Search results

Home / Search

Category:
Select
Select

11270 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • A.18.1.1 Identification of applicable legislation and contractual requirements

    1 - To satisfy the control, is it enough for an organization to just state that they identify & manage the relevant legislative statutory, regulatory, contractual requirements in their information security policy document?

    In the Information Security Policy, you can only state the commitment to fulfill legal requirements and refer to the document where the relevant legislative statutory, regulatory, and contractual requirements are listed.

    You also need to implement your security policies and procedures, which will satisfy the identified legislative, statutory, regulatory, and contractual requirements.

    These articles will provide you with further explanation:

    2 - I am trying to understand if other evidence like a separate defined list of laws or at least an email from their legal department is absolutely necessary to fulfill it. For context, what if the organization has stated that "due to sensitivity and attorney client privilege" they would not share anything more than that first statement to reference?

    Please note that while this statement may work for most situations, due to business or legal needs you may need to share part or the whole information with third parties (e.g., in case a supplier needs a better understanding of a security clause, or if legal authority demands it). In such cases, you should evaluate if the value of sharing the information overwhelms the risks. In this case, you should consider presenting only the minimum information required and add an NDA.

    This article can provide related information:

    • 3 reasons why ISO 27001 helps to protect confidential information in law firms https://advisera.com/27001academy/blog/2019/10/15/iso-27001-for-law-firms-3-ways-to-maintain-confidentiality/

    • GDPR applicability

      Article 3 – Territorial scope – states in paragraph 2 that “This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.” . So, if the company offers goods and services to people in the EU (actually positioned in the EU), GDPR applies to the company. If the company offers goods and services to people in non-EU countries, and the company is not in the EU, GDPR doesn’t apply to them (even if EU citizens reside in the services countries).

      Please also consult these links:

    • ITMS Process

      There is no „one size fits all“ approach. However, ITIL encompasses everything you need, at least for the beginning.

      Here are the articles to help you while starting the implementation:

      Additionally, use the ITIL4 approach by following the value. That will help you focus on necessary and avoid overhead.

    • Data Processing Questions

      Regarding the Records of Processing Activities (ROPA), we have a template in our EU GDPR Toolkit that you purchased, you just fill in there details related to processing operations. For example, if you offer SaaS services, you just need to fill in exactly the processing operations that are part of the services offered, without mentioning all the customers. The role of the ROPA is to have a view related to all the processing operations in the organization, done for the Controller role or for the Processor role. Third parties need to be mentioned explicitly only when they perform different processing operations as suppliers (such as externalized backup services, or hosting services).

      For more details please consult these resources:

    • ISO 9001 to Software companies

      ISO 9001 Internal Auditor Course is applicable to people, internal auditors of quality management systems (QMS). If a software company has a QMS, ISO 9001 Internal Auditor Course will prepare internal auditors to audit the company’s QMS.

      The following material will provide you with information about audits:

    • Questions regarding Technical files 13485/MDR

      1: Do we need a Technical File for outsourced products that are manufactured elsewhere?
      You need to have a technical file for products that you are placing on the market. If products that are manufactured elsewhere are part of your final device, yes you need to have all necessary documentation from that outsourced product in your technical file.

      2: Do we need a Technical File for products that we relabel?

      Again, the question is who places the product on the market. If by putting the label you state that you are a manufacturer, in that case, you need to have the whole technical file. If with putting the label you state that you are a distributor, in that case, you do not have proper Technical documentation, rather medical device file according to the ISO 13485, requirement 4.2.3 which will then contain the EC certificate, instructions for use, information on installation/service and the like, depending on the type of product.

      3: Do we need a Technical File for products that we do not adapt or manufacture ourselves but that we buy and resell (as part of one of our products)?

      I believe that I have answered this in the previous two answers. If something else needs to be clarified, feel free to contact us.

    • Management Review

      ISO 45001 is an international standard, intended to be used by any organization, in any industry, anywhere in the world. As such, it is written to be flexible in nature, giving requirements that describe what needs to be, but not how to do it. So, the standard will not give details such as who does and does not need to be included in a management review; only that a management review needs to happen, certain data needs to be reviewed, and records need to be kept. In this case, not all organizations would have access to a doctor for this review, so the standard will not identify this as a requirement.

      So, it is up to your organization to determine who needs to be included in your management review. If you do have a doctor on site they may be a valuable asset to this process, but ISO 45001 does not require that a doctor take part.

      You can learn a bit more about how management review works in the article:

Page 66-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +