Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Labeling of medical device accessories

    The standard that talks about symbols for medical products is ISO 15223-1:2021. There is no laser symbol specifically in it, but it says that the manufacturer is responsible for conducting a risk analysis based on which he will assess what information he must provide to the user. In your risk analysis, the danger of laser beams must be covered, so it is logical that such a symbol exists on the product.

  • Supplier Security Policy

    I’m assuming you are referring to the text “, as well as audit the supplier or partner at least once a year.” in section 3.5 of the Supplier Security Policy.

    Considering that this text means that, as you need to audit your processes, you also need to audit suppliers and partners to ensure they have implemented the security controls you agreed with them, and if the controls are performing properly.

    Please note that such audits are required only if control A.15.2.1 - Monitoring and review of supplier services is stated as applicable in the Statement of Applicability.

    Additionally, there are different types of audits, some more thorough (e.g., a comprehensive local audit), others simpler (e.g., verification of applied security clauses), and you should consider criteria such as the criticality of the supplier, results of previous audits and incidents history to decide which audit approach to apply.

    For further information, see:

  • Internal Audit Questions

    1. On the first management review meeting should we discuss about the Internal Audit  

    Results of performed internal audits are mandatory inputs to be discussed in the management review.

    For further information, see:

    2. Should the project manager gather all pieces of information during the project implementation

    The project manager is responsible to ensure that information needed for the ISMS implementation is identified and gathered by the information owners (e.g., department heads, process owners, users, etc.).

    Please note that the project manager has a coordinator role regarding tasks to be performed in the ISMS implementation project.

    For further information, see:

  • ISO security framework or standard for IoT

    I’m assuming that by CSA you mean Cloud Security Alliance.

    Considering that, ISO has three specific standards related to IoT:

    • ISO/IEC 21823-2:2020 Internet of things (IoT) — Interoperability for IoT systems — Part 2: Transport interoperability
    • ISO/IEC TR 30164:2020 Internet of things (IoT) — Edge computing
    • ISO/IEC TR 30166:2020 Internet of things (IoT) — Industrial IoT

    They do not define a security framework for IoT, but security requirements that need to be considered (e.g., Security and privacy, by ISO/IEC TR 30164:2020, and Security requirements by ISO/IEC 21823-2:2020), and ISO 27001 can be used to implement the security framework to fulfill such requirements.

    These articles will provide you with further explanation about ISO 27001 and how to work with security controls:

    • The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
    • Where to start from with ISO 27001 https://advisera.com/27001academy/knowledgebase/iso-27001-where-to-start-most-important-materials/

    • A.18.1.1 Identification of applicable legislation and contractual requirements

      1 - To satisfy the control, is it enough for an organization to just state that they identify & manage the relevant legislative statutory, regulatory, contractual requirements in their information security policy document?

      In the Information Security Policy, you can only state the commitment to fulfill legal requirements and refer to the document where the relevant legislative statutory, regulatory, and contractual requirements are listed.

      You also need to implement your security policies and procedures, which will satisfy the identified legislative, statutory, regulatory, and contractual requirements.

      These articles will provide you with further explanation:

      2 - I am trying to understand if other evidence like a separate defined list of laws or at least an email from their legal department is absolutely necessary to fulfill it. For context, what if the organization has stated that "due to sensitivity and attorney client privilege" they would not share anything more than that first statement to reference?

      Please note that while this statement may work for most situations, due to business or legal needs you may need to share part or the whole information with third parties (e.g., in case a supplier needs a better understanding of a security clause, or if legal authority demands it). In such cases, you should evaluate if the value of sharing the information overwhelms the risks. In this case, you should consider presenting only the minimum information required and add an NDA.

      This article can provide related information:

Page 68 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +