Search results

CONSULTA DE PROCEDIMIENTOS DEL SGC ISO 9001:2015

No, it is not mandatory to have a flowchart in a procedure. It is up to each organization to decide the composition of a procedure.

In house food laboratory accreditation

As an internal QC laboratory, you need to consider the needs of production, as your “client” when you review the client requests. Reporting can be simplified, as agreed. This is as long as the internal user has accurate, valid information to make a decision on.

Regarding the quality policy for an ISO 17025 laboratory, it needs to specifically address safeguarding impartiality, competency and consistent valid results.

For impartiality look at risks due to shared resources, reporting structures where QC personnel may report to the production manager and possible undue pressure on the QC lab to speed up release of results. Look at the article How to ensure impartiality in an ISO 17025 laboratory at https://advisera.com/17025academy/blog/2020/10/12/ensuring-impartiality-in-an-iso-17025-laboratory/ 

CCTV retention time

ISO 27001 does not prescribe retention times for records.

To identify the required retention time, you need to consider the results of the risk assessment and applicable legal requirements (e.g., laws, regulations, and contracts).

In case there are no relevant risks or legal requirements defining for how long to keep records such as CCTV images, the organization can adopt the retention time that best fulfills its needs.

For further information see:

• Records management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/11/24/records-management-in-iso-27001-and-iso-22301/

Cloud security risk assessment methodology

I'm assuming that by "cloud adoption lifecycle" you mean a sequence of steps followed to implement cloud computing capabilities.

Considering that, please note that this toolkit includes all you need to perform the cloud security risk assessment and to plan for cloud security controls. You have to follow the steps in the toolkit and use the templates to achieve this.

In case you need further support to implement the documents, you can schedule a call with an expert to have a one-on-one live consultation.

This article will provide you with further explanation about ISO 27001 information risk assessment:

• 6 main steps in risk management https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/

Audit of an application hosted on a private cloud virtual server

The general approach to performing an audit is:

• define dates, criteria (i.e., the security requirements that need to be evaluated), and audit scope (i.e., the application to be evaluated).
• develop checklists to help you not forget something during the audit (i.e., what needs to be verified to evaluate if the security requirements are being met).
• evaluate the application. At this point, the most common methods are: Inquiry personnel (e.g., users, developers, administrators, etc.); Observation of the application being used; Examination or Inspection of Evidence (e.g., records of previous processing, system logs, etc.); Re-performance (i.e., repeating previous processing to evaluate its results); and use of tools to perform Computer-Assisted Audit Techniques (CAAT).
• elaborate on the audit report which will include the non-compliances and other findings

Considering a cloud environment, you need to clarify the responsibilities for each asset, so you can properly identify who needs to be audited about which asset.

For example, in an IaaS cloud model, the cloud provider is responsible only for the physical structure, while in a PaaS model, the cloud provider is also responsible for the development environment used by application developers, and in a SaaS environment, the cloud provider is also responsible for the applications.

These articles will provide you a further explanation about preparing an audit:

• How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
• How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
• Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/
• Defining the ISMS scope if the servers are in the cloud https://advisera.com/27001academy/blog/2017/05/22/defining-the-isms-scope-if-the-servers-are-in-the-cloud/

Testing and calibration

I do not have enough information to respond to the question of how long it would take to calibrate a tester.

For more information on associated calibration intervals, refer to ILAC G24:2007 Guidelines for the determination of calibration intervals of measuring instruments (note currently under revision) available for download at https://ilac.org/?ddownload=818 

For more information, have a look at

The article: What does ISO 17025:2017 require for laboratory measurement equipment and related procedures? at https://advisera.com/17025academy/blog/2019/07/25/iso-17025-measurement-requirements-of-the-standard/

Valor y entregables de ITIL

ITIL considers the whole life cycle of the service as well as the whole (IT Service Management) organization.

Here are a few articles that can give you an idea of why consider (and implement) ITIL i.e. what are some of the positive outcomes of the ITIL implementation:

• Why ITIL? https://advisera.com/20000academy/knowledgebase/itil/
• How ITIL can help reduce the gap between customers and the IT department https://advisera.com/20000academy/blog/2016/06/28/how-itil-can-help-reduce-the-gap-between-customers-and-the-it-department/
• How to translate ITIL/ISO 20000 language into business language understandable by your management https://advisera.com/20000academy/blog/2016/03/01/how-to-translate-itiliso-20000-language-into-business-language-understandable-by-your-management/
• acing reality – Measurements in ITIL https://advisera.com/20000academy/blog/2013/04/02/facing-reality-measurements-itil/
• ITIL – Framing the value of services (part II) https://advisera.com/20000academy/blog/2014/11/25/itil-framing-the-value-of-services-part-ii/

• General privacy policy/notice vs. entity-specific policy/notice

  It all depends on the role of the subsidiaries, whether they are data controllers or data processors. If they are data processors, it is the role of the data controller to make sure that data subjects are informed by means of a privacy notice. If they are data controllers, they need to make sure that they have a privacy notice describing their processing operations. What is really important is to make sure that the data subject is informed. The privacy notice or notices can reside in a single location, however, they must be easy to read and understand, and contain information about all the processing operations.

  Please visit these resources as well:

  • Everything you need to know about the GDPR Privacy Notice: https://advisera.com/articles/gdpr-privacy-notice-6-key-elements-to-include/
  • Article 13 GDPR: Information to be provided where personal data are collected from the data subject: https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-are-collected-from-the-data-subject/
  • Article 14 GDPR: Information to be provided where personal data have not been obtained from the data subject: https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-have-not-been-obtained-from-the-data-subject/

• ISO 45001 Audits in a Construction Company

  The departments that need to be audited for the OHSMS will depend on the scope you have chosen for the management system. With ISO 45001 it is up to the organization to determine which processes will become part of the OHSMS, and this will determine what needs to be audited. I like to think of the scope as “where the PH&S rules will apply”.

  Once you know which processes are included, then you will prepare to assess each process against the planned arrangement. In effect, you will be collecting evidence to show that process meets their requirements. Where they do not, you will raise a nonconformity which will require corrective action to improve the system and make the process meet requirements once again.

  You can find out more on how scope and internal audit work in the articles:

  • How to determine scope of the OH&SMS https://advisera.com/45001academy/blog/2015/12/09/how-to-determine-scope-of-the-ohsms/
  • How to perform internal audits in ISO 45001 https://advisera.com/45001academy/blog/2015/09/23/how-to-perform-internal-audits-in-iso-45001/