Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Information Security Program
Answer:
An Information Security Program is a collection of the controls that an organization needs to have in place to protect information and keep information security risks at acceptable levels.
Considering that, to create a ISP you should use the templates related to Risk Management, to identify the risks and proper treatments, and use the Statement of Applicability to present the applicable controls and how they will be implemented.
You must note that this will be only part of the ISMS, and that you should consider implementing all other documents to ensure the controls you decided to implement will be monitored periodically and improved or adjusted as needed.
This material will provide you more information:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/ -
Documenting competencies
Is there a template which defines and documents competence for ISMS roles?
Answer:
Records of experience that can be used are references from previous employers or records of activities performed in the organization itself. Training and education records that can be used are certificates and presence lists.
You can use our Training and Awareness Plan template to determine and organize the required competencies for your ISMS. You can see a free demo of this template at this link: https://advisera.com/27001academy/documentation/training-and-awareness-plan/ -
Defining scope
A chip manufacturing organization would like to go for ISO 27001 and want to include only IT managed services in the scope. IT managed services is a support organization and helping the entire business but their labs environment is different and would like to keep it out of scope from ISO 27001. Is that possible?
Answer:
ISO 27001 does not require the ISMS scope to be all the organization, so it can be defined only as a small part if it will fulfill its needs and objectives.
What you should consider is if the defined scope will protect the information the business considers relevant. For example if you define only the IT managed services as the scope, but the information it handles also is used in the labs environment, at the labs it may not be properly protected.
These articles will provide you further explanation about defining scope:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms -scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
These materials will also help you regarding defining scope:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Certificar un producto o servicio con ISO 27001
Respuesta: No puedes certificar directamente un producto o servicio, o un proceso de un servicio/producto, pero puedes incluirlos en la definición de tu certificado. Por ejemplo: Los sistemas de información que dan soporte al servicio X, de acuerdo a la declaración de aplicabilidad versión x/y/z.
En cualquier caso, si la compañía es pequeña o mediana, nosotros recomendamos incluir en el alcance del SGSI toda la organización.
Para más información sobre el alcance “How to define the ISMS scope” : https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
Documentation in smaller companies
Answer:
In my opinion small companies should indeed, avoid too much documentation, and that is actually the aim of the new standard ISO 9001:2015. Just complying with the mandatory documents, which list you can see here - List of mandatory documents required by ISO 9001:2015: https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ and deciding about some other documented procedures commonly used should be enough for an organization to success in an audit.
To learn more about documented information in ISO 9001:2015, you can see these materials:
- New approach to document an d record control in ISO 9001:2015: https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- Book - Managing ISO Documentation: a plain English guide: https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Free on-line course- ISO 9001:2015 Foundations Course: https://advisera.com/training/iso-9001-foundations-course/ -
Quality policy in ISO 9001 and ISO 17025
Answer:
You don´t need to keep separately the quality policy for ISO 17025 and ISO 9001. What is mandatory is to maintain documented information of the quality policy for both standards, so it doesn´t matter if you do it separately or you have only one document.
To learn more about quality policy in ISO 9001 and ISO 17025, you can see - ISO 17025 vs ISO 9001https://advisera.com/17025academy/blog/2019/07/11/iso-17025-vs-iso-9001-main-differences-and-similarities// -
Loading and unloading areas and ISO 27001
We've received this question:
>I am fully satisfied with the answer for loading & unloading area. I do understand what the standard says but how to make it from scratch? So just consider any office, and I have to make a new loading & unloading area.
Answer:
Once you already have the requirements for this new area, you have to assess your office to verify if you have any environment (e.g., an room or free area) available that can fulfill them (the most restrictive ones will be those related to an isolated environment and the existence of internal and external doors, because all others are related to actions and signalization).
