Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Emergency Situation identification
For example:- Fire & explosion emergency and how identify emergency situations from Fire & Explosions.
Answer:
The main requirement form ISO 45001 and the OHS management system is to identify potential emergency situations and then create response plans for them, these situations need not be broken down further unless the company determines this to be necessary. There are a number of ways to identify emergency situations; look at legal requirements for emergency response, review the hazards and risks you identified for your processes, and look to industry guidelines and rules that might exist.
Remember the important this is to identify what could go wrong in your workplace that could lead to an emergency and make a plan to respond.
You can learn more about hazard identification in this article: How to identify and classify OH&S hazards, https://advisera.com/45001academy/blog/2015/05/14/how-to-identify-and-classify-ohs-hazards/
For more information on what needs to be documented for ISO 45001 see our whitepaper “Checklist of Mandatory Documentation Required by ISO 45001”, https://info.advisera.com/45001academy/free-download/checklist-of-mandatory-documentation-required-by-iso-45001 -
Risk assessment and risk management
Answer: Risk assessment is the process to identify, analyse and evaluate risks, so you can prioritize them, allowing you to focus on the most relevant risks and optimize resources.
2. What is the difference between threat and risk?
Answer: Threat is an agent (e.g., a person, a malware, a natural event, etc.) that has the potential to cause an incident, while the risk is the relation between the impact and the probability of an incident to happen.
These articles will provide you further explanation about risk and threats:
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
- How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment
This material will also help you regarding risk and threats:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Security Awareness Training: https://advisera.com/training/awareness-session/security-awareness-training/– this is a series of 25 videos that cover various topics related to security. -
Legal basis for processing personal data
Answer:
If you refer to which legal basis you should use for processing personal data such as CV of candidates, the most suitable one would be a contractual obligation. In your specific case, the processing is necessary for the performance of a contract with the individual or in order to take steps at the request of the individual prior to entering into a labor agreement/contract. The same legal basis should be used for processing employees personal data after joining the company. For the background check prior to employment, you should use legitimate interest as the legal basis for processing.
If you want to find out more about the legal basis for processing personal data check out this article: Is consent needed? Six legal bases to process data according to GDPR (https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/). -
Change Control in an Agile DevOps environment
Answer:
The Change Management Policy template included in your toolkit can be adapted to the requirements of Agile DevOps environment. You only have to see the included comments in the template to see where you can include your specific requirements. By following the guidance of the comments you can adapt the Change Management Policy to support Agile DevOps environment while in compliance with ISO 27001. This template is located in folder 8. Annex A, subfolder A.12 Operations security
This article will provide you further explanation about change control:
- How to manage changes in an ISMS according to ISO 27001 A.12.1.2 https://advisera.com/27001academy/blog/2015/09/14/how-to-manage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/
These materials will also help you regarding change control:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Integrating the Risk Management Framework (RMF) with DevOps https://resources.sei.cmu.edu/asset_files/Presentation/2018_017_001_517074.pdf
- NIST Special Publication 800-53 (Rev. 4) - CM-3 CONFIGURATION CHANGE CONTROL https://nvd.nist.gov/800-53/Rev4/control/CM-3 -
Applicable ISO Standards for Sterilization
Answer:
Please refer to the following standards applicable for sterilization:
1. ISO 11135:2014-Sterilization of health-care products -- Ethylene oxide -- Requirements for the development, ,validation and routine control of a sterilization process for medical devices
2. ISO 11137-1:2006-Sterilization of health care products -- Radiation -- Part 1: Requirements for development, validation and routine control of a sterilization process for medical devices
3. ISO 17665-1:2006: Sterilization of health care products — Moist heat — Part 1: Requirements for the development, validation and routine control of a sterilization process for medical devices
4. ISO 20857:2010-Sterilization of health care products -- Dry heat -- Requireme nts for the development, validation and routine control of a sterilization process for medical devices
5. ISO 25424:2018-Sterilization of health care products -- Low temperature steam and formaldehyde -- Requirements for development, validation and routine control of a sterilization process for medical devices
You may refer further to the link: https://www.iso.org/committee/54576/x/catalogue/p/1/u/0/w/0/d/0 which will provide detailed description of each standard. -
Action plan for internal audit
Answer:
To perform an internal audit you should consider these steps:
- Develop an internal audit procedure
- Plan your audits, considering dates, criteria and scope
- Develop checklists to help you not forget something during the audit
- Elaborate the audit report which will include the non-compliances and other findings
These articles will provide you further explanation about internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
- Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/
This material will also help you regarding action pla ns:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
ISO 22301 toolkit
Answer:
ISO 22301 does not require 27001 implementation, and vice versa. What may happen is that because of business objectives and needs, or legal and contractual requirements, your organization may need to be compliant with both standards.
This article will provide you further explanation about requirements:
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/
2- Or if I do both, should I focus on ISO 27001 first?
Answer:
In case there is a need for both standards, to decide for which you should go first you have to consider:
- If your organization faces a multitude of non-IT threats capable to stop operations, then you should go for ISO 22301 first.
- If your organiz ation deals with digital products, and information technology processes are the heart of your organization, first you should go for ISO 27001.
This article will provide you further explanation about ISO 27001 and ISO 22301:
- What to implement first: ISO 22301 or ISO 27001? https://advisera.com/27001academy/blog/2017/04/03/what-to-implement-first-iso-22301-or-iso-27001/ -
Risk assessment
Answer:
If you have risks already treated you must include them in your risk assessment table, so you can monitor them in the future. As for how you should you score these kind of risks, the values of consequence and likelihood must consider the current values under the implemented controls (for risks where there are already existing controls, the likelihood and/or impact will be lower), and describe the controls applied in the last column of your risk assessment table.
By t he way, included in your toolkit you have the access to video tutorials that can help you fill in the risk assessment table, with real data as examples. -
ISO 27001 for very small business
Answer:
Certainly, it is possible to implement ISO 27001 in a small company without causing too much overhead. Advisera is specialized on supporting small and medium size organizations on the implementation of ISO management systems, ISO 27001 among them. For that purpose we developed toolkits with the minimum documentation required for certification, so organizations are not overhead with its maintenance. The templates are more than 80% complete, and you have only to adjust them considering your organizations needs. Comments included in each template will guide you on which content can be changed or deleted to fulfill your needs, and which content must be kept to ensure compliance with the standard.
For your needs I suggest you the ISO 27001 documentation toolkit. You can see a free demo of its contents at this link: https://advisera.com/27001academy/iso-27001-documentation-toolkit/
These article will provide you further explanation about ISO 27001 and its implementation:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- 5 ways to avoid overhead with ISO 27001 (and keep the costs down) https://advisera.com/27001academy/blog/2012/06/19/5-ways-to-avoid-overhead-with-iso-27001-and-keep-the-costs-down/
These materials will also help you regarding ISO 27001 and its implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- Conformio (online tool for ISO 27001) https://advisera.com/conformio/
- Security Awareness Training: https://advisera.com/training/awareness-session/security-awareness-training/ - this is a series of 25 videos that cover various topics related to security. -
Data transfer outside of the EU
Answer:
Based on your description, if the servers are in EU and the data does not leave those servers in order to be sent to the mother company in the US, there is no cross-border data transfer. I would also assume that the storage is provided via an affiliate of the EU based company of a subcontractor of the US company.
If you want to find out more about cross-border data transfers check out this webinar: “How to make personal data transfers to other c ountries compliant with GDPR” (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/).