Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Is clause 8.3 applicable?
Hi Pete, thank you for your question.
If by ITSM you mean how IT teams manage the end-to-end delivery of IT services to customers, including all the processes and activities to design, create, deliver, and support IT services. Then, clause 8.3 is applicable to ITSM companies. Here, design is not about the tools (like apps or software), but about the right arrangement of the tools, assets and processes.
-
AS9100 Router Configuration Mgmt
Making so, from there on, any changes are managed by CM department when the major milestones of the build or steps of the build are changed. I have a CM department trying to convince me that they do not only manage, make not e, or do any of the router changes, they also do not associate themselves or notate the request for the router to get loaded at the around same time as CM loads the BOM, on new assemblies. This leaves a gap in our process if CM does not own this configuration sustainability. What are your thoughts, is Router process configuration something with its own revision, needing to be tracked by CM since it is directly related to the configuration to the parts on the BOM?
Answer:
The decision of whether a router is included in the configuration management of a product is taken by the company per the customer and legal requirements for the product. As this document is often the instructions on how to assemble and test a product it is often considered to be part of the configuration listing for the final product that is shipped, and also often maintained by the configuration management department. However, this requirement is not necessarily the case for every customer or company that creates parts for aerospace. If you perceive a gap in your system then I suggest you refer to the customer requirements for configuration management and reporting to ensure that there is no specific requirement from them as to how this is done and reported.
For more information on what is included in AS9100 Rev D see this whitepaper, “Clause-by-clause explanation of AS9100 Rev D”, https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
Mandatory and non-mandatory documents
Answer:
In ISO world, mandatory requirements/documents are related to the words “must” or “shall”, while non mandatory requirements/documents are related to words “may”or “should”. Considering section 7.2 Competence, all requirements are mandatory (from a to d), and the single one requiring documentation is the retention of evidence of competence (item 7.2 d). Examples of evidence are certificates, university degrees, work declarations and attendance lists, which have their own formats, making unfeasible to define a single template for them. This means you have to conduct all the activities mentioned in a to c, but you do not have to document them (this is why there is no policy in our toolkit for that purpose) - what you need to have are records related to 7.2 d) mentioned above.
These a rticles can be helpful for you:
- Explanation of the basic terminology in ISO standards https://advisera.com/27001academy/blog/2015/01/12/explanation-of-the-basic-terminology-in-iso-standards/
- Records management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/11/24/records-management-in-iso-27001-and-iso-22301/ -
ISO 45001 Training
Answer:
The ISO 45001 standard is intended to be used by any organization that wants to improve their OHS performance. The standard is about implementing an OHS management system and goes beyond training to implementing all the processes that are necessary to identify and control hazards within the workplace, including meeting OHS legal requirements and improving the health & safety of the workers. The training element of this is to make everyone aware of the OHSMS processes and how they are involved, the hazards and consequences of not following the rules, and what has happened regarding the incident investigation. The role of this training is to make employees knowledgeable about the system and its risks and to make them more competent.
For more about the ISO 45001 standard see this article: “What is ISO 45001?”, https://advisera.com/45001academy/what-is-iso-45001/ -
Toolkit content
Answer:
ISO 27001 does not require each control to be implemented, nor it requires each implemented control to be documented. Therefore, you have the following options:
a) Exclude a control in the Statement of Applicability if there are no risks or requirements for this particular control
b) Implement a control and write a separate policy or procedure for it
c) Implement a control and document it though a policy or a procedure which covers also other controls
d) Implement a control without documenting it - in this case you only describe briefly how you implemented it in the SoA
These articles will provide you further explanation about selecting controls and SoA:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
2 - For my own reference: I assumed that the ISO standard and controls (Annex A or SOA) are copyright protected ? But I saw you used the numbering and especially “titles” from the ISO standard, is this allowed ? I’m just wondering if I can use my own excel “including the official control description” as well and store it in Conformio or on our file server.
Answer: Using numbering and titles as reference to the standard is allowed because in many requires (like the one which defines the SoA content) you have to make reference to the standard to be compliant. What is not allowed is copy of sections content, as well as copies from description of controls, but you can write them in other words to use in your excel file with no problem -
A quality plan can help
Answer:
I don’t know the purpose of that sampling that you made, but if I collected samples from a supplier and gave them for testing, I would want to keep a sample with me, a kind of “sample testimony”. Later, if you are suspicious of any thing you can take that testimony and request further testing by your team or a third party.
To prevent any future problem, I advise you to create or update your quality plan. The following material will provide you information about quality plans:
- ISO 9001 – Making the best out of ISO 9001 Quality Plan - https://advisera.com/9001academy/blog/2015/12/08/making-the-best-out-of-iso-9001-quality-plan/
- free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9 001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Implemented controls
Answer:
Our experience show us that companies typically have ca 80 controls implemented before the start of an ISO 27001 project, and then they have ca 20 to 30 controls to implement during the project.
The quantity of implemented controls does not have a direct impact in the certification, because information security management is about balancing needs and expectations with the level of acceptable risks (similar organizations may have different number of implemented controls and both can be certified).
This article will provide you further explanation about selecting controls:
- The basic logic of ISO 27001: How does information security work? https://advisera.co m/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
This material will also help you regarding selecting controls:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
Filling templates
Answer:
Since you already have identified the interested parties, now you have to identify the documents in which their requirements can be located (e.g. service level agreements, outsourcing contracts, laws, industry regulations, etc.), and the precise requirements that must be fulfilled (e.g., the clauses).
For example, a customer has a service level agreement with your company which defines, on clause 32-b, that access to all information provided by the customer to information system ABC are restricted to customer personnel only. In this case the person responsible for syste m ABC is the responsible to ensure compliance of the system to this requirement. Then your document would be like this:
Interested party: Customer Jon
Requirement: Clause 32-b (Information provided to system ABC are restricted to customer's personnel)
Document: Service level agreement
Person responsible for compliance: System ABC administrator
Deadline: when system ABC is made available for customer use
This article will provide you further explanation about identifying requirements:
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/ -
ISMS manual
Answer:
In fact ISO 27001 requirements do not prescribe the development of an ISMS Manual, and for good reasons. If you put all the policies and procedures into a single document, this will make the reading of such document very difficult. Additionally, the standard already has a requirement for a document that describe how a company will implement its information security – it is called Statement of Applicability.
This article will provide you further explanation about ISMS Manual:
- Is the ISO 27001 Manual really necessary? https://advisera.com/27001academy/blog/2014/02/03/is-the-iso-27001-manual-really-necessary/
This material will also help you regarding ISMS Manual:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/ -
Access profiles
1. User Profile A (which Profiles are expected to be captured here?)
2. User Profile B (which Profiles are expected to be captured here?)
Answer:
As example for profiles you can have Administrator profile (Profile A) and Common user profile (Profile B).
For an operational system you can have the following access rights:
- Administrator: read and write on flies and alter system configurations
- Common user: read and write on flies only
For an corporate networks you can have the following access rights:
- Administrator: remote access to internal networks and full access to Intern
- Common user: internal network access only
This article will provide you further explanation about access control:
- How to handle access control according to ISO 27001 https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/
This material will also help you regarding access control:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/