Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Documented information in ISO 14001:2015
Answer:
In the following article you will find the mandatory documented information necessary to comply with ISO 14001:2015 requirements, but also some other documentation commonly used during the implementation of the standard:
- List of mandatory documents required by ISO 14001:2015: https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/list-of-mandatory-documents-required-by-iso-140012015/
These materials can also help you to undestand the documented information required by ISO 14001:2015:
- Book - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- Free on-line ISO 14001:2015 Foundations Course: https://advisera.com/training/iso-14001-internal-auditor-course/ -
Security requirements for suppliers
We are building an ISMS for an ISO 27001 certification of our entire company. Now the question comes up about the requirements for our data center. Are all these points that are important for certification complete?
- Access protection
- Password policy compliance
- Typical irritant signals: fire loads, dirt or water-bearing cables in data centers or craft materials in server cabinets or unlabeled data carriers lying around.
1. In other words: What are the requirements for our data center provider if we want to certify ourselves as an entire company ISO72001?
Answer: The requirements your datacenter provider must fulfill are practically the same you would have to fulfill if the datacenter belonged to your organization, and without more detailed information abou t your context it is not possible to provide an specific answer. Since your provider is not ISO 27001 certified yet, I'd suggest you to talk to them about performing a risk assessment together to identify which risks the provider must have to treat, so these treatments can be defined as contractual clauses in your service agreement.
These articles can provide you additional information:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
- Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
2 . Can we also successfully certify ourselves to ISO 27001 with a data center without ISO 27001 certification?
Answer: Provided that your provider can show evidences that it is handling your security requirements as defined in the service agreement, there is no need for the provider to be ISO 27001 certified, although this certification can prove beneficial to it to minimize compliance costs. -
Filling the Business Impact Analysis questionnaires
Answer: There is no need to figure out different values of working capital for each time frame. In this part of the questionnaire you only have to identify for how much time you will need the working capital available to resume operations. For example, for a just in time operation which needs US$ 500K of working capital, you my decide to mark that this capital is needed immediately or up to 1h after the disruptive event. For an activity that keeps a significant a stock of products, you may mark that this capital is needed up to 1 week.
2. Under ‘External services’ should the top 10 suppliers be named if the list consists of thousands?
Answer: Under ‘External services’ you have to list the most critical suppliers to ensure the cont inuity under the minimum service levels agreed. These can vary from one to several, depending on the scenario you define.
Included in the toolkit you bought, there is a video tutorial that can help you fill in the Business Impact Analysis, using real data so facilitate the understanding. -
Information security standards for medical devices
Answer:
For the protection of personal health information and compliance with medical-related regulations, I suggest you to consider ISO 27001 together with ISO 27299 and ISO 13485.
ISO 27799 has the objective to provide security controls to protect personal health information, presenting guidance for this specific sector.
ISO 13485 has the objective to specify requirements for a Quality Management System where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.
These articles will provide you further explanation about these standards:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- How ISO 27001 and ISO 27799 complement each other in health organizations https://advisera.com/27001academy/blog/2016/06/13/how-iso-27001-and-iso-27799-complement-each-other-in-health-organizations/
- What is ISO 13485? https://advisera.com/13485academy/what-is-iso-13485/ -
Performance against management system objectives
Answer:
If I understand correctly the subject, I, as an assessor, would like to see the performance of the organization (the organization is the client of LRQA) against the management system objectives. What are the trends? What is the evolution of the results? Were the action plans implemented? Were the action plans effective?
The following materials will provide you more information about monitoring and analysis:
- Article - How to implement the Check phase (performance evaluation) in the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/11/17/how-to-implement-the-check-phase-performance-evaluation-in-the-qms-according-to-iso-90012015/
- How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
- [free course ] ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Competencies for ISMS implementation
Answer:
The foundation course will give you a good basis for understanding the ISO 27001 requirements and how to fulfill them, but to increase the chances of success, I'd recommend you to add competencies related to project management, so you can manage the requirements, deadlines, activities, costs, and personnel involved in the implementation.
These articles will provide you further explanation about implementing ISO 27001:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- ISO 27001 project – How to make it work https://advisera.com/27001academy/blog/2013/04/22/iso-27001-project-how-to-make-it-work/
- Who should be your project manager for ISO 27001/ISO 22301? https://advisera.com/27001academy/blog/2014/12/01/who-should-be-your-project-manager-for-iso-27001-iso-22301/
This material will also hel p you regarding implementing ISO 27001:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- ISO 27001:2013 FOUNDATIONS COURSE https://advisera.com/training/iso-27001-foundations-course/
- ISO 27001:2013 LEAD IMPLEMENTER COURSE https://advisera.com/training/iso-27001-lead-implementer-course/ -
Service management and information security
Answer:
By learning about security standards/certification, service management professional can benefit from a better understanding of information security clauses included in service level agreements (which are increasing with the increase on privacy protection laws and customer awareness on the matter), and how to fulfill them in a better cost-effective way, while avoiding problems related to non compliance and regulations/laws breaches.
This article will provide you further explanation about information security benefits:
- Four key benefits of ISO 27001 implementation https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/ -
Information security strategy
Answer:
In fact, the information security strategy must be a part of the efforts to achieve business objectives and organizational strategies. For example, for the business objective of increase revenues, a business strategy may be to increase revenues through e-commerce, and an information security strategy may be to adopt a more robust platform to support the increase in the access and transactions and reduce unplanned downtime, or to decrease the number of data leakages, which directly supports an increase in trust in the organization. By implementing these information security strategies probably the strategic business objective may also be achieved.
This article will provide you further explanation about strategic alignment:
- Aligning information security with the strategic direction of a company according to ISO 27001 https://advisera.com/27001academy/blog/2017/02/20/strategic-direction-of-a-company-according-to-iso-27001/ -
ISMS and ERP
Answer:
An ISMS can help identify information security requirements that must be considered on the ERP Internal Projects to better protect information and the ERP performance, such as which controls to implement, and how to test them.
This article will provide you further explanation about including security requiements:
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/ -
Standards correlation
Answer:
Regarding the standards you've mentioned, we have available the following matrices as free downloadable material:
- ISO 27001 vs. ISO 22301 matrix https://info.advisera.com/27001academy/free-download/iso-27001-vs-iso-22301-matrix
- ISO 27001 vs. ISO 20000 matrix https://info.advisera.com/27001academy/free-download/iso-27001-vs-iso-20000-matrix
- ISO 27001 vs. ISO 9001 matrix https://info.advisera.com/9001academy/free-download/iso-9001-vs-iso-27001-matrix
- ISO 14001:2015 vs. ISO 9001:2015 matrix https://info.advisera.com/14001academy/free-download/iso-4001-2015-vs-iso-9001-2015-matrix