Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Risk assessment
1. We are a small company, the CIO (me) will be the risk owner for all assets, is that a problem?
Answer: ISO 27001 does not define who must be the risk owner, so a single person can be the owner of all risks. The choice of the risk owner should consider the capability to make decisions about treating the risks and that the quantity of risks do not become excessive to be managed.
For more information, see: Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/
2. Do I have to include also the private phones of our employees (their mailbox is configured on it and an app for 2 factor authentication)
Answer: If the organization does allow employees to use their own devices to access information included in the ISMS scope, then these personal devices should be included in the risk assessment.
For more information, see: How to write an easy-to-use BYOD policy compliant with ISO 27001 https://advi sera.com/27001academy/blog/2015/09/07/how-to-write-an-easy-to-use-byod-policy-compliant-with-iso-27001/
3. Do I have to include also the private PC of laptop that they use at home to connect via VPN to an online workplace where the can work from home?
Answer: Like the previous answer, if the organization does allow employees to use their own devices to access information included in the ISMS scope, then these personal devices should be included in the risk assessment.
For more information, see:How to apply information security controls in teleworking according to ISO 27001 https://advisera.com/27001academy/blog/2021/10/27/how-to-use-iso-27001-to-secure-data-when-working-remotely/ -
Toolkit content
Answer: ISO 27001 does not require documents specific for control from section A.6, but these following templates in your toolkit cover controls from this section:
- Bring Your Own Device (BYOD) Policy (covers controls A.6.2.1 and A.6.2.2)
- Mobile Device and Teleworking Policy (covers control A.6.2)
- Acceptable Use Policy (covers controls A.6.2.1 and A.6.2.2)
2. Also, A.12 Operations security should include all below, but I can see only 3 controls ? Could you please let me know how to address this, please ?
1. Operational procedures and responsibilities
2. Protection from malware
3. Backup
4. Logging and monitoring
5. Control of operational software
6. Technical vulnerability management
7. Information systems audit considerations
Answer: These controls are covered by the following templates:
1. Operational procedures and responsibilities: Operating Procedures for Information and Communication Technology
2. Protection from malware: Acceptable Use Policy
3. Backup: Operating Procedures for Information and Communication Technology, Backup Policy, and Acceptable Use Policy
4. Logging and monitoring: Operating Procedures for Information and Communication Technology
5. Control of operational software: Acceptable Use Policy
6. Technical vulnerability management: Acceptable Use Policy
7. Information systems audit considerations: Internal Audit Procedure
ISO 27001 does not require each control in Annex A to be documented. Our toolkits focus on small and mid-size companies, and that's the reason why we do not write documents to cover each control – for those companies this large number of documents would result in an overkill for many of them. Instead of that a single template may cover multiple controls.
In the root folder of the toolkit you'll find a document called “List of Documents” that explains which control is covered by which document. -
Deletion request
Answer:
The right to be forgotten established under the EU GDPR is not an absolute right.
You must comply with a deletion request where:
- the individual has objected to the processing and (other than in relation to objections to direct marketing) there are - - no overriding legitimate grounds to justify that processing;
- the personal data is no longer needed for the purpose for which it was collected or processed;
- the individual withdraws consent and there are no other grounds for the processing;
- the personal data is unlawfully processed;
- there is a legal obligation under Union or Member State law to erase the personal data; or
- personal data was processed in connection with an online service offered to a child.
You do not need to comply if the processing is:
- necessary for rights of freedom of expression or information;
- for compliance with a legal obligation under Union or Member State law;
- in the public interest or carried out by an official authority;
- for public interest in the area of public health;
- for archiving or research; or
- for legal claims. -
Supplier evaluation
Answer
It is your company that has the authority to decide if all raw material manufacturers need to be audited or not. ISO 9001:2015 does not oblige to use audits to qualify suppliers.
“Manufacturer have an ISO 9001-2015 standard is this enough? (please do consider that: raw material provider has a ISO 9001-2015 standard and also we perform initial laboratory control all provided raw material).”
Answer
Again, it is your company that has the authority to decide the initial qualification criteria for suppliers.
“According to ISO 9001:2008 clause 7.4.1, it was required to keep records of the criteria for selection, evaluation and re-evaluation of the suppliers but this requirement was ch anged ISO 9001-2015 and wide is expanded. In ISO 9001:2008, the organization needed to ensure the purchased product met specified purchase requirements. In ISO 9001:2015, the verification needs to ensure "the externally provided processes, products and services meet requirements. (is this mean every provider shall be in site audit?)”
Answer
It means that organizations should decide which products, services or subcontracting are relevant enough to the conformity or products or services provided by the organization. For those considered to be relevant, organizations should plan how they will control if specified purchase requirements are being met. Site audit is just one of the possibilities, others are internal lab quality control, supplier quality control, third party quality control
The following material will provide you information about purchasing:
- ISO 9001 – How to evaluate supplier performance according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/10/27/how-to-evaluate-supplier-performance-according-to-iso-90012015/
- free online training ISO 9001:2015 Lead Auditor Course - https://advisera.com/training/iso-9001-lead-auditor-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Audit preparation
Answer:
Before auditing, an auditor should prepare a checklist to help him or her to perform the audit. If an auditor has no previous access to company documentation, he or her can prepare the checklist based of the reference standard. So, an auditor goes to the audit with at least a checklist based on ISO 9001:2015. If the auditor has one hour, before starting the audit, to go through the company documentation, he or she can use that possibility to pinpoint specific documents used to comply with the reference standard.
