Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Disciplinary process
Answer:
ISO 27001 does not prescribe how an organization should write its documents, so this decision is up to the organization, based on the results of risk assessment, legal requirements (e.g., contracts, regulations or laws the organization must comply with), or if Top Management decides this practice will be beneficial to the organization.
The same applies to the level of sanctions related to policy non compliance. Depending of the risks related to each policy, the sanction level may vary (e.g. non compliance to access control policy may be more severe than non compliance to clean desk policy).
These articles will provide you further explanation about writing documents:
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures// -
Template content
Section: 3.1 Chyptographic Measures
Question: At the beginning of this section the document talks about related documents. About the guideline for information classification and about contractual and legal needs. About the second one: by this do you mean the list of legal, official, contractual and other requirements? If yes do I have to add the document in section 2 (reference documents)?
Answer:
Yes, the referred document is the list of legal, official, contractual and other requirements. Regarding the second, you have to list this document, or the similar one you already use in your organization, in the list of referenced documents. If you don't have such a List, then list all the legislation and contracts related to the use of cryptography.
This article will provide you further explanation about use of cryptographic controls:
- How to use the cryptography according t o ISO 27001 control A.10 https://advisera.com/27001academy/how-to-use-the-cryptography-according-to-iso-27001/ -
Employee awareness of HLS
Answer:
No, there is no requirement in ISO 9001 that all employees shall be aware of HLS.
The following materials will provide you more information on Annex SL:
- Article - Has the PDCA Cycle been removed from the new ISO standards? - https://advisera.com/27001academy/blog/2014/04/13/has-the-pdca-cycle-been-removed-from-the-new-iso-standards/
- [free course] ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/ -
Performing risk assessment
Answer:
Included in the toolkit you bought you have access to a video tutorial that can help you fill in the risk assessment table, but broadly speaking you can use historical data from your company, or opinion of the personnel most involved with the assets you are assessing to valuate the consequence and likelihood of the risks.
These articles may provide you more information and examples about identification of probability of occurrence:
- How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/ -
Procedimientos en ISO 9001:2015
Respuesta:
Lo cierto es que en esta nueva versión de la norma ISO 9001:2015 ya no existe la obligatoriedad de crear procedimientos. La nueva ISO 9001 nos habla únicamente de información documentada que es necesaria mantener, esto correspondería a la política de calidad, los objetivos, el alcance y los criterios para la selección de los proveedores; y también menciona que debe ser retenida información documentada, que se refiere a lo que se entiende como registros. No obstante, la organización puede determinar la necesidad de crear una serie de procedimientos que le ayuden a facilitar la implementación y mantenimiento de la norma.
En este artículo puede encontrar un listado con los documentos y registros obligatorios así como los comúnmente utilizados - Lista de documentos obligatorios requeridos por la ISO 9001:2015: https://advisera.com/9001academy/es/knowledgebase/lista-de-documentos-obligatorios-requeridos-por-la-iso-90012015/
Estos materiales también pueden ayudarle con la documentación de ISO 9001:2015:
- Libro - Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso gratuito en línea - Fundamentos ISO 9001:2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ -
ISMS scope
Answer: Section 3.4 of the ISMS scope document requires an organization to document a general overview of which network and IT assets (e.g., firewalls, switches, communication links, etc.) are included in the scope, but you also have to understand how these assets relate to elements external to the scope (e.g., Internet, customer's network, communication providers, etc.), so you can have a precise understanding of your security context and environment.
Here is an example:
"The network and IT infrastructure included in the ISMS scope comprise of two local networks (user and system LANs) and a wi-fi network (for consultants), interconnected by two independent switches, and a backbone which connects all networks to the Internet."
These articles will provide you further explanation about ISMS scope:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
2 I also want to know if you have a gap assessment document for ISO 22301?
Answer: For ISO 22301 gap assessment I suggest you to take a look at the free demo of our ISO 22301 Internal Audit Checklist at this link: https://advisera.com/27001academy/documentation/internal-audit-checklist/
This document provides a list of questions in order to help identify compliance with ISO 22301. For each clause or control from the standard the checklist provides one or more questions which allows you to visualize which specific elements of business continuity management system you’ve already implemented, and what you still need to do. -
Availability of the policies and procedures of the ISMS
Answer:
The GDPR does not require you to have specific persons signing policies and procedures, this is usually an internal requirement of the companies. The only thing you may need to prove is the fact that the policies and procedures are available to the concerned employees and that there is a method in place to check if they are effective. -
ISO 27001 courses
Answer:
I suggest you to take a look at these ISO 27001 courses:
- ISO 27001:2013 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
- ISO 27001:2013 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/
- ISO 27001:2013 Lead Implementer Course https://advisera.com/training/iso-27001-lead-implementer-course/
All exams are accredited by Exemplar Global, and recognized world-wide. You can enroll each one for free (you only have to pay for the certification exam / workshop). -
What other regions are planning to apply GDPR?
Answer:
Not so sure about the US because privacy related concepts are a little different there, but Canada and other countries especially the ones that received adequacy decisions in the past will definitely be amending their local privacy laws to be as close as possible to the GDPR. -
Roles in a QMS
Answer:
When implementing a QMS you use the process approach. The QMS is nothing more than a set of processes. In each process you identify a flow of activities. Each activity has the participation of one or more functions (roles). What I recommend you to do is to list all the activities done by each function in each process.
This way you will develop a sound characterization of what is expected from each function (role).
The following material will provide you information about roles in a QMS:
- How to document roles and responsibilities according to ISO 9001 - https://advisera.com/9001academy/blog/2018/02/26/how-to-document-roles-and-responsibilities-according-to-iso-9001/
- What is the job of the Quality Manager according to ISO 9001? - https://advisera.com/9001academy/blog/2016/08/23/what-is-the-job-of-the-quality-manager-according-to-iso9001/
- free online training ISO 9001:2015 Lead Implementer Course - https://advisera.com/training/iso-9001-lead-implementer-course/ - book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/