If you now do not have such available area you will have to build one (if this control is considered applicable). In this case you will have to include these requirements to the responsible to build this new area, so you can ensure it will fulfill control A.11.1.6. -
Toolkit selection
From your experience, what is the best way to approach this project? We are also looking at purchasing your tool kit and was wondering if we should purchase on the ISO 27001 toolkit or to buy the EU GDPR/ISO 27001 toolkit despite our certification requirement is for only ISO 27001 considering the price difference for future sake.
Answer:
The main question here is if the US facility has to handle EU citizen's data, or will handle it in the near future. If the US facility does not have access to EU citizen's data, and does not expect that for the near future, you can reduce its scope only to ISO 27001 and US legal requirements. Implementing integrated standards/regul ations is more complex, and you should avoid such implementations whenever possible.
Regarding the toolkits, I'd suggest you to buy the EU GDPR/ISO 27001 toolkit https://advisera.com/eugdpracademy/eu-gdpr-iso-27001-integrated-documentation-toolkit/, because this one has all documents you will need to fulfill both ISO 27001 and EU GDPR, and you can use only the ISO 27001 related documents to implement ISO 27001 in your US facility. -
Evidenciar el contexto de la organización
Respuesta:
Siempre es recomendable realizar la determinación del contexto de la forma más sencilla posible, por ejemplo organizando una tormenta de ideas con el personal relevante de la organización y llevando a cabo un análisis DOFA (debilidades, oportunidades, fortalezas y amenazas). El acta de reunión que incluye este análisis sería suficiente para evidenciar que se ha llevado a cabo la determinación del contexto de la organización.
Para más información sobre el contexto de la organización en ISO 14001:2015 puede ver:
- Artículo - Determinar el contexto de la organización en ISO 14001: https://advisera.com/14001academy/es/knowledgebase/determinar-el-contexto-de-la-organizacion-en-iso-14001/
- Libro - The ISO 14001:2015 Companion (en inglés): https://advisera.com/books/the-iso-14001-2015-companion/
- Curso en línea gratuito de Fundamentos ISO 14001:2015: https://advisera.com/training/es/course/curso-fundamentos-iso-14001/ -
Auditoría interna y control/evaluación de proveedores
Como se hace en ese caso, de qué manera verificar los requisitos que establece la norma que tienen que ver con esos departamentos.?
Respuesta:
En ese caso la organización cuenta con varios proveedores externos que realizan los servicios de diferentes áreas de la organización. La cláusula 8.4.1 de la norma ISO 9001:2015 establece que los proveedores externos sean controlados y que su desempeño sea evaluado, por tanto esto es lo que debe ser auditado en la organización: el control y la evaluación de los proveedores externos.
Uno de los métodos para llevar a cabo el control de los procesos subcontratados es que en el contrato con el proveedor la organización establezca mediante información documentada (por ejemplo procedimientos o instrucciones de trabajo) las funciones, responsabilidade s, informes consecuencias, etc. A su vez la organización debe de contar con una serie de criterios para la selección de sus proveedores, como la calidad del envío, el precio, los términos de pago, etc.
Otra opción para el control de proveedores puede ser mediante un proceso de auditoría por una segunda parte. En este caso la lista de verificación o checklist tiene que ser acordado y aprobado por ambas partes, la organización y el proveedor.
Estos materiales pueden serle de utilidad para llevar a cabo la auditoría interna en cuanto al control y evaluación de proveedores:
- Artículo - Cómo controlar los procesos subcontratados utilizando ISO 9001:2015 (en inglés): https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
- Artículo - Cómo evaluar el desempeño de los proveedores según ISO 9001:2015 (en inglés): https://advisera.com/9001academy/blog/2015/10/27/how-to-evaluate-supplier-performance-according-to-iso-90012015/?icn=free-blog-9001&ici=top-how-to-evaluate-supplier-performance-according-to-iso-9001-2015-txt
- Curso gratuito en línea - Curso de auditor interno ISO 9001:2015: https://advisera.com/es/formacion/curso-auditor-interno-iso-9001/