk (neither they have to), so you have to make questions about their concerns regarding the business objectives (which are them, which are the most important, and why) and how information can help achieve these objectives, or prevent these of being achieved. From these answers you will be able to identify their risk posture, the most relevant risks and what you can do to treat them.
Another important issue is that in general these questions are as ked by the responsible for the information security (i.e., the CISO or similar role).
These articles will provide you further explanation about requirements identification:
- Top management perspective of information security implementation https://advisera.com/27001academy/blog/2012/12/04/top-management-perspective-of-information-security-implementation/
- Management’s view of information security https://advisera.com/27001academy/blog/2011/05/16/managements-view-of-information-security/
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/ -
Information security cloud policy
Answer:
To elaborate an information security security policy which also considers cloud security, I suggest you to take a look at the free demo of these two templates:
- Information Security Policy https://advisera.com/27001academy/documentation/information-security-policy/
- Cloud Security Policy https://advisera.com/27001academy/documentation/cloud-security-policy/
They can guide you on how to define the purpose, direction, principles and basic rules for information security management, and how to manage the security of cloud environment infrastructure.
This article will provide you further explanation about information security policy:
- What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/ -
Internal audit and certification
Answer:
You need to perform an internal audit and corrective actions for identified nonconformities before applying for certification so you can provide evidences of audits results required by the standard (e.g., audit report, nonconformities action plans, etc.). Additionally, the results of internal audit are required for the management review, another mandatory requirement for certification.
These articles will provide you further explanation about what expect from certification audit:
- Becoming ISO 27001 certified – How to prepare for certification audit https://advisera.com/27001academy/iso-27001-certification/
- Infographic: The brain of an ISO auditor – What to expect at a certification audit https://advisera.com/articles/infographic-the-brain-of-an-iso-auditor-what-to-expect-at-a-certification-audit/
These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Objective and consequence
P – Profit
Q – Quantity
P – Productivity
D – Development
Q – Quality
C – Cost
D – Delivery
M – Morale (including safety, training, attrition, rewards/awards/appreciation)
The very first parameter is not easy to calculate. Pl. suggest”
Answer:
These things are not calculated sequentially but iteratively. I arrange your items according to the figure below in a sort of cause-effect relationship map.
Be aware of which items are critical to winning your target customers. Customers are not all alike, some value innovation and development, others value service and flexibility, and others value price above all. Operational perspective topics should be a function of your target-customers and not a general list.
Personally, I look into profit as a consequence of all other things. Your organization invests in resources and infrastructures, in order to be excellent at the operational perspective, to have results at the customer perspective translated into financial results. Your organization may need a certain level of profit to be sustainable or attractive to investors, you can start with a figure and see what level of sales, costs, and prices you need and evaluate if it is reasonable and attainable. Perhaps your organization concludes that it has to change its strategy in order to meet a certain level of profit.
The following material will provide you with information about quality objectives:
- ISO 9001 – How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
- [free course] ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/