The following material will provide you information about auditing:
- ISO 9001 – How to create a checklist for an ISO 9001 internal audit for your QMS - https://advisera.com/9001academy/blog/2016/07/12/how-to-create-a-check-list-for-an-iso-9001-internal-audit-for-your-qms/
- ISO 9001 Audit Checklist - https://advisera.com/9001academy/knowledgebase/iso-9001-audit-checklist/
- free online training ISO 9001:2015 Lead Auditor Course - https://advisera.com/training/iso-9001-lead-auditor-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Background check
Answer: Considering ISO 27001, the need for background check is only required when:
- you have legal requirements (e.g., laws, contracts, or regulations) demanding such action;
- there are unacceptable risks which only can be handle by performing background checks;
- there is a top management decision defining that background checks must be performed.
If none of these situations apply, there is no need to implement background check., and even if background check is applicable, most probably it will not be necessary to cover all employees, but only the most critical roles in your organization.
2 . If we do not want to go for BGC for all employees and have letter from management for the same is it recommended or it will be a NC.
Answer: As explained before, if there is a letter from management requiring background checks, not performing them would be NC. An approach you may try is to show management that performing background checks on all employees wouldn't be efficient (or maybe even be against law), and that the background scope should be reduced only to those roles regarded as critical according the results of risk assessment.
This article will provide you further explanation about background checks:
- How to perform background checks according to ISO 27001 https://advisera.com/27001academy/blog/2018/03/26/how-to-perform-background-checks-according-to-iso-27001/ -
Temporary change of process controls
Answer:
IATF 16949 brings new requirements for an organization to comply. One of them is 8.5.6.1.1. Temporary change of process controls.
The main reason behind this requirement is a need for a temporary change of documented process controls that organization has used, due various of reason, it is important that organization can control process with alternative methods and get back to regular once as soon as a normal operations resume.
This process must be documented with the list of manufacturing control actions that contains both the planned methods and the approved alternative methods of process control. Alternative process control must be reviewed at least once a day and all products must be traceable.
If Plex system assures all mention requirements, and some obviously do, it can be used for fulfilling this requirement.
For more information please look at:
- How to Develop a Control Plan According to IATF 16949 https://advisera.com/16949academy/blog/2017/09/27/how-to-develop-a-control-plan-according-to-iatf-16949/
- Procedure for Document and Record Control https://advisera.com/16949academy/documentation/procedure-for-document-and-record-control/
-Control Plan https://advisera.com/16949academy/documentation/control-plan/ -
BCP sample
Answer:
Specifics of security requirements for BCPs will vary according to disruptive scenarios considered, as well as the continuity levels derived by an organization, but as general examples of security requirements to consider in a BCP you my have contractual clauses defining that access control to information, assets or premises must be ensured all time, even during disruptive events (so you have to consider redundant access controls), or that the results of risk assessment have identified as unacceptable a situation where you have a single point of failure (e.g., single communication link or database server).
For more information I suggest you these materials:
- Writing a business continuity plan according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/writing-a-business-continuity-plan-according-to-iso-22301-free-webinar-on-demand/
- ISO 22301 Case study in the travel industry: Business continuity as a necessity in customer care https://advisera.com/27001academy/blog/2016/11/07/iso-22301-case-study-in-the-travel-industry-business-continuity-as-a-necessity-in-customer-care/
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Regarding the clause 6.3
Answer:
Adding or removing suppliers, is not related with clause 6.3
“2. When the format of a particular ISO format changes, organizational changes, equipment changes or facility change we use the change request form. Is this the correct explanation?”
Answer:
Changing forms is not related with clause 6.3. Clause 6.3 is about planning how to handle changes without breaking the quality management system. For example, when an organization moves to a new location, or introduces a set of new production equipment it is necessary to plan the introduction of these changes in a controlled way. Last year I worked with an injection molding company that duplicated the number of machines and changed location to another site, with a lot of new workers recruited – that was a great change in planning, operating and controlling production. 6.3 is about changes like this.
Some years ago, I worked with a machine manufacturin g company. One of their operations was painting parts of the machines. Then, due to stricter environmental legislation they decided to subcontract that operation to a painting services specialist. They had to change their production planning and quality control to consider the new flow of production. 6.3 is about changes like this.
The following material will provide you information about planning and controlling changes:
- ISO 9001 – QMS Change Management in 7 steps – https://advisera.com/9001academy/blog/2016/11/29/qms-change-management-in-7-steps/
– free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
How important is IATF for an organization
Answer:
IATF 16949:2018 is the successor of TS 16949. For companies that are in the automotive industry, this standard is required for Tier 1, Tier 2 and Tier 3 suppliers of OEM producers. It is, also, very popular and requested for suppliers of those companies. If you are in the automotive business than IATF 16949 is a must.
The following article will give you more information:
-Why is IATF good idea for organization and more about it please find out on https://advisera.com/16949academy/what-is-iatf-16949/
2. How it helps in improving the current status?
Answer:
IATF 16949 gives structure and former best practice that can improve significantly process and system of an organization.
Please find out more about how to write Quality Manual: https://advisera.com/16949academy/blog/2017/05/31/how-to-write-the-iatf-16949-quality-manual/
Also, it is important to know Core Tools for IATF: https://advisera.com/16949academy/blog/2017/08/23/what-are-the-five-core-tools-of-iatf-16949/
3 . What are the clauses and how they are different from TS 16949?
Answer:
The new structure of standard in accordance with Annex SL and requirements are from clause 4 to clause 10, following the ISO 9001:2015 structure, as it was a technical specification for it.
They differ from TS 16949, also, in new requirements that set higher demand for an organization that wants to comply.
Please find out more on https://advisera.com/16949academy/blog/