Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Incident and Service request priority
Answer:
Although it sounds logical, it's not necessary that incidents (or service requests) with high impact must have high urgency. For example, there is an incident or service request affecting reporting module in your ERP, part that deals with financial year reports. Although complete business of the company is in danger (like, reports submitted to the governance can't be made, or can't be made correctly), there is still plenty of time to resolve this.
Or, there is a service request, or bug, affecting some parts of the intranet (e.g. a part of intranet that affects all employees but does not a ffect business operation).
You can learn more in the article "All about Incident Classification" https://advisera.com/20000academy/knowledgebase/incident-classification/ -
Documenting disciplinary process
ISO 27001 does not require you to document control A.7.2.3 (Disciplinary process) as a separate document, neither does it require you to create a process flow chart.
As you mentioned, we included a section on how to handle disciplinary process in the "Incident management procedure" (folder 08 - A.16 in the toolkit), and this quite enough for a small company.
These materials will also help you regarding disciplinary process:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
Difference between ISO 27001 and locally published ISO 27001
Answer: I'm not familiar with the Colombian standards, but in most cases the local standards have the same (English) text as the original standard published by ISO, or they are directly translated into local language.
The point is - local ISO standards should not be different from the original ISO standard. -
ISO 27001 phases and corresponding outputs
Answer:
You can use the "List of documents" from our ISO 27001 toolkit which will show you the steps you need to take, and which documents we suggest filling out for each step: https://advisera.com/wp-content/uploads//sites/5/2015/06/List_of_documents_ISO_27001_Documentation_Toolkit_EN.pdf
Also, these materials might help you:
- ISO 27001 Project plan https://info.advisera.com/27001academy/free-download/project-plan-for-iso-27001-iso-22301-implementation
- Diagram of ISO 27001:2013 Implementation (PDF) https://info.advisera.com/27001academy/free-download/diagram-of-iso-27001-implementation-process -
Documenting controls from section A.14
I assume your first line refers to A.14.1.1 Information security requirements analysis and specification - we have a template called Specification of information system requirements https://advisera.com/27001academy/documentation/specification-of-information-system-requirements/
Regarding controls from A.14.2 we have this Security development policy https://advisera.com/27001academy/documentation/secure-development-policy/
By the way, ISO 27001 requires you to document only the control A.14.2.5 Secure system engineering principles.
Here are a couple of articles that will help you:
- How to set security requirements and test systems acc ording to ISO 27001 https://advisera.com/27001academy/blog/2016/01/11/how-to-set-security-requirements-and-test-systems-according-to-iso-27001/
- What are secure engineering principles in ISO 27001:2013 control A.14.2.5? https://advisera.com/27001academy/blog/2015/08/31/what-are-secure-engineering-principles-in-iso-270012013-control-a-14-2-5/
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/ -
Asset owners
Answer:
ISO 27001 does not specify how to do this for grouped assets - theoretically you could write the names of all asset owners in one cell, but it would be more practical to write something like "all people who are using the asset".
See also this article: How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/ -
Information about external providers
Answer:
I do not have enough information. Therefore, I will assume a scenario that I think adapts to the content of the finding. Perhaps your company requires that critical suppliers must have ISO 9001 certification. If that is so, the finding is requesting that you check that suppliers had made the transition to ISO 9001:2015 version. For example, last week I went to a car shop and they had their ISO 9001 certificate on the wall: it was according to ISO 9001:2008 and was outdated. I would send e-mails, or telephone critical suppliers requesting evidences of their transition to the ISO 9001:2015 version.
The following material will provide you information about external providers:
- ISO 9001 – How to evaluate supplier performance according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/10/27/how-to-evaluate-supplier-performance-according-to-iso-90012015/
- free online training ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Environmental aspects and risks
Answer:
There is no mandatory way about how to manage risks associated with environmental aspects. So, you can follow your suggestion if it works for you. For example, normally I have an environmental aspects and impacts register and then, for each impact I list associated risks in different columns in the same register.
The following material will provide you information about assessment of environmental risks:
- ISO 14001 – ISO 14001 risks and opportunities vs. environmental aspects - https://advisera.com/14001academy/blog/2016/06/06/iso-14001-risks-and-opportunities-vs-environmental-aspects/
- Risks and opportunities in ISO 14001:2015 – What they are and why they are important - https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/
- Risk Management in ISO 14001:2015 – What, why and how? - https://adv isera.com/14001academy/knowledgebase/risk-management-in-iso-140012015-what-why-and-how/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Qualification of internal auditors
Answer:
It is up to each organization to establish the competency requirements that its internal auditors must meet. Your organization can have a job description for its internal auditors where it is stated in a clear way what are the requirements. For example, I see organizations stating that internal auditors must have a 20, or 30, or 40 hours training. It is your organization that sets the bar for its internal auditors.
The following material will provide you information about internal audits:
- ISO 9001 – Five Main Steps in ISO 9001 Internal Audit - https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
- free online training ISO 9001:2015 Internal Auditor Course - https://training.advis era.com/course/iso-9001-internal-auditor-